[Resolved] Computer is running slow and locking up.

Hello there, Gordon22



I'm Conspire, I'll be glad to help you with your computer problems.

Please observe these rules while we work:

• Read the entire procedure
• It is important to perform ALL actions in sequence.
• If you don't know, stop and ask! Don't keep going on.
• Please reply to this thread. Do not start a new topic.
• Stick with me till you're given the all clear.
• Remember, absence of symptoms does not mean the infection is all gone.
• Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process.

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.
This may cause a delay, but I will do my best to keep it as short as possible.

Please bear with me, I will post back to you as soon as I can.

IMPORTANT NOTE : Please do not delete anything unless instructed to.

Nice to meet you. Thank you for coming to my aid. I will do everything that you say.

Hi,

I noticed that you have just installed MBAM and I would like to know if you have run the scan already? If so, please post that log as well.

The log can be found here:

• Open MBAM and click on the Logs tab
• Click on the most recent log
• Click Open

Copy and paste the contents of the log into your next reply.

===================================================

In the mean time,

Please download DDS by sUBs from one of the following links and save it to your desktop.

• • DDS.scr
  • DDS.pif
• Disable any script blocking protection (How to Disable your Security Programs)
• Double click DDS icon to run the tool (may take up to 3 minutes to run)
• When done, DDS.txt will open.
• After a few moments, attach.txt will open in a second window.
• Save both reports to your desktop.

—————————————————

• Post the contents of the DDS.txt report in your next reply
• Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

===================================================

Please download RootRepeal to your desktop

• Physically disconnect your machine from the internet as your system will be unprotected.
• Unzip it to it's own folder, close all other programs especially your security programs (anti-spyware, anti-virus, and firewall) and run RootRepeal.exe
• Click the Report tab at the bottom and then the Scan button.
• A box will pop up, check the boxes beside Drivers, Files, Processes SSDT and click OK.
• Another box will open, check the boxes beside all the drives, eg : C:\, then click OK.
• The scan will take a little while to run, so let it go unhindered.
• Once it is done, click the Save Report button, call it RepealScan and save the log to your desktop.
• Reconnect to the internet.
• Post the log here in your reply.

===================================================

On your next reply please post :
DDS log
RootRepeal log
MBAM log (if any)


Good Day!

