Looks better. Run Hijack This, close all windows and browsers except Hijack This, place a check to the left of the following items and press "fix checked": R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll (file missing) O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file) O3 - Toolbar: ShopAtHome Toolbar - {98279C38-DE4B-4bcf-93C9-8EC26069D6F4} - C:\Program Files\SelectRebates\Toolbar\ShopAtHomeToolbar.dll (file missing) O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP Premium\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP Premium\dapextie2.htm O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe Please download ComboFix to the desktop from one of the following links: Link1 Link 2 Link 3 Combofix is a powerful tool so follow the instructions exactly or you could damage your computer. Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with Combofix and remove some of its embedded files which may cause "unpredictable results". Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. In your case to run Combofix do the following: 1. Go offline turn off your AVG antivirus, Windows Defender, Ad-Aware and any other antispyware that you may have. 2. Run Combofix and save its log. 3. Restart the computer to get the antivirus running again but leave the antispyware programs off until we get the computer cleaned. 4. Post the Combofix log. Remember to re-enable the protection again afterwards before connecting to the Internet. Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running or move the mouse, it will cause your system to hang.) Please post the log it produces.

0

how do i turn off AVG Anti Virus? i open it up and component but it just tells me it is active and doesn't give me an option to turn off..

0

nvm..saw the link you posted

0

Combofix-log ComboFix 08-12-04.04 - Acer Customer 2008-12-04 15:25:07.1 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.301 [GMT -6:00] Running from: c:\users\Acer Customer\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\SelectRebates c:\program files\SelectRebates\FFToolbar\chrome.manifest c:\program files\SelectRebates\FFToolbar\chrome\content\options.js c:\program files\SelectRebates\FFToolbar\chrome\content\options.xul c:\program files\SelectRebates\FFToolbar\chrome\content\sahtoolbar.js c:\program files\SelectRebates\FFToolbar\chrome\content\sahtoolbar.xul c:\program files\SelectRebates\FFToolbar\chrome\locale\en-US\contents.rdf c:\program files\SelectRebates\FFToolbar\chrome\locale\en-US\sahtoolbar.dtd c:\program files\SelectRebates\FFToolbar\chrome\locale\en-US\sahtoolbar.dtd.skin c:\program files\SelectRebates\FFToolbar\chrome\locale\en-US\sahtoolbar.properties c:\program files\SelectRebates\FFToolbar\chrome\skin\3rdParty.png c:\program files\SelectRebates\FFToolbar\chrome\skin\add-folderplus.png c:\program files\SelectRebates\FFToolbar\chrome\skin\add-plussign.png c:\program files\SelectRebates\FFToolbar\chrome\skin\alert-blue.png c:\program files\SelectRebates\FFToolbar\chrome\skin\alert-red.png c:\program files\SelectRebates\FFToolbar\chrome\skin\bluebar.png c:\program files\SelectRebates\FFToolbar\chrome\skin\dollarsign.png c:\program files\SelectRebates\FFToolbar\chrome\skin\FindWords.png c:\program files\SelectRebates\FFToolbar\chrome\skin\gripper.png c:\program files\SelectRebates\FFToolbar\chrome\skin\icon-magnifying.png c:\program files\SelectRebates\FFToolbar\chrome\skin\invite.png c:\program files\SelectRebates\FFToolbar\chrome\skin\invite2.png c:\program files\SelectRebates\FFToolbar\chrome\skin\my-blue.png c:\program files\SelectRebates\FFToolbar\chrome\skin\my-gray.png c:\program files\SelectRebates\FFToolbar\chrome\skin\my-green.png c:\program files\SelectRebates\FFToolbar\chrome\skin\my-red.png c:\program files\SelectRebates\FFToolbar\chrome\skin\Options.png c:\program files\SelectRebates\FFToolbar\chrome\skin\S.png c:\program files\SelectRebates\FFToolbar\chrome\skin\SAH-LogoHotSpots.png c:\program