[azarl]

OK,

• Click Start > Run and type cmd {enter}
• Type SFC /scannow (Note the space between the c and the /)
• You may need your Windows XP CD so have it ready.
  If you have Service Pack 2 (SP2) or SP3 installed, you will need the SP2 or SP3 version of the version of the CD.
• Allow the scan to run and when completed, reboot the system.

[Advertisements]

Well, I have other computers here in the office and one recently installed has a Dell Reinstallation CD for XP Pro SP3. However, the Scannow application says it is the wrong OS (even though they are both SP3). Thoughts?

[beerman]

Well, I have other computers here in the office and one recently installed has a Dell Reinstallation CD for XP Pro SP3. However, the Scannow application says it is the wrong OS (even though they are both SP3). Thoughts?

[azarl]

Can you have a look on the CDs and see if they have an i386 directory please

[beerman]

It does.

[azarl]

• Create a directory on your hard disk c:\temp
• Click on start > run and type cmd
• In the command window type expand d:\i386\explorer.ex_ c:\temp\explorer.exe and press enter (change d:\ to your CD drive letter)
• then type expand d:\i386\winlogon.ex_ c:\temp\winlogon.exe and press enter
  
  You can copy the above commands and right-click in the command window and select paste if that is easier
  
• Confirm that explorer.exe and winlogon.exe have copied to c:\temp

• Double-click SystemLook.exe to run it again.
• Copy the content of the following codebox into the main textfield:
  
  

  :filefind
  winlogon.exe
  explorer.exe
  

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

[beerman]

Here you go.

SystemLook 04.09.10 by jpshortstuff
Log created at 14:47 on 15/12/2010 by Ntaylor
Administrator - Elevation successful

========== filefind ==========

Searching for "winlogon.exe"
C:\temp\winlogon.exe --a---- 507904 bytes [19:46 15/12/2010] [10:42 14/04/2008] ED0EF0A136DEC83DF69F04118870003E
C:\WINDOWS\system32\winlogon.exe ------- 507904 bytes [07:00 14/04/2008] [13:05 09/12/2010] B0FE1EAE4241EDDD570A11DA07BBF8DF
C:\WINDOWS\system32\dllcache\winlogon.exe --a---- 507904 bytes [07:00 14/04/2008] [22:14 08/12/2010] B0FE1EAE4241EDDD570A11DA07BBF8DF

Searching for "explorer.exe"
C:\temp\explorer.exe --a---- 1033728 bytes [19:45 15/12/2010] [10:42 14/04/2008] 12896823FB95BFB3DC9B46BCAEDC9923
C:\WINDOWS\explorer.exe ------- 1033728 bytes [07:00 14/04/2008] [13:04 09/12/2010] 1E03E6742698717733E480B36569EFF2
C:\WINDOWS\system32\dllcache\explorer.exe --a---- 1033728 bytes [07:00 14/04/2008] [22:14 08/12/2010] 1E03E6742698717733E480B36569EFF2

-= EOF =-

[azarl]

ComboFix Script

• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
• Open notepad and copy/paste the text in the quotebox below into it:

FCopy::
C:\temp\winlogon.exe | C:\WINDOWS\system32\winlogon.exe
C:\temp\winlogon.exe | C:\WINDOWS\system32\dllcache\winlogon.exe
C:\temp\explorer.exe | C:\WINDOWS\explorer.exe
C:\temp\explorer.exe | C:\WINDOWS\system32\dllcache\explorer.exe

Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it will produce a log for you at C:\ComboFix.txt which I need you to include in your next reply.

[beerman]

Thanks again.


ComboFix 10-12-14.07 - Ntaylor 12/15/2010 15:35:41.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1480 [GMT -5:00]
Running from: c:\documents and settings\ntaylor\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\ntaylor\Desktop\CFScript.txt
AV: Symantec AntiVirus Corporate Edition *Disabled/Updated* {FB06448E-52B8-493A-90F3-E43226D3305C}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
--------------- FCopy ---------------

c:\temp\winlogon.exe --> c:\windows\system32\winlogon.exe
c:\temp\winlogon.exe --> c:\windows\system32\dllcache\winlogon.exe
c:\temp\explorer.exe --> c:\windows\explorer.exe
c:\temp\explorer.exe --> c:\windows\system32\dllcache\explorer.exe
.
((((((((((((((((((((((((( Files Created from 2010-11-15 to 2010-12-15 )))))))))))))))))))))))))))))))
.

