Connection Timer ?

[Lisandro]

Still getting these pop-up things.  When I get a firewall installed, will that solve this problem?

Could you post a screenshot with the pop-up message?
It's difficult to imagine what is happening...

[alanrf]

Rap,

if the pop still looks the same as before (explorer.exe) then can you create the log again too, so we can see if the same problem is still there? 

Sometimes these trojans can take some effort to remove.

By the way what trojans did Avast report finding?

[Rappy]

I dont remember now what Trojans Avast found.  I deleted them as they were detected and didnt think to note the names.

I've downloaded and installed Kerio, but from what I see it allows all outgoing same as what you said about the built in XP firewall and I'm not finding how to change that. 

How would I go about posting a view of the next pop-up?

Rap

[Lisandro]

I've downloaded and installed Kerio, but from what I see it allows all outgoing same as what you said about the built in XP firewall

For sure not... You must configure your firewall to 'ask' your what programs would be allowed to connect.
I suggest you visit the Kerio webpage and see the tutorials there 

[alanrf]

If you do not know how to do the screenshot of the popup then just as much of the contents as possible would be fine. 

While I agree with all that has been said about firewalls by Tech and DavidR I do not want you to be under any illusions.  Installing a firewall is not going to eradicate the problem in your system right now.  It will certainly do a lot to make sure it cannot come back after you have have cleared the current problem.

Sorry, there are both of those tasks still to do.

1) defend your system better against future attacks
2) eliminate the current problem in your system

[Rappy]

Just an update.  With Keiro installed and settings to not allow outgoing, if I open the logs area of the config under the Network tab there are tons of denied attempts for outgoing avast email scanner service.  Most of the addresses I see listed are the same ones I would get those pop-up windows for. 

Full and thorough virus scan (3 times), initially removed a trojan and the last 2 scans came up clean.  So are these logs about outgoing a problem?

Rap

[alanrf]

Rap,

if you are blocking outgoing attempts then you still have software in your system that is trying to send emails. It will continue to consume the resources of your system and it may still have other tricks up its sleeve that it can use against your system. 

It is in your best interests to find it and remove it.

[Rappy]

I understand that, but the question now then is, how do I find it and remove it?  I've done 3 thorough full system scans with Avast as well as 3 thorough scans with Ad-Aware.  If they find nothing, then how do I find where this is coming from and remove it? lol

Rap

[Lisandro]

I've done 3 thorough full system scans with Avast as well as 3 thorough scans with Ad-Aware.  If they find nothing, then how do I find where this is coming from and remove it?

None software is perfect or detect everything...
Maybe you can try other antispyware applications (freeware): download, install, update and run it.
Spybot Search and Destroy
Spywareblaster
A-squared
Ewido

[alanrf]

Hey Tech,

where did Eddy go?  I wanted to send Rap to run the hijackthis from Eddy's site and it seems his site is no longer active.

[Lisandro]

where did Eddy go?  I wanted to send Rap to run the hijackthis from Eddy's site and it seems his site is no longer active.

He's sick and trying to rest, take medicines and so on...
Until there, the users should:
Download: http://www.spywareinfo.com/~merijn/files/hijackthis.zip
Tutorial: http://www.tomcoyote.org/hjt/#introduction
Online analysis of your Hijackthis log: http://hijackthis.de/index.php

Ignore any references to 023 entries for avast, this is a bug in the HJT 1.99.1, this has been mentioned many times in previous threads.

[DavidR]

Please be more specific, when you say pop-up things.

Do you mean explorer.exe trying to use port 25?

If so yes a firewall should block this activity, but more worryingly it would indicate you haven't fully resolved the original issue. Without an adequate firewall giving outbound protection, your system could be connecting to the internet and downloading more of the same.

I suggest you get Zone Alarm (free version), whilst it does have some compatibility issues with web shield (mainly with the pro version), it does provide good outbound protection and a relatively user friendly interface for the lessor experienced firewall user.

To be truly clean you are going to have to secure your system otherwise you will be fighting a never ending battle.

[Rappy]

Well, in the last couple days I've tried several things.  I've scanned my system over 10 times with Avast, scanned with Ad-Aware, downloaded and ran Avast Cleaner and even tried a system restore.  I still have the avast scanning outgoing mail, although its all now blocked by the Kerio.  I tried getting ZoneAlarm and it wont even install.  Everything comes out clean, so I have no idea where to go now from here  .

Rap

[Lisandro]

I still have the avast scanning outgoing mail, although its all now blocked by the Kerio.

What? The emails are blocked or avast scanning is blocked?

I tried getting ZoneAlarm and it wont even install.

I suppose you have uninstalled Kerio and booted...

To be clean:
1. Disable System restore on Windows ME: http://support.microsoft.com/default.aspx?scid=kb;en-us;Q264887
    Disable System restore on Windows XP: http://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;310405
2. Clean all your temporary files
3. Maybe boot in SafeMode (repeatedly press F8 while booting): http://support.microsoft.com/default.aspx?scid=kb;en-us;315222
    Or if you have XP, then schedule a boot time scanning with avast.

And then test other Antispyware applications (freeware): download, install, update and run it.
Ad-Aware
Spybot Search and Destroy
Spywareblaster
A-squared
Ewido
Webroot Spy Sweeper:
Microsoft AntiSpyware
X-Cleaner Free