I've Been Jacked

Incident Status Location Adware:Adware/Maxifiles Not disinfected C:\avenger\backup.zip[avenger/b122.exe] Adware:Adware/Maxifiles Not disinfected C:\avenger\backup.zip[avenger/b122.exe][Installeur.exe] Adware:Adware/ActiveSearch Not disinfected C:\avenger\backup.zip[avenger/b122.exe][²ÜÇ\Services.dll] Spyware:Spyware/Virtumonde Not disinfected C:\avenger\backup.zip[avenger/neircdql.dll] Virus:Trj/Downloader.OBC Not disinfected C:\avenger\backup.zip[avenger/net.exe][²ÖÇ\install.exe] Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\User-1\Desktop\ComboFix.exe[ComboFixT\nircmd.cfexe] Spyware:Spyware/Virtumonde Not disinfected C:\Documents and Settings\User-1\Desktop\net.exe[²ÖÇ\is67333.exe] Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\User-1\Desktop\New Folder (2)\SmitfraudFix\Process.exe Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\User-1\Desktop\SmitfraudFix.zip[SmitfraudFix/Process.exe] Adware:Adware/WebHancer Not disinfected C:\QooBox\Quarantine\C\Program Files\webHancer\Programs\whiehlpr.dll.vir Adware:Adware/WebHancer Not disinfected C:\QooBox\Quarantine\C\Program Files\webHancer\whAgent_update.exe.vir[whiehlpr.dll] Adware:Adware/CommAd Not disinfected C:\QooBox\Quarantine\C\WINDOWS\IA\asappsrv.dll.vir Adware:Adware/CommAd Not disinfected C:\QooBox\Quarantine\C\WINDOWS\IA\command.exe.vir Adware:Adware/CommAd Not disinfected C:\QooBox\Quarantine\C\WINDOWS\IA\KE.vbs.vir Adware:Adware/DollarRevenue Not disinfected C:\QooBox\Quarantine\C\WINDOWS\system32\atmtd.dll.vir Adware:Adware/DollarRevenue Not disinfected C:\QooBox\Quarantine\C\WINDOWS\system32\atmtd.dll._.vir Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINDOWS\nircmd.exe

Incident Status Location Adware:Adware/Maxifiles Not disinfected C:\avenger\backup.zip[avenger/b122.exe] Adware:Adware/Maxifiles Not disinfected C:\avenger\backup.zip[avenger/b122.exe][Installeur.exe] Adware:Adware/ActiveSearch Not disinfected C:\avenger\backup.zip[avenger/b122.exe][²ÜÇ\Services.dll] Spyware:Spyware/Virtumonde Not disinfected C:\avenger\backup.zip[avenger/neircdql.dll] Virus:Trj/Downloader.OBC Not disinfected C:\avenger\backup.zip[avenger/net.exe][²ÖÇ\install.exe] Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\User-1\Desktop\ComboFix.exe[ComboFixT\nircmd.cfexe] Spyware:Spyware/Virtumonde Not disinfected C:\Documents and Settings\User-1\Desktop\net.exe[²ÖÇ\is67333.exe] Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\User-1\Desktop\New Folder (2)\SmitfraudFix\Process.exe Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\User-1\Desktop\SmitfraudFix.zip[SmitfraudFix/Process.exe] Adware:Adware/WebHancer Not disinfected C:\QooBox\Quarantine\C\Program Files\webHancer\Programs\whiehlpr.dll.vir Adware:Adware/WebHancer Not disinfected C:\QooBox\Quarantine\C\Program Files\webHancer\whAgent_update.exe.vir[whiehlpr.dll] Adware:Adware/CommAd Not disinfected C:\QooBox\Quarantine\C\WINDOWS\IA\asappsrv.dll.vir Adware:Adware/CommAd Not disinfected C:\QooBox\Quarantine\C\WINDOWS\IA\command.exe.vir Adware:Adware/CommAd Not disinfected C:\QooBox\Quarantine\C\WINDOWS\IA\KE.vbs.vir Adware:Adware/DollarRevenue Not disinfected C:\QooBox\Quarantine\C\WINDOWS\system32\atmtd.dll.vir Adware:Adware/DollarRevenue Not disinfected C:\QooBox\Quarantine\C\WINDOWS\system32\atmtd.dll._.vir Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINDOWS\nircmd.exe

Looks the same, so no new infection found. Good job on repairs there. Some remaining items of infection that do need to be deleted, and you can remove all the tools we used here as well.

Do a search ( Start - Search/Find - Files or Folders) for the following hilighted files/folders (shown in Bold), and if found, delete them.

C:\Documents and Settings\User-1\Desktop\net.exe

Delete that other file you located:

C:\WINDOWS\b122.exe


And remove the following tools from our repairs:

Files:
C:\WINDOWS\nircmd.exe
C:\Documents and Settings\User-1\Desktop\ComboFix.exe
C:\Documents and Settings\User-1\Desktop\SmitfraudFix.zip

Folders:
C:\avenger
C:\QooBox
C:\Documents and Settings\User-1\Desktop\New Folder (2)\SmitfraudFix

Be sure to run ATF Cleaner after. Then post back an update on how your system is running now.