[Closed] help! somethign is controling my pc

Hi, and Welcome to WhatTheTech

My name is jpshortstuff. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

• I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for the issues on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

As I am still training, my posts to you will be checked by an Expert member. This will ensure that all advice and instructions I give you are accurate and safe. This may mean that my replies may take a little longer.

jpshortstuff

Hi

Identity Theft

It looks like you have been infected by a few Backdoor Trojans.

This allows hackers to remotely control your computer, steal critical system information and Download and Execute files

Its very possible that anything could have been installed on your computer by the remote attacker, including opening other backdoors and installing rootkits. While we can attempt to clean what we see in your logs, we cannot guarantee that your computer will be completely in the clear since we have no way of knowing that has been done to the computer. Your computer could be completely compromised at this moment. It may be prudent to backup your information, reformat, and reinstall.

More information on Remote Access Trojans can be found here.

I suggest you do the following immediately:

• Call all of your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft and to put a watch on your accounts or change all your account numbers.
• From a clean computer, change *all* your online passwords – for email, for banks, financial accounts, PayPal, eBay, online companies, any online forums or groups you belong to.
• DO NOT change passwords or do any transactions while using the infected computer because the attacker will get the new passwords and transaction information.

If, however, you decide that the computer is not used for any sensitive work, or if you do not wish to reformat at this time, I can help you clean your computer to the best of my abilities. I must remind you that i cannot guarantee that your computer will be completely clean afterwards since we have no way of knowing what has been done to it.

To help you make your decision, here are a few related articles that i suggest you read:

• Danger: Remote Access Trojans.
• When should I re-format? How should I reinstall?
• How Do I Handle Possible Identify Theft, Internet Fraud and Credit Card Fraud?

Should you have any questions, please feel free to ask.

Please let me know what you decide to do in your next post.

========
Should you wish to continue, please do the following:

We have noticed that most people seeking help from us are coming with infections contracted from the use of P2P programs.

Because of this, we felt we needed to change our policy on the use of P2P file sharing programs.

You have the following P-2-P program(s) installed
BearShare

This is how you uninstall it/them:

• Click Start
• Go to Control Panel
• Go to Add/Remove Programs
• Find and click Remove for the following (if present):

BearShare
and any other P2P programs you may have (e.g. Limewire)


Have you or an Administrator set any restrictions on this computer for regedit?

You have DownloadAcceleratorPlus installed. The free version of this program is "adware based". If you have the free version, I highly recomend you uninstall it via Start >> Control Panel >> Add/Remove Programs. See these two links for more information:
http://www.bleepingcomputer.com/uninstall/…r-Plus-DAP.html
http://www.bleepingcomputer.com/startups/D…rator-7431.html


Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform full scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. Please save it to a convenient location.
• The log can also be found here:
  C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
• Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
• Post that log back here.

I need to see another log from HijackThis.

• Run Hijackthis.
• Click on Open the Misc Tools section.
• Next click on Open uninstall manager.
• Press the Save list button.
• Save the file to your desktop, with the default name of uninstall_list
• Copy & Paste the entire contents of that file in your in your next post.

Please post a new HijackThis log as well.

Thanks.

Hi, are you still after help here?