The rootrepeal scan worked. Here is the log. ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2010/01/13 13:07 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== Drivers ——————- Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xA5C08000 Size: 49152 File Visible: No Signed: - Status: - Hidden/Locked Files ——————- Path: Volume C:\ Status: MBR Rootkit Detected! Path: C:\hiberfil.sys Status: Locked to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9716f7101d40.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9716f8111480.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9716f8431c0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9716f8b2af0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9716f8f8c0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9717e2e123d80.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9719b971960.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d982123a2a4e0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d982161c1f9c0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e00132130.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e00182ee0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e001e00.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e0023cb0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e00281960.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e002d2fd0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e00323d80.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e00331c0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e0038da0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e00900.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e00e1480.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e0101134b0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e010175d0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d17333737a0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d17341033c0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1734167d0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173416d0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d17341b1c50.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1734202bf0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1734253a90.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d17342b9c0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1734301770.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1734301771.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d17343529f0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d17343b5d0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173461670.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1734b2420.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1735141380.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d17351e32c0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1735241f0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1735291190.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d17352e2030.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d17352e2130.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d17353334b0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173539da0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173541e40.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1735932c0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1735f4e0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1736121570.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1736172420.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d17361c31c0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1736222e0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173622320.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1736271090.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1736312ce0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1736363c80.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1736737a0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1736d7d0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d17370bb0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1737154e0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d17371a1280.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d17371f2220.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1737242fd0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d17372a2e0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d17372f1190.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1737342130.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d17373932c0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173751860.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1737a2710.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1737f35b0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1738173b90.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d17381dab0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1738221960.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1738272610.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d17382c33c0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1738323e0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173832e0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1738371090.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d17388fa0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1738d1d40.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173901e40.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173910ea0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1739151c50.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d17391a29f0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d17391f36b0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173925da0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d17392f2900.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d17393438a0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d17393a7d0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173952fd0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d1739a3b90.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173a137d0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173a181570.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173a1d2420.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173a2231c0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173a285d0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173a2d1380.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173a31480.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173a322130.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173a372fd0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173a829f0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173ad3990.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173b03d80.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173b102de0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173b153d80.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173b1bbb0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173b201860.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173b252610.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173b2a37a0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173b306d0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173b351570.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173b3a2220.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173b6ea0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1d173bb2030.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1f00121b50.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1f00172800.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1f001c35b0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1f00223e0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1f0022ee0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1f0027fa0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1f002c2030.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1f00312de0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1f00363c80.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1f0073d80.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1f00dda0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1f010034b0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1f010102220.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1f010102221.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1f0101538a0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e011acb0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e011b2bf0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e011f1a50.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e01203b90.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e012121190.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e012171f40.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e0121c2bf0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e012213990.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e01222030.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e012279c0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e0122c1770.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e012312710.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e0123633c0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e0126ab0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e01272de0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e012b1770.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e023833c0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e023e1f0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e02403d80.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e024102bf0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e0241480.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e024153a90.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e0241b9c0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e024201770.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e024252610.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e0242a3990.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e024308c0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e024351570.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e0243a2320.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e0246bb0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e024b1f40.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e025131e40.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e025182af0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e0251d37a0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e025236d0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e025281480.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e0252d2220.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e025322fd0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e025331c0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e025385d0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e041e32c0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e04244e0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e04291480.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e042e2130.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e04332ee0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e04383d80.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e0442af0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e04937a0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e04f6d0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e051134b0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e05174e0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e051c1280.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e05212420.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e052632c0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e052c1f0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e052cb0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e05362220.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e05362320.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e053b35b0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e0571a50.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e05c2710.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e06154e0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e061a1380.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e061f2220.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e06242ee0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e062af0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e062fea0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e06341d40.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e06392bf0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e065cb0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e06a2420.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e06f35b0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e071736b0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e071d5d0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e07221280.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e07238a0.bup Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Cache\7d9c1e07272030.bup Status: Invisible to the Windows API!S==EOF==

Hi,

You are infected with a password stealer.

We recommend, you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or it if it contains any other sensitive information, please get to a known clean computer and change all passwords where applicable, Pin numbers, credit card numbers, account numbers, etc. should all be changed immediately, and it would be wise to contact those same financial institutions to advise them of your situation. This infection that you have will attract others, keep it offline except when we are troubleshooting.

Trojans attempt to steal passwords, as well as logging keypresses and open a window periodically sends the collected information. Even if we clean the malware off your system, We can't guarantee that your system will be clean afterwards. Also, we cannot guarantee to repair all the damage it caused.

Should you have decided to do a re-format of your system or wish to continue, please let me know.

Please read this :
How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud

When should I re-format? How should I reinstall

===================================================

Please read through these instructions to familarize yourself with what to expect when this tool runs


Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
  
• Double click on ComboFix.exe & follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

===================================================

On your next reply please post :
ComboFix log


Good Day!

I cannot save ComboFix to my computer. Says I cannot read the source file. VOID.

Hi,

How to disable McAfee:

• Please open McAfee Security Centre
• Under Common Tasks click on Home
• Click Computer Files
• Click Configure
• Make sure the following are disabled by ticking the "Off" button.
  

  Virus protection
  Spyware protection
  System Guards Protection
  Script Scanning Protection (you may have to scroll down to see it)

• Next, select never for "When to re-enable real time scanning"
• and click OK.

===================================================

Please follow all previous instructions regarding security programs.

Open a new Notepad session

• Click the Start button, click run
• in the run box type notepad
• click ok
• In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  
• Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

File::
c:\windows\system32\drivers\OLD4798.tmp
c:\windows\system32\drivers\OLD4775.tmp
c:\windows\system32\drivers\OLD46E3.tmp
c:\windows\system32\drivers\OLD4642.tmp
c:\windows\system32\drivers\OLD45C4.tmp
c:\windows\system32\drivers\OLD44F6.tmp
c:\windows\system32\drivers\OLD449E.tmp
c:\windows\system32\drivers\OLD449B.tmp
c:\windows\system32\drivers\OLD4498.tmp
c:\windows\system32\drivers\OLD4491.tmp
c:\windows\system32\drivers\OLD4453.tmp
c:\windows\system32\drivers\OLD442E.tmp
c:\windows\system32\drivers\OLD43BC.tmp
c:\windows\system32\drivers\OLD43AD.tmp
c:\windows\system32\drivers\OLD43AA.tmp
c:\windows\system32\drivers\OLD43A7.tmp
c:\windows\system32\drivers\OLD437C.tmp
c:\windows\system32\drivers\OLD4379.tmp
c:\windows\system32\drivers\OLD4376.tmp
c:\windows\system32\drivers\OLD436E.tmp
c:\windows\system32\drivers\OLD4357.tmp
c:\windows\system32\drivers\OLD4321.tmp
c:\windows\system32\drivers\OLD431C.tmp
c:\windows\system32\drivers\OLD430B.tmp
c:\windows\system32\drivers\OLD42CE.tmp
c:\windows\system32\drivers\OLD42CB.tmp
c:\windows\system32\drivers\OLD42C0.tmp
c:\windows\system32\drivers\OLD42BD.tmp
c:\windows\system32\drivers\OLD427F.tmp
c:\windows\system32\drivers\OLD425E.tmp
c:\windows\system32\drivers\OLD417D.tmp
c:\windows\system32\drivers\OLD415C.tmp
c:\windows\system32\drivers\OLD407D.tmp
c:\windows\system32\drivers\OLD3FE6.tmp
c:\windows\system32\drivers\OLD3F19.tmp
c:\windows\system32\drivers\OLD3EE4.tmp
c:\windows\system32\drivers\OLD3EE1.tmp
c:\windows\system32\drivers\OLD3DB0.tmp
c:\windows\system32\drivers\OLD3D2B.tmp
c:\windows\system32\drivers\OLD3CD5.tmp
c:\windows\system32\drivers\OLD3CD1.tmp
c:\windows\system32\drivers\OLD3C32.tmp
c:\windows\system32\drivers\OLD3C01.tmp
c:\windows\system32\drivers\OLD3BFE.tmp

In the notepad

• Click File, Save as…, and set the Save in to your Desktop
• In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
• Click save

Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

===================================================

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

• Click NO
• In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
• Now click the Scan button.
  Once the scan is complete, you may receive another notice about rootkit activity.
• Click OK.
• GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
• Save it where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.

===================================================

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  

  *atapi*

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

===================================================

On your next reply please post :
ComboFix log
GMER log
SystemLook log
How is your computer behaving?


Good Day!

Hi,

How to disable McAfee:

• Please open McAfee Security Centre
• Under Common Tasks click on Home
• Click Computer Files
• Click Configure
• Make sure the following are disabled by ticking the "Off" button.
  

  Virus protection
  Spyware protection
  System Guards Protection
  Script Scanning Protection (you may have to scroll down to see it)

• Next, select never for "When to re-enable real time scanning"
• and click OK.

===================================================

Please follow all previous instructions regarding security programs.

Open a new Notepad session

• Click the Start button, click run
• in the run box type notepad
• click ok
• In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  
• Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

