What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

AGain! REPEAT - I'M INFECTED [Closed]

24 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16 last edited
i don't get it, this is how stupid i am…. don't know how log on that way…only know how to logon under my registered name. go figure, i'm so stupid

here is the combo fix report: oh and i know how i got this virus…… i clicked on a very convincing notice that my windows media player needed an update ….. or my adobe flash, i can't remember which one….. but it looked real.

ComboFix 13-06-08.02 - cici 06/11/2013 11:19:32.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.2812.1536 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\cici\AppData\Local\Temp\AFF1.tmp\F_IN_BOX.dll
c:\windows\Downloaded Program Files\popcaploader.dll
c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\s.bat
c:\windows\system32\drivers\etc\lmhosts
c:\windows\system32\windrv.sys
.
.
((((((((((((((((((((((((( Files Created from 2013-05-11 to 2013-06-11 )))))))))))))))))))))))))))))))
.
.
2013-06-11 15:26 . 2013-06-11 15:26 ——– d—–w- c:\users\Default\AppData\Local\temp
2013-06-11 08:45 . 2013-06-11 08:45 ——– d—–w- C:\_OTL
2013-05-30 10:13 . 2013-05-30 10:13 ——– d—–w- c:\program files\Mozilla Maintenance Service
2013-05-30 10:09 . 2013-05-30 10:29 ——– d—–w- c:\program files\Flash Player Pro
2013-05-28 07:59 . 2013-05-28 07:59 ——– d—–w- c:\program files\SafeMonitor
2013-05-27 15:59 . 2013-05-27 15:59 ——– d—–w- c:\program files\Desktop Taipei
2013-05-24 14:47 . 2013-05-24 14:47 ——– d—–w- c:\windows\system32\SPReview
2013-05-24 14:46 . 2013-05-24 14:46 ——– d—–w- c:\windows\system32\EventProviders
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-30 10:09 . 2012-05-26 02:39 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-05-30 10:09 . 2012-05-26 02:39 418464 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-05-24 14:55 . 2009-07-14 02:05 152576 —-a-w- c:\windows\system32\msclmd.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 23:50 121528 —-a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-03-02 98304]
"cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent.exe" [2010-03-10 496184]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2009-11-19 307768]
"IdeaNotesUser"="c:\program files\DDNI\Lenovo Idea Notes\DDNIMSGUser.exe" [2009-08-24 221872]
"UCam_Menu"="c:\program files\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"YouCam Mirror Tray icon"="c:\program files\Lenovo\YouCam\YouCamTray.exe" [2009-12-22 167008]
"UpdateP2GShortCut"="c:\program files\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]
"EnergyUtility"="c:\program files\Lenovo\Energy Management\utility.exe" [2009-12-17 4114368]
"Energy Management"="c:\program files\Lenovo\Energy Management\Energy Management.exe" [2009-12-17 6223808]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]
"InstaLAN"="c:\program files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" [2011-11-14 1884064]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WLStart"="c:\program files\Windows Live\Installer\wlstart.exe" [2009-07-26 768336]
"SPReview"="c:\windows\System32\SPReview\SPReview.exe" [2013-05-24 280576]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R3 Bridge0;Bridge0;c:\windows\system32\drivers\WDBridge.sys [2009-07-28 63240]
R3 IGRS;IGRS;c:\program files\Lenovo\ReadyComm\common\IGRS.exe [2009-07-15 38152]
R3 k57nd60x;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2009-07-13 229888]
R3 Lenovo ReadyComm AppSvc;Lenovo ReadyComm AppSvc;c:\program files\Lenovo\ReadyComm\AppSvc.exe [2009-08-14 509192]
R3 Lenovo ReadyComm ConnSvc;Lenovo ReadyComm ConnSvc;c:\program files\Lenovo\ReadyComm\ConnSvc.exe [2009-11-17 575304]
R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
R3 PS_MDP;ReadyComm Presentation Space Helper Service;c:\windows\System32\IgrsSvcs.exe [2009-07-14 20992]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-03-12 189984]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-04-24 1343400]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [2009-07-21 81704]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-03-03 172032]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-10-30 58680]
S2 DDNIMSGService;DDNIMSGService;c:\program files\DDNI\Lenovo Idea Notes\DDNIMSGService.exe [2010-01-21 172720]
S2 DDNIService;DDNIService;c:\program files\DDNI\DIBS\DDNIService.exe [2010-03-04 160432]
S2 ReadyComm.DirectRouter;ReadyComm.DirectRouter;c:\windows\System32\IgrsSvcs.exe [2009-07-14 20992]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [2009-09-03 21256]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2009-11-13 58368]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-12-22 30392]
S3 usbsmi;Lenovo EasyCamera;c:\windows\system32\DRIVERS\SMIksdrv.sys [2009-10-16 171776]
S3 wdmirror;wdmirror;c:\windows\system32\DRIVERS\WDMirror.sys [2009-07-16 11792]
.
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc SensrSvc Mcx2Svc
IgrsSvcs REG_MULTI_SZ ReadyComm.DirectRouter PS_MDP
.
Contents of the 'Scheduled Tasks' folder
.
2013-06-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-26 23:41]
.
2013-06-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-11 23:56]
.
2013-06-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-11 23:56]
.
.
——- Supplementary Scan ——-
.
IE: Create Astra Gift puzzle - c:\program files\Astra Gift Maker\gm.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\cici\AppData\Roaming\Mozilla\Firefox\Profiles\hw3kguv7.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-VeriFaceManager - c:\program files\Lenovo\VeriFace\PManage.exe
HKLM-Run-SNM - c:\program files\SpyNoMore\SNM.exe
SafeBoot-mcmscsvc
SafeBoot-MCODS
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
———————— Other Running Processes ————————
.
c:\windows\system32\atieclxx.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\system32\WLANExt.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Belkin\Router Setup and Monitor\BelkinService.exe
c:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Belkin\Router Setup and Monitor\BelkinSetup.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Completion time: 2013-06-11 11:40:04 - machine was rebooted
ComboFix-quarantined-files.txt 2013-06-11 15:39
.
Pre-Run: 83,946,205,184 bytes free
Post-Run: 83,845,558,272 bytes free
.
- - End Of File - - E0B0198803A692DCD2C3ABB994F09067
A36C5E4F47E84449FF07ED3517B43A31