yeah sorry for the delay Malwarebytes' Anti-Malware 1.25 Versión de la Base de Datos: 1062 Windows 5.1.2600 Service Pack 2 12:07:40 a.m. 25/08/2008 mbam-log-08-25-2008 (00-07-36).txt Tipo de examen : Examen Completo (C:\|D:\|E:\|) Objetos examinados: 225692 Tiempo transcurrido: 1 hour(s), 22 minute(s), 12 second(s) Procesos en Memoria Infectados: 0 Módulos en Memoria Infectados: 1 Claves del Registro Infectadas: 28 Valores del Registro Infectados: 8 Elementos de Datos del Registro Infectados: 1 Carpetas Infectadas: 7 Ficheros Infectados: 168 Procesos en Memoria Infectados: (No se han detectado elementos maliciosos) Módulos en Memoria Infectados: E:\WINDOWS\system32\amvo0.dll (Trojan.Agent) -> No action taken. Claves del Registro Infectadas: HKEY_CLASSES_ROOT\fis.amo (Adware.SmartShopper) -> No action taken. HKEY_CLASSES_ROOT\fis.amo.1 (Adware.SmartShopper) -> No action taken. HKEY_CLASSES_ROOT\fis.momo (Adware.SmartShopper) -> No action taken. HKEY_CLASSES_ROOT\fis.momo.1 (Adware.SmartShopper) -> No action taken. HKEY_CLASSES_ROOT\fis.ohb (Adware.SmartShopper) -> No action taken. HKEY_CLASSES_ROOT\fis.ohb.1 (Adware.SmartShopper) -> No action taken. HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin.1 (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\oberontb.band (Adware.Gamesbar) -> No action taken. HKEY_CLASSES_ROOT\TypeLib\{ad76633e-e50d-4844-9e7f-4dfbc7c18467} (Adware.Gamesbar) -> No action taken. HKEY_CLASSES_ROOT\Interface\{ec1a2105-5621-440f-987d-27ef428131d9} (Adware.Gamesbar) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> No action taken. HKEY_CLASSES_ROOT\oberontb.band.1 (Adware.Gamesbar) -> No action taken. HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{84da4fdf-a1cf-4195-8688-3e961f505983} (Adware.MyWebSearch) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5ed7d3de-6dbe-4516-8712-01b1b64b7057} (Adware.SmartShopper) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{37b85a2b-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{1a93c934-025b-4c3a-b38e-9654a7003239} (Adware.Gamesbar) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\upmedia (Adware.SmartShopper) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winbue32 (Dialer) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\UpMedia (Adware.SmartShopper) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PSRV (Trojan.Agent) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> No action taken. Valores del Registro Infectados: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kamsoft (Trojan.Agent) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\amva (Trojan.Agent) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\host-domain-lookup.com (Malware.Trace) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\mysearchnow.com (Malware.Trace) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\www.host-domain-lookup.com (Malware.Trace) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\www.mysearchnow.com (Malware.Trace) -> No action taken. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootStera (Rogue.WinAntivirus) -> No action taken. Elementos de Datos del Registro Infectados: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> No action taken. Carpetas Infectadas: E:\Archivos de programa\MyGlobalSearch (Adware.MyWebSearch) -> No action taken. E:\Archivos de programa\MyGlobalSearch\bar (Adware.MyWebSearch) -> No action taken. E:\Archivos de programa\MyGlobalSearch\bar\1.bin (Adware.MyWebSearch) -> No action taken. E:\Archivos de programa\MyGlobalSearch\bar\Cache (Adware.MyWebSearch) -> No action taken. E:\Archivos de programa\MyGlobalSearch\bar\History (Adware.MyWebSearch) -> No action taken. E:\Archivos de programa\MyGlobalSearch\bar\Settings (Adware.MyWebSearch) -> No action taken. E:\WINDOWS\system32\UpMedia (Adware.SmartShopper) -> No action taken. Ficheros Infectados: E:\Archivos de programa\GamesBar\oberontb.dll (Adware.Gamesbar) -> No action taken. C:\1yl2d.bat (Trojan.Vundo) -> No action taken. C:\6x8be16.cmd (Spyware.OnlineGames) -> No action taken. C:\oufddh.exe (Spyware.OnlineGames) -> No action taken. C:\u8jre9hv.bat (Spyware.OnLineGames) -> No action taken. C:\m88coaim.exe (Spyware.OnlineGames) -> No action taken. C:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0058033.exe (Spyware.OnlineGames) -> No action taken. C:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0058010.exe (Spyware.OnlineGames) -> No action taken. C:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065207.dll (Adware.WhenUSave) -> No action taken. C:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065368.exe (Spyware.OnlineGames) -> No action taken. C:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065389.exe (Spyware.OnlineGames) -> No action taken. C:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065443.cmd (Spyware.OnlineGames) -> No action taken. C:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065468.cmd (Spyware.OnlineGames) -> No action taken. C:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065506.cmd (Spyware.OnlineGames) -> No action taken. C:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065532.cmd (Spyware.OnlineGames) -> No action taken. C:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065554.cmd (Spyware.OnlineGames) -> No action taken. C:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065575.cmd (Spyware.OnlineGames) -> No action taken. C:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065596.cmd (Spyware.OnlineGames) -> No action taken. C:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065711.bat (Spyware.OnLineGames) -> No action taken. C:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065732.bat (Spyware.OnLineGames) -> No action taken. C:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065772.bat (Spyware.OnLineGames) -> No action taken. C:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067605.bat (Trojan.Vundo) -> No action taken. C:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067639.bat (Trojan.Vundo) -> No action taken. C:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067678.bat (Trojan.Vundo) -> No action taken. C:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067712.bat (Trojan.Vundo) -> No action taken. C:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067745.bat (Trojan.Vundo) -> No action taken. C:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067769.bat (Trojan.Vundo) -> No action taken. C:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067989.cmd (Trojan.Agent) -> No action taken. D:\1yl2d.bat (Trojan.Vundo) -> No action taken. D:\m88coaim.exe (Spyware.OnlineGames) -> No action taken. D:\oufddh.exe (Spyware.OnlineGames) -> No action taken. D:\u8jre9hv.bat (Spyware.OnLineGames) -> No action taken. D:\6x8be16.cmd (Spyware.OnlineGames) -> No action taken. D:\programas\CORE10k.EXE (Trojan.Agent) -> No action taken. D:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0058013.exe (Spyware.OnlineGames) -> No action taken. D:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0058035.exe (Spyware.OnlineGames) -> No action taken. D:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065371.exe (Spyware.OnlineGames) -> No action taken. D:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065391.exe (Spyware.OnlineGames) -> No action taken. D:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065446.cmd (Spyware.OnlineGames) -> No action taken. D:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065508.cmd (Spyware.OnlineGames) -> No action taken. D:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065534.cmd (Spyware.OnlineGames) -> No action taken. D:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065558.cmd (Spyware.OnlineGames) -> No action taken. D:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065578.cmd (Spyware.OnlineGames) -> No action taken. D:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065598.cmd (Spyware.OnlineGames) -> No action taken. D:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065713.bat (Spyware.OnLineGames) -> No action taken. D:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065735.bat (Spyware.OnLineGames) -> No action taken. D:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065774.bat (Spyware.OnLineGames) -> No action taken. D:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065472.cmd (Spyware.OnlineGames) -> No action taken. D:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067715.bat (Trojan.Vundo) -> No action taken. D:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067611.bat (Trojan.Vundo) -> No action taken. D:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067641.bat (Trojan.Vundo) -> No action taken. D:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067681.bat (Trojan.Vundo) -> No action taken. D:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067749.bat (Trojan.Vundo) -> No action taken. D:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067776.bat (Trojan.Vundo) -> No action taken. D:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067994.cmd (Trojan.Agent) -> No action taken. E:\m88coaim.exe (Spyware.OnlineGames) -> No action taken. E:\oufddh.exe (Spyware.OnlineGames) -> No action taken. E:\1yl2d.bat (Trojan.Vundo) -> No action taken. E:\6x8be16.cmd (Spyware.OnlineGames) -> No action taken. E:\u8jre9hv.bat (Spyware.OnLineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0046598.dll (Adware.SmartShopper) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0046599.dll (Adware.SmartShopper) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0058017.exe (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0058020.exe (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0058021.dll (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0058027.dll (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0058042.exe (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0058043.dll (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0058037.exe (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065191.exe (Adware.SmartShopper) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065200.exe (Trojan.Downloader) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065374.exe (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065384.dll (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065393.exe (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065399.exe (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065400.dll (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065406.dll (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065448.cmd (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065453.exe (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065475.cmd (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065484.dll (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065513.cmd (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065526.dll (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065540.cmd (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065550.dll (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065563.cmd (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065571.dll (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065580.cmd (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065589.dll (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065601.cmd (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065604.exe (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065627.dll (Spyware.OnlineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065715.bat (Spyware.OnLineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065729.dll (Spyware.OnLineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065741.bat (Spyware.OnLineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065764.dll (Spyware.OnLineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065777.bat (Spyware.OnLineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065784.exe (Spyware.OnLineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0065785.dll (Spyware.OnLineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0066765.dll (Spyware.OnLineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067615.bat (Trojan.Vundo) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067635.dll (Spyware.OnLineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067643.bat (Trojan.Vundo) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067670.dll (Spyware.OnLineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067687.bat (Trojan.Vundo) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067705.dll (Spyware.OnLineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067718.bat (Trojan.Vundo) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067738.dll (Spyware.OnLineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067750.bat (Trojan.Vundo) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067766.dll (Spyware.OnLineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067780.bat (Trojan.Vundo) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067784.exe (Trojan.Vundo) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067785.dll (Spyware.OnLineGames) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0068001.cmd (Trojan.Agent) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0068003.exe (Trojan.Agent) -> No action taken. E:\System Volume Information\_restore{63C68254-9EBA-4F8E-8D0E-58005B43D766}\RP225\A0067797.dll (Spyware.OnLineGames) -> No action taken. E:\Documents and Settings\pc\Configuración local\Temp\yv.dll (Spyware.OnlineGames) -> No action taken. E:\Documents and Settings\pc\Configuración local\Temp\tru18.tmp (Spyware.OnlineGames) -> No action taken. E:\Documents and Settings\pc\Configuración local\Temp\tru1A.tmp (Trojan.Agent) -> No action taken. E:\Documents and Settings\pc\Configuración local\Temp\tru20.tmp (Trojan.Agent) -> No action taken. E:\Documents and Settings\pc\Configuración local\Temp\tru25.tmp (Trojan.Vaklik) -> No action taken. E:\Documents and Settings\pc\Configuración local\Temp\tru26.tmp (Trojan.Vaklik) -> No action taken. E:\Documents and Settings\pc\Configuración local\Temp\tru2B.tmp (Trojan.Vaklik) -> No action taken. E:\Documents and Settings\pc\Configuración local\Temp\tru8.tmp (Spyware.OnlineGames) -> No action taken. E:\WINDOWS\system32\UpMedia\uninstallSE.exe (Adware.SmartShopper) -> No action taken. E:\Archivos de programa\MyGlobalSearch\bar\1.bin\M9FFXTBR.JAR (Adware.MyWebSearch) -> No action taken. E:\Archivos de programa\MyGlobalSearch\bar\1.bin\M9FFXTBR.MANIFEST (Adware.MyWebSearch) -> No action taken. E:\Archivos de programa\MyGlobalSearch\bar\1.bin\M9NTSTBR.JAR (Adware.MyWebSearch) -> No action taken. E:\Archivos de programa\MyGlobalSearch\bar\1.bin\M9NTSTBR.MANIFEST (Adware.MyWebSearch) -> No action taken. E:\Archivos de programa\MyGlobalSearch\bar\1.bin\M9PLUGIN.DLL (Adware.MyWebSearch) -> No action taken. E:\Archivos de programa\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (Adware.MyWebSearch) -> No action taken. E:\Archivos de programa\MyGlobalSearch\bar\1.bin\NPMYGLSH.DLL (Adware.MyWebSearch) -> No action taken. E:\Archivos de programa\MyGlobalSearch\bar\Cache\00DB95FD (Adware.MyWebSearch) -> No action taken. E:\Archivos de programa\MyGlobalSearch\bar\Cache\011B2B93 (Adware.MyWebSearch) -> No action taken. E:\Archivos de programa\MyGlobalSearch\bar\Cache\0136CCE1.bin (Adware.MyWebSearch) -> No action taken. E:\Archivos de programa\MyGlobalSearch\bar\Cache\0136DCA0.bin (Adware.MyWebSearch) -> No action taken. E:\Archivos de programa\MyGlobalSearch\bar\Cache\0136E991.bin (Adware.MyWebSearch) -> No action taken. E:\Archivos de programa\MyGlobalSearch\bar\Cache\files.ini (Adware.MyWebSearch) -> No action taken. E:\Archivos de programa\MyGlobalSearch\bar\History\search (Adware.MyWebSearch) -> No action taken. E:\Archivos de programa\MyGlobalSearch\bar\Settings\prevcfg.htm (Adware.MyWebSearch) -> No action taken. E:\Archivos de programa\MyGlobalSearch\bar\Settings\settings.dat (Adware.MyWebSearch) -> No action taken. E:\Archivos de programa\MyGlobalSearch\bar\Settings\settings.htm (Adware.MyWebSearch) -> No action taken. E:\WINDOWS\system32\winbue32.dll (Dialer) -> No action taken. E:\WINDOWS\system32\ckvo.exe (Trojan.Agent) -> No action taken. E:\1nkbd8h.bat (Trojan.Agent) -> No action taken. E:\c9hehpa.bat (Trojan.Agent) -> No action taken. E:\gumkrhf.bat (Trojan.Agent) -> No action taken. E:\ivcvknr.bat (Trojan.Agent) -> No action taken. E:\00hoeav.com (Trojan.Agent) -> No action taken. E:\r.cmd (Trojan.Agent) -> No action taken. E:\83l3v.cmd (Trojan.Agent) -> No action taken. E:\xmnm2.cmd (Trojan.Agent) -> No action taken. E:\mvxm.cmd (Trojan.Agent) -> No action taken. E:\n2de.cmd (Trojan.Agent) -> No action taken. E:\un9.cmd (Trojan.Agent) -> No action taken. E:\WINDOWS\system32\amvo.exe (Trojan.Agent) -> No action taken. E:\WINDOWS\system32\amvo0.dll (Trojan.Agent) -> No action taken. E:\WINDOWS\system32\amvo1.dll (Trojan.Agent) -> No action taken. E:\Archivos de programa\Archivos comunes\Yazzle1162OinUninstaller.exe (Adware.PurityScan) -> No action taken. E:\WINDOWS\system32\stera.job (Rogue.WinAntivirus) -> No action taken. E:\Documents and Settings\pc\Configuración local\Temp\tru4.tmp (Trojan.Agent) -> No action taken. E:\Documents and Settings\pc\Configuración local\Temp\tru5.tmp (Trojan.Agent) -> No action taken. E:\Documents and Settings\pc\Configuración local\Temp\tru6.tmp (Trojan.Agent) -> No action taken. E:\Documents and Settings\pc\Configuración local\Temp\tru7.tmp (Trojan.Agent) -> No action taken. E:\Documents and Settings\pc\Configuración local\Temp\tru9.tmp (Trojan.Agent) -> No action taken. E:\Documents and Settings\pc\Configuración local\Temp\win4A.tmp.exe (Heuristics.Malware) -> No action taken. E:\Documents and Settings\All Users\Menú Inicio\Online Security Guide.url (Rogue.Link) -> No action taken. E:\Documents and Settings\All Users\Menú Inicio\Security Troubleshooting.url (Rogue.Link) -> No action taken.