files\SelectRebates\FFToolbar\chrome\skin\SAH-logotext.png c:\program files\SelectRebates\FFToolbar\chrome\skin\SAH-mainlogo-v1.png c:\program files\SelectRebates\FFToolbar\chrome\skin\SAH-mainlogo-v2.png c:\program files\SelectRebates\FFToolbar\chrome\skin\sahtoolbar.css c:\program files\SelectRebates\FFToolbar\chrome\skin\Scissors.png c:\program files\SelectRebates\FFToolbar\chrome\skin\Search.png c:\program files\SelectRebates\FFToolbar\chrome\skin\shoppingcart.png c:\program files\SelectRebates\FFToolbar\chrome\skin\singleperson.png c:\program files\SelectRebates\FFToolbar\chrome\skin\star.png c:\program files\SelectRebates\FFToolbar\chrome\skin\thumb2.png c:\program files\SelectRebates\FFToolbar\chrome\skin\Thumbs.db c:\program files\SelectRebates\FFToolbar\chrome\skin\toolbar-images-ALL.png c:\program files\SelectRebates\FFToolbar\chrome\skin\Toolbar_HelpAndFeedback.png c:\program files\SelectRebates\FFToolbar\chrome\skin\Wrench.png c:\program files\SelectRebates\FFToolbar\defaults\preferences\sahtoolbar.js c:\program files\SelectRebates\FFToolbar\install.rdf c:\program files\SelectRebates\SelectAlerts.dat c:\program files\SelectRebates\SelectRebates.ini c:\program files\SelectRebates\SelectRebatesA.dat c:\program files\SelectRebates\SelectRebatesB.dat c:\program files\SelectRebates\SelectRebatesBT.dat c:\program files\SelectRebates\SelectRebatesDownload.exe c:\program files\SelectRebates\SRebates.dll c:\program files\SelectRebates\Toolbar\Add.bmp c:\program files\SelectRebates\Toolbar\AdvancedOptions.html c:\program files\SelectRebates\Toolbar\basis.xml c:\program files\SelectRebates\Toolbar\Basis.xml.dym c:\program files\SelectRebates\Toolbar\basis.xml.temp c:\program files\SelectRebates\Toolbar\Blank.bmp c:\program files\SelectRebates\Toolbar\button-CloseWindow.gif c:\program files\SelectRebates\Toolbar\i_clipboard.bmp c:\program files\SelectRebates\Toolbar\i_help.bmp c:\program files\SelectRebates\Toolbar\i_magnifying.bmp c:\program files\SelectRebates\Toolbar\icons.bmp c:\program files\SelectRebates\Toolbar\ImageCache\alert-red.bmp c:\program files\SelectRebates\Toolbar\Invite.bmp c:\program files\SelectRebates\Toolbar\logo.bmp c:\program files\SelectRebates\Toolbar\logo_24.bmp c:\program files\SelectRebates\Toolbar\logo_HotSpots.bmp c:\program files\SelectRebates\Toolbar\MyNew.bmp c:\program files\SelectRebates\Toolbar\MyNone.bmp c:\program files\SelectRebates\Toolbar\MyPage.bmp c:\program files\SelectRebates\Toolbar\Rate.bmp c:\program files\SelectRebates\Toolbar\RightControls.dym c:\program files\SelectRebates\Toolbar\sah_logo_bars.gif c:\program files\SelectRebates\Toolbar\Scissors.bmp c:\program files\SelectRebates\Toolbar\Tools.bmp c:\program files\SelectRebates\Toolbar\Tools2.bmp c:\programdata\VCREDI~3.exe c:\windows\system32\x64 . ((((((((((((((((((((((((( Files Created from 2008-11-04 to 2008-12-04 ))))))))))))))))))))))))))))))) . 2009-11-27 07:20 . 2008-09-12 04:44 206,256 --a------ c:\windows\System32\idmmbc.dll 2008-12-04 14:15 . 2008-12-04 14:15 410,984 --a------ c:\windows\System32\deploytk.dll 2008-12-04 13:34 . 2008-12-04 13:34 <DIR> d-------- c:\windows\E80F62FF5D3C4A1984099721F2928206.TMP 2008-12-04 11:14 . 2008-12-04 11:14 <DIR> d-------- c:\users\All Users\Malwarebytes 2008-12-04 11:14 . 2008-12-04 11:14 <DIR> d-------- c:\users\Acer Customer\AppData\Roaming\Malwarebytes 2008-12-04 11:14 . 2008-12-04 11:14 <DIR> d-------- c:\programdata\Malwarebytes 2008-12-04 11:14 . 2008-12-04 11:26 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware 2008-12-04 11:14 . 2008-12-03 19:54 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys 2008-12-04 11:14 . 2008-12-03 19:54 15,504 --a------ c:\windows\System32\drivers\mbam.sys 2008-12-04 02:12 . 2008-12-04 02:12 <DIR> d-------- c:\program files\Trend Micro 2008-12-04 00:19 . 2008-12-04 00:19 <DIR> d-------- c:\users\All Users\SUPERAntiSpyware.com 2008-12-04 00:19 . 2008-12-04 00:19 <DIR> d-------- c:\programdata\SUPERAntiSpyware.com 2008-12-04 00:17 . 