Expert: Brian Benosky - 8/10/2008

Question
Hi Brian
My computer was infected by xpantivirus. I've symantec endpoint protection and spybot1.6 installed on my PC. I've followed the instruction from symantec to clean it and also did a online scan from symantec web site and a full scan by spybot. After I done all of the scan, I still get a window alert showing "You have security problem". Then I can kill this message by deleting "7.tmp","*.tmp" processes in task manager. If I don't delete these process, a IE popup will open a antivirus 2008 web site and my homepage was changed to google.ca. Any suggestion to fix this?

Answer
Hi Vincent

Please download Malwarebytes' Anti-Malware to your desktop from here:
http://www.besttechie.net/tools/mbam-setup.exe
Double-click mbam-setup.exe and follow the prompts to install the program.
  * At the end, be sure a checkmark is placed next to
        o Update Malwarebytes' Anti-Malware
        o and Launch Malwarebytes' Anti-Malware
  * then click Finish.
  * If an update is found, it will download and install the latest version.
  * Once the program has loaded, select Perform full scan, then click Scan.
  * When the scan is complete, click OK, then Show Results to view the results.
  * Be sure that everything is checked, and click Remove Selected.
  * When completed, a log will open in Notepad.

Next, please download HijackThis to your desktop from here:
http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
Make sure you close EVERY open window and ALL browser windows. The only thing that should be open is the HijackThis program.
Double-click on the file you just downloaded.
Click on the "Install" button.
Upon install, HijackThis should open for you.
Should it not open, go to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe
Choose 'Do a system scan and save a log file'.
Copy the text file which opens in Notepad and paste it in your follow-up here.

Brian