captarheel

have run both IE and FF in regular mode for a couple of hours now -- no IP block alerts. Will continue to monitor overnight and let you know.

MrC, I will check these scheduled services, but I have not been running for about 2 hours this morning and have not had any alerts. I have not seen any alerts since we ran the last two scans. The long scan did not find anything, but the first scan, as you recall, did find and eliminate 3 tracking cookies. I have not tried opening either FF or IE in regular mode, but I am running IE in safe mode. Should I try running FF or IE in regular mode? I won't try that until I hear from you.

ran both. First scan found three tracking cookies. Cleaned and removed them. The Vipre Rescue program took a long time, like you said, but found nothing. If there is a log somewhere from either that you would like me to post, please point me to where I will find it. Thanks!

cleared the cache, but the IP blocking alert just showed back up.

I have both Firefox and IE installed, and the alerts pop up when using both.

although ESET said it cleaned those viruses, the pop up alerts are still coming

finally found some things . . . log.txt

the IP block alerts have not stopped. I can run IE in safe mode and although the alerts still come in, the speed is relatively normal. When running FF in safe mode, the speed is sluggish but nominally usable. Any suggestions?

same was true when i ran firefox in safe mode -- speed was practically back to normal

Using ie as you described in your last post without add-ons dramatically increased the speed. Does this give you any more clues?

Mr. C, My main computer has become nearly unusable for internet connections. Speed suddenly became glacial. I cannot get on the internet at all without disabling the McAfee firewall. Have you seen this before? I can probably use a pin drive to transfer downloads to the infected computer if you have any suggestions. Thanks.

Thanks. I'm pretty unfamiliar with restore points. Is there a reason to bring it back to where it was? Any harm in leaving it back at June 21?

I took it all the way back to June 21. Still getting the IP block messages from MBAM.

ok. Will check back periodically. Thanks for the help!

As i think about it, I think I got a message about flash something or other wanting access to the internet and I mistakenly clicked 'allow' for something that I wasn't totally certain about. Don't know if that is relevant or not. I don't have all of the prior MBAM logs as somewhere along the way (July 4) I uninstalled and then reinstalled and re-registered MBAM.

I think it started on Monday the 2nd. I have not installed any new programs. I have totally uninstalled all FF components and personal data, and am using IE exclusively, but am still having the problem. I nearly always use a wireless router -- at work and at home.

Here you go.

IP block still popping up.

McAfee just popped up a notification saying it had detected and removed a trojan: Artemis!48580F5E2A72

MBAM's notification about the IP outbound blocker did just come up again.

Okay. I ran TFC. It said it cleaned out 32MB of files. I am watching for more IP blocks. Will let you know what I see. What about the two folders I did not recognize but which were empty?

tried again. Here is the txt file result: All processes killed ========== OTL ========== Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully. 64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-help\ deleted successfully. File Protocol\Handler\ms-help - No CLSID value found not found. File PTYJAVA] not found. File ptytemp] not found. OTL by OldTimer - Version 3.2.42.2 log created on 07062012_084043 Files\Folders moved on Reboot... Registry entries deleted on Reboot...

By the way -- don't know if it helps, but I am still getting the IP block message even after that last OTL fix.

I do not recognize those two folders. I opened them and they are both empty. ran the fix -- here's the log: All processes killed Error: Unable to interpret <:OTLO3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.O18:64bit: - Protocol\Handler\ms-help - No CLSID value found:Commands[EMPTYJAVA][emptytemp]> in the current context! OTL by OldTimer - Version 3.2.42.2 log created on 07062012_071209 Files\Folders moved on Reboot... Registry entries deleted on Reboot...

I totally deleted Firefox and all personal information. am now using IE. Still getting the IP block messages from MBAM. Same outbound address. I read the other post, and saw the suggestion for some OTL fixes, but I was not able to fully copy the suggested fixes -- I couldn't figure out how to pick up the text outside the visible area of the text box and I couldn't get the scroll bar to work at the same time as trying to copy. As such, I have not run any of those suggested fixes.