2008-12-04 00:17 <DIR> d-------- c:\users\Acer Customer\AppData\Roaming\SUPERAntiSpyware.com 2008-12-04 00:17 . 2008-12-04 00:17 <DIR> d-------- c:\program files\SUPERAntiSpyware 2008-12-02 15:22 . 2008-12-02 15:23 <DIR> d-------- c:\program files\Internet Download Manager 2008-11-08 19:03 . 2004-06-26 13:22 6,016 --a------ c:\windows\System32\drivers\vnccom.SYS 2008-11-08 19:03 . 2008-11-08 19:03 17 --a------ c:\windows\System32\' 2008-11-08 19:01 . 2008-11-08 19:01 <DIR> d-------- c:\program files\UltraVNC 2008-11-08 19:01 . 2005-06-10 22:02 12,800 --a------ c:\windows\System32\vncdrv.dll 2008-11-08 19:01 . 2004-06-26 13:21 5,760 --a------ c:\windows\System32\vnchelp.dll 2008-11-08 19:01 . 2004-06-26 13:22 4,736 --a------ c:\windows\System32\drivers\vncdrv.sys 2008-11-06 01:06 . 2008-12-03 23:40 <DIR> d-------- c:\users\Acer Customer\AppData\Roaming\Apple Computer 2008-11-06 01:04 . 2008-11-06 01:04 <DIR> d-------- c:\program files\iPod 2008-11-06 01:03 . 2008-11-06 01:04 <DIR> d-------- c:\users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-11-06 01:03 . 2008-11-06 01:04 <DIR> d-------- c:\programdata\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-11-06 01:03 . 2008-11-06 01:04 <DIR> d-------- c:\program files\iTunes 2008-11-06 00:50 . 2008-11-06 00:50 <DIR> d----c--- c:\windows\System32\DRVSTORE 2008-11-06 00:50 . 2008-04-17 13:12 107,368 --a------ c:\windows\System32\GEARAspi.dll 2008-11-06 00:50 . 2008-04-17 13:12 15,464 --a------ c:\windows\System32\drivers\GEARAspiWDM.sys 2008-11-05 02:08 . 2008-11-05 02:37 <DIR> d-------- c:\program files\Deskshare 2008-11-05 02:08 . 2008-11-05 02:37 <DIR> d-------- c:\program files\Common Files\DeskShare Shared 2008-11-04 12:34 . 2008-10-16 15:13 1,809,944 --a------ c:\windows\System32\wuaueng.dll 2008-11-04 12:34 . 2008-10-16 14:56 1,524,736 --a------ c:\windows\System32\wucltux.dll 2008-11-04 12:34 . 2008-10-16 15:09 51,224 --a------ c:\windows\System32\wuauclt.exe 2008-11-04 12:34 . 2008-10-16 15:09 43,544 --a------ c:\windows\System32\wups2.dll 2008-11-04 12:33 . 2008-10-16 15:12 561,688 --a------ c:\windows\System32\wuapi.dll 2008-11-04 12:33 . 2008-10-16 14:08 162,064 --a------ c:\windows\System32\wuwebv.dll 2008-11-04 12:33 . 2008-10-16 14:55 83,456 --a------ c:\windows\System32\wudriver.dll 2008-11-04 12:33 . 2008-10-16 15:08 34,328 --a------ c:\windows\System32\wups.dll 2008-11-04 12:33 . 2008-10-16 13:56 31,232 --a------ c:\windows\System32\wuapp.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-04 20:14 --------- d-----w c:\program files\Java 2008-12-04 20:07 --------- d-----w c:\program files\Common Files\Symantec Shared 2008-12-04 19:34 --------- d-----w c:\programdata\Symantec 2008-12-04 17:26 --------- d-----w c:\program files\Advanced Registry Fix 2008-12-04 06:15 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2008-12-04 05:40 --------- d-----w c:\users\Acer Customer\AppData\Roaming\AdobeUM 2008-12-04 05:40 --------- d-----w c:\users\Acer Customer\AppData\Roaming\Acer 2008-12-04 05:40 --------- d-----w c:\users\Acer Customer\AppData\Roaming\AccurateRip 2008-12-04 05:40 --------- d-----w c:\users\Acer Customer\AppData\Roaming\acccore 2008-12-03 22:49 --------- d-----w c:\programdata\Google Updater 2008-12-02 21:23 --------- d-----w c:\users\Acer Customer\AppData\Roaming\DMCache 2008-11-18 03:18 --------- d-----w c:\program files\Opera 2008-11-09 10:05 --------- d-----w c:\programdata\Yahoo! 2008-11-09 04:47 --------- d-----w c:\program files\MSN Messenger 2008-11-09 04:47 --------- d-----w c:\program files\Messenger Plus! Live 2008-11-07 20:21 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-06 07:03 --------- d-----w c:\programdata\Apple Computer 2008-11-05 08:33 --------- d---a-w c:\programdata\TEMP 2008-11-04 03:24 --------- d-----w c:\programdata\Yahoo! Companion 2008-11-04 01:59 --------- d-----w c:\program files\Fast Break Basketball 2008-11-03 05:42 --------- d-----w c:\program files\Advance Split Machine 2008-10-29 07:31 --------- d-----w c:\programdata\Xfire 2008-10-29 03:14 --------- d-----w c:\users\Acer Customer\AppData\Roaming\Xfire 2008-10-29 03:07 --------- d-----w c:\program files\Xfire 2008-10-28 09:25 --------- d-----w c:\program files\GameSpy Arcade 2008-10-27 17:38 97,928 ----a-w c:\windows\system32\drivers\avgldx86.sys 2008-10-27 17:37 --------- d-----w c:\programdata\avg8 2008-10-27 17:36 --------- d-----w c:\program files\AVG 2008-10-27 16:50 --------- d-----w c:\users\Acer Customer\AppData\Roaming\iExpert Software 2008-10-27 16:50 --------- d-----w c:\program files\Registry Clean Expert 2008-10-20 22:13 --------- d-----w c:\program files\Halo3Stats 2008-10-20 19:35 --------- d-----w c:\program files\Bonjour 2008-10-20 19:34 --------- d-----w c:\program files\QuickTime 2008-10-20 19:31 --------- d-----w c:\program files\Common Files\Apple 2008-10-20 19:24 --------- d-----w c:\program files\Apple Software Update 2008-10-20 19:19 --------- d-----w c:\programdata\Apple 2008-10-20 17:56 --------- d-----w c:\program files\Crossword Solver 2008-10-16 03:48 --------- d-----w c:\program files\Football Mogul 2008 2008-10-15 21:36 --------- d-----w c:\program files\Undisker 2008-10-14 00:24 --------- d-----w c:\program files\DriftCity 2008-10-12 19:20 --------- d-----w c:\program files\Microsoft Games 2008-10-12 05:01 --------- d--h--w c:\users\Acer Customer\AppData\Roaming\ijjigame 2008-10-12 01:01 --------- d-----w c:\program files\CDisplay 2008-07-10 08:10 174 --sha-w c:\program files\desktop.ini 2008-04-20 00:32 22,328 ----a-w c:\users\Acer Customer\AppData\Roaming\PnkBstrK.sys 2006-11-27 04:14 618,496 ----a-w c:\program files\OMTU.exe 2006-09-04 21:48 151,366 ----a-w c:\program files\stadium.png 2005-10-10 13:10 54,272 ----a-w c:\program files\tdbaccess.dll 2008-08-23 06:44 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2008-08-23 06:44 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2008-08-23 06:44 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat 2007-03-09 07:12 27,648 --sha-w c:\windows\System32\AVSredirect.dll 2008-03-12 08:29 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012008031220080313\index.dat 2008-03-13 17:30 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012008031320080314\index.dat 2008-03-15 01:04 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012008031420080315\index.dat 2008-03-15 10:17 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012008031520080316\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "????r"="" [?] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-10 1232896] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440] "RegClean Expert Scheduler"="c:\program files\Registry Clean Expert\RCHelper.exe" [2008-10-24 605944] "msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352] "Aim6"="c:\program files\AIM6\aim6.exe" [2007-10-04 50528] "Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-08-30 4670704] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728] "Google Update"="c:\users\Acer Customer\AppData\Local\Google\Update\GoogleUpdate.exe" [2008-11-28 133104] "vxdhm"="c:\users\Acer Customer\AppData\Roaming\Google\wincore.exe" [2008-12-03 128000] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-11-17 1805552] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-22 815104] "Persistence"="c:\windows\system32\igfxpers.exe" [2008-06-18 133656] "NvSvc"="c:\windows\system32\nvsvc.dll" [2006-11-22 90191] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-11-22 81920] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-11-22 7757824] "LogitechCommunicationsManager"="c:\program files\Common Files\Logitech\LComMgr\Communications_Helper.exe" [2006-10-31 304664] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-06-18 141848] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-06-18 166424] "eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-02-06 464168] "MSConfig"="c:\windows\system32\msconfig.exe" [2006-11-02 222208] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-04 136600] "RtHDVCpl"="RtHDVCpl.exe" [2006-11-30 c:\windows\RtHDVCpl.exe] c:\users\Acer Customer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ GameSpot Download Manager.lnk - c:\program files\GameSpot\GDM_TrayApp.exe [2007-08-28 237568] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-07-23 15:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.iac2"= c:\progra~1\REPLAY~1\iac25_32.ax "VIDC.XFR1"= xfcodec.dll [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Empowering Technology Launcher.