I do have the popup blocker enabled, and just what you described, "Your computer is infected, click here for your free scan", is still there.
Try hijackthis and post the report in the thread.
I'm running Malwarebytes right now and if that doesn't work, I will post results from hijackthis. Thanks
I wish my last infection had known that. After doing all the other usual stuff to no avail, (including booting off an uninfected drive) I reformatted. Did it work? NO. How can anything survive a reformat? Believe me, it can. After FIVE -- count 'em -- FIVE *CLEAN* reformats I finally got rid of it somehow by rejiggering the partition. This particularly nasty but clever piece of code I theorized was living OUTSIDE of the partition, in disk space unused by and unaccessible to the OS. My theory is that rejiggering the partition changed the offset from track zero that it expected to find itself. I have no idea how it loaded itself; it must have been interacting directly with the hard drive's controller to read and load its boot code. You can find it if you google; I don't remember what the name was.
Here it is:
I suspect mine happened when I wasn't paying attention or was sleepy or something and accidently clicked on the wrong button. I ususually go into task manager and terminate when I see something suspicious, because malicious javascript CAN be set to run when the close-window is clicked.Originally Posted by strange_wings
How does one pick up these nastier malware? Simply not knowing how to protect their pc or just not knowing what type of activities to avoid?
I bought the PC from Dell direct.Originally Posted by strange_wings
Hey, you didn't happen to buy your PC from a Best Buy did you? (no, the report doesn't suggest that)
I have no clue what rPsooXa.exe is. Does anyone else?
Other than that - do you use NetZero? If not, that report says you have a lot of stuff installed from it. That there's three toolbars: from netzero, Ask, and google - plus some google updater?
Norton - there's one of your problems. It's not the best antivirus.
Am I seeing two spyware scanners?
Digital Line Detect is preinstalled Dell junk. Rather unneeded.
Looking at a lot of that, and that so much is running at once, if you're experiencing slow down - that's why.
Netzero's my ISP, so I can't remove it. Should I uninstall and reinstall it?Originally Posted by coaster
This is what I found suspicious on just scanning through:
C:\\WINDOWS\\RTHDCPL.EXE - non-OS executables don't run from the Windows folder
C:\\Documents and Settings\\Cathy\\Application Data\\Microsoft\
PsooXa.exe
O4 - HKCU\\..\\Run: [] C:\\Documents and Settings\\Cathy\\Application Data\\Microsoft\
PsooXa.exe
This is the most suspicious thing I saw; nothing, and I mean I have never seen any executable run from the users' Documents folder
2 - exec.exe
2 - iexplore.exe
There are two copies of each of these; that's not necessarily a problem, just confirm there were two IE windows open; and I don't know what the other one is, but naming an executable "exec" is sort of unusual
R3 - URLSearchHook: URLSearchHook Class - {37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - C:\\Program Files\\NetZero\\SearchEnh1.dll
I started to copy these NetZero thing then gave up; there are so many of them. I counted at least three different entities trying to grab some piece of the internet browsing through redirectors, toolbars, whatever. No wonder there are problems.
I found alll those proxy overrides disconcerting, but I don't know what kind of internet access is being used, or what kind of home network.
What I'd do:
Download Eset NOD32 AV & F/W - best retail out there IMO and worth $80
Disable network connection
Uninstall NetZero
Uninstall Norton
Search for all instances of files, shortcuts, and Registry entries that match rPsooXa.exe and delete
Install Eset
Reconnect to internet
Say temporary "no" to everything that wants access except Eset
Update Eset files
Run full virus & spyware scan
Then start teaching your firewall which apps are OK to connect, and just say no to all the rest
Try to eliminate about half of your startup programs; some of them are probably unecessary or duplicating others.
Just saying, that's what I'd do based on that log. But a better recommendation, and one you're more likely to get a definitive fix, is to post it on the HijackThis forum.
