JSntgRvr

Save these instructions as a text file (use notepad) in the flash drive. Boot to the OTLPE CD Please double-click OTLPE.exe to run it as you did before. Copy the lines in the quote below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy): Return to OTLPE, right click in the "Custom Scans/Fixes" window and choose Paste. Click the red Run Fix button. A report will be produced and saved in the C:\_OTL\MovedFiles folder in the form of Date_Time.log. Open that report and post its contents in a reply. Restart the computer back to the OTLPE CD. Double-click on the OTLPE icon. When asked "Do you wish to load the remote registry", select Yes When asked "Do you wish to load remote user profile(s) for scanning", select Yes Ensure the box "Automatically Load All Remaining Users" is checked and press OK OTL should now start. Change the following settings Change Drivers to All Change Registry to All Under the Custom Scan box paste this in /md5start atapi.sys /md5stop [*]Press Run Scan to start the scan. [*]When finished, the file will be saved in drive C:\OTL.txt [*]Copy this file to your USB drive. [*]Please post the contents of the C:\OTL.txt file in your reply also.

Please go here: The Spy Killer Forum Click on "New Topic" Put your name, e-mail address, and this as the title: "JSntgRvr" Put a link to this thread in the description box. Then next to the file box, at the bottom, click the browse button, then navigate to this file: C:\_OTS\MovedFiles\02152010_212605\C_\fiou.exe [*]Click Open. [*]Click Post. You wont know if the file was uploaded. Following the above instructions will be enough. Let me know when done. Test the computer and tomorrow, after school or work, run OTS.exe once again and post the log.

Lets check for remnants: Launch and update Malwarebytes' Anti-Malware. If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. When the scan is complete, click OK, then Show Results to view the results. Make sure that everything is checked, and click Remove Selected. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note) The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. Copy&Paste the entire report in your next reply. Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly. Please do an online scan with Kaspersky WebScanner Kaspersky online scanner uses JAVA tecnology to perform the scan. If you do not have the latest JAVA version, follow the instructions below under Upgrading Java, to download and install the latest version. Read through the requirements and privacy statement and click on Accept button. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run. When the downloads have finished, click on Settings. Make sure the following is checked. Spyware, Adware, Dialers, and other potentially dangerous programs Archives Mail databases [*]Click on My Computer under Scan. [*]Once the scan is complete, it will display the results. Click on View Scan Report. [*]You will see a list of infected items there. Click on Save Report As.... [*]Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. [*]Please post this log in your next reply. Attention! Kaspersky Online Scanner 7.0 may fail to start if another anti-virus program is already installed and running on your computer. Please deactivate the anti-virus software installed on your computer prior to starting Kaspersky Online Scanner 7.0. Upgrading Java : Download the latest version of Java SE Runtime Environment (JRE)JRE 6 Update 18. Click the "Download" button to the right. Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.". Click on Continue. Click on the link to download Windows Offline Installation (jre-6u18-windows-i586.exe) and save it to your desktop. Do NOT use the Sun Download Manager.. Close any programs you may have running - especially your web browser. Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java version. Reboot your computer once all Java components are removed. Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u18-windows-i586.exe and select "Run as an Administrator.")

You want another good news, those files and folders stopped re-spawning. Please download SystemLook from one of the links below and save it to your Desktop. (If you have not done so) Download Mirror #1 Download Mirror #2 Double-click SystemLook.exe to run it. Copy the content of the following codebox into the main textfield: Click the Look button to start the scan. When finished, a notepad window will open with the results of the scan. Please post this log in your next reply. Note: The log can also be found on your Desktop entitled SystemLook.txt

Lots of members have had the same issue with COMODO.

AZrgh!! I was deleting OTS.exe with that fix. Here is another.

Run this fix and post the report along with anothr OTS log, File age=60.

Please download SystemLook from one of the links below and save it to your Desktop. Download Mirror #1 Download Mirror #2 Double-click SystemLook.exe to run it. Copy the content of the following codebox into the main textfield: Click the Look button to start the scan. When finished, a notepad window will open with the results of the scan. Please post this log in your next reply. Note: The log can also be found on your Desktop entitled SystemLook.txt

Did you run the batch file?

