[Resolved] HijackThis log - clean confirmation needed

Hello Caysee

Welcome to the Whatthetech Malware Removal Forum,

All advice given by anyone volunteering here, is taken at your own risk.
While best efforts are made to assist in removing infections safely, unexpected stuff can happen.


Sorry about the delay, but the amount of people posting with infected computers is through the roof and sometimes we can't get to logs as fast as we would like to. If you have not resolved your issue and still need assistance, post a new HJT log please as your system may have changed since your original post.

Ken

Hi Caysee,

I know getting infected with this garbage is frustrating to say the least but keep in mind that all infections and systems are different , what Combofix can clean on one system it may damage another so do not run Combofix unless instructed to do so.

Your Trendmicro Anti Virus is out of date, you need to update it, if you don't want this program let me know and I can link you to some free ones that are more than adequate.


Open HijackThis > Do a System Scan Only, close your browser and all open windows including this one, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.

O20 - AppInit_DLLs: lqvkhx.dll

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe



Go to your Add Remove Programs in the Control Panel and uninstall Viewpoint, it installs without your knowledge or consent, is considered Adware, uses system resources and is not needed for anything.

C:\Program Files\Viewpoint <–Delete this folder if its still present






Please download ATF Cleaner by Atribune to your desktop.

• This program is for XP and Windows 2000 only
• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up
Please note: If you use online banking or are registered online with any other organizations, ensure you have memorized password and other personal information as removing cookies will temporarily disable the auto-login facility.






Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.<– Don't forget this
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and Paste the entire report in your next reply along with a New Hijackthis log.

I forgot to mention that I would appreciate the links to the free anti-virus programs. Thank you so much for your time!

Hi,

Before you install any other AV, you need to uninstall Trendmicro first, you should never run more than one AV. You can uninstall Trendmicro via the Add Remove Programs in the Control Panel.

Just install One AV and One Firewall.


Free Anti Virus Programs

• Free Avast 4 Home Edition
• AVG Free
• Avira AntiVir® Personal Edition Classic

Free Firewalls

• Zone Alarm
• Sygate Personal Firewall Free Edition
• Outpost Firewall Free

Lets check this file.


Go to VirusTotal and submit this file for analysis, just use the browse feature and then Send File, you will get a report back, post the report into this thread for me to see.

c:\windows\system32\cc3270mt.dll

It said the file had already been analyzed so I clicked the button to have it analyzed again. Hope that was the right thing to do: File cc3270mt.dll received on 01.18.2009 22:52:42 (CET) Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED Result: 0/38 (0%) Loading server information… Your file is queued in position: 1. Estimated start time is between 42 and 60 seconds. Do not close the window until scan is complete. The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result. If you are waiting for more than five minutes you have to resend your file. Your file is being scanned by VirusTotal in this moment, results will be shown as they're generated. Compact Print results Your file has expired or does not exists. Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time. You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. Email: Antivirus Version Last Update Result a-squared 4.0.0.73 2009.01.18 - AhnLab-V3 2009.1.15.0 2009.01.17 - AntiVir 7.9.0.57 2009.01.18 - Authentium 5.1.0.4 2009.01.18 - Avast 4.8.1281.0 2009.01.16 - AVG 8.0.0.229 2009.01.18 - BitDefender 7.2 2009.01.18 - CAT-QuickHeal 10.00 2009.01.17 - ClamAV 0.94.1 2009.01.18 - Comodo 935 2009.01.18 - DrWeb 4.44.0.09170 2009.01.18 - eSafe 7.0.17.0 2009.01.18 - eTrust-Vet 31.6.6312 2009.01.17 - F-Prot 4.4.4.56 2009.01.18 - F-Secure 8.0.14470.0 2009.01.18 - Fortinet 3.117.0.0 2009.01.15 - GData 19 2009.01.18 - Ikarus T3.1.1.45.0 2009.01.18 - K7AntiVirus 7.10.594 2009.01.17 - Kaspersky 7.0.0.125 2009.01.18 - McAfee 5499 2009.01.18 - McAfee+Artemis 5499 2009.01.18 - Microsoft None 2009.01.18 - NOD32 3775 2009.01.18 - Norman 5.93.01 2009.01.16 - nProtect 2009.1.8.0 2009.01.16 - Panda 9.5.1.2 2009.01.18 - PCTools 4.4.2.0 2009.01.18 - Prevx1 V2 2009.01.18 - Rising 21.12.62.00 2009.01.18 - SecureWeb-Gateway 6.7.6 2009.01.18 - Sophos 4.37.0 2009.01.18 - Sunbelt 3.2.1835.2 2009.01.16 - Symantec 10 2009.01.18 - TheHacker [removed].223 2009.01.18 - TrendMicro 8.700.0.1004 2009.01.16 - ViRobot 2009.1.17.1563 2009.01.17 - VirusBuster 4.5.11.0 2009.01.18 - Additional information File size: 658432 bytes MD5…: 155779c88df4e35695efb19e0d7a2366 SHA1..: 0bbebf5d2bb8196241ea84e5cdba0f5574bd7838 SHA256: 9ca024184070e1cab75e242e4ce037e1bc7953a0b4e0bc3f861edce9b805619c SHA512: 59fae880d8ad3b6f9101ecac33e8014e50a059eee3889008c157d3b45dbf0dc6 0ad00f21df13ddc0f7e20b1b8a315d13b97b2ea0b77b79a1a1aaa57534cbe239 ssdeep: 12288:tC62nvgBNoPlamOZrI+9kmekrJF77sEa8Nf1rb4WWGSyuapZrrk+kQzf:g 624BNoPE9I++meCJF7Q8Nf1X4mSyuY8 PEiD..: - TrID..: File type identification DOS Executable Borland C++ (39.2%) Win32 Executable Generic (25.7%) Win32 Dynamic Link Library (generic) (22.8%) Generic Win/DOS Executable (6.0%) DOS Executable Generic (6.0%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x3270121c timedatestamp…..: 0x4418859e (Wed Mar 15 21:22:38 2006) machinetype…….: 0x14c (I386) ( 7 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x7f000 0x7f000 6.57 4a3ce655178883c036b1649b7a354de9 .data 0x80000 0x14000 0xec00 4.78 d1fc99f306bae1b310637d44d0598aea .tls 0x94000 0x3000 0x2400 0.00 13a95890b5f0947d6f058ca9c30a3e01 .idata 0x97000 0x2000 0x1400 5.08 44623cb20847af295a1a3cc0b1a332b0 .edata 0x99000 0xa000 0x9400 5.95 11def70770fddd8950d6c62413684355 .rsrc 0xa3000 0x1000 0x1000 3.31 fb9d72f082e1b37db1c2eef430a999b7 .reloc 0xa4000 0x5000 0x4e00 6.66 346b429ce1d3844691c3273b7cd823de ( 4 imports ) > ADVAPI32.DLL: RegCloseKey, RegOpenKeyExA, RegQueryValueExA > KERNEL32.DLL: Beep, CloseHandle, CompareStringA, CompareStringW, CreateDirectoryA, CreateDirectoryW, CreateFileA, CreateFileW, CreatePipe, CreateProcessA, CreateProcessW, CreateThread, DeleteCriticalSection, DeleteFileA, DeleteFileW, DosDateTimeToFileTime, DuplicateHandle, EnterCriticalSection, EnumCalendarInfoA, ExitProcess, ExitThread, FileTimeToDosDateTime, FileTimeToLocalFileTime, FileTimeToSystemTime, FillConsoleOutputAttribute, FillConsoleOutputCharacterA, FindClose, FindFirstFileA, FindFirstFileW, FindNextFileA, FindNextFileW, FlushConsoleInputBuffer, FlushFileBuffers, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleScreenBufferInfo, GetCurrentDirectoryA, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetDateFormatA, GetDiskFreeSpaceA, GetDriveTypeA, GetDriveTypeW, GetEnvironmentStrings, GetEnvironmentStringsW, GetEnvironmentVariableA, GetExitCodeProcess, GetFileAttributesA, GetFileAttributesW, GetFileSize, GetFileTime, GetFileType, GetFullPathNameA, GetFullPathNameW, GetLargestConsoleWindowSize, GetLastError, GetLocalTime, GetLocaleInfoA, GetLogicalDrives, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleW, GetNumberOfConsoleInputEvents, GetOEMCP, GetProcAddress, GetProcessHeap, GetShortPathNameA, GetShortPathNameW, GetStartupInfoA, GetStartupInfoW, GetStdHandle, GetStringTypeA, GetStringTypeExA, GetStringTypeW, GetSystemDefaultLangID, GetSystemDirectoryA, GetSystemTimeAsFileTime, GetThreadLocale, GetTickCount, GetTimeZoneInformation, GetUserDefaultLCID, GetVersion, GetVersionExA, GetVolumeInformationA, GetVolumeInformationW, GlobalAlloc, GlobalFree, GlobalLock, GlobalMemoryStatus, GlobalReAlloc, GlobalSize, GlobalUnlock, HeapAlloc, HeapFree, HeapReAlloc, InitializeCriticalSection, InterlockedDecrement, InterlockedExchange, InterlockedIncrement, IsBadReadPtr, IsValidLocale, LCMapStringA, LCMapStringW, LeaveCriticalSection, LoadLibraryA, LoadLibraryExA, LoadLibraryW, LocalAlloc, LocalFileTimeToFileTime, LocalFree, LockFile, MoveFileA, MoveFileW, MultiByteToWideChar, PeekConsoleInputA, RaiseException, ReadConsoleInputA, ReadConsoleOutputA, ReadFile, RemoveDirectoryA, RemoveDirectoryW, RtlUnwind, ScrollConsoleScreenBufferA, SetConsoleCtrlHandler, SetConsoleCursorInfo, SetConsoleCursorPosition, SetConsoleMode, SetConsoleScreenBufferSize, SetConsoleWindowInfo, SetCurrentDirectoryA, SetCurrentDirectoryW, SetEndOfFile, SetEnvironmentVariableA, SetEnvironmentVariableW, SetErrorMode, SetFileAttributesA, SetFileAttributesW, SetFilePointer, SetFileTime, SetHandleCount, SetLastError, SetLocalTime, SetStdHandle, SetThreadLocale, Sleep, SystemTimeToFileTime, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, UnlockFile, VirtualAlloc, VirtualFree, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WideCharToMultiByte, WriteConsoleInputA, WriteConsoleOutputA, WriteFile, lstrcmpiA, lstrcpynA, lstrlenA > USER32.DLL: CharLowerW, CharNextA, CharUpperW, EnumThreadWindows, GetKeyboardType, LoadStringA, MessageBoxA, wsprintfA, wsprintfW, GetSystemMetrics > OLEAUT32.DLL: - ( 1433 exports ) @$bdele$qpv, @$bdele$qpvrx13std@nothrow_t, @$bdele$qpvt1, @$bdla$qpv, @$bdla$qpvrx13std@nothrow_t, @$bdla$qpvt1, @$blsh$qr42std@_basic_ostream$c19std@_char_traits$c__rx3bcd, @$bnew$qui, @$bnew$quirx13std@nothrow_t, @$bnwa$qui, @$bnwa$quirx13std@nothrow_t, @$brsh$qr42std@_basic_istream$c19std@_char_traits$c__r3bcd, @_time_put$b48std@_ostreambuf_iterator$b19std@_char_traits$b___@$bctr$qrx12std@_Locinfoui, @_time_put$b48std@_ostreambuf_iterator$b19std@_char_traits$b___@$bctr$qui, @_time_put$b48std@_ostreambuf_iterator$b19std@_char_traits$b___@$bdtr$qv, @_time_put$b48std@_ostreambuf_iterator$b19std@_char_traits$b___@_Getcat$qppx16std@locale@facet, @_time_put$b48std@_ostreambuf_iterator$b19std@_char_traits$b___@do_put$xq48std@_ostreambuf_iterator$b19std@_char_traits$b__r12std@ios_basebpx6std@tmcc, @_time_put$b48std@_ostreambuf_iterator$b19std@_char_traits$b___@id, @TRegexp@$bctr$qpxc, @TRegexp@$bctr$qrx7TRegexp, @TRegexp@$bdtr$qv, @TRegexp@copy_pattern$qrx7TRegexp, @TRegexp@find$xqpxcpuiui, @TRegexp@gen_pattern$qpxc, @TRegexp@maxpat, @_CatchCleanup$qv, @_InitTermAndUnexPtrs$qv, @_ReThrowException$quipuc, @_ThrowExceptionLDTC$qpvt1t1t1uiuiuipuct1, @__DynamicCast$qpvt1t1t1i, @__DynamicCastVCLptr$qqrpvt1, @__DynamicCastVCLref$qqrpvt1, @__GetTypeInfo$qpvt1t1, @__GetTypeInfo$qpvt1t1t1, @__ThrowExceptionName$qv, @__ThrowFileName$qv, @__ThrowLineNumber$qv, @__lockDebuggerData$qv, @__unlockDebuggerData$qv, @_cast_memptr$qpvt1uiuiui, @_vcl_GetHeapStatus$qv, @_vector_apply_$qpvt1uiuiuit1, @_vector_vapply_$qpvt1uiuiuit1, @bcd@$bctr$qgi, @std@_basic_string$c19std@_char_traits$c_17std@_allocator$c__@npos, @std@_codecvt$bci_@$bctr$qrx12std@_Locinfoui, @std@_codecvt$bci_@$bctr$qui, @std@_codecvt$bci_@$bdtr$qv, @std@_codecvt$bci_@_Getcat$qppx16std@locale@facet, @std@_codecvt$bci_@do_always_noconv$xqv, @std@_codecvt$bci_@do_encoding$xqv, @std@_codecvt$bci_@do_in$xqripxct2rpxcpbt5rpb, @std@_codecvt$bci_@do_length$xqrxipxct2ui, @std@_codecvt$bci_@do_max_length$xqv, @std@_codecvt$bci_@do_out$xqripxbt2rpxbpct5rpc, @std@_codecvt$bci_@do_unshift$xqripct2rpc, @std@_codecvt$bci_@id, @std@_codecvt$cci_@id, @std@_collate$b_@id, @std@_collate$c_@id, @std@_ctype$b_@$bctr$qrx12std@_Locinfoui, @std@_ctype$b_@$bctr$qui, @std@_ctype$b_@$bdtr$qv, @std@_ctype$b_@_Getcat$qppx16std@locale@facet, @std@_ctype$b_@do_is$xqpxbt1ps, @std@_ctype$b_@do_is$xqsb, @std@_ctype$b_@do_narrow$xqbc, @std@_ctype$b_@do_narrow$xqpxbt1cpc, @std@_ctype$b_@do_scan_is$xqspxbt2, @std@_ctype$b_@do_scan_not$xqspxbt2, @std@_ctype$b_@do_tolower$xqb, @std@_ctype$b_@do_tolower$xqpbpxb, @std@_ctype$b_@do_toupper$xqb, @std@_ctype$b_@do_toupper$xqpbpxb, @std@_ctype$b_@do_widen$xqc, @std@_ctype$b_@do_widen$xqpxct1pb, @std@_ctype$b_@id, @std@_ctype$c_@$bctr$qpxsoui, @std@_ctype$c_@$bctr$qrx12std@_Locinfoui, @std@_ctype$c_@$bdtr$qv, @std@_ctype$c_@_Getcat$qppx16std@locale@facet, @std@_ctype$c_@do_narrow$xqcc, @std@_ctype$c_@do_narrow$xqpxct1cpc, @std@_ctype$c_@do_tolower$xqc, @std@_ctype$c_@do_tolower$xqpcpxc, @std@_ctype$c_@do_toupper$xqc, @std@_ctype$c_@do_toupper$xqpcpxc, @std@_ctype$c_@do_widen$xqc, @std@_ctype$c_@do_widen$xqpxct1pc, @std@_ctype$c_@id, @std@_ctype$c_@table_size, @std@_messages$b_@id, @std@_messages$c_@id, @std@_money_get$b48std@_istreambuf_iterator$b19std@_char_traits$b___@id, @std@_money_get$c48std@_istreambuf_iterator$c19std@_char_traits$c___@id, @std@_money_put$b48std@_ostreambuf_iterator$b19std@_char_traits$b___@id, @std@_money_put$c48std@_ostreambuf_iterator$c19std@_char_traits$c___@id, @std@_moneypunct$bo$i0$_@$bctr$qrx12std@_Locinfoui, @std@_moneypunct$bo$i0$_@$bctr$qui, @std@_moneypunct$bo$i0$_@$bdtr$qv, @std@_moneypunct$bo$i0$_@_Getcat$qppx16std@locale@facet, @std@_moneypunct$bo$i0$_@id, @std@_moneypunct$bo$i0$_@intl, @std@_moneypunct$bo$i1$_@$bctr$qrx12std@_Locinfoui, @std@_moneypunct$bo$i1$_@$bctr$qui, @std@_moneypunct$bo$i1$_@$bdtr$qv, @std@_moneypunct$bo$i1$_@_Getcat$qppx16std@locale@facet, @std@_moneypunct$bo$i1$_@id, @std@_moneypunct$bo$i1$_@intl, @std@_moneypunct$co$i0$_@$bctr$qrx12std@_Locinfoui, @std@_moneypunct$co$i0$_@$bctr$qui, @std@_moneypunct$co$i0$_@$bdtr$qv, @std@_moneypunct$co$i0$_@_Getcat$qppx16std@locale@facet, @std@_moneypunct$co$i0$_@id, @std@_moneypunct$co$i0$_@intl, @std@_moneypunct$co$i1$_@$bctr$qrx12std@_Locinfoui, @std@_moneypunct$co$i1$_@$bctr$qui, @std@_moneypunct$co$i1$_@$bdtr$qv, @std@_moneypunct$co$i1$_@_Getcat$qppx16std@locale@facet, @std@_moneypunct$co$i1$_@id, @std@_moneypunct$co$i1$_@intl, @std@_num_get$b48std@_istreambuf_iterator$b19std@_char_traits$b___@id, @std@_num_get$c48std@_istreambuf_iterator$c19std@_char_traits$c___@id, @std@_num_put$b48std@_ostreambuf_iterator$b19std@_char_traits$b___@id, @std@_num_put$c48std@_ostreambuf_iterator$c19std@_char_traits$c___@id, @std@_numeric_limits$b_@digits, @std@_numeric_limits$b_@digits10, @std@_numeric_limits$b_@is_signed, @std@_numeric_limits$c_@digits, @std@_numeric_limits$c_@digits10, @std@_numeric_limits$c_@is_signed, @std@_numeric_limits$d_@digits, @std@_numeric_limits$d_@digits10, @std@_numeric_limits$d_@max_exponent, @std@_numeric_limits$d_@max_exponent10, @std@_numeric_limits$d_@min_exponent, @std@_numeric_limits$d_@min_exponent10, @std@_numeric_limits$f_@digits, @std@_numeric_limits$f_@digits10, @std@_numeric_limits$f_@max_exponent, @std@_numeric_limits$f_@max_exponent10, @std@_numeric_limits$f_@min_exponent, @std@_numeric_limits$f_@min_exponent10, @std@_numeric_limits$g_@digits, @std@_numeric_limits$g_@digits10, @std@_numeric_limits$g_@max_exponent, @std@_numeric_limits$g_@max_exponent10, @std@_numeric_limits$g_@min_exponent, @std@_numeric_limits$g_@min_exponent10, @std@_numeric_limits$i_@digits, @std@_numeric_limits$i_@digits10, @std@_numeric_limits$i_@is_signed, @std@_numeric_limits$j_@digits, @std@_numeric_limits$j_@digits10, @std@_numeric_limits$j_@is_signed, @std@_numeric_limits$l_@digits, @std@_numeric_limits$l_@digits10, @std@_numeric_limits$l_@is_signed, @std@_numeric_limits$o_@digits, @std@_numeric_limits$o_@digits10, @std@_numeric_limits$o_@is_modulo, @std@_numeric_limits$o_@is_signed, @std@_numeric_limits$s_@digits, @std@_numeric_limits$s_@digits10, @std@_numeric_limits$s_@is_signed, @std@_numeric_limits$uc_@digits, @std@_numeric_limits$uc_@digits10, @std@_numeric_limits$uc_@is_signed, @std@_numeric_limits$ui_@digits, @std@_numeric_limits$ui_@digits10, @std@_numeric_limits$ui_@is_signed, @std@_numeric_limits$uj_@digits, @std@_numeric_limits$uj_@digits10, @std@_numeric_limits$uj_@is_signed, @std@_numeric_limits$ul_@digits, @std@_numeric_limits$ul_@digits10, @std@_numeric_limits$ul_@is_signed, @std@_numeric_limits$us_@digits, @std@_numeric_limits$us_@digits10, @std@_numeric_limits$us_@is_signed, @std@_numeric_limits$zc_@digits, @std@_numeric_limits$zc_@digits10, @std@_numeric_limits$zc_@is_signed, @std@_numpunct$b_@id, @std@_numpunct$c_@id, @std@_time_get$b48std@_istreambuf_iterator$b19std@_char_traits$b___@id, @std@_time_get$c48std@_istreambuf_iterator$c19std@_char_traits$c___@id, @std@_time_put$c48std@_ostreambuf_iterator$c19std@_char_traits$c___@id, @std@_BADOFF, @std@_Debug_message$qpxct1, @std@_Fiopen$qpxb23std@__Iosb$i_@_Openmodei, @std@_Fiopen$qpxc23std@__Iosb$i_@_Openmodei, @std@_Fpz, @std@_Ios_init, @std@_Locinfo@$bctr$qipxc, @std@_Locinfo@$bctr$qpxc, @std@_Locinfo@$bdtr$qv, @std@_Locinfo@_Addcats$qipxc, @std@_Locinfo@_Getcoll$xqv, @std@_Locinfo@_Getctype$xqv, @std@_Locinfo@_Getcvt$xqv, @std@_Locinfo@_Getname$xqv, @std@_Locinfo@_Gettnames$xqv, @std@_Lockit@$bctr$qi, @std@_Lockit@$bdtr$qv, @std@_New_hand, @std@_Nomemory$qv, @std@_Num_base@digits, @std@_Num_base@digits10, @std@_Num_base@has_denorm, @std@_Num_base@has_denorm_loss, @std@_Num_base@has_infinity, @std@_Num_base@has_quiet_NaN, @std@_Num_base@has_signaling_NaN, @std@_Num_base@is_bounded, @std@_Num_base@is_exact, @std@_Num_base@is_iec559, @std@_Num_base@is_integer, @std@_Num_base@is_modulo, @std@_Num_base@is_signed, @std@_Num_base@is_specialized, @std@_Num_base@max_exponent, @std@_Num_base@max_exponent10, @std@_Num_base@min_exponent, @std@_Num_base@min_exponent10, @std@_Num_base@radix, @std@_Num_base@round_style, @std@_Num_base@tinyness_before, @std@_Num_base@traps, @std@_Num_float_base@has_denorm, @std@_Num_float_base@has_denorm_loss, @std@_Num_float_base@has_infinity, @std@_Num_float_base@has_quiet_NaN, @std@_Num_float_base@has_signaling_NaN, @std@_Num_float_base@is_bounded, @std@_Num_float_base@is_exact, @std@_Num_float_base@is_iec559, @std@_Num_float_base@is_integer, @std@_Num_float_base@is_modulo, @std@_Num_float_base@is_signed, @std@_Num_float_base@is_specialized, @std@_Num_float_base@radix, @std@_Num_float_base@round_style, @std@_Num_float_base@tinyness_before, @std@_Num_float_base@traps, @std@_Num_int_base@is_bounded, @std@_Num_int_base@is_exact, @std@_Num_int_base@is_integer, @std@_Num_int_base@is_modulo, @std@_Num_int_base@is_specialized, @std@_Num_int_base@radix, @std@_Raise_handler, @std@_String_base@_Xlen$xqv, @std@_String_base@_Xran$xqv, @std@_Throw$qrx13std@exception, @std@_Winit@$bctr$qv, @std@_Winit@$bdtr$qv, @std@_Winit@_Init_cnt, @std@_Wios_init, @std@cerr, @std@cin, @std@clog, @std@codecvt_base@$bctr$qui, @std@codecvt_base@$bdtr$qv, @std@codecvt_base@always_noconv$xqv, @std@codecvt_base@do_always_noconv$xqv, @std@codecvt_base@do_encoding$xqv, @std@codecvt_base@do_max_length$xqv, @std@cout, @std@ctype_base@$bctr$qui, @std@ctype_base@$bdtr$qv, @std@exception@$bctr$qv, @std@exception@$bdtr$qv, @std@exception@_Set_raise_handler$qpqrx13std@exception$v, @std@exception@what$xqv, @std@ios_base@$bctr$qv, @std@ios_base@$bdtr$qv, @std@ios_base@Init@$bctr$qv, @std@ios_base@Init@$bdtr$qv, @std@ios_base@Init@_Init_cnt, @std@ios_base@_Addstd$qv, @std@ios_base@_Callfns$q18std@ios_base@event, @std@ios_base@_Findarr$qi, @std@ios_base@_Index, @std@ios_base@_Init$qv, @std@ios_base@_Sync, @std@ios_base@_Tidy$qv, @std@ios_base@clear$q22std@__Iosb$i_@_Iostateo, @std@ios_base@copyfmt$qrx12std@ios_base, @std@ios_base@getloc$xqv, @std@ios_base@imbue$qrx10std@locale, @std@ios_base@register_callback$qpq18std@ios_base@eventr12std@ios_basei$vi, @std@istrstream@$bdtr$qv, @std@locale@$basg$qrx10std@locale, @std@locale@$bctr$q18std@_Uninitialized, @std@locale@$bctr$qp18std@locale@_Locimp, @std@locale@$bctr$qpxci, @std@locale@$bctr$qrx10std@locale, @std@locale@$bctr$qrx10std@localepxci, @std@locale@$bctr$qrx10std@localet1i, @std@locale@$bctr$qv, @std@locale@$bdtr$qv, @std@locale@$beql$xqrx10std@locale, @std@locale@_Addfac$qp16std@locale@facetuiui, @std@locale@_Getfacet$xqui, @std@locale@_Init$qv, @std@locale@_Locimp@$bctr$qo, @std@locale@_Locimp@$bctr$qrx18std@locale@_Locimp, @std@locale@_Locimp@$bdtr$qv, @std@locale@_Locimp@_Addfac$qp16std@locale@facetui, @std@locale@classic$qv, @std@locale@empty$qv, @std@locale@facet@$bctr$qui, @std@locale@facet@$bdtr$qv, @std@locale@facet@_Decref$qv, @std@locale@facet@_Incref$qv, @std@locale@facet@_Register$qv, @std@locale@global$qrx10std@locale, @std@locale@id@$bctr$qui, @std@locale@id@$oui$qv, @std@locale@id@_Id_cnt, @std@locale@name$xqv, @std@messages_base@$bctr$qui, @std@money_base@$bctr$qui, @std@nothrow, @std@ostrstream@$bctr$qpci23std@__Iosb$i_@_Openmode, @std@ostrstream@$bdtr$qv, @std@resetiosflags$q23std@__Iosb$i_@_Fmtflags, @std@set_new_handler$qpqv$v, @std@set_terminate$qpqv$v, @std@set_unexpected$qpqv$v, @std@setbase$qi, @std@setiosflags$q23std@__Iosb$i_@_Fmtflags, @std@setprecision$qi, @std@setw$qi, @std@strstream@$bctr$qpci23std@__Iosb$i_@_Openmode, @std@strstream@$bdtr$qv, @std@strstreambuf@$bdtr$qv, @std@strstreambuf@_Init$qipct2i, @std@strstreambuf@_Tidy$qv, @std@strstreambuf@freeze$qo, @std@strstreambuf@overflow$qi, @std@strstreambuf@pbackfail$qi, @std@strstreambuf@seekoff$ql22std@__Iosb$i_@_Seekdir23std@__Iosb$i_@_Openmode, @std@strstreambuf@seekpos$q12std@_fpos$i_23std@__Iosb$i_@_Openmode, @std@strstreambuf@underflow$qv, @std@terminate$qv, @std@time_base@$bctr$qui, @std@type_info@$basg$qrx13std@type_info, @std@type_info@$bctr$qrx13std@type_info, @std@type_info@$bdtr$qv, @std@type_info@$beql$xqrx13std@type_info, @std@type_info@$bneq$xqrx13std@type_info, @std@type_info@_first_base$xqr24std@type_info@_base_info, @std@type_info@_first_vbase$xqr25std@type_info@_vbase_info, @std@type_info@_guid$xqv, @std@type_info@_internal_rtti_cast$xqpvpx13std@type_info, @std@type_info@_next_base$xqr24std@type_info@_base_info, @std@type_info@before$xqrx13std@type_info, @std@type_info@name$xqv, @std@uncaught_exception$qv, @std@unexpected$qv, @std@wcerr, @std@wcin, @std@wclog, @std@wcout, @xmsg@$basg$qrx4xmsg, @xmsg@$bctr$qrx4xmsg, @xmsg@$bctr$qrx60std@_basic_string$c19std@_char_traits$c_17std@_allocator$c__, @xmsg@$bdtr$qv, @xmsg@raise$qv, @xmsg@what$xqv, __8087, __Atan, __Atexit, __Cosh, __CurrExcContext, __Denorm, __Dint, __Dnorm, __Dscale, __Dtest, __Dunscale, __Eps, __ErrorExit, __ErrorMessage, __Exp, __FAtan, __FCosh, __FDenorm, __FDint, __FDnorm, __FDscale, __FDtest, __FDunscale, __FEps, __FExp, __FInf, __FLog, __FNan, __FRteps, __FSin, __FSinh, __FSnan, __FUnloadDelayLoadedDLL, __FXbig, __FZero, __Feraise, __Getctyptab, __Global_unwind, __Hugeval, __Inf, __LCosh, __LDenorm, __LDnorm, __LDscale, __LDtest, __LDunscale, __LEps, __LExp, __LInf, __LNan, __LPoly, __LRteps, __LSin, __LSinh, __LSnan, __LXbig, __LZero, __Local_unwind, __Locksyslock, __Mtxdst, __Mtxinit, __Mtxlock, __Mtxunlock, __Nan, __Once, __Return_unwind, __Rteps, __SetUserHandler, __Sin, __Sinh, __Snan, __Stod, __Stodx, __Stof, __Stoflt, __Stofx, __Stold, __Stoldx, __Stoll, __Stollx, __Stolx, __Stopfx, __Stoull, __Stoullx, __Stoulx, __Stoxflt, __Unlocksyslock, __Xbig, __Zero, ___CPPdebugHook, ___CRTL_MEM_GetBorMemPtrs, ___CRTL_MEM_UseBorMM, ___CRTL_TLS_Alloc, ___CRTL_TLS_ExitThread, ___CRTL_TLS_Free, ___CRTL_TLS_GetInfo, ___CRTL_TLS_GetValue, ___CRTL_TLS_InitThread, ___CRTL_TLS_SetValue, ___CRTL_VCL_Thread_Hook, ___CRTL_VCL_Thread_Unhook, ___ErrorMessage, ____ExceptionHandler, ____wopen, ___access, ___alloca_helper, ___assertfail, ___bcd_log10, ___bcd_pow10, ___bcd_tobinary, ___bcd_todecimal, ___close, ___cputn, ___debuggerDisableTerminateCallback, ___doserrno, ___eof, ___errno, ___flush_win95_keyup_events, ___ftruncate, ___getStream, ___getline, ___ieee_64_n_inf, ___ieee_64_n_nanq, ___ieee_64_n_nans, ___ieee_64_n_zero, ___ieee_64_p_inf, ___ieee_64_p_nanq, ___ieee_64_p_nans, ___ieee_64_p_zero, ___isatty, ___isatty_osfhandle, ___isctype, ___iswctype, ___locale, ___lseek, ___matherr, ___matherrl, ___mb_cur_max, ___movecursor, ___moveline, ___open, ___pfnDliFailureHook, ___pfnDliNotifyHook, ___putline, ___raiseDebuggerException, ___read, ___scroll, ___terminatePTR, ___threadid, ___unexpectdPTR, ___validatexy, ___wcreat, ___wcserror, ___wfindfirst, ___wfindnext, ___wopen, ___write, __adopt_thread, __alloca, __argc, __argv, __argv_default_expand, __assert, __atoi64, __atold, __beginthread, __beginthreadNT, __beginthreadex, __c_exit, __cexit, __chartype, __chdrive, __chgsign, __chgsignl, __chmod, __clear87, __close, __cmdline_escapes, __commit, __control87, __copysign, __copysignl, __creat, __crotl, __crotr, __crtinit, __cwait, __daylight, __default87, __delayLoadHelper, __directvideo, __dos_close, __dos_creat, __dos_creatnew, __dos_findfirst, __dos_findnext, __dos_getdate, __dos_getdiskfree, __dos_getdrive, __dos_getfileattr, __dos_getftime, __dos_gettime, __dos_open, __dos_read, __dos_setdate, __dos_setdrive, __dos_setfileattr, __dos_setftime, __dos_settime, __dos_write, __ecvt, __endthread, __endthreadex, __environ, __envsize, __exit, __exitargv, __exitargv_ptr, __expand, __expand_wild, __fcloseall, __fcvt, __fdopen, __fgetc, __fgetchar, __fgetwc, __fgetwchar, __fileno, __findclose, __findfirst, __findfirsti64, __findnext, __findnexti64, __finite, __finitel, __flushall, __flushout, __fnsplit, __fpclass, __fpclassl, __fpreset, __fputc, __fputchar, __fputwc, __fputwchar, __free_heaps, __fsopen, __ftol, __ftoul, __ftruncate, __fullpath, __futime, __gcvt, __get_heap_redirector_info, __get_osfhandle, __getdcwd, __getdrive, __getdrives, __getmbcp, __getsystime, __getw, __getws, __handle_exitargv, __handle_setargv, __handle_wexitargv, __handle_wsetargv, __heapchk, __heapmin, __heapset, __heapwalk, __huge_dble, __huge_flt, __huge_ldble, __i64toa, __i64tow, __indefinite, __init_handles, __ismbbalnum, __ismbbalpha, __ismbbgraph, __ismbbkalpha, __ismbbkana, __ismbbkpunct, __ismbblead, __ismbbprint, __ismbbpunct, __ismbbtrail, __ismbcalnum, __ismbcalpha, __ismbcdigit, __ismbcgraph, __ismbchira, __ismbckata, __ismbcl0, __ismbcl1, __ismbcl2, __ismbclegal, __ismbclower, __ismbcprint, __ismbcpunct, __ismbcspace, __ismbcsymbol, __ismbcupper, __ismbslead, __ismbstrail, __isnan, __isnanl, __itow, __llocaleconv, __logb, __logbl, __lower, __lrand, __lrotl, __lrotr, __lsetlocale, __lstrcoll, __lstricoll, __lstrlwr, __lstrncoll, __lstrnicoll, __lstrupr, __lstrxfrm, __ltoa, __ltolower, __ltoupper, __ltow, __ltowlower, __ltowupper, __lwcscoll, __lwcsicoll, __lwcslwr, __lwcsncoll, __lwcsnicoll, __lwcsupr, __lwcsxfrm, __lwsetlocale, __makepath, __matherr, __matherrl, __max_dble, __max_flt, __max_ldble, __mbbtombc, __mbbtype, __mbccmp, __mbccpy, __mbcjistojms, __mbcjmstojis, __mbclen, __mbctohira, __mbctokata, __mbctolower, __mbctombb, __mbctoupper, __mbctype, __mbsbtype, __mbscat, __mbschr, __mbscmp, __mbscoll, __mbscpy, __mbscspn, __mbsdec, __mbsdup, __mbsicmp, __mbsicoll, __mbsinc, __mbslen, __mbslwr, __mbsnbcat, __mbsnbcmp, __mbsnbcnt, __mbsnbcoll, __mbsnbcpy, __mbsnbicmp, __mbsnbicoll, __mbsnbset, __mbsncat, __mbsnccnt, __mbsncmp, __mbsncoll, __mbsncpy, __mbsnextc, __mbsnicmp, __mbsnicoll, __mbsninc, __mbsnset, __mbspbrk, __mbsrchr, __mbsrev, __mbsset, __mbsspn, __mbsspnp, __mbsstr, __mbstok, __mbsupr, __messagefile, __messagefunc, __mkdir, __mktemp, __msize, __nextafter, __nextafterl, __nfile, __open, __open_osfhandle, __oscmd, __osenv, __osmajor, __osminor, __osmode, __ostype, __osversion, __pclose, __pcre_compile, __pcre_exec, __pcre_maketables, __pcre_regcomp, __pcre_regerror, __pcre_regexec, __pcre_regfree, __pcre_study, __pcre_version, __pipe, __popen, __putw, __putws, __read, __rmdir, __rmtmp, __rotl, __rotr, __rtl_chmod, __rtl_close, __rtl_creat, __rtl_heapwalk, __rtl_memset, __rtl_memset_, __rtl_mstick, __rtl_open, __rtl_read, __rtl_setUnmangleMode, __rtl_strcmp, __rtl_strcpy, __rtl_unmangle, __rtl_ustick, __rtl_write, __scalb, __scalbl, __searchenv, __searchstr, __set_matherr_handler, __set_matherrl_handler, __setargv, __setargv_ptr, __setcursortype, __seterrormode, __setmbcp, __setsystime, __sleep, __snprintf, __snwprintf, __sopen, __splitpath, __startup, __startupd, __stat, __stati64, __status87, __stkbase, __stkchk, __stpcpy, __strdate, __streams, __strerror, __stricoll, __strncoll, __strnicoll, __strtime, __strtold, __sys_errlist, __sys_nerr, __tccmp, __tccpy, __tclen, __tcschr, __tcsclen, __tcscmp, __tcscoll, __tcscspn, __tcsdec, __tcsicmp, __tcsicoll, __tcsinc, __tcslwr, __tcsnbcnt, __tcsncat, __tcsnccat, __tcsnccmp, __tcsnccnt, __tcsnccoll, __tcsnccpy, __tcsncicmp, __tcsncicoll, __tcsncmp, __tcsncoll, __tcsncpy, __tcsncset, __tcsnextc, __tcsnicmp, __tcsnicoll, __tcsninc, __tcsnset, __tcspbrk, __tcsrchr, __tcsrev, __tcsset, __tcsspn, __tcsspnp, __tcsstr, __tcstok, __tcsupr, __tempnam, __timezone, __tiny_ldble, __tzname, __tzset, __ui64toa, __ui64tow, __ultow, __unadopt_thread, __unlink, __unsetuserhandler, __upper, __utime, __version, __vsnprintf, __vsnwprintf, __waccess, __wargv, __wargv_default_expand, __wasctime, __wchdir, __wchmod, __wcreat, __wcsdup, __wcserror, __wcsicmp, __wcsicoll, __wcslwr, __wcsncoll, __wcsnicmp, __wcsnicoll, __wcsnset, __wcspcpy, __wcsrev, __wcsset, __wcstold, __wcsupr, __wctime, __wenviron, __wenvsize, __wexecl, __wexecle, __wexeclp, __wexeclpe, __wexecv, __wexecve, __wexecvp, __wexecvpe, __wexitargv, __wexitargv_ptr, __wexpand_wild, __wfdopen, __wfindclose, __wfindfirst, __wfindfirsti64, __wfindnext, __wfindnexti64, __wfnmerge, __wfnsplit, __wfopen, __wfreopen, __wfsopen, __wfullpath, __wgetcurdir, __wgetcwd, __wgetdcwd, __wgetenv, __wherex, __wherey, __wmakepath, __wmemchr, __wmemcpy, __wmemset, __wmkdir, __wmktemp, __wopen, __woscmd, __wosenv, __wperror, __wpopen, __wputenv, __wremove, __wrename, __write, __wrmdir, __wrtl_chmod, __wrtl_creat, __wrtl_open, __wscroll, __wsearchenv, __wsearchstr, __wsetargv, __wsetargv_ptr, __wsetlocale, __wsopen, __wspawnl, __wspawnle, __wspawnlp, __wspawnlpe, __wspawnv, __wspawnve, __wspawnvp, __wspawnvpe, __wsplitpath, __wstartup, __wstartupd, __wstat, __wstati64, __wstrdate, __wstrtime, __wsystem, __wtempnam, __wtmpnam, __wtof, __wtoi, __wtoi64, __wtol, __wtold, __wtzname, __wtzset, __wunlink, __wutime, _abort, _abs, _access, _acos, _acosl, _alloca, _asctime, _asin, _asinl, _atan, _atan2, _atan2f, _atan2l, _atanl, _atexit, _atof, _atoi, _atol, _basename, _bsearch, _btowc, _calloc, _ceil, _ceill, _cgets, _chdir, _chmod, _chsize, _clearerr, _clock, _close, _closedir, _clreol, _clrscr, _cos, _cosf, _cosh, _coshl, _cosl, _cprintf, _cputs, _creat, _creatnew, _creattemp, _cscanf, _ctime, _cvprintf, _cvscanf, _cwait, _delline, _difftime, _div, _dostounix, _dup, _dup2, _ecvt, _eof, _execl, _execle, _execlp, _execlpe, _execv, _execve, _execvp, _execvpe, _exit, _exp, _expf, _expl, _fabs, _fabsl, _fclose, _fcloseall, _fcvt, _fdopen, _feof, _ferror, _fflush, _fgetc, _fgetchar, _fgetpos, _fgets, _fgetwc, _fgetws, _filelength, _fileno, _findclose, _findfirst, _findnext, _floor, _floorl, _flushall, _fmod, _fmodl, _fnmerge, _fnsplit, _fopen, _fprintf, _fputc, _fputchar, _fputs, _fputwc, _fputws, _fread, _free, _freopen, _frexp, _frexpl, _fscanf, _fseek, _fsetpos, _fstat, _ftell, _ftime, _fwprintf, _fwrite, _fwscanf, _gcvt, _getc, _getch, _getchar, _getche, _getcurdir, _getcwd, _getdate, _getdfree, _getdisk, _getenv, _getftime, _getpass, _getpid, _gets, _gettext, _gettextinfo, _gettime, _getw, _getwc, _getwchar, _gmtime, _gotoxy, _heapcheck, _heapcheckfree, _heapchecknode, _heapfillfree, _heapwalk, _highvideo, _hypot, _hypotl, _insline, _isalnum, _isalpha, _isascii, _isatty, _iscntrl, _isdigit, _isgraph, _islower, _isprint, _ispunct, _isspace, _isupper, _iswalnum, _iswalpha, _iswascii, _iswcntrl, _iswdigit, _iswgraph, _iswlower, _iswprint, _iswpunct, _iswspace, _iswupper, _iswxdigit, _isxdigit, _itoa, _kbhit, _labs, _ldexp, _ldexpf, _ldexpl, _ldiv, _lfind, _localeconv, _localtime, _lock, _locking, _log, _log10, _log10l, _logf, _logl, _longjmp, _lowvideo, _lsearch, _lseek, _ltoa, _malloc, _mblen, _mbrtowc, _mbstowcs, _mbtowc, _memccpy, _memchr, _memcmp, _memcpy, _memicmp, _memmove, _memset, _mkdir, _mktemp, _mktime, _modf, _modfl, _movetext, _normvideo, _open, _opendir, _pcre_compile, _pcre_exec, _pcre_free, _pcre_info, _pcre_maketables, _pcre_malloc, _pcre_study, _pcre_version, _perror, _poly, _polyl, _pow, _pow10, _pow10l, _powf, _powl, _printf, _putc, _putch, _putchar, _putenv, _puts, _puttext, _putw, _putwc, _putwchar, _qsort, _raise, _rand, _read, _readdir, _realloc, _regcomp, _regerror, _regexec, _regfree, _remove, _rename, _rewind, _rewinddir, _rmdir, _rmtmp, _scanf, _searchpath, _setbuf, _setdate, _setdisk, _setftime, _setjmp, _setlocale, _setmode, _settime, _setvbuf, _signal, _sin, _sinf, _sinh, _sinhl, _sinl, _sleep, _snprintf, _snwprintf, _sopen, _spawnl, _spawnle, _spawnlp, _spawnlpe, _spawnv, _spawnve, _spawnvp, _spawnvpe, _sprintf, _sqrt, _sqrtf, _sqrtl, _srand, _sscanf, _stackavail, _stat, _stime, _stpcpy, _strcat, _strchr, _strcmp, _strcoll, _strcpy, _strcspn, _strdup, _strerror, _strftime, _stricmp, _strirshr, _strishr, _strlen, _strlwr, _strncat, _strncmp, _strncpy, _strnicmp, _strnset, _strpbrk, _strptime, _strrchr, _strrev, _strrshr, _strset, _strshr, _strspn, _strstr, _strtod, _strtok, _strtol, _strtoul, _strupr, _strxfrm, _swab, _swprintf, _swscanf, _system, _tan, _tanf, _tanh, _tanhl, _tanl, _tell, _tempnam, _textattr, _textbackground, _textcolor, _textmode, _time, _tmpfile, _tmpnam, _tolower, _toupper, _towlower, _towupper, _tzset, _ultoa, _umask, _ungetc, _ungetch, _ungetwc, _unixtodos, _unlink, _unlock, _utime, _vfprintf, _vfscanf, _vfwprintf, _vfwscanf, _vprintf, _vscanf, _vsnprintf, _vsnwprintf, _vsprintf, _vsscanf, _vswprintf, _vswscanf, _vwprintf, _vwscanf, _wait, _wclosedir, _wcrtomb, _wcscat, _wcschr, _wcscmp, _wcscoll, _wcscpy, _wcscspn, _wcsftime, _wcslen, _wcsncat, _wcsncmp, _wcsncpy, _wcspbrk, _wcsrchr, _wcsspn, _wcsstr, _wcstod, _wcstok, _wcstol, _wcstombs, _wcstoul, _wcsxfrm, _wctob, _wctomb, _wherex, _wherey, _window, _wmemcmp, _wmemmove, _wopendir, _wprintf, _wreaddir, _wrewinddir, _write, _wscanf, _wsearchpath CWSandbox info: http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=155779c88df4e35695efb19e0d7a2366

Thanks, It looks like the file is ok. How are things running now??

The computer has been running good this weekend. It hasn't been slow and I haven't had any pop-ups. It actually scares me to say these things because I'm worried I'll jinx something! Also, it's a little like the kid is sick when the doctor is not around, but now that the doctor is here, the kid is fine.

Caysee,

Just go about using your computer as normal. Don't forget to update Trendmicro or uninstall it and install another one, don't go without one. My choice would be AVG Free, then do a full scan, I am sure it will find some leftovers, not to worry if it does, the main infection is gone.

I Will leave this thread open for you for a week or so in case you need to post back( hopefully you will not ) .



ATF Cleaner <– Yours to keep, run it now and then to clean out the clutter.

Malwarebytes <– Yours to keep also, check for updates and run a scan now and then.

Hijackthis <—Your call, hopefully you won't need it again, if you do you can redownload it

Combofix <—Is not a general cleaning tool, just run it with supervision or you can bork your system

• Click START then RUN
• Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
  
  
  
  • [external image: Posted Image]
  
  
• When shown the disclaimer, Select "2"

The above procedure will:

• Delete the following:
  • ComboFix and its associated files and folders.
  • VundoFix backups, if present
  • The C:\Deckard folder, if present
  • The C:_OtMoveIt folder, if present
• Reset the clock settings.
• Hide file extensions, if required.
• Hide System/Hidden files, if required.
• Reset System Restore.

• How did I get infected in the first place ? Read these links and find out how to prevent getting infected again.
• Tutorial for System Restore <– Do this first to prevent yourself from being reinfected.
• WhattheTech
• TonyKlein CastleCops
• Grinler BleepingComputer
• GeeksTo Go
• Dslreports

Keep in mind if you install some of these programs. Only ONE Anti Virus and only ONE Firewall is recommended, more is overkill and can cause you problems. You can install all the Spyware programs I have listed without any problems. If you install Spyware Blaster, you can still install Spybot Search and Destroy but do not enable the TeaTimer in Spybot.

Here are some free programs to install, all free and highly regarded by the fine people in the Malware Removal Community

• Spybot Search and Destroy 1.6
  Check for Updates/ Immunize and run a Full System Scan on a regular basis. If you install Spyware Blaster ( Recommended ) then do not enable the TeaTimer in Spybot Search and Destroy.
  
• Spyware Blaster It will prevent most spyware from ever being installed. No scan to run, just update about once a week and enable all protection.
  
• Spyware Guard It offers realtime protection from spyware installation attempts, again, no scan to run, just install it and let it do its thing.
  
• IE-Spyad
  IE-Spyad places over 6000 web sites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (cookies etc) from the sites listed, although you will still be able to connect to the sites.
  
• Firefox 3 It has more features and is a lot more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use them both.

Safe Surfn
Ken

Ken, I've done everything you had listed. All is running well. The only thing that didn't work was the combofix /u. I've looked and can't find it anywhere so I'm not sure what happened to it, but I guess it's a good thing that its gone, right? I really appreciate all of the help I've gotten from this site. I'm so happy to see that there are still people willing to volunteer time to help others like this. I'll be back on payday to make a donation, but I don't think anyone could donate the amount of money that you all deserve! Thank you so much!

Your very welcome Caysee, Take care, Ken

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.