please note: it's still infected….i closed out mozilla and logged back on….and the grey screen announcing an advertisement was still there and the quantcast window is still on your webpage and i am assuming this is not created by you
Post #17
You are not stupid and are doing well under some difficult circumstances.

I haven't had a chance to check ComboFix thoroughly and I have to go out for a while now. but I can see it sorted out some undesirable entries.

Has the Firefox issue gone?

If not, I think the best thing is to uninstall and reinstall Firefox; this will clear out all user data and plugins, so we are starting with a fresh install of Firefox,

You can backup your bookmarks if you need to but you will need to install any addins again.

Also note down any passwords etc.

Download a new copy of Firefox from here and save it to your desktop.

How to backup your bookmarks
  • open Firefox.
  • click the “Bookmarks” menu
  • click select Show All Bookmarks
  • in the “Library” window, click the Import and Backup button and then select Backup
  • in the “Bookmarks backup filename” window that opens, choose a location to save the file, which is named Bookmarks-"date".json by default
  • once the backup has run, close all windows and check location for backup file.
Remove Firefox
  • click on Start, Run
  • in the open text entry box please copy/paste appwiz.cpl Then click Enter.
  • press the Remove or Change/Remove…button to uninstall Firefox.
Delete the folders in red

C:\Program Files\Mozilla
c:\users\cici\AppData\Roaming\Mozilla

Reboot

Install the new copy of Firefox that you saved to the desktop.

Restore Bookmarks
  • open Firefox
  • click the “Bookmarks” menu
  • click Show All Bookmarks
  • in the “Library” window, click the “Import and Backup” button and then select Restore
  • in the “Bookmarks backup filename” window that opens, choose the location you saved the backup file to ,
When the restore has taken place, close all windows.

Open Firefox again and let me know how it is working now.