If it still hanging, follow these steps: Copy the entire contents of the Quote Box below to Notepad. Name the file as fix.bat Change the Save as Type to All Files and Save it on the desktop Once saved, double click on the fix.bat file. Attempt to run the fix again.

It is suppose to be a fast fix. Try to run it again.

Start OTS. Copy/Paste the information in the Quotebox below into the pane where it says "Paste fix here" and then click the Run Fix button. The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. CLick the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here along with a new OTS scan log. This time select a file age of 60 days. I will review the information when it comes back in. Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.

Lets try another program. Download OTS.exe by OldTimer to your Desktop. Close any open browsers. Double-click on OTS.exe to start the program. Leave all settings as they appear as default, except for the following: Under Drivers, select "All". Under Registry, select "All". File age should be 30 days. Under Additional Scans, click on the "Extras" button. [*]Now click the Run Scan button on the toolbar. [*]The program will be scanning huge amounts of data so depending on your system it could take a long time to complete. Let it run unhindered until it finishes. [*]When the scan is complete Notepad will open with the report file loaded in it. [*]Save that notepad file Use the Reply button and attach the notepad file here (Do not copy and paste in a reply, rather attach it to it).

Hi, jkim Please download ComboFix from Here or Here to your Desktop. **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop** If you are using Firefox, make sure that your download settings are as follows: Tools->Options->Main tab Set to "Always ask me where to Save the files". [*]During the download, rename Combofix to Combo-Fix as follows: [*]It is important you rename Combofix during the download, but not after. [*]Please do not rename Combofix to other names, but only to the one indicated. [*]Close any open browsers. [*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. ----------------------------------------------------------- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results". Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. ----------------------------------------------------------- Close any open browsers. WARNING: Combofix will disconnect your machine from the Internet as soon as it starts Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished. If there is no internet connection after running Combofix, then restart your computer to restore back your connection. ----------------------------------------------------------- [*]Double click on combo-Fix.exe & follow the prompts. [*]Install the Recovery Console if prompted. [*]When finished, it will produce a report for you. [*]Please post the "C:\Combo-Fix.txt" . **Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall** Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser. Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security.

Hi, cbailey1903 Please download ComboFix from Here or Here to your Desktop. **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop** If you are using Firefox, make sure that your download settings are as follows: Tools->Options->Main tab Set to "Always ask me where to Save the files". [*]During the download, rename Combofix to Combo-Fix as follows: [*]It is important you rename Combofix during the download, but not after. [*]Please do not rename Combofix to other names, but only to the one indicated. [*]Close any open browsers. [*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. ----------------------------------------------------------- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results". Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. ----------------------------------------------------------- Close any open browsers. WARNING: Combofix will disconnect your machine from the Internet as soon as it starts Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished. If there is no internet connection after running Combofix, then restart your computer to restore back your connection. ----------------------------------------------------------- [*]Double click on combo-Fix.exe & follow the prompts. [*]Install the Recovery Console if prompted. [*]When finished, it will produce a report for you. [*]Please post the "C:\Combo-Fix.txt" . **Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall** Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser. Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security.

