High Deep,
That's a mess..
You've done a good job of picking the baddies, from a quick glance..
except for the
017 entries.. they look like a local network.. is he at Warwick University by any chance?
Also, one thing that you need to remember is that fixing an entry in HJT, just stops it running.. usually until the next boot. Each individual file or folder must then be deleted manually.. but that's the easy bit.. you picked out the troublesome ones, which is the hardest job.. after that, the processes to deal with them are just a matter of remembering. That's why I have a 7 page Word document, with all the usual C&Ps in the order that I use them. That way it becomes nice and systematic.. he says.. (I wish it was that easy)
I know it's unusual fior me to do this, this way round, but as he has no protection whatsoever running on his machine, we'll start by cleaning it up automatically..
But first, get him to install a firewall and Anti-Virus, otherwise he's probably looking at a minute's surfing before he gets infected again.
Firewall
Anti-Virus
Then get him to install and run the following.. (one C&P coming up)..
download AdAware SE from
here.
First, in the main window, look in the bottom right corner and click on Check for updates now and download the latest reference files.
Next, we need to configure Ad-aware for a full scan.
Click on the Gear icon (second from the left) to access the preferences/settings window
1. In the General window make sure the following are selected:
· Automatically save log-file
· Automatically quarantine objects prior to removal
· Safe Mode (always request confirmation)
2. Click on the Scanning button on the left and select :
· Scan Within Archives
· Scan Active Processes
· Scan Registry
· Deep Scan Registry
· Scan my IE favorites for banned URL’s
· Scan my Hosts file
· Under Click here to select drives + folders, choose:
· All of your hard drives | Proceed
3. Click on the Advanced button on the left and select:
· Include additional process information
· Include additional file information
· Include environment information
4. Click the Tweak button and select:
· Under the Scanning Engine:
· Unload recognized processes & modules during scan
· Include additional Ad-aware settings in logfile
· Under the Cleaning Engine:
· Let Windows remove files in use at next reboot
5. Click on Proceed to save the settings.
6. Click Start and on the next screen choose:
· Use Custom Scanning Options
7. Click Next and Ad-aware will scan your hard drive(s) with the options you have selected.
When finished, mark everything for removal and get rid of it. (Right-click the window and choose Select All from the drop down menu and click Next).
Next, please reboot again and download Spybot - Search & Destroy 1.3 from
here: if you haven't already got the program.
Click on
Updates | Download Updates, and follow the prompts.
Next, close all Internet Explorer windows, and click
Check for Problems. Once the scan is complete, have SpyBot remove all it finds marked in
RED.
Next, download and run
CCleaner. If you have certain cookies you want to retain, then click on the Options button before running, and move across the ones that you want to keep...
Next reboot and go
here, and run the online virus scan; choosing the
Autoclean option just before clicking the
Scan button. Then please post a new log and we can see what's left..
Cheers
Liam