Originally posted by 2oldGeek:

---

Hi dee,

Fix these entries using HiJackThis
Launch HiJackThis
Click the Do a system scan only button
Put a check next to the entries listed below:

My bad, I meant for you to check both of these duplicate lines:

O4 - HKLM\..\Run: [lphcce2j0eg75] C:\WINDOWS\system32\lphcce2j0eg75.exe

And I missed this one:

O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} ?

Your bad, ya missed this one :]

O23 - Service: McAfee Application Installer Cleanup (0189191177588188) (0189191177588188mcinstcleanup) - Unknown owner - C:\WINDOWS\TEMP\018919~1.EXE (file missing)


Click the Fix checked button..



Do the delete on reboot thing again with this to make sure we got it?

C:\WINDOWS\system32\lphcce2j0eg75.exe

Close HijackThis and reboot.

Post one more HJT log and we?ll finish?

2OG

p.s. Tell me how your running now and if you have any problems...

---

Originally posted by 2oldGeek:

---

If you can't find it, let's assume it's already gone........

Just carry on with the other stuff and post a HJT Log.

Your doing OK, Dee.

2OG

---

Originally posted by 2oldGeek:

---

Hi dee, just one thing bothers me?.
?????? This line keeps showing up. Are you checking it? If you are, it?s coming back.
Fix it again and if it comes back we may have to get rough with it??. :]

Fix this entry using HiJackThis
Launch HiJackThis
Click the Do a system scan only button
Put a check next to the entries listed below:


O23 - Service: McAfee Application Installer Cleanup (0189191177588188) (0189191177588188mcinstcleanup) - Unknown owner - C:\WINDOWS\TEMP\018919~1.EXE (file missing)


Click the Fix checked button..


Close HijackThis and reboot.

If you can remove it, no need to post another log just let me know if it?s gone??

2OG

---

Originally posted by 2oldGeek:

---

Dee,

Forgive me I?m Old and I had a senior moment..

What you will need to do to get rid of this 023 line is:

Go to the Safe Mode
Run HJT
Click the button ?Open the Misc Tools section?
Click on ?Delete an NT service??
Copy and Paste the following line in the box:
McAfee Application Installer Cleanup

Now press OK

And that should do it.

2OG

---

Originally posted by 2oldGeek:

---

Dee, I?m going to be out of pocket for a few days so let me shoot this to you as a Final.

I know the 023 line may still be hanging around, but it?s dead in the water so can?t hurt anything.. It?s a fluke in HJT. I?m sometimes too picky about cleaning up all the trash lol.

Congratulations, your log looks CLEAN

This will keep you busy for a few days???.

There are a few things you must do once you are completely clean:

1. Time for some housekeeping

Please download the OTMoveIt2 by OldTimer
? Save it to your desktop.
? Run the tool by clicking on the icon.
? Click the Cleanup button.
? The tools that we used as well as this one will be removed from your system.


2. Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 only

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.


Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

3. Now Set a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:

? Go to Start > Programs > Accessories > System Tools and click "System Restore".
? Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
? Then go to Start > Run and type: Cleanmgr
? Click "OK".
? Click the "More Options" Tab.
? Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.

4. Defragment your Hard Drive

1.Open My Computer.
2.Right-click the local disk volume that you want to defragment, and then click Properties.
3.On the Tools tab, click Defragment Now.
4.Click Defragment.


Here are some tips to reduce the potential for spyware infection in the future:

Dee, you do not have a 3rd party Firewall?
It is critical that you use a firewall to protect your computer from hackers. We don't recommend the firewall that comes built in to Windows. It doesn't block everything that may try to get in, and the entire firewall is written to the registry. As various kinds of malware hack the Registry in order to disable the Windows firewall, it's far preferable to install one of the excellent third party solutions. Two good ones are are ZoneAlarm Free and Sunbelt Kerio Personal Firewall has a "free mode" as well.
I personally use and recommend ZoneAlarm..

Make sure you keep your Windows OS current by visiting Windows update
regularly to download and install any critical updates and service packs. With out these you are leaving the backdoor open.

I strongly recommend installing the following applications:

? Spywareblaster <= SpywareBlaster will prevent spyware from being installed.
? How to use Ad-Aware to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Ad-Aware.
? How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware.


To protect yourself further:

Go to these sites and read about these you may decide to use them, I do.

? Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Malware, Cookies etc) from the sites listed, although you will still be able to connect to the sites.

? MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know Malware sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer


And also see TonyKlein's good advice
So how did I get infected in the first place?


Always a pleasure to help someone, like yourself, that really tries to do all the seemingly stupid stuff required for cleaning a computer?.. LOL

I?ll leave this thread open so, give me a holler when you get it all packaged up and let me know How Goes It?..

Have a ?Happy?
2OG

---