2010-12-15 19:43 . 2010-12-15 19:46 -------- d-----w- C:\temp
2010-12-15 08:01 . 2010-12-15 08:01 -------- d-sh--w- c:\documents and settings\Default User\IETldCache
2010-12-14 17:36 . 2010-12-15 14:07 0 ----a-w- c:\windows\Abugu.bin
2010-12-14 16:30 . 2010-12-14 16:30 -------- d-----w- C:\_OTL
2010-12-13 17:53 . 2010-12-13 17:53 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Temp
2010-12-09 15:33 . 2010-08-17 13:17 58880 -c--a-w- c:\windows\system32\dllcache\spoolsv.exe
2010-12-09 15:33 . 2010-08-17 13:17 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-12-09 15:27 . 2010-12-09 15:27 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE
2010-12-09 15:27 . 2010-12-09 15:27 -------- d-sh--w- c:\documents and settings\LocalService\IECompatCache
2010-12-08 22:12 . 2006-05-05 21:19 87808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2010-12-08 22:12 . 2006-05-05 21:19 107696 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2010-12-08 22:11 . 2010-12-15 20:31 -------- d-----w- c:\program files\Symantec AntiVirus
2010-12-08 22:10 . 2010-12-08 22:10 -------- d--h--w- c:\windows\PIF
2010-12-08 22:00 . 2010-12-08 22:00 -------- d-----w- c:\documents and settings\administrator\Local Settings\Application Data\Adobe
2010-12-08 21:59 . 2010-12-08 21:59 -------- d-----w- c:\documents and settings\administrator\Local Settings\Application Data\Symantec
2010-11-30 13:43 . 2010-11-30 13:43 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-11-30 13:43 . 2010-11-30 13:43 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp
2010-11-23 16:39 . 2009-07-20 19:39 339456 ----a-w- c:\windows\system32\drivers\ADIHdAud.sys
2010-11-23 16:39 . 2008-01-16 21:50 31232 ----a-w- c:\windows\system32\PostProc.dll
2010-11-22 17:55 . 2010-11-22 17:55 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-11-17 17:28 . 2010-12-10 14:05 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-11-17 17:28 . 2010-12-10 14:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-18 18:12 . 2010-02-05 01:06 81920 ----a-w- c:\windows\system32\isign32.dll
2010-11-06 00:26 . 2008-04-14 07:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-11-06 00:26 . 2008-04-14 07:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-11-06 00:26 . 2008-04-14 07:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-11-03 12:25 . 2008-04-14 07:00 385024 ----a-w- c:\windows\system32\html.iec
2010-11-02 15:17 . 2008-04-14 07:00 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys
2010-10-28 13:13 . 2008-04-14 07:00 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-10-26 13:25 . 2008-04-14 07:00 1853312 ----a-w- c:\windows\system32\win32k.sys
2010-10-14 15:24 . 2010-02-05 18:47 1925120 ----a-w- c:\windows\system32\cdintf250.dll
2010-09-18 16:23 . 2008-04-14 07:00 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2008-04-14 07:00 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2008-04-14 07:00 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2008-04-14 07:00 953856 ----a-w- c:\windows\system32\mfc40u.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-12-15_14.55.50 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-12-15 18:43 . 2003-03-24 21:52 49212 c:\windows\LastGood\system32\dllcache\fp4awebs.dll
+ 2010-12-15 18:43 . 2003-03-24 21:52 32826 c:\windows\LastGood\system32\dllcache\fp4avss.dll
+ 2010-12-15 18:43 . 2003-03-24 21:52 41020 c:\windows\LastGood\system32\dllcache\fp4avnb.dll
+ 2010-12-15 18:43 . 2003-03-24 21:52 49210 c:\windows\LastGood\system32\dllcache\fp4areg.dll
+ 2010-12-15 18:43 . 2003-03-24 21:52 82035 c:\windows\LastGood\system32\dllcache\fp4anscp.dll
+ 2010-12-15 18:43 . 2008-04-14 07:00 46592 c:\windows\LastGood\system32\dllcache\coadmin.dll
+ 2010-12-15 18:43 . 2003-03-24 21:52 16439 c:\windows\LastGood\system32\dllcache\author.exe
+ 2010-12-15 18:43 . 2003-03-24 21:52 20540 c:\windows\LastGood\system32\dllcache\author.dll
+ 2010-12-15 18:43 . 2008-04-14 07:00 43520 c:\windows\LastGood\system32\dllcache\admwprox.dll
+ 2010-12-15 18:43 . 2003-03-24 21:52 16439 c:\windows\LastGood\system32\dllcache\admin.exe
+ 2010-12-15 18:43 . 2003-03-24 21:52 20540 c:\windows\LastGood\system32\dllcache\admin.dll
+ 2010-12-15 18:43 . 2004-05-13 05:39 876653 c:\windows\LastGood\system32\dllcache\fp4awel.dll
+ 2010-12-15 18:43 . 2003-03-24 21:52 102509 c:\windows\LastGood\system32\dllcache\fp4atxt.dll
+ 2010-12-15 18:43 . 2003-03-24 21:52 147513 c:\windows\LastGood\system32\dllcache\fp4apws.dll
+ 2010-12-15 18:43 . 2004-05-13 05:39 184435 c:\windows\LastGood\system32\dllcache\fp4amsft.dll
+ 2010-12-15 18:43 . 2003-03-24 21:52 188480 c:\windows\LastGood\system32\dllcache\cfgwiz.exe
+ 2010-12-15 18:43 . 2008-04-14 07:00 290816 c:\windows\LastGood\system32\dllcache\adsiis51.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-10-15 623992]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-07-13 149280]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-09-27 13918208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-09-27 86016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-10 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2009-08-03 1044480]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-03-24 53408]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-06-15 124656]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

