RESOLVED Real Time Scan turned off every time I turn my computer on

[Tink66]

By jove folks, I think I've got it!! AVAST hasn't been turned off the last few times I've logged in!
Also, I am not using the icons on my desktop to read emails etc and things seem to be OK!
Thanks for everyone's help.
The Green Goddess xx

[essexboy]

I feel that may have been due to the customised icons you were using as Combofix did not like them 

Lets run a quick sweep for orphans and I will then tidy you up

Please download Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

[Tink66]

I already have MBAM installed so will run a quick scan and the full scan, as I think that is what you are stating?
I am still havinh problems with insecure websites.....
Thanks for your help!

[Tink66]

Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Database version: 5281

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

09/12/2010 18:03:36
mbam-log-2010-12-09 (18-03-36).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 177089
Time elapsed: 38 minute(s), 32 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\program files\windows live\messenger\riched20.dll (PUP.FunWebProducts) -> Not selected for removal.
c:\system volume information\_restore{143daf18-5906-4fc1-af29-1a98fbad7a17}\RP340\A0040904.DLL (PUP.FunWebProducts) -> Not selected for removal.
c:\system volume information\_restore{143daf18-5906-4fc1-af29-1a98fbad7a17}\RP340\A0040905.DLL (PUP.FunWebProducts) -> Not selected for removal.


I never did run the worm/virus programme you suggested, Essexboy, as I was unsure which option to choose.  I think I may have b*ggered things up regarding the insecure sites as I blocked certain sites via the padlock icon, thinking they were baddies.  For instance, iconix is part of MSN, I believe?

Sugar, just realised I forgot to select the items for quarantine!

Advice gratefully received as always!

[essexboy]

Try to reset IE to default settings

Go to Control panel > internet options
Go to the Security tab
Select reset to default level

Then let me know of any outstanding problems 

[SafeSurf]

Sugar, just realised I forgot to select the items for quarantine!

After you do what Essexboy suggested, update MBAM again and run an MBAM scan again...this time putting infected items into quarantine.  Then post your log.  Thanks.

[Tink66]

Try to reset IE to default settings

Go to Control panel > internet options
Go to the Security tab
Select reset to default level

Then let me know of any outstanding problems 

OK, have done.  Watch this space!

[Tink66]

Sugar, just realised I forgot to select the items for quarantine!

After you do what Essexboy suggested, update MBAM again and run an MBAM scan again...this time putting infected items into quarantine.  Then post your log.  Thanks.

Will do when I have some time as it takes an hour or so to run!

[essexboy]

Use the quick scan - it is just as good 

[Tink66]

This is a quick scan; the full one yesterday showed 3 infected items that I forgot to quarantine.

By the way, I think that the other problems have sorted themselves......   Thanks a million!!

[essexboy]

Looking at that I am a happy bunny 

I will remove my tools now and give some recommendations, but I would like you to run for 24 hours or so and come back if you have any problems

 Now the best part of the day ----- Your log now appears clean  :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset  System Restore points:

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :Commands
  [resethosts]
  [purity]
  [emptytemp]
  [EMPTYFLASH]
  [CLEARALLRESTOREPOINTS]
  [Reboot]

• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done

.
Click Start > Run  and copy/paste the following bolded text into the Run box and click OK:

ComboFix /Uninstall

Run OTL and hit the cleanup button.  It will remove all the programmes we have used plus itself.  MBAM can be uninstalled via control panel add/remove along with ERUNT.  But they may be useful tools to keep

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View Tab.
• Under the Hidden files and folders heading select Do not show hidden files and folders.
  
• Click Yes to confirm.
• Click OK.

SPRING CLEAN
 
Download and run Puran Disc Defragmenter

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

• SpywareBlaster to help prevent spyware from installing in the first place.
  Malwarebytes.  Run weekly to keep your system clean
  

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit

• Microsoft Windows Update
  

To learn more about how to protect yourself while on the internet read our little guide  How did I get infected in the first place ?
Keep safe  :wave:

[Tink66]

I have scanned through the link you gave for computer protection and have loaded Keyscramler.  I am also considering the Open DNS recommendation - would you recommend I do so? I do note that one of the programmes might not run with Windows Defender which I also use.

