JeanInMontana

Heh, well IMO IE is always unreliable. Maybe try a repair install on it.

Your running two active antivirus programs. Pick Kasperskys or Avira and take the one you don't want to run active out of auto start. This alone can be the root of your problems. Second please follow the instructions here http://www.malwarebytes.org/forums/index.php?showtopic=2936

Trialware doesn't guarantee there won't be problems down the road. All software no matter who makes it is subject to having trouble. It's the nature of the beast. MBAM does offer money back if not satisfied and free support.

Hi plodr and welcome to Malwarebytes. Your friend with the rootkits, needs to be told there is never a guarantee they are removed. Any banking or credit card info she had on the machine has been compromised and must be deal with. Passwords all need changing for all she has. A reformat is the only way to be sure of rootkit removal.

OK so is MBAM scanning in Safe Mode and it removed those items? Can you restore to before the problem? I don't think we can clean the system in Safe Mode. I need to see a HJT log in normal boot, to stand a chance of seeing where and what is running.

Sorry to butt in here, but forum rules explicitly say no tampered logs. Provide a full log or this thread will be closed.

I just got a report that your notepad is not malware. Are you still having symptoms?

Your still running Limewire. I'll have to close this thread if you can't comply with site policy concerning P2P programs.

Well possibly if you have spyware it's causing the errors. You should go to the malware removal forum and follow the instructions at the top of the page and post your logs.

I would recommend you get rid of C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe uninstall it via Add/Remove programs and delete all files and folders associated with it. MBAM has updated several versions to the definitions since your last scan let's see a new log of it and HJT. Let me know how things are running.

Are we done here? You need to respond or I will close the thread.

Hello?

Are you going to respond?

Since this issue is resolved I will close the thread to prevent others from posting into it. If you need assistance please start your own topic and someone will be happy to assist you. The fixes and advice in this thread are for this machine only. Do not apply to your machine. Please start a thread of your own and someone will be happy to help you.

Since this issue is resolved I will close the thread to prevent others from posting into it. If you need assistance please start your own topic and someone will be happy to assist you. The fixes and advice in this thread are for this machine only. Do not apply to your machine. Please start a thread of your own and someone will be happy to help you.

Since this issue is resolved I will close the thread to prevent others from posting into it. If you need assistance please start your own topic and someone will be happy to assist you. The fixes and advice in this thread are for this machine only. Do not apply to your machine. Please start a thread of your own and someone will be happy to help you.

Since this issue is resolved I will close the thread to prevent others from posting into it. If you need assistance please start your own topic and someone will be happy to assist you. The fixes and advice in this thread are for this machine only. Do not apply to your machine. Please start a thread of your own and someone will be happy to help you.

Since this issue is resolved I will close the thread to prevent others from posting into it. If you need assistance please start your own topic and someone will be happy to assist you. The fixes and advice in this thread are for this machine only. Do not apply to your machine. Please start a thread of your own and someone will be happy to help you.

Hi there Mattwardinterglaze and welcome to Malwarebytes. Make sure your running as an administrator on the machine. Allow email from Malwarebytes.org and set your preferences in the User Control Panel to email notifications for replies to your topics. This ensures you make prompt replies back and we get you cleaned in the fastest way possible. Please set your system to show all files; Click Start. Open My Computer. Select the Tools menu and click Folder Options. Select the View Tab. Under the Hidden files and folders heading select Show hidden files and folders. Uncheck the Hide protected operating system files (recommended) option. Click Yes to confirm. Click OK. If you haven't already, please get these programs, update and run a complete scan removing all items found. Spybot Search & Destroy Be sure to use the immunize feature. But do not enable TeaTimer at this time. Open SB S&D Make sure you are in Advanced Mode. Click on the Mode link at the top of the program and then Advanced Mode. Click on the Tools section and then Resident. You will see two items. 1. Resident "SD helper" (Internet Explorer bad download blocker.) active 2. Resident "Tea Timer" (Protection of over-all system settings.) active. Uncheck number 2.. Leave number 1 checked always. You can enable Tea Timer again if you wish once all special fixes have been done. Please run a quick scan of your main drive, usually C with MBAM making sure you check all items found for removal. Please post that log in your next reply. Then go here and run a scan PandaActive Scan There is a full tutorial on how to to this at the top of this forum. Post the logs from the Panda and MBAM scans please, along with a log from this program HiJack This! You will post three logs. 1. MBAM scan. 2. Panda Active Scan. 3. HiJack This scan. Please run and post the scans in this order. You will finish the MBAM first so go ahead and post that log, then move on to Panda and so forth. I will analyze the logs and give you further instructions. Be sure to set your email to allow mail from Malwarebytes.org and your personal settings to send an email on reply to your topic. This will let you know when there has been an update to your topic and you can come and see what has been said. Be patient and persistent. These things can take time and many procedures.

OK please update MBAM and run a quick scan. Post that log and a new HJT log.

There is nothing in the log that screams malware. If it were ran in normal boot perhaps it would show. The files show in the Panda scan as in program files. They are not dat files they are exe.

Your log looks clean. We need to now reset a clean System Restore point. If you don't and you need to use System Restore you will reinfect yourself. Go to Start>Control Panel>System. Click on the System Restore tab and put a check in Turn off System Restore. Then click OK. Now go to Start>Help and Support > Undo Changes to Your System or System Restore depending on the make of your PC. Click on what ever will open the System Restore box. You will see two options, Choose Create a System Restore Point. Give it a name like Clean Restore Point and today's date. Now if you need to use it you have it. Many of infections can be avoided with an added layer of prevention. All recommended programs are free and easy on system resources. You should install them as part of your protection arsenal. Keep MBAM and Spybot Search & Destroy and always immunize SBS&D when you update. You will also need at least one other scanning program Asquared or SuperAntiSpyware are good and there are several other excellent programs with free and paid versions. Read the overviews of what each program below does so you have an understanding of their importance and how to use. A firewall and antivirus are also essential. The Windows firewall in XP and Vista is not sufficient. Preform Windows Updates monthly on the second Tuesday or use automatic updates, and use your scanners weekly at the least. Always update before you scan. Keep other software known for vulnerabilities updated also. Use the Secunia Inspector free scan to identify risks in outdated versions. SpywareBlaster from Javacool Software WinPatrol by BillPStudios SiteHound by FireTrust RogueRemover hpHosts The windows firewall is not sufficient to protect. It doesn't monitor outgoing traffic and this is a must. I use and recommend Online Armor Free Also the full protection of MBAM is offered at a very low price, from the link in my signature.

Update MBAM please and run a quick scan post that log and a new HJT log.

Hi Rosie. What seems to be your problem? I don't see any malware and you give no reason for posting. Please open notepad and unwrap word. Logs are too hard to read when they are wrapped. Open SB S&D Make sure you are in Advanced Mode. Click on the Mode link at the top of the program and then Advanced Mode. Click on the Tools section and then Resident. You will see two items. 1. Resident "SD helper" (Internet Explorer bad download blocker.) active 2. Resident "Tea Timer" (Protection of over-all system settings.) active. Uncheck number 2.. Leave number 1 checked always. You can enable Tea Timer again if you wish once all special fixes have been done.

To rid msconfig of old entries you need to edit the registry, this is a crucial area of the system, and extreme caution must be used. The auto reboot you should post in general PC help. Someone might have ideas there. OK, if your seeing things we need to see a new and updated MBAM scan, and a new HJT log.