[Jay156]

okay I will do another FULL scan tonight since it took so long last time. I'll just let it run over night. Unless clicking on Perform Quick Scan works the same way

[eddie5659]

Yep, Perform Quick Scan

It will look in the main folders, whereas a full scan scan's things such as game folders, etc

[Jay156]

here ya go. should I remove selected? i know it might be a dumb question.

[eddie5659]

Yep, remove all

[eddie5659]

Let me know when its been removed, as there is a tool to run

[Jay156]

Removed my man. heres the log

[eddie5659]

Okay, as one of the files that has been removed many times is being shown as Delf in the log you attached, lets see if there are any more files lurking:


Download FixIEDef by ShadowPuterDude to the Desktop.

Note: Please disable any real time protection that may interfere with FixIEDef, such as Microsoft Defender, Spybot Search and Destroy's Tea Timer and SUPERAntiSpyware. Make sure you enable this protection once your computer is cleaned.

Instructions:

Disable Windows Defender until the computer is clean

• Open Windows Defender
• Select Tools and then General Settings
• Under Real Time Protection Options uncheck Turn on real-time protection
• Select Save

Don't forget to re-enable it, when your computer is clean.

Disable SUPERAntiSpyware until the computer is clean

• Right-click on the shortcut from the system tray
• Choose View Control Center (preferences/options)
• On the General and Startup tab, uncheck Start SUPERAntispyware when Windows starts.
• Click Close to exit.

Don't forget to re-enable it, when your computer is clean.

Disable Teatimer
First:

• Right click Spybot in the System Tray (looks like a calendar with a padlock symbol)
• Choose Exit Spybot S&D Resident

Second:

• Open Spybot S&D
• Click Mode, check Advanced Mode
• Go To Left Panel, Click Tools, then also in left panel, click Resident
• If your firewall raises a question, say OK
• Uncheck the box labeled Resident Tea-Timer and OK any prompts.
• Use File, Exit to terminate Spybot
• Reboot your machine for the changes to take effect.

Don't forget to re-enable it, when your computer is clean.

Run FixIEDef:

Double-click FixIEDef


Click 'Accept'


Click 'Scan'


Wait for the scan to finish. It won't take very long.


WARNING: FixIEDef will kill all copies of Internet Explorer and Explorer that are running, during scanning. The icons and Start Menu on your Desktop will not be visible while FixIEDef is scanning. This is necessary to remove parts of the infection that would otherwise not be removed.

Everything will be restored to normal, once the malicious file is removed.

Click 'Exit' once FixIEDef displays the All Finished message.


Post the Results of the scan:

Post the FixIEDef log file, located on the Desktop.


eddie

[Jay156]

hey there, heres the log

[eddie5659]

That's good that its not that infection

Please start RootRepeal, and, before doing anything else, try changing the "Disk Access Level" in the Settings->Options dialog. Try moving it to the "Special" or "High" level. Also, click on the Files tab, and uncheck "Use lowest level for MBR check". Please let me know if this fixes the problem.

-------------


If not, can you run this one:

Please download MBRCheck.exe to your Desktop. Run the application.

If no infection is found, it will produce a report on the desktop. Post that report in your next reply.

If an infection is found, you will be presented with the following dialog:

Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Type N and press Enter. A report will be produced on the desktop. Post that report in your next reply.

eddie

[Jay156]

hey there here ya go. Also could it just be that the comp itself is "outdated" so to speak?

[eddie5659]

Could be, but its just that the same files keep reappearing.

One of the major areas for spyware is torrent and p2p use, you may want to scan before you open anything:

I'd like you to read the Guidelines for P2P Programs where we explain why it's not a good idea to have them.

Also available here.


In the meantime, just about to go to work, so will look at this when home. We can run this program to clean it up, make it a bit faster as well

Please download Runscanner to your desktop and run it.

• When the first page comes up select Beginner Mode
• On the next page select Save a binary .Run file (Recommended) then click Start full scan at the top.
• At this time Runscanner.exe may request access to the Internet through your firewall please allow it to do so, it will then run for two or three minutes.
• On completion it will ask for a location to save the file and a name. It will do this for both the .run file and the log file
• Call the .run file "RSReport" and save it to your desktop. You will see the RSReport.run file on your desktop. Rightclick on it and select Send To then select Compressed (zipped) Folder and upload that zip here. Click on the Go Advanced button for the uploading options at the bottom of this page (in the picture below )

• In there, at the bottom, click on the button Manage Attachments (in the picture below .
• A window will appear, and then Browse to RSReport.zip on your Desktop.
• Click Upload, and when uploaded click Close this Window
• Then, in the previous window, click on Add Reply

eddie

[Jay156]

Hey there hope this worked. When I saved the second file to desktop it had the same name so I called the second one RSRReport, is that ok? Just making sure.

[eddie5659]

Yep, it worked


Download the attachment at the end of this post. This will be your RSReport file, with the fixes I need you to do.

• Save it to your desktop, then extract the RSReport.run file to your Desktop, overwriting the existing one.
• Open the runscanner folder and double click on the runscanner.exe file.
• This time select the Expert Mode
• Click the button Open Run File
• Click on the RSReport file, and select Open
• click the Item Fixer tab
• Click the button at the top called Fix selected items
• Accept the warning(s) and repeat until they are all gone.
• Reboot your PC
• Post a fresh HijackThis log

-----------------------


Also, lets just look at the file details on this:

• Double-click SystemLook.exe to run it (should be on your Desktop still).
• Copy the content of the following codebox into the main textfield:
  

  :file
  C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe
  

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found at on your Desktop entitled SystemLook.txt

eddie

[Jay156]

HJT log

[Jay156]

Systemlook log. Hey Eddie, I just want to say that I MORE than greatly appreciate EVERY BIT of your help. I honestly do. Yeah it took a bit for someone to get to me but it doesn't matter. You have been MORE than a huge help for me and my "dinky lil computer". Just a question.....how are these files continuing to 'reappear' if i'm not even using the torrent program? to be honest I haven't downloaded anything since I told you I wasn't going to, and also are these files harmful? Just wondering. Also I know I don't have the best computer, but i like to make it run better than it can do stock. Anyways have you seen that i7 processor? over 26gb a FUKIN secon? holy cow that **** is fast. Just askin.