Hi, donj The reports submitted provide no clue as to what is the problem. Perhaps we should take a look at the computer from an external source. First, if you were unable to run GMER, follow these steps: Double click GMER.exe. No need to scan. Just wait until the initial scan is finished. Once done click on the Rootkit tab, then on the[save..] button, and in the File name area, type in "ark.txt" Change the Save as Type to All Files Save the log where you can easily find it, such as your desktop. Post it in your next reply **Caution** Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries Please copy and paste the contents of that report in your next reply. Now, back to the external source, you will need a flash drive to move information from the sick computer to a working computer, so we can see the progress of our actions. Save these instructions in your flash drive as a text file (use notepad) so you can have access to these while in an external environment (PE). Here is what you need to do. Two programs to download First Download ISOBurner. Click Here for ISOBurner Instructions. Install the program, and follow the next set of steps. Second Download OTLPE.iso and burn to a CD using ISO Burner. NOTE: This file is 276.7MB in size so it may take some time to download. When downloaded double click and this will then open ISOBurner to burn the file to CD Boot the Non working computer using the boot CD you just created. In order to do so, the computer must be set to boot from the CD first Note : For information click here Your system should now display a REATOGO-X-PE desktop. Double-click on the OTLPE icon. When asked "Do you wish to load the remote registry", select Yes When asked "Do you wish to load remote user profile(s) for scanning", select Yes Ensure the box "Automatically Load All Remaining Users" is checked and press OK OTL should now start. Change the following settings Change Drivers to All Change Registry to All Under the Custom Scan box paste this in %SYSTEMDRIVE%\*.* /md5start eventlog.dll scecli.dll netlogon.dll cngaudit.dll sceclt.dll ntelogon.dll logevent.dll iaStor.sys nvstor.sys atapi.sys IdeChnDr.sys viasraid.sys AGP440.sys vaxscsi.sys nvatabus.sys viamraid.sys nvata.sys nvgts.sys iastorv.sys ViPrt.sys eNetHook.dll ahcix86.sys KR10N.sys nvstor32.sys ahcix86s.sys nvrd32.sys /md5stop %systemroot%\*. /mp /s %systemroot%\System32\config\*.sav [*]Press Run Scan to start the scan. [*]When finished, the file will be saved in drive C:\OTL.txt [*]Copy this file to your USB drive. [*]Please post the contents of the C:\OTL.txt file in your reply.

Remove Comodo from your system. Copy the entire contents of the Quote Box below to Notepad. Name the file as CFScript.txt Change the Save as Type to All Files and Save it on the desktop Once saved, referring to the picture above, drag CFScript.txt into ComboFix.exe, and post back the resulting report. Lets take a deeper look. Download OTL to your Desktop Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted. OTL should now start. Change the following settings Change Drivers to All Change Registry and Extra Registry to All Under File Scans, change File age to 30 [*]Under the Custom Scan box paste this in netsvcs %SYSTEMDRIVE%\*.exe /md5start eventlog.dll scecli.dll netlogon.dll cngaudit.dll sceclt.dll ntelogon.dll logevent.dll iaStor.sys nvstor.sys atapi.sys IdeChnDr.sys viasraid.sys AGP440.sys vaxscsi.sys nvatabus.sys viamraid.sys nvata.sys nvgts.sys iastorv.sys ViPrt.sys eNetHook.dll ahcix86.sys KR10N.sys nvstor32.sys ahcix86s.sys nvrd32.sys /md5stop %systemroot%\*. /mp /s CREATERESTOREPOINT %systemroot%\system32\*.dll /lockedfiles %systemroot%\Tasks\*.job /lockedfiles [*]Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long. When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL. Please attach the contents of these files in your next reply. Download GMER Rootkit Scanner from here or here. Extract the contents of the zipped file to desktop. Double click GMER.exe. If it gives you a warning about rootkit activity and asks if you want to run a full scan...click on NO, then use the following settings for a more complete scan.. Click the image to enlarge it In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED ... Sections Processes Threads Libraries Drives/Partition other than Systemdrive (typically C:\) Show All (don't miss this one) [*] Then click the Scan button & wait for it to finish. [*] Once done click on the [save..] button, and in the File name area, type in "ark.txt" [*]Save it where you can easily find it, such as your desktop and post its contents in your next reply. **Caution** Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries I will check these report in the AM.

They should stop soon. Copy the entire contents of the Quote Box below to Notepad. Name the file as CFScript.txt Change the Save as Type to All Files and Save it on the desktop Once saved, referring to the picture above, drag CFScript.txt into ComboFix.exe, and post back the resulting report. Copy the entire contents of the Quote Box below to Notepad. Name the file as Test.bat Change the Save as Type to All Files and Save it on the desktop Once saved, double click on the Test.bat file and post its report.

But able to connect to the Internet? Go to Services. Doubleclick on the wireless zero configuration. Set it to automatic. While in services, check the Remote Procedure Call. Is it running?

Something is producing lots of empty folders and files. Are you still unable to connect. The syntax is correct. Copy the entire contents of the Quote Box below to Notepad. Name the file as CFScript.txt Change the Save as Type to All Files and Save it on the desktop Once saved, referring to the picture above, drag CFScript.txt into ComboFix.exe, and post back the resulting report.

You are welcome.