here´s the hjt log Actualización de seguridad para el Reproductor de Windows Media (KB911564) Actualización de seguridad para Windows XP (KB890046) Actualización de seguridad para Windows XP (KB893756) Actualización de seguridad para Windows XP (KB896358) Actualización de seguridad para Windows XP (KB896423) Actualización de seguridad para Windows XP (KB896424) Actualización de seguridad para Windows XP (KB896428) Actualización de seguridad para Windows XP (KB899589) Actualización de seguridad para Windows XP (KB900725) Actualización de seguridad para Windows XP (KB901190) Actualización de seguridad para Windows XP (KB901214) Actualización de seguridad para Windows XP (KB902400) Actualización de seguridad para Windows XP (KB904706) Actualización de seguridad para Windows XP (KB905414) Actualización de seguridad para Windows XP (KB905749) Actualización de seguridad para Windows XP (KB908519) Actualización de seguridad para Windows XP (KB911562) Actualización de seguridad para Windows XP (KB911567) Actualización de seguridad para Windows XP (KB912919) Actualización de seguridad para Windows XP (KB913580) Actualización de seguridad para Windows XP (KB914389) Actualización de seguridad para Windows XP (KB916281) Actualización de seguridad para Windows XP (KB917344) Actualización de seguridad para Windows XP (KB917953) Actualización de seguridad para Windows XP (KB918439) Actualización para Windows XP (KB894391) Actualización para Windows XP (KB898461) Actualización para Windows XP (KB900485) Actualización para Windows XP (KB908531) Actualización para Windows XP (KB910437) Actualización para Windows XP (KB911280) Ad-Aware 2007 Ad-Aware SE Personal Adobe Acrobat 5.0 Adobe Flash Player 9 ActiveX Adobe Shockwave Player Apple Software Update ArcSoft PhotoImpression 5 AVG 7.5 BearShare Belles Beauty Boutique Bettys Beer Bar Buildalot Build-a-lot Burger Island Burger Shop Cake Mania 2 Carrie the Caregiver Cathys Caribbean Club Companion wizard Compresor WinRAR Daycare Nightmare Diner Dash Diner Dash Flo on the Go Diner Dash Hometown Hero Download Accelerator Plus (DAP) Dream Day Wedding EPSON Scan Fashion Fits Fish Tycoon Flower Shop - Big City Break GamesBar 1.1.0.5 Gift Shop Hijackthis 1.99.1 HijackThis 1.99.1 HouseCall 6.6 Ink Monitor iOfficeWorks 7.64 iTunes Jackpot Match-Up Java™ SE Runtime Environment 6 Update 1 K-Lite Codec Pack 2.76 Full LimeWire 4.12.15 LiveReg (Symantec Corporation) LiveUpdate 1.80 (Symantec Corporation) Loco - Christmas Edition Malwarebytes' Anti-Malware Manual del usuario CX4900 Messenger Plus! Live & Sponsor (CiD) Microsoft Office XP Professional con FrontPage Miss Management Mozilla Firefox (2.0.0.16) MSN MySpaceIM Mystery Case Files - Prime Suspects Nanny Mania NVIDIA Drivers OIN Paparazzi Plant Tycoon QuickTime Revisión de Windows XP - KB873339 Revisión de Windows XP - KB886185 Revisión de Windows XP - KB887472 Revisión de Windows XP - KB887742 Revisión de Windows XP - KB888113 Revisión de Windows XP - KB888302 Revisión de Windows XP - KB890859 Revisión de Windows XP - KB891781 Roller Rush Safety Bar Shopmania Shopping Marathon Software de impresora EPSON SpeedBit Video Accelerator The Apprentice Los Angeles Tibia 7.92 Turbo Pizza Uptown Engine VIA Platform Device Manager Virtual Villagers Virtual Villagers The Lost Children Wedding Dash Winamp (remove only) Windows Installer 3.1 (KB893803) Windows Live Messenger Windows Live OneCare safety scanner Windows Media Format Runtime