R2 File Backup;File Backup Service;c:\program files\Starfield\offSyncService.exe [1/17/2010 6:39 PM 1310448]
R2 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [6/15/2006 1:40 AM 115952]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [12/8/2010 10:20 PM 102448]
S0 cerc6;cerc6; [x]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/1/2010 8:54 AM 136176]
.
Contents of the 'Scheduled Tasks' folder

2010-12-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-01 13:54]

2010-12-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-01 13:54]
.
.
------- Supplementary Scan -------
.
uStart Page = https://rllogin.wal-.../&ct_orig_uri=/
uInternet Connection Wizard,ShellNext = https://rllogin.wal-.../&ct_orig_uri=/
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
DPF: {1EFDA478-664E-41A6-8C2F-852344CC7F64} - hxxps://cnc.mcbcnet.com/cnc/CNCPrintAttachment.ocx
FF - ProfilePath - c:\documents and settings\ntaylor\Application Data\Mozilla\Firefox\Profiles\vhvwipfr.default\
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: [email protected] - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-15 15:39
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3504)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2010-12-15 15:41:07
ComboFix-quarantined-files.txt 2010-12-15 20:41
ComboFix2.txt 2010-12-15 14:57

Pre-Run: 106,025,201,664 bytes free
Post-Run: 106,061,340,672 bytes free

- - End Of File - - 7F09ED832D2EF8072A86701BD3534F9B

[azarl]

Looking good.

» Step 1 «
Clear Cache/Temp Files
Download TFC by OldTimer to your desktop

• Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
• It will close all programs when run, so make sure you have saved all your work before you begin.
• Click the Start button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. Let it run uninterrupted to completion.
• Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.

» Step 2 «
Malwarebytes' Anti-Malware
Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy & Paste the entire report in your next reply.

If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

» Step 3 «
Kaspersky WebScanner
Please do an online scan with Kaspersky WebScanner

Kaspersky online scanner uses JAVA technology to perform the scan. If you do not have the latest JAVA version, follow the instructions below under Upgrading Java, to download and install the latest vision.

Upgrading Java

• Download the latest version of Java Runtime Environment (JRE) 6 Update 22.
• Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
• Click the "Download" button to the right.
• Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
• Click on Continue.
• Click on the link to download Windows Offline Installation (jre-6u21-windows-i586-p.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java version.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u21-windows-i586-p.exe and select "Run as an Administrator.")

Running Kaspersky WebScanner

• Read through the requirements and privacy statement and click on Accept button.
• It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
• When the downloads have finished, click on Settings.
• Make sure the following is checked.
  
  • Spyware, Adware, Diallers, and other potentially dangerous programs
    Archives
    Mail databases
• Click on My Computer under Scan.
• Once the scan is complete, it will display the results. Click on View Scan Report.
• You will see a list of infected items there. Click on Save Report As....
• Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
• Please post this log in your next reply.

[beerman]

Glad to know it is going well. The computer seems to be operating more quickly.

Problem with Kaspersky online scan. I keep getting an error that it requires a constant internet connection. I don't know why it is doing that. Anyway, here is the MBAM log:

Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Database version: 5323

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12/15/2010 4:35:00 PM
mbam-log-2010-12-15 (16-35-00).txt

Scan type: Quick scan
Objects scanned: 150125
Time elapsed: 3 minute(s), 32 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\temp\explorer.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
c:\temp\winlogon.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

[azarl]

Kaspersky can be tempremental. Try the ESET scanner

ESET Scanner
Please run a free online scan with the ESET Online Scanner
Note: Use Internet Explorer for this scan. (If you need to use Firefox or Opera, click on the download icon to download the ESET Installer and save to your desktop. When the download is complete double-click on the icon on the desktop.)

• Tick the box next to YES, I accept the Terms of Use
• Click Start
• When asked, allow the ActiveX control to install
• Click Start
• Make sure that the options Remove found threats and the option Scan unwanted applications is checked
• Click Scan (This scan can take several hours, so please be patient)
• Once the scan is completed, you may close the window
• Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
• Copy and paste that log as a reply to this topic

[azarl]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.