Satchfan
Post #18 last edited
i can't find half of what you said and it's not you, it's me….i'm fried….my brain can only do so much…raging headache…. maybe it's the 11 hour drive home yesterday thru a tornado, unreal driving rainstorms, almost died when a car hydroplaned on the other side of the highway and missed me by 10 feet when it sailed in the air right at me….. plus i have my head trauma/concussion issue that has made me even more incapable of staying on task or figuring things out…. i'll just uninstall then re-install thru my control panel. it is still infected and raging away…… you never told me if this quantcast pop up is yours, it only shows on your website…or maybe not, i'm only using your website today. who knows….. thanks so much for all your patience and help. i'll go and uninstall firefox now. i'm back…… just going into my control panel didn't help…i uninstalled. i reinstalled from their website….. it's still there. i am fried. i can't deal with this today….old woman with bad brain and i'm sobbing now and can't do anything when i am this upset…… i'm so sorry i'm such a wreck. i have to log off now. i really do or i'll be hysterical and that is an ugly sight, old woman out of control. i'll log back on tomorrow. i'm so sorry
Post #19
I am so sorry to hear about all your dreadful experiences which in the grand scheme of things makes this computer issue seem very minor in comparison.

Please take all the time you need and I'll wait to hear from you when you are feeling better and wish to continue.

Incidentally, quantcast is only a "cookie" issue and can be easily resolved.

Kind regards

Satchfan
Post #20
okay, i still can't figure it out…. i go to the start icon on the left bottom of my screen….when i copy/paste that appwiz.cpl that stupid safe monitor icon appears over it and when i copy paste it in the run box it just brings up my control panel…hello? why can't i just click on control panel and just hit uninstall? i don't get it. and about that stupid safe monitor that is only a cookie issue, it is not showing under cookies when i go into privacy and click on show cookies, it isn't listed there. C:\Program Files\Mozilla when copy and pasted into the run box brings up 3 file folders associated with Mozilla, how do delete those? some do sound suspicious…what is a jsloader? that folder was created around the time i got infected. i am totally at sea here….
Post #21
I hope you are feeling better after a rest.

Quantcast is probably not on your computer but embedded in the web page you are visiting and is harmless. However, removing SafeMonitor could resolve the pop up about Quantcast.

Re uninstalling Firefox

You can uninstall it through the Control Panel but before you do, let's try and resolve the Firefox problem by removing SafeMonitor and Java, (which is out-of-date anyway).

Uninstall programs

Uninstall these programs:

SafeMonitor
Java 7 Update 9
  • click Start, Control Panel, Programs and Features
  • click on Java, and then Uninstall. Repeat this for all versions of Java or JRE runtime
  • click on each of the programs in turn and then Uninstall.
If you are prompted for an administrator password or confirmation, type the password or provide confirmation.
  • Next

    Using Windows Explorer, (Windows key+E), find and delete these folders:

    C:\Program Files\SafeMonitor
    C:\Program Files\Java

    Next

    Remove these add-ons in your browsers:
    • In Internet Explorer: Settings > Manage add-ons > Toolbars and Extensions > Safe Monitor
    • In Firefox: Tools > Add-ons > Extensions > Safe Monitor > Remove
    • in Chrome: Tool icon > Tools > Extensions > Safe Monitor > Trash Icon
    Let me know how that went and if Firefox is behaving better now.

    Satchfan
Post #22
i uninstalled both programs…..but when i clicked on the windows button plus e…… then copied and pasted the file into the search box no such file was found. i must be doing something wrong. plus i can't figure out the other instructions either Nina…. this is not going well
Post #23 last edited
Ok, the fact that you have uninstalled the programs is good.

What we need to do now is to delete the folders that contain the programs and then remove the "add-ins" of SafeMonitor in your browsers.

First, we'll delete the folders.
  • open Windows Explorer,as you did before, (Windows key+E).
  • look in the left Window and click on the arrow just to the left of Local Disk C:\.
  • below Local Disk C there is now a list in alphabetical order. Click on Program Files
  • in the right window you should see a list of the programs in that folder.
  • locate SafeMonitor then right-click on it and choose Delete
  • do the same for the Java folder.
Tell me when you’ve done that and I’ll give the next set of instructions.
Post #24 last edited
I DID that….. those files are not appearing!!!! that is why i copied and pasted them into the box to try to locate them that way, they are not there! but now that safe monitor is uninstalled plus java that annoying shaking box has disappeared and the grey screen has disappeared.
Post #25
That's OK if they are already gone.

Now we’ll get rid of the add-ins/extension.

