Hey guys, would appreciate the help with the following. Im pretty sure I have some sort of virus. My temp folder in document settings now has another(second) temporary internet folder with two gif files that cannot be deleted. I get the message cannot delete FREESI~GIF cannot find specified path. I have tried everything. Safe mode, Norton, Spybot, Hijack. I have tried removing the read only attribute. I can't think of anything else please help and keep in mind that I am a novice. They appear to be porn related gifs. Every time I restart a mysterious Enis folder also appearce on the second temporary internet folder. Please advise.

Google to MoveOnBoot and run it.

MoveonBoot failed!

If your computer has been comprimised , you need to leave no stone unturned , remember , no one program is enough , that goes for spy files & virii . Start with these & see how you go . Online Virus check ( free ) http://housecall.antivirus.com/ http://housecall.trendmicro.com/ http://www.cybertechhelp.com/html/misc/av.php http://www.pandasoftware.es/activescan/activescan-com.asp http://www.pcpitstop.com/antivirus/default.asp http://www.ravantivirus.com/scan/ http://www.bitdefender.com/scan/licence.php http://security.symantec.com/sscv6/home.asp?j=1&langid=ie&venid=sym&close_parent=true&plfid=23&pkj=HXJDYNBRFNJSVSTIVVB http://virusscan.jotti.dhs.org/ System Restore option in Windows Me/XP http://www.augustana.ab.ca/other/cns/virus/ http://www.adamtj.org/repository/howto/W32.Blaster.Worm/ Users of Windows Me and Windows XP should temporarily turn off System Restore. Windows Me/XP uses this feature, which is enabled by default, to restore the files on your computer in case they become damaged. If a virus, worm, or Trojan infects a computer, System Restore may back up the virus, worm, or Trojan on the computer. Windows prevents outside programs, including antivirus programs, from modifying System Restore. Therefore, antivirus programs or tools cannot remove threats in the System Restore folder. As a result, System Restore has the potential of restoring an infected file onto your computer, even after you have cleaned the infected files from all the other locations. Also, a virus scan may detect a threat in the System Restore folder even though you have removed the threat. For instructions on how to turn off System Restore, read your Windows documentation, or one of the following articles: How to turn off or turn on Windows XP System Restore http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039?OpenDocument&src=sec_doc_nam ===================================== Remove Spyfiles by using these 5 programs . Make sure you use the SpyBot/SpywareBlaster/Ad-aware/Bazooka > Online > Update button regularly . SpyBot http://www.safer-networking.org/en/index.html http://beam.to/spybotsd Update http://majorgeeks.com/download.php?det=4392 Editors note: - SpyBot-Search & Destroy 1.3 MUST be installed before this update to work properly. 1st step , Choose your Mode ( at the top of screen ) Mode > Advanced ( if you want to have more options ) Editor's Note: The Resident shield in version 1.3 has an issue allowing certain cookies (Specifically Double Click)when set to notify. If page loading becomes a problem, right click the icon in the Systray, select “Resident IE” and either uncheck “Use Resident in IE sessions” or check "Block all bad pages silently". Once you have the program installed , open SpyBot and select the "Immunize" icon on the left & then Click on Immunize , in the new page . Repeat this process evry time you Update . Permanently running bad download blocker for Internet Explorer . Select > Block all bad pages silently & click Install . Then check the box "lock hosts file read-only as protection against hijackers". Select your download site . Open Spybot Search and Destroy. After clicking the button that says "Search for Updates" & the check is finished , you will see 5 items near the top of the window, "Search for Updates", "Download Updates", UniDo(Europe), "Show Log" and "Help". Next to UniDo(Europe) you will see a "down" arrow. Click the "down" arrow and you will see download site choices (3 in Europe, 1 in USA and 1 in Australia). Right click on your selection to make it default . A Beginner's Guide to Spybot http://www.trincoll.edu/depts/cc/documentation/security/spyware/Spybot_guide.htm http://tomcoyote.org/SPYBOT/index1.php http://tomcoyote.org/SPYBOT/index2.php SpyBot lock host files greyed out If it doesn't have a hosts file you cant lock it, so that tweak will be grayed out. Have SpyBot install its hosts file. http://www.zerosrealm.com/immunizing.php Note: For those running in "Basic" mode ( version 1.2 ) you will NOT see this. You must be running in Advanced mode! To get in advanced mode, a really easy way is to go to Start >> All Programs >> Spybot Search and Destroy >> Spybot Search and Destroy (advanced). Click it. You are now in advanced mode. Select your download site . Open Spybot Search and Destroy. After clicking the button that says "Search for Updates" & the check is finished , you will see 5 items near the top of the window, "Search for Updates", "Download Updates", UniDo(Europe), "Show Log" and "Help". Next to UniDo(Europe) you will see a "down" arrow. Click the "down" arrow and you will see download site choices (3 in Europe, 1 in USA and 1 in Australia). Right click on your selection to make it default . What the Heck is Teatimer? http://www.voiceofthepublic.com/SSD/SI/teatimer.swf.html SpywareBlaster http://www.wilderssecurity.net/spywareblaster.html SpywareBlaster doesn't scan and clean for spyware - it prevents it from ever being installed. Freeware SpywareGuard http://www.javacoolsoftware.com/spywareguard.html SpywareGuard provides a real-time protection solution against spyware that is a great addition to SpywareBlaster's protection method. An anti-virus program scans files before you open them and prevents execution if a virus is detected - SpywareGuard does the same thing, but for spyware! And you can easily have an anti-virus program running alongside SpywareGuard. Ad-aware http://www.lavasoft.de/ http://www.lavasoftusa.com/ All software offered on this page is free* to download and use and compatible with Windows 98/ME/NT40, Windows 2000 and Windows XP Home and Professional. Download sites . http://download.com.com/3000-2144-10045910.html?part=69274&subj=dlpage&tag=button http://majorgeeks.com/download.php?det=506 The following explains how to set Ad-aware's settings to perform a "Full Scan." http://spywarewarrior.com/viewtopic.php?p=3293#3293 http://forums.thatcomputerguy.us/index.php?showtopic=1190 In Ad-aware click the Gear to go to the Settings area. The following items should be on a green check, not on a red X. Under the Scanning button: * Scan within archives * Under Memory & Registry, Check EVERYTHING * In Check Drives & Folders, make sure all of your hard drives are selected Under the Advanced button, check ALL under Log detail level (this makes it easier for visitors to the Lavasoft Support Forums to see what options you have selected should you require assistance.) Under the Tweak button... Some of these may not be an available option, depending on your version of Ad-aware and your version of Windows. Do not be concerned if you cannot select a certain item. In Scanning Engine: * Unload recognized processes during scanning * Include info about ignored objects in logfile, if detected in scan * Include basic Ad-aware settings in logfile * Include additional Ad-aware settings in logfile * Include used command line parameters in logfile In Cleaning Engine: * XP/2000: Allow unloading explorer to unload shell extensions prior to deletion * Let Windows remove files in use at next reboot * UNCHECK: Automatically try to unregister objects prior to deletion Click Proceed to save these settings. When you would like to perform a "Full Scan," switch the scan mode from SmartScan to Custom. http://www.lavahelp.com/howto/fullscan/index.html Bazooka http://www.webgrid.co.uk/security_2.html http://www.winsite.com/bin/Info?17000000037943 http://www.kephyr.com/ Here is the current list of Bazooka fixes . http://www.kephyr.com/spywarescanner/library/index.phtml?source=appvisit Bazooka is freeware and Windows 95/98/ME/NT/2000/XP compatible Click on the files found & you will be taken to a site that will show you how to remove , either with a program or manually . It reports on all drives & partitions , so remember to check all these , when doing manual remove . After the Download - It is important to remember that once the installation of Bazooka is completed , that you should update the File Signatures by clicking on the Update tab and check for an update . Make sure you Update after installing & then regularly . List of fake spyware removers or , Rogue/Suspect Anti-Spyware Products & Web Sites http://www.spywarewarrior.com/rogue_anti-spyware.htm http://netrn.net/spywareblog/archives/2004/05/30/ http://myweb.tiscali.co.uk/lesgrotte/map.htm#scum ================================ HijackThis log file analysis & repair http://hijackthis.de/index.php?langselect=english HijackThis is a program used by experienced users in order to detect browser hijackers. It allows you to identify any sort of spyware and malware (as well as some trojan horses and worms). This is achieved by scanning special zones of the registry as well as the hard disk drive, the results being listed in a structured window. Another feature of HijackThis is the creation of a log file, which can be saved as a simple text file and opened by any text editor (notepad as default). Until now, inexperienced users, who could not analyze the log file by themselves, had no other choice than posting it in a specialized forum and to hope that a more experienced user takes some time to analyze it. The script presented on this page is a way to analyze your log without help from the outside: simply copy/paste the content of the log file in the textbox below and hit the analyze button.