File::
c:\windows\system32\drivers\OLD4798.tmp
c:\windows\system32\drivers\OLD4775.tmp
c:\windows\system32\drivers\OLD46E3.tmp
c:\windows\system32\drivers\OLD4642.tmp
c:\windows\system32\drivers\OLD45C4.tmp
c:\windows\system32\drivers\OLD44F6.tmp
c:\windows\system32\drivers\OLD449E.tmp
c:\windows\system32\drivers\OLD449B.tmp
c:\windows\system32\drivers\OLD4498.tmp
c:\windows\system32\drivers\OLD4491.tmp
c:\windows\system32\drivers\OLD4453.tmp
c:\windows\system32\drivers\OLD442E.tmp
c:\windows\system32\drivers\OLD43BC.tmp
c:\windows\system32\drivers\OLD43AD.tmp
c:\windows\system32\drivers\OLD43AA.tmp
c:\windows\system32\drivers\OLD43A7.tmp
c:\windows\system32\drivers\OLD437C.tmp
c:\windows\system32\drivers\OLD4379.tmp
c:\windows\system32\drivers\OLD4376.tmp
c:\windows\system32\drivers\OLD436E.tmp
c:\windows\system32\drivers\OLD4357.tmp
c:\windows\system32\drivers\OLD4321.tmp
c:\windows\system32\drivers\OLD431C.tmp
c:\windows\system32\drivers\OLD430B.tmp
c:\windows\system32\drivers\OLD42CE.tmp
c:\windows\system32\drivers\OLD42CB.tmp
c:\windows\system32\drivers\OLD42C0.tmp
c:\windows\system32\drivers\OLD42BD.tmp
c:\windows\system32\drivers\OLD427F.tmp
c:\windows\system32\drivers\OLD425E.tmp
c:\windows\system32\drivers\OLD417D.tmp
c:\windows\system32\drivers\OLD415C.tmp
c:\windows\system32\drivers\OLD407D.tmp
c:\windows\system32\drivers\OLD3FE6.tmp
c:\windows\system32\drivers\OLD3F19.tmp
c:\windows\system32\drivers\OLD3EE4.tmp
c:\windows\system32\drivers\OLD3EE1.tmp
c:\windows\system32\drivers\OLD3DB0.tmp
c:\windows\system32\drivers\OLD3D2B.tmp
c:\windows\system32\drivers\OLD3CD5.tmp
c:\windows\system32\drivers\OLD3CD1.tmp
c:\windows\system32\drivers\OLD3C32.tmp
c:\windows\system32\drivers\OLD3C01.tmp
c:\windows\system32\drivers\OLD3BFE.tmp

In the notepad

• Click File, Save as…, and set the Save in to your Desktop
• In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
• Click save

Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

===================================================

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

• Click NO
• In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
• Now click the Scan button.
  Once the scan is complete, you may receive another notice about rootkit activity.
• Click OK.
• GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
• Save it where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.

===================================================

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  

  *atapi*

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

===================================================

On your next reply please post :
ComboFix log
GMER log
SystemLook log
How is your computer behaving?


Good Day!

SystemLook v1.0 by jpshortstuff (11.01.10) Log created at 02:53 on 17/01/2010 by G-Man (Administrator - Elevation successful) No Context: *atapi* -=End Of File=- SystemLook v1.0 by jpshortstuff (11.01.10) Log created at 02:53 on 17/01/2010 by G-Man (Administrator - Elevation successful) No Context: atapi -=End Of File=- My computer is running much better now. It is not freezing up all the time and is running much faster as well.

I am not able to run Gmer rootit, it either freezes after it finishes, restarts my computer, or shows a blue screen saying i have some kind of error. I am not sure what to do with it, and with the systemlook, it did nothing.

Hi,

I see that you have two AVs running in your system. How long have you been subscribing to McAfee? It is recommended that you leave only one AV installed on your computer as two AVs will likely to cause more problem than actually offering double protection. You may want to consider removing Microsoft Security Essentials if your subscription has long way to go before expiry.

As for the GMER, please make sure that you have disabled both antivirus and TeaTimer. Then, try to run GMER again and see what happens.

Disabling TeaTimer

While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.

• Run Spybot-S&D in Advanced Mode.
• If it is not already set to do this Go to the Mode menu select "Advanced Mode"
• On the left hand side, Click on Tools
• Then click on the Resident Icon in the List
• Uncheck "Resident TeaTimer" and click OK any prompts.
• Restart your computer.

===================================================

Please run SystemLook again as there was a slight mistake in the script.

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  

  :filefind
  *atapi*

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

===================================================

You have ( Limewire and Vuze ), a P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.

References for the risk of these programs can be found in these links:
http://www.microsoft.com/windows/ie/commun…protection.mspx
http://www.internetworldstats.com/articles…cles/art053.htm


I would recommend that you uninstall it, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.

===================================================

On your next reply please post :
GMER log
SystemLook log


Good Day!