Chrome
  • open Google Chrome
  • click on the Customize icon 🖼Click to load external image (Posted Image), at the top right
  • click on Settings
  • on the left, click Extensions
  • click the trash can icon by Safe Monitor
  • when the confirmation dialog appears, click Remove.
Firefox
  • open Firefox
  • click on Tools > Add-ons > Extensions
  • click on Safe Monitor and then on Remove
Internet Explorer
  • open Internet Explorer
  • click on Tools > Manage Add-ons > Extensions
  • If Safe Monitor is “Enabled”, right-click on it and choose Disable.
Let me know how that goes.
Post #26
none of those things were in add on manager at all…..i had already uninstalled google chrome as they added that on when i downloaded firefox, i uninstalled firefox then…..then i reinstalled firefox using the custom mode so they could not automatically add in Chrome….. and when i uninstalled Chrome i told them i hated their constant surveillance and would never use their products again, i don't even use my gmail account. i hate all this surveillance every single email website has going on now…… i make sure my history is deleted upon exit….plus cookies
Post #28
oh i thought i had….oops….. no more pop ups but mozilla has crashed 3 times today, just froze and stopped working….. haven't seen that happen in ages…. happened all the time with internet explorer….. hopefully this is just a bad day at firefox……are we done nina? it was only slightly agonizing, lol….thanks so much for your patience and fortitude. :)
Post #29
I’d like you to run a couple more scans before we tidy up just to be sure that things are as they seem.

Run Malwarebytes’ Anti-Malware

I noticed that you had MBAM on your system: if you no longer have it, you can download it from here:
  • start Malwarebytes-Anti-Malware and update it, (“Update” tab}
  • once it is updated, click on “Scanner” tab, select Perform quick scan, then click Scan.
  • when the scan is complete, click OK, then Show Results to view the results.
  • be sure that everything is checked, and click Remove Selected.
  • when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • copy and paste the contents of that report in your next reply and exit MBAM.
NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

================================================

Run ESET Online Scan

IMPORTANT Please make sure you uncheck the box next to Remove found threats. Eset will detect anything that looks even slightly suspicious, which could include legitimate program files. If you do not uncheck the box, Eset will automatically remove all suspicious files which could leave some of your software inoperable.

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan
  • click the Eset online Scanner button.
  • for alternate browsers only: (Microsoft Internet Explorer users can skip these steps)


    o click on esetinstaller.exe to download the ESET Smart Installer. Save it to your desktop.
    o double click on the Eset installer icon on your desktop.

  • check Yes, I accept the Terms of Use
  • click the Start button.
  • accept any security warnings from your browser.
  • check Scan archives and Remove found threats.
  • click Advanced settings and select the following:


    o Scan potentially unwanted applications
    o Scan for potentially unsafe applications
    o Enable Anti-Stealth technology

  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • when the scan completes, push List of found threats
  • push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

    Note - if ESET doesn't find any threats, no report will be created.
  • push the back button.
  • push Finish
If a log has been produced post it in your next reply with the Malwarebytes log.

Thanks

Satchfan
Post #30 last edited
Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Database version: v2013.06.13.09 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 9.0.8112.16421 cici :: CICI-PC [administrator] 6/13/2013 6:27:56 PM mbam-log-2013-06-13 (18-27-56).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 203168 Time elapsed: 10 minute(s), 4 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) i'm dong the the other scan right now…….but i only disabled my avast for 10 minutes and this is going to take more than 10 minutes, will it seriously affect the scan once 10 minutes is up and the avast turns itself back on? OH HECK….. i just went back into avast and shut it down for an hour…hope it didn't screw anything up…here is final scan C:\ProgramData\Spybot - Search & Destroy\Recovery\iCrossRider22.zip Win32/Bagle.gen.zip worm C:\Users\All Users\Spybot - Search & Destroy\Recovery\iCrossRider22.zip Win32/Bagle.gen.zip worm D:\CICI-PC\Backup Set 2012-07-22 190001\Backup Files 2012-07-29 201225\Backup files 1.zip Win32/Adware.SpyNoMore application D:\CICI-PC\Backup Set 2012-08-05 190001\Backup Files 2012-08-05 190001\Backup files 1.zip Win32/Adware.SpyNoMore application D:\CICI-PC\Backup Set 2012-08-26 194813\Backup Files 2012-08-26 194813\Backup files 1.zip Win32/Adware.SpyNoMore application

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI