Start Up Problem

Open Hijackthis and select Do a system scan only

Place a check against the following entries

O4 - S-1-5-21-3208327182-2709425978-4292038597-1005 Startup: wpbt0.dll.lnk = C:\Windows\System32\rundll32.exe (User 'Ultimo Lee')
O4 - S-1-5-21-3208327182-2709425978-4292038597-1005 User Startup: wpbt0.dll.lnk = C:\Windows\System32\rundll32.exe (User 'Ultimo Lee')
O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)
O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)


Close all open windows except Hijackthis and click Fix checked.Close Hijackthis.Reboot the computer.









Did you run malwarebytes as asked? Post the log please.

Hijackthis stuff is done and there was no pop up when i logged back in.

Wondering if i need to update my MBAM from the links provided. I opened MBAM, went to update but the "Check for Updates" wasn't available to click plus my version is nearly 2 years old

[external image: Posted Image]

You will need to uninstall malwarebytes and download the new version as it is so old.

Forgot to mention, after restarting after Hijackthis a file marked "backups" appeared on my desktop

[external image: Posted Image]

Is this ok to delete?








MBAM Scan: there was no "Show Results icon" just said "No malicious items detected" and this log popped up


Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Database version: v2012.01.17.04

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.19170
:: HOME-PC [administrator]

17/01/2012 22:14:24
mbam-log-2012-01-17 (22-14-24).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 236434
Time elapsed: 14 minute(s), 41 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

Leave that file for now,we will remove everything when we are done,hopefully this scan will be the last one.


ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
• Click the [external image: Posted Image] button.
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the [external image: Posted Image] icon on your desktop.
• Check [external image: Posted Image]
• Click the Start button.
• Accept any security warnings from your browser.
• Check [external image: Posted Image]
• Make sure that the option "Remove found threats" is checked
• Push the Start button.
• ESET will then download updates for itself, install itself, and begin
  scanning your computer. Please be patient as this can take some time.
• When the scan completes, push [external image: Posted Image]
• Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
  ESETScan. Include the contents of this report in your next reply.
• Push the Back button.
• Push Finish

———-

Post the log,



Also tell me how the computer is running now.

It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.[

Does this mean COMODO, Windows, MBAM and i also have something called spyware blaster

Just disable comodo,I'm off now so just try and post the log when it is finished and i will have a look tomorrow.

This came up during installation

[external image: Posted Image]

The check was unticked, i ticked it but still just got this message

Check to make sure your proxy server settings are correct in IE and Firefox then try again.

IE

Click "Tools", then click "Internet Options". This will bring up the Internet Options window.

Click the "Connections" tab, then click the "LAN Settings" button.

Uncheck the box labeled "Use a proxy server for your LAN". Click "OK", and click "OK" in the previous window. This will remove the proxy server settings in Internet Explorer.

Firefox (Windows)

Click "Tools", then click "Options" to bring up the Options window.

Click the "Advanced" button, then click the "Network" tab.

Click the "Settings" button, located next to "Configure how Firefox connects to the Internet".


Click the radio button labeled "No proxy". Click "OK" twice. This will remove the proxy server settings in Firefox





If still no go try the f secure online scan instead http://www.f-secure.com/en/web/labs_global…/online-scanner

Sorted the proxy settings and it looked to have worked but then it again said "can not update. is proxy configured" So i used f-secure. Shouldn't MBAM have picked these infections up? and how can i provent these in future? Scanning Report Wednesday, January 18, 2012 23:26:06 - 23:31:04 Computer name: HOME-PC Scanning type: Quick scan Target: System 11 malware found TrackingCookie.2o7 (spyware) System (Disinfected) TrackingCookie.Atdmt (spyware) System (Disinfected) TrackingCookie.Adtech (spyware) System (Disinfected) TrackingCookie.Doubleclick (spyware) System (Disinfected) TrackingCookie.Revsci (spyware) System (Disinfected) TrackingCookie.Adrevolver (spyware) System (Disinfected) TrackingCookie.Mookie (spyware) System (Disinfected) TrackingCookie.Adbrite (spyware) System (Disinfected) TrackingCookie.Webtrends (spyware) System (Disinfected) TrackingCookie.Mediaplex (spyware) System (Disinfected) TrackingCookie.Yieldmanager (spyware) System (Disinfected) Statistics Scanned: Files: 3776 System: 3776 Not scanned: 0 Actions: Disinfected: 11 Renamed: 0 Deleted: 0 Not cleaned: 0

ESET is funny like that sometimes don't really know why. We run a few different scans because some look for things others do not. Any more problems? If not we will clean up the tools we have used and then we are done here.

Should i start clearing cookies more often? maybe with ATF Cleaner?

I've also been having a problem with windows updates, i posted a thread here awhile ago

http://forums.whatthetech.com/index.php?sh…=120570&hl=

Not sure if you can help me with that.

Is it ok to delete the backups file that appeared on my desktop?

EDIT: Also COMODO keeps asking me nearly everyday to update, is this normal?

COMODO popped up to ask if it should block or allow something again, i blocked then this popped up

[external image: Posted Image]

I logged off and logged in again and it popped up again

Should i start clearing cookies more often? maybe with ATF Cleaner?

Always a good idea.

I've also been having a problem with windows updates, i posted a thread here awhile ago

Post a new thread in the windows forum when we are done here.

Is it ok to delete the backups file that appeared on my desktop?

Leave until we are finished

EDIT: Also COMODO keeps asking me nearly everyday to update, is this normal?

Yes




Delete the copy of combofix you have and download a fresh copy from the links below,run it and post the new log.


Link 1
Link 2

Apologies for the delay, it's been a busy couple of days.

Had a problem with Combofix, part way through extract this popped up.

[external image: Posted Image]

I aborted and tried to open Firefox to come and post here but i had no response from from the firefox icon. I logged out and logged back in again to try and redo Combofix, i forgot to exit COMODO this time and A quarantine notice from COMODO came up for

NirCmd.3XE

I thought best to quarantine it and carried on with Combofix but the same notice in the above picture appeared again. The same problem with firefox happened again, after logging back in again i got the COMODO pop up asking me to block or allow on several things, i blocked them all and then came to post here.