Enter your Control Panel and double-click on Network Connections Then right click on your Default Connection Usually Local Area Connection for Cable and DSL, or AOL Connection. [*]Left click on Properties [*]Double-Click on the Internet Protocol (TCP/IP) item [*]Select the radio dial that says Obtain DNS Servers Automatically [*]Press OK twice to get out of the properties screen Go to Start->Run->Type CMD and click Ok. The MSDOS Window will be displayed. At the command prompt, type the following and press Enter after each line: netsh int ip reset C:\Resetlog.txt netsh winsock reset catalog ipconfig /flushdns (The space between g and / is needed) Exit Restart the computer. Copy the entire contents of the Quote Box below to Notepad. Name the file as CFScript.txt Change the Save as Type to All Files and Save it on the desktop Once saved, referring to the picture above, drag CFScript.txt into ComboFix.exe, and post back the resulting report. Open the following file and post its contents: ComboFix-quarantined-files.txt

Hi, donj Lets give it a try. Some programs may be compromised. Copy the entire contents of the Code Box below to Notepad. Name the file as CFScript.txt Change the Save as Type to All Files and Save it on the desktop http://forums.malwarebytes.org/index.php?act=ST&f=7&t=39848 Collect:: c:\windows\system32\aexarasug.exe c:\windows\system32\accesse.exe c:\windows\system32\ndismgr.sys FCopy:: c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys | c:\windows\system32\drivers\tcpip.sys File:: c:\program files\20484187.dat c:\program files\20483640.dat c:\program files\20459281.dat c:\program files\20458718.dat c:\program files\1475171.dat c:\program files\1117984.dat c:\program files\894875.dat c:\program files\24539093.dat c:\documents and settings\Don\Application Data\gaboln\hxmrsftav .exe DirLook:: c:\documents and settings\Don\Application Data\gaboln c:\documents and settings\Administrator\Local Settings\Application Data\dgakth c:\documents and settings\Administrator\Local Settings\Application Data\fnlxtk c:\documents and settings\Administrator\Local Settings\Application Data\ybchse c:\documents and settings\Administrator\Local Settings\Application Data\rorqsx c:\documents and settings\Administrator\Local Settings\Application Data\uquibp c:\documents and settings\Administrator\Local Settings\Application Data\fvawxd c:\documents and settings\Administrator\Local Settings\Application Data\fcaahi c:\documents and settings\Administrator\Local Settings\Application Data\yivbrq c:\documents and settings\Administrator\Local Settings\Application Data\rvlkrk c:\documents and settings\Administrator\Local Settings\Application Data\dgyvei c:\documents and settings\Administrator\Local Settings\Application Data\yfesmo c:\documents and settings\Administrator\Local Settings\Application Data\dvmgkv c:\documents and settings\Administrator\Application Data\uskiwa c:\documents and settings\Administrator\Local Settings\Application Data\uskiwa c:\documents and settings\Administrator\Local Settings\Application Data\kvtrff c:\documents and settings\Administrator\Local Settings\Application Data\mfqqci c:\documents and settings\Administrator\Local Settings\Application Data\hjahoq c:\documents and settings\Administrator\Application Data\kfaesu c:\documents and settings\Administrator\Local Settings\Application Data\kfaesu c:\documents and settings\Administrator\Local Settings\Application Data\waegsd c:\documents and settings\Administrator\Local Settings\Application Data\xmoqog c:\documents and settings\Administrator\Local Settings\Application Data\csgjfq c:\documents and settings\Administrator\Local Settings\Application Data\bfakvp c:\documents and settings\Administrator\Local Settings\Application Data\scxmju c:\documents and settings\Administrator\Local Settings\Application Data\efqqgh c:\documents and settings\Administrator\Local Settings\Application Data\nylugr c:\documents and settings\Administrator\Local Settings\Application Data\ueaerm c:\documents and settings\Administrator\Local Settings\Application Data\dtxfhc c:\documents and settings\Administrator\Local Settings\Application Data\rlvfse c:\documents and settings\Administrator\Local Settings\Application Data\vwwvyy c:\documents and settings\Administrator\Local Settings\Application Data\syageo c:\documents and settings\Don\Local Settings\Application Data\abietk c:\documents and settings\Don\Local Settings\Application Data\ufrtfs c:\documents and settings\Don\Local Settings\Application Data\wvjbsh c:\documents and settings\Don\Local Settings\Application Data\fmjtag c:\documents and settings\Don\Local Settings\Application Data\iloebw c:\documents and settings\Don\Local Settings\Application Data\sfkibg c:\documents and settings\Don\Local Settings\Application Data\tvcpnu c:\documents and settings\Don\Local Settings\Application Data\itddfo c:\documents and settings\Don\Local Settings\Application Data\gfwhqa c:\documents and settings\Administrator\Local Settings\Application Data\gkalbi c:\documents and settings\Administrator\Local Settings\Application Data\cbsmjt c:\documents and settings\Administrator\Local Settings\Application Data\yvtjiq c:\documents and settings\Don\Local Settings\Application Data\hlwkjf c:\documents and settings\Don\Local Settings\Application Data\jkkmib c:\documents and settings\Don\Local Settings\Application Data\ubalar c:\documents and settings\Don\Application Data\fbwefs c:\documents and settings\Don\Local Settings\Application Data\fbwefs c:\documents and settings\Don\Application Data\yomnfm c:\documents and settings\Don\Local Settings\Application Data\yomnfm c:\documents and settings\Don\Local Settings\Application Data\hrvqjo c:\documents and settings\Don\Local Settings\Application Data\wufaqt c:\documents and settings\Don\Local Settings\Application Data\bnsrrx c:\documents and settings\Don\Local Settings\Application Data\vkgapu c:\documents and settings\Don\Local Settings\Application Data\mlcxya c:\documents and settings\Don\Local Settings\Application Data\fdkcow c:\documents and settings\Don\Local Settings\Application Data\lllwyr c:\documents and settings\Don\Local Settings\Application Data\pehutx c:\documents and settings\Don\Application Data\kdhopu c:\documents and settings\Don\Local Settings\Application Data\kdhopu c:\documents and settings\Don\Local Settings\Application Data\rivwbq c:\documents and settings\Administrator\Local Settings\Application Data\xonubk c:\documents and settings\Administrator\Local Settings\Application Data\bwrapu c:\documents and settings\Administrator\Local Settings\Application Data\nspvyv c:\documents and settings\Administrator\Local Settings\Application Data\tbqpir c:\documents and settings\Administrator\Local Settings\Application Data\urjwug c:\documents and settings\Administrator\Local Settings\Application Data\pvsmho c:\documents and settings\Administrator\Local Settings\Application Data\bggytm c:\documents and settings\Administrator\Local Settings\Application Data\enqmtp c:\documents and settings\Administrator\Local Settings\Application Data\iluhfh c:\documents and settings\Administrator\Local Settings\Application Data\txntbr c:\documents and settings\Administrator\Local Settings\Application Data\lukvov c:\documents and settings\Administrator\Local Settings\Application Data\rjhxmd c:\documents and settings\Administrator\Local Settings\Application Data\cirftf c:\documents and settings\Administrator\Local Settings\Application Data\mcmjto c:\documents and settings\Administrator\Local Settings\Application Data\usldbm c:\documents and settings\Administrator\Local Settings\Application Data\djkvjl c:\documents and settings\Administrator\Local Settings\Application Data\yelsii c:\documents and settings\Administrator\Local Settings\Application Data\Adobe c:\documents and settings\Administrator\Local Settings\Application Data\feyrpu c:\documents and settings\Administrator\Local Settings\Application Data\tjtmwa c:\documents and settings\Administrator\Local Settings\Application Data\qhowqr c:\documents and settings\Administrator\Local Settings\Application Data\kufgpl c:\documents and settings\Administrator\Local Settings\Application Data\irksuq c:\documents and settings\Administrator\Local Settings\Application Data\oylmel c:\documents and settings\Administrator\Local Settings\Application Data\lmrcow c:\documents and settings\Administrator\Local Settings\Application Data\wwfnbu c:\documents and settings\HP_Administrator\Local Settings\Application Data\xdlqit c:\documents and settings\Don\Local Settings\Application Data\kgbsoe c:\documents and settings\Don\Local Settings\Application Data\tavwon c:\documents and settings\Don\Local Settings\Application Data\puxunk c:\documents and settings\Don\Local Settings\Application Data\gxnjmv c:\documents and settings\Don\Local Settings\Application Data\hogqyk c:\documents and settings\Don\Local Settings\Application Data\lxhkna c:\documents and settings\Don\Local Settings\Application Data\togeuy c:\documents and settings\Don\Local Settings\Application Data\eytphw c:\documents and settings\Don\Local Settings\Application Data\xmkygq c:\documents and settings\Administrator\Application Data\qrkfma c:\documents and settings\Administrator\Local Settings\Application Data\qrkfma c:\documents and settings\Administrator\Local Settings\Application Data\vissjh c:\documents and settings\Don\Local Settings\Application Data\canyjj c:\documents and settings\Don\Local Settings\Application Data\rbkwso c:\documents and settings\Don\Local Settings\Application Data\cbhpxq c:\documents and settings\Don\Local Settings\Application Data\nlbgbv c:\documents and settings\Don\Local Settings\Application Data\taxiac c:\documents and settings\Don\Local Settings\Application Data\aotkyj RenV:: c:\program files\Adobe\Reader 9.0\Reader\reader_sl .exe c:\program files\Common Files\Adobe\ARM\1.0\adobearm .exe c:\program files\Common Files\Real\Update_OB\realsched .exe c:\program files\Dell AIO Printer A960\dlbfbmgr .exe c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08 .exe c:\program files\iTunes\ituneshelper .exe c:\program files\Malwarebytes' Anti-Malware\mbam .exe c:\program files\Norton Internet Security\urllstck .exe c:\program files\Spyware Doctor\pctstray .exe c:\windows\ehome\ehtray .exe Registry:: [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sefjhf98jfoidsfoishgoiusgdgfgd] Once saved, referring to the picture above, drag CFScript.txt into ComboFix.exe, and post back the resulting report. **Note** When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis. Ensure you are connected to the internet and click OK on the message box. (This may not even happen in your condition.) ==================================================================== Please download SystemLook from one of the links below and save it to your Desktop. Download Mirror #1 Download Mirror #2 Double-click SystemLook.exe to run it. Copy the content of the following codebox into the main textfield: Click the Look button to start the scan. When finished, a notepad window will open with the results of the scan. Please post this log in your next reply. Note: The log can also be found on your Desktop entitled SystemLook.txt