Hi

When you used MalwareBytes Anti-Malware, did you click Remove Selected? I only ask because you log shows "No Action Taken" by each entry. Please open the following file:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
or C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
And check whether or not it still says "No Action Taken" (the log you posted could have been created before the items were removed).
If this log is different, please post it. If it is the same, then I'm afraid you will have to run the scan again. Please remember to click Remove Selected not Save Logfile. The log will popup after the program has removed the entries.

I can see Limewire and Bearshare in your log. If you want to continue receiving help here you must remove these programs. For more information, here is our policy:
http://forums.whatthetech.com/We_do_not_support_t91501.html

Once removed, please post a fresh HijackThis log, along with the MBAM results.

Thanks.

sorry but the computer won´t let me remove Bear share, i tried downloading it and instaling it but it did work.

Hi

Are you logged in as an Administrator? If not, please try logging in as an Administrator and then try uninstalling the program again.

If this still doesn't work, have a go in safe mode.

Here are instructions for getting into safe mode:

• Restart the computer.
• As soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.
• Use the arrow keys to select the Safe mode menu item
• Press Enter.

Remember to log in as an Administrator.

Then try uninstalling the program as before.

If you still get an error message, please navigate to this folder:
E:\Archivos de programa\BearShare
And see if you can see an uninstall program (usually called something like uninstall.exe, uninst.exe etc). Try double-clicking this if you can find it.

If this still doesn't work, please post exactly what error messages/behavior you are getting. Also please post the information about MBAM I asked or, and a new HijackThis log, even if you can't get BearShare to uninstall.

Did you successfully uninstall LimeWire?

Thanks.

Hi, are you still after help here?

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log