[Opa the Openminded]

Something went very wrong. I downloaded ComboFix to my desktop, properly and completely turned off my AntiVirus, and ran ComboFix with no other programs running. ComboFix began ok and I was watching the screen being sure to leave the computer alone and not interfere. Then ComboFix dissapeared from my screen, leading me to think that it had completed, although no log file presented itself afterwards. I walked away from the computer and left it alone for a while (maybe 30 minutes) to be sure that ComboFix had indeed completed, and nothing new had occured, so i then hit alt+ctrl+delete to check the computer's Applications just to double check that ComboFix wasnt still running. It did not show any applications running. I then opened a internet explorer page to return to this site for further directions on locating the missing log. I typed C:\ComboFix.exe into Start>Search to locate the file, and everything froze. Eventually the search turned into a white screen, and i canceled the application. I have not been able to re-open internet explorer since, even after restarting the computer 3 times, and even trying on a different computer user profile. I was able to finally get internet explorer to open by running the computer in safe mode, which I currently am in now. I forgot to mention previously that after the OTS caused my computer to crash, the computer takes much longer loading (several minutes, when it used always load in under a minute) before eventually going to the screen where you choose a user profile. I will leave the computer on in safe mode over night and await your instructions before proceeding.

[Advertisements]

Good Afternoon,

Could you please attempt to run ComboFix in Safe Mode and see if it will run for you there?

[SweetTech]

Good Afternoon,

Could you please attempt to run ComboFix in Safe Mode and see if it will run for you there?

[Opa the Openminded]

I just began running ComboFix and it was going fine and then stopped, alerting me that avast! antivirus real time scanner was still active. I then went into avast! and it showed that all 8 shields were still disabled. I even re-clicked "disable until computer restarts", then hit ok on ComboFix. It is still saying that avast! real time scanner is still active, and is warning me of potential machine damage. Should i perhaps uninstall avast! just to avoid further computer damage, and then re-install it afterwards? The warning is still on my screen, waiting for me to select "OK" as that is the only option, other than clicking the "X" in the top right corner. How should i proceed?

Edited by Opa the Openminded, 27 October 2011 - 04:56 PM.

[SweetTech]

Hi!

Apologizes for not responding sooner. Please proceed with okay your way through those Anti-Virus alerts.

[Opa the Openminded]

No need to appologize, you are providing me a great service at no cost and Im sure you have many other obligations and events. But I am afraid of the warning, because it says that "ComboFix shall continue to run (once I hit OK), but kindly note that this is at your own risk" and if my computer is damaged to the point that i will no longer be able to get online, then I wont have you, or anyone for that matter, to assist me. If it is safer, I wouldnt mind uninstalling avast! for the time being, seeing as ComboFix already cause a crash on my computer. I also do not have sound from my computer any longer after that crash.

[SweetTech]

Okay, no problem. I completely understand where you are coming from. I know that sometimes users do not feel comfortable uninstalling their Anti-Virus program.

But if you'd feel more comfortable uninstalling Avast for the time being, then that's fine.

Please proceed with uninstalling it now, followed by running this removal tool:

avast! Uninstall Utility

Sometimes it's not possible to uninstall avast! the standard way - using the ADD/REMOVE PROGRAMS in control panel. In this case, you can use our uninstallation utility aswClear.

• Download aswClear.exe on to your desktop
• Start Windows in Safe Mode
• Open (execute) the uninstall utility = aswClear.exe
• If you installed avast! in a different folder than the default, browse for it. Note: Be careful! The content of any folder you choose will be deleted!
• Click REMOVE
• Restart your computer

After you run the Avast removal tool and reboot your computer, please boot back up into Safe Mode and re-run ComboFix and allow it to perform a scan on your computer.

[Opa the Openminded]

Hello AgentST and happy Friday!

Ok, the deed is done. Here is the ComboFix log (ComboFix was ran in safe mode), I'll be re-installing avast! now...


ComboFix 11-10-28.04 - Jason 10/28/2011 11:10:53.1.1 - x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.348 [GMT -7:00]
Running from: c:\documents and settings\Jason\Desktop\ComboFix.exe
FW: COMODO Firewall *Enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Jason\Application Data\0200000074305643C.manifest
c:\documents and settings\Jason\Application Data\0200000074305643O.manifest
c:\documents and settings\Jason\Application Data\0200000074305643P.manifest
c:\documents and settings\Jason\Application Data\0200000074305643R.manifest
c:\documents and settings\Jason\Application Data\0200000074305643S.manifest
c:\documents and settings\Jason\WINDOWS
c:\documents and settings\Vicki\WINDOWS
c:\progra~1\AWS\WEATHE~1\MINIbu~1.dll
c:\program files\AWS\WEATHE~1\MINIBU~1.DLL
c:\program files\INSTALL.LOG
c:\program files\iWin Games\iWinGamesHookIE.dll
c:\program files\MyWaySA
c:\windows\help\tours\htmltour\unlock_playing.htm
c:\windows\system32\d3d9caps.dat
c:\windows\system32\iexp_log.txt
c:\windows\SYSTEM32\oqtwa.bak1
c:\windows\SYSTEM32\oqtwa.bak2
c:\windows\system32\Thumbs.db
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_BDGUARD
.
.
((((((((((((((((((((((((( Files Created from 2011-09-28 to 2011-10-28 )))))))))))))))))))))))))))))))
.
.
2011-10-26 06:34 . 2011-10-26 06:34 -------- d-----w- C:\_OTL
2011-10-16 03:31 . 2011-10-16 03:32 -------- d-----w- c:\documents and settings\Jason\Local Settings\Application Data\join.me
2011-10-15 03:34 . 2011-10-15 03:34 -------- d-----w- c:\windows\system32\config\systemprofile\Local Settings\Application Data\Yahoo
2011-10-15 00:00 . 2011-10-25 20:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Comodo
2011-10-14 23:59 . 2011-10-15 00:00 -------- d-----w- c:\program files\COMODO
2011-10-14 23:12 . 2011-10-14 23:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Comodo Downloader
2011-10-08 01:48 . 2011-10-08 01:48 97760 ----a-w- c:\windows\system32\drivers\inspect.sys
2011-10-08 01:48 . 2011-10-08 01:48 492768 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2011-10-08 01:48 . 2011-10-08 01:48 31704 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2011-10-08 01:48 . 2011-10-08 01:48 18056 ----a-w- c:\windows\system32\drivers\cmderd.sys
2011-10-08 01:47 . 2011-10-08 01:47 33984 ----a-w- c:\windows\system32\cmdcsr.dll
2011-10-08 01:47 . 2011-10-08 01:47 300200 ----a-w- c:\windows\system32\guard32.dll
2011-10-04 11:36 . 2011-10-04 11:36 -------- d-----w- c:\documents and settings\Jason\Local Settings\Application Data\DOSBox
2011-10-04 11:01 . 2011-10-28 10:40 -------- d-----w- c:\program files\DOSBox-0.74
2011-09-29 19:59 . 2011-09-29 20:01 -------- d-----w- c:\documents and settings\Jason\Application Data\HpUpdate
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-13 18:53 . 2011-05-20 03:05 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-26 18:41 . 2008-07-30 02:59 611328 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 18:41 . 2004-08-04 11:00 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-26 18:41 . 2004-08-04 11:00 20480 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-09 09:12 . 2004-08-04 11:00 599040 ----a-w- c:\windows\system32\crypt32.dll
2011-09-06 13:20 . 2004-08-04 11:00 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-08-22 23:48 . 2004-08-04 11:00 916480 ----a-w- c:\windows\system32\wininet.dll
2011-08-22 23:48 . 2004-08-04 11:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-08-22 23:48 . 2004-08-04 11:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-08-22 11:56 . 2004-08-04 11:00 385024 ----a-w- c:\windows\system32\html.iec
2011-08-17 13:49 . 2004-08-04 11:00 138496 ----a-w- c:\windows\system32\drivers\afd.sys
2001-11-05 17:30 . 2007-02-18 04:06 165376 -c--a-w- c:\program files\UNWISE.EXE
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 110592]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]
"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-12 290816]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2004-03-13 57393]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2004-03-13 40960]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 57344]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-11-16 127035]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-27 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"COMODO"="c:\program files\COMODO\COMODO GeekBuddy\CLPSLA.exe" [2011-05-26 208184]
"CPA"="c:\program files\COMODO\COMODO GeekBuddy\VALA.exe" [2011-05-26 182584]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-10-08 2497864]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-14 53760]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\SYSTEM32\guard32.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CLPSLS]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WDDMStatus.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WDDMStatus.lnk
backup=c:\windows\pss\WDDMStatus.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WDSmartWare.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WDSmartWare.lnk
backup=c:\windows\pss\WDSmartWare.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Vicki^Start Menu^Programs^Startup^Event Reminder.lnk]
path=c:\documents and settings\Vicki\Start Menu\Programs\Startup\Event Reminder.lnk
backup=c:\windows\pss\Event Reminder.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2011-05-10 09:41 49208 ----a-w- c:\program files\HP\HP Software Update\hpwuschd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-05-30 19:30 292136 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]
2005-08-13 00:16 1121792 -c--a-w- c:\program files\McAfee\SpamKiller\MSKDetct.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)
"iWinTrusted"=2 (0x2)
"Fax"=2 (0x2)
"DSBrokerService"=3 (0x3)
"xmlprov"=3 (0x3)
"SCardSvr"=3 (0x3)
"COMSysApp"=3 (0x3)
"clr_optimization_v2.0.50727_32"=3 (0x3)
"CiSvc"=3 (0x3)
"ALG"=3 (0x3)
"YahooAUService"=2 (0x2)
"WDSmartWareBackgroundService"=2 (0x2)
"WDDMService"=2 (0x2)
"iPod Service"=3 (0x3)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\SYSTEM32\\LEXPPS.EXE"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\HP Software Update\\hpwucli.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Sierra On-Line\\SIGSPat.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:*:Disabled:Blizzard Downloader: 3724
.
R0 sptd;sptd;c:\windows\SYSTEM32\DRIVERS\sptd.sys [7/31/2006 2:42 AM 643072]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\SYSTEM32\DRIVERS\cmdhlp.sys [10/7/2011 6:48 PM 31704]
R2 CLPSLS;COMODO livePCsupport Service;c:\program files\COMODO\COMODO GeekBuddy\CLPSLS.exe [5/25/2011 8:43 PM 154424]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\SYSTEM32\DRIVERS\cmdGuard.sys [10/7/2011 6:48 PM 492768]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\SYSTEM32\DRIVERS\wdcsam.sys [9/28/2010 8:26 PM 11520]
S4 iWinTrusted;iWinTrusted;c:\program files\iWin Games\iWinTrusted.exe [4/14/2010 7:16 AM 78104]
S4 WDDMService;WD SmartWare Drive Manager;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [1/21/2010 4:24 PM 110592]
S4 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [6/16/2009 8:58 AM 20480]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 11:32 128512 ----a-w- c:\windows\SYSTEM32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-28 c:\windows\Tasks\User_Feed_Synchronization-{7EDD6984-8BD9-4A09-96D9-A5B025419E15}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 11:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/?fr=fp-yie8
uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: &AIM Search - c:\program files\AIM Toolbar\AIMBar.dll/aimsearch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{96486288-8BF8-4BB6-8A38-779EB18FC612}: NameServer = 8.26.56.26,156.154.70.22
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-MCAgentExe - c:\progra~1\mcafee.com\agent\mcagent.exe
MSConfigStartUp-MCUpdateExe - c:\progra~1\mcafee.com\agent\McUpdate.exe
MSConfigStartUp-MPFExe - c:\progra~1\McAfee.com\PERSON~1\MpfTray.exe
MSConfigStartUp-MSKAGENTEXE - c:\progra~1\McAfee\SPAMKI~1\MskAgent.exe
MSConfigStartUp-Pareto_Update - c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre1.6.0_05\bin\jusched.exe
MSConfigStartUp-Wwujehokofa - c:\windows\Egijofoceqozuzeq.dll
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-10-28 11:41
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(580)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
.
Completion time: 2011-10-28 11:53:17 - machine was rebooted
ComboFix-quarantined-files.txt 2011-10-28 18:53
.
Pre-Run: 13,622,099,968 bytes free
Post-Run: 13,605,789,696 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 08AE6D0A12D61474B9E03135A2893251

Edited by Opa the Openminded, 28 October 2011 - 04:24 PM.

[Opa the Openminded]

***This message was in regards to an issue I was having with avast! however I already managed to fix this issue by restarting my computer and updating the virus definitions***

Edited by Opa the Openminded, 28 October 2011 - 02:13 PM.

[SweetTech]

Hi!

It looks like ComboFix found some things.

Lets see what these scans find.


Scanning with MalwareBytes' Anti-Malware

Please download Malwarebytes' Anti-Malware (v1.51.0.1200) and save it to your desktop.
Download Link 1
Download Link 2Malwarebytes' may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

• Make sure you are connected to the Internet and double-click on mbam-setup.exe to install the application.
  For instructions with screenshots, please refer to this Guide.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• Malwarebytes will automatically start and you will be asked to update the program before performing a scan.
• If an update is found, the program will automatically update itself. Press the OK button and continue.
• If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

• Under the Scanner tab, make sure the "Perform Quick Scan" option is selected.
• Click on the Scan button.
• When finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box, then click the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked and then click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab.
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows the database version and your operating system.
• Exit Malwarebytes' when done.

Note: If Malwarebytes' encounters a file that is difficult to remove, you will be asked to reboot your computer so it can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally will prevent Malwarebytes' from removing all the malware.



NEXT:



ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
• Click the button.
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the icon on your desktop.
• Check
• Click the button.
• Accept any security warnings from your browser.
• Check
• Make sure that the option "Remove found threats" is Unchecked
• When the Computer scan settings display shows, click the Advanced option, the place a check next to the following (if it is not already checked):
  
  • Enable Anti-Stealth technology
• Push the Start button.
• ESET will then download updates for itself, install itself, and begin
  scanning your computer. Please be patient as this can take some time.
• When the scan completes, push
• Push , and save the file to your desktop using a unique name, such as
  ESETScan. Include the contents of this report in your next reply.
• Push the button.
• Push

NEXT:


Security Check
Download Security Check by screen317 from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

[Opa the Openminded]

Very sorry I was away from home the last 2 days. Super cool ComboFix found some stuff and my computer is kinda back to normal after the crash, although still a bit slower than typical. I'll get right on these next steps!

[Opa the Openminded]

Here is the MalwareBytes Anti Malware Log (I'd like to note that the guide with screen shots said to "Perform Full Scan" however I did follow your instructions by "Performing Quick Scan")






Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8049

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

10/31/2011 3:36:03 AM
mbam-log-2011-10-31 (03-36-03).txt

Scan type: Quick scan
Objects scanned: 242553
Time elapsed: 16 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4D25F926-B9FE-4682-BF72-8AB8210D6D75} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\documents and settings\Vicki\application data\0200000074305643c.manifest (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\Vicki\application data\0200000074305643o.manifest (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\Vicki\application data\0200000074305643p.manifest (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\Vicki\application data\0200000074305643r.manifest (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\Vicki\application data\0200000074305643s.manifest (Malware.Trace) -> Quarantined and deleted successfully.

[Opa the Openminded]

ESETScan Log:



C:\Documents and Settings\Vicki\My Documents\Downloads\RegistryEasy_Setup005.exe a variant of Win32/Adware.RegistryEasy application
C:\Downloads\RiskII-dm[1].exe a variant of Win32/Adware.Trymedia application
C:\I386\GTDownDE_87.ocx probably a variant of Win32/Adware.Agent.LCKGTSG application
C:\Program Files\LimeWire\The Grouch show you the world.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan
C:\Program Files\LimeWire\DIABLO 2 CD-Key + NoCD Patch\diablo2noCD108all\DLoad.exe probably a variant of Win32/Hupigon.GIHWJT trojan
C:\Qoobox\Quarantine\C\PROGRA~1\AWS\WEATHE~1\MINIbu~1.dll.vir Win32/Adware.WBug.A application
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\oqtwa.bak1.vir Win32/Adware.Virtumonde.NEO application
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\oqtwa.bak2.vir Win32/Adware.Virtumonde.NEO application
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP513\A0135090.dll Win32/Adware.WBug.A application
C:\_OTL\MovedFiles\10252011_233424\C_WINDOWS\SYSTEM32\efipepet.ini Win32/Adware.Virtumonde.NEO application
C:\_OTL\MovedFiles\10252011_233424\C_WINDOWS\SYSTEM32\ewulanev.ini Win32/Adware.Virtumonde.NEO application
C:\_OTL\MovedFiles\10252011_233424\C_WINDOWS\SYSTEM32\opinomab.ini Win32/Adware.Virtumonde.NEO application
C:\_OTL\MovedFiles\10252011_233424\C_WINDOWS\SYSTEM32\oqtwa.ini Win32/Adware.Virtumonde.NEO application
C:\_OTL\MovedFiles\10252011_233424\C_WINDOWS\SYSTEM32\oqtwa.ini2 Win32/Adware.Virtumonde.NEO application
C:\_OTL\MovedFiles\10252011_233424\C_WINDOWS\SYSTEM32\owejujud.ini Win32/Adware.Virtumonde.NEO application
C:\_OTL\MovedFiles\10252011_233424\C_WINDOWS\SYSTEM32\ubogopus.ini Win32/Adware.Virtumonde.NEO application
C:\_OTL\MovedFiles\10252011_233424\C_WINDOWS\SYSTEM32\uporiwum.ini Win32/Adware.Virtumonde.NEO application

[SweetTech]

Hi!

Thanks for that information.

Please post the ESET and SecurityCheck logs when you get a free chance.

[Opa the Openminded]

Good Morning Sweet Tech! Just completed the Security Check :] & it seems you just missed it as we were posting at the same time when I added the ESETScan log. Hope you had a good weekend and happy halloween