Yes. Congratulations. Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programmes changing them. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.) To reset your restore points, please note that you will need to log into your computer with an account which has full administrator access. You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account. (Windows XP) 1. Turn off System Restore. On the Desktop, right-click My Computer. Click Properties. Click the System Restore tab. Check Turn off System Restore. Click Apply, and then click OK. 2. Reboot. 3. Turn ON System Restore. On the Desktop, right-click My Computer. Click Properties. Click the System Restore tab. UN-Check *Turn off System Restore*. Click Apply, and then click OK.. Since the tools we used to scan the computer, as well as tools to delete files and folders, are no longer needed, they should be removed, as well as the folders created by these tools. Follow these steps to uninstall Combofix. Click START then RUN Now copy and paste Combofix /Uninstall in the runbox and click OK. Create a Restore point: Click Start, point to All Programs, point to Accessories, point to System Tools, and then click System Restore. In the System Restore dialog box, click Create a restore point, and then click Next. Type a description for your restore point, such as "After Cleanup", then click Create. The following is a list of tools and utilities that I like to suggest to people. This list is full of great tools and utilities to help you understand how you got infected and how to keep from getting infected again. Spybot Search & Destroy - Uber powerful tool which can search and annhilate nasties that make it onto your system. Now with an Immunize section that will help prevent future infections. AdAware - Another very powerful tool which searches and kills nasties that infect your system. AdAware and Spybot Search & Destroy compliment each other very well. SpywareBlaster - Great prevention tool to keep nasties from installing on your system. ZonedOut + IE-SpyAd - puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all. Windows Updates - It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there. Google Toolbar - Free google toolbar that allows you to use the powerful Google search engine from the bar, but also blocks pop up windows. Trillian or Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN) ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed. To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Miekiemoes. Best wishes!

The log is clear. How is the computer doing?