I Ran the OTL fixes and it took less than a second.  Everything else seemed to go to plan!  
Is the defrag tool the same as the defrag option I choose through system tools?  It seemed much faster than that one.

I gather that I do not need any of the earlier worm/virus removal tools that you suggested earlier in my post so shall keep my fingers crossed and let you know how things go in the next couple of days.

A GREAT BIG THANK YOU TO MY AVAST HEROES - ESSEXBOY AND SAFESURF!  HOPE YOU BOTH HAVE A GREAT CHRISTMAS!

[SafeSurf]

Glad to hear everything is working out fine! 

Is the defrag tool the same as the defrag option I choose through system tools?  It seemed much faster than that one.

No...Puran is different than the system one.  It probably ran quicker because you did the regular defrag with Puran.  If you run the Puran boot-time defrag, which goes much deeper, this takes longer and does a better job.  I would suggest after all the changes we did with your machine that you run this after doing a regular Puran defrag.  You don't normally have to do a Puran boot defrag unless you are doing major changes with your machine.

I gather that I do not need any of the earlier worm/virus removal tools that you suggested earlier

I would keep MBAM, as many of us use this as an on-demand scanner (some use the Pro/resident version) and it does not conflict with Avast.  Any of the tools Essexboy used for diagnostics and to remove malware you do not need to keep on your machine.

I really do not think you need to keep Windows Defender on with Avast on an XP machine.  This uses a lot of memory and the detection rate of Avast is so much better.  Plus you have MBAM as an on-demand scanner, so I see no need for it.

Here are a few suggestions in addition to the ones given to you by Essexboy to keep you and your machine safer in the future:

1.   Keep your definitions up to date for both Avast and MBAM. 
2.   Keep all your shields on with Avast.
3.   Update MBAM prior to scanning, then do Quick scans.
4.   Keep your MS Updates current.
5.   Add things to your browsers for safer browsing.  See my Signature as an example.
6.   Use common sense when browsing and do not go to risky sites.
7.   When downloading software, read what you are clicking and do not download adware toolbars which are commonly opted in; look before you click or do a Custom install to avoid putting unwanted toolbars on your machine that lead to spyware tracking or adware.
8.   Check to see that your software is up to date with the free Secunia Software Inspector http://secunia.com/vulnerability_scanning/personal/ since software is changing all the time.  This site gives you the vendor's direct download link making it easy to upgrade your software.  Many of us here scan our machines weekly.

In addition, now you only have the Windows XP firewall (FW), which is very weak and 1-way protection.  I would recommend a third-party 2-way FW for maximum security.  Users have reported that the following FW’s have not conflicted with Avast: Online Armor, Comodo (w/o AV), Outpost – all come in free and paid versions, with the paid versions including HIPS and some also include keyloggers as well to increase your protection.

When you feel that your issue is resolved/fixed (no hurry), please go back to the first open post in this topic, click the modify button in that Post and change the title/subject, add [Resolved] to the beginning of the title so this thread can be closed.  In the meantime, feel free to ask additional questions.

I wish you a very Happy Holiday as well, and it was our pleasure assisting you.

[essexboy]

As an addition to that I have started to use trusteer rapport for all my banking sites.  This locks down the communications to just you and the site, enables an antikeylogger and confirms the site is correct and not a lookalike

No apparent overheads on my system at all - details here  http://www.trusteer.com/presentation-how-it-works and here http://www.trusteer.com/product/trusteer-rapport  Download here http://www.trusteer.com/solutions/home-users/online-security

[CraigB]

As an addition to that I have started to use trusteer rapport for all my banking sites.  This locks down the communications to just you and the site, enables an antikeylogger and confirms the site is correct and not a lookalike

No apparent overheads on my system at all - details here  http://www.trusteer.com/presentation-how-it-works and here http://www.trusteer.com/product/trusteer-rapport  Download here http://www.trusteer.com/solutions/home-users/online-security

Unfortunatly trusteer isnt much good for us over here in Australia, trusteer doesn't support our major banks here which is disappointing because it is an excellent addition for security.
Keep in mind that if you ever delet trusteer it is hopeless at cleaning up after itself, just deleted off a friend's system who has moved over here from your end of the world and it left a trail of rubbish right through there computer,but if you plan on keeping it then that wont be a problem anyway