Results of screen317's Security Check version 0.99.24
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Disabled!
avast! Free Antivirus
ESET Online Scanner v3
COMODO Internet Security
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
Java™ 6 Update 26
Out of date Java installed!
Adobe Flash Player ( 10.1.53.64) Flash Player Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Comodo Firewall cmdagent.exe
Comodo Firewall cfp.exe
AVAST Software Avast AvastSvc.exe
AVAST Software Avast avastUI.exe
``````````End of Log````````````

Edited by Opa the Openminded, 31 October 2011 - 11:40 AM.

[SweetTech]

Yes, it does appear that we were posting at the same time.

I did have a nice weekend, it was a bit hectic, but overall I can't complain.

Hi!

These threat(s) below are currently in Quarantine/System Restore and shall be removed when we clean up our tools later on.

C:\Qoobox\Quarantine\C\PROGRA~1\AWS\WEATHE~1\MINIbu~1.dll.vir Win32/Adware.WBug.A application
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\oqtwa.bak1.vir Win32/Adware.Virtumonde.NEO application
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\oqtwa.bak2.vir Win32/Adware.Virtumonde.NEO application
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP513\A0135090.dll Win32/Adware.WBug.A application
C:\_OTL\MovedFiles\10252011_233424\C_WINDOWS\SYSTEM32\efipepet.ini Win32/Adware.Virtumonde.NEO application
C:\_OTL\MovedFiles\10252011_233424\C_WINDOWS\SYSTEM32\ewulanev.ini Win32/Adware.Virtumonde.NEO application
C:\_OTL\MovedFiles\10252011_233424\C_WINDOWS\SYSTEM32\opinomab.ini Win32/Adware.Virtumonde.NEO application
C:\_OTL\MovedFiles\10252011_233424\C_WINDOWS\SYSTEM32\oqtwa.ini Win32/Adware.Virtumonde.NEO application
C:\_OTL\MovedFiles\10252011_233424\C_WINDOWS\SYSTEM32\oqtwa.ini2 Win32/Adware.Virtumonde.NEO application
C:\_OTL\MovedFiles\10252011_233424\C_WINDOWS\SYSTEM32\owejujud.ini Win32/Adware.Virtumonde.NEO application
C:\_OTL\MovedFiles\10252011_233424\C_WINDOWS\SYSTEM32\ubogopus.ini Win32/Adware.Virtumonde.NEO application
C:\_OTL\MovedFiles\10252011_233424\C_WINDOWS\SYSTEM32\uporiwum.ini Win32/Adware.Virtumonde.NEO application

These threat(s) below will be removed very shortly:

C:\Documents and Settings\Vicki\My Documents\Downloads\RegistryEasy_Setup005.exe a variant of Win32/Adware.RegistryEasy application
C:\Downloads\RiskII-dm[1].exe a variant of Win32/Adware.Trymedia application
C:\I386\GTDownDE_87.ocx probably a variant of Win32/Adware.Agent.LCKGTSG application
C:\Program Files\LimeWire\The Grouch show you the world.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan
C:\Program Files\LimeWire\DIABLO 2 CD-Key + NoCD Patch\diablo2noCD108all\DLoad.exe probably a variant of Win32/Hupigon.GIHWJT trojan

____________________________________________________

From the looks of your SecurityCheck log, I can see that we have some outdated programs that need to be updated.

Lets address those programs that need updating now!

Your SecurityCheck log indicates that your version of Flash Player is outdated. This is a vulnerability that needs to be addressed. Please remove the outdated version of Flash Player and then install the latest version.

Java Outdated

Important Note: Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system.

• Microsoft: ‘Unprecedented Wave of Java Exploitation’
• Drive-by Trojan preying on out-of-date Java installations
• Ghosts of Java Haunt Users

Please follow these steps to remove older version Java components and update:

• Download the latest version of Java Runtime Environment (JRE) Version 7 and save it to your desktop.
• Look for "Java Platform, Standard Edition".
• Click the "Download JRE" button to the right.
• Read the License Agreement, and then check the box that says: "Accept License Agreement".
• From the list, select your OS and Platform:
  
  • 32-bit Select: Windows x86 Offline.
  • 64-bit Select: Windows x64.
• If a download for an Offline Installation is available, it is recommended to choose that and save the file to your desktop.
• Close any programs you may have running - especially your web browser.

Go to > Control Panel, double-click on Add/Remove Programs or Programs and Features in Vista/Windows 7 and remove all older versions of Java.

• Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-7-windows-i586.exe to install the newest version.
• If using Windows 7 or Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
• When the Java Setup - Welcome window opens, click the Install > button.
• If offered to install a Toolbar, just uncheck the box before continuing unless you want it.
• The McAfee Security Scan Plus tool is installed by default unless you uncheck the McAfee installation box when updating Java.

Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications but it's not necessary.
To disable the JQS service if you don't want to use it:

• Go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter.
• Click Ok and reboot your computer.

NEXT



OTL Fix

We need to run an OTL Fix

• Please reopen on your desktop.
• Copy and Paste the following code into the textbox.
  

  :Services
  :OTL
  
  :Reg
  
  :Files
  C:\Documents and Settings\Vicki\My Documents\Downloads\RegistryEasy_Setup005.exe
  C:\Downloads\RiskII-dm[1].exe
  C:\Program Files\LimeWire\The Grouch show you the world.mp3
  C:\Program Files\LimeWire\DIABLO 2 CD-Key + NoCD Patch\
  ipconfig /flushdns /c
  :Commands
  [purity]
  [resethosts]
  [CreateRestorePoint]
  [emptytemp]
  [EMPTYFLASH]
  

• Push
• OTL may ask to reboot the machine. Please do so if asked.
• Click the OK button.
• A report will open. Copy and Paste that report in your next reply.
• If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

NEXT:



OTL Custom Scan

We need to run an OTL Custom Scan

• Please reopen on your desktop.
• Copy and Paste the following code into the textbox.
  
  

  
  netsvcs
  drivers32
  hklm\software\clients\startmenuinternet|command /rs
  %USERPROFILE%\AppData\Local\Google\Chrome\User Data\*.* /s
  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
  

• Push the button.
• A report will open. Copy and Paste that report in your next reply.

NEXT:



What outstanding issues (if any) are you still experiencing with your computer?