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Empowering Technology Launcher.lnk backup=c:\windows\pss\Empowering Technology Launcher.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^VirtuaWin.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\VirtuaWin.lnk backup=c:\windows\pss\VirtuaWin.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WinZip Quick Pick.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Quick Pick.lnk backup=c:\windows\pss\WinZip Quick Pick.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^Users^Acer Customer^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Xfire.lnk] path=c:\users\Acer Customer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk backup=c:\windows\pss\Xfire.lnk.Startup backupExtension=.Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Assist Launcher] --a------ 2006-12-04 15:05 1261568 c:\program files\Acer Assist\launcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AcerOrbicamRibbon] --a------ 2006-11-20 19:09 754712 c:\program files\Acer\OrbiCam10\OrbiCam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6] --a------ 2007-10-04 09:20 50528 c:\program files\AIM6\aim6.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG8_TRAY] --a------ 2008-11-27 13:22 1261336 c:\progra~1\AVG\AVG8\avgtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] --a------ 2007-12-19 14:13 486856 c:\program files\DAEMON Tools Lite\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igndlm.exe] --a------ 2007-03-05 15:57 1103480 c:\program files\Download Manager\DLM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-10-01 18:57 289576 c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX] --a------ 2006-11-20 19:04 244512 c:\program files\Common Files\Logitech\LComMgr\LVComSX.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 1999-07-17 13:34 381200 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] --a------ 2007-01-19 13:54 5674352 c:\program files\MSN Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-09-06 14:09 413696 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] --a------ 2007-08-31 16:06 68856 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2008-03-31 18:22 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh] --a------ 2008-05-15 15:11 3644464 c:\program files\Veoh Networks\Veoh\VeohClient.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] --a------ 2007-08-30 17:43 4670704 c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{300FC74B-2318-4D14-AC53-306200A8835E}"= UDP:c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\MCE Deluxe Suite.exe:CyberLink MCE Deluxe Suite "{47C39F74-3446-4FB4-B64D-B39E7559E330}"= TCP:c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\MCE Deluxe Suite.exe:CyberLink MCE Deluxe Suite "{A93242F6-EBA4-46E7-8653-F3F080BD9726}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone) "{C3E409DE-9F25-4F7A-B4AD-892E66FDA715}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader "{6853DADC-3D46-4433-A295-D757C0EED960}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader "{DE772FB7-4116-4B72-8884-0CCF316B27E9}"= UDP:c:\program files\SkillGround\Games\UTG\Main.exe:UTG "{1E52731B-DBF8-441A-811F-0E95CEC86659}"= TCP:c:\program files\SkillGround\Games\UTG\Main.exe:UTG "{EDEE0E86-1DC9-410E-B70A-AD71A741774B}"= UDP:c:\users\Acer Customer\AppData\Local\Temp\Low\SkillGround\SkillGround.exe:SkillGround "{7F88ED6D-4531-487C-9925-61F840699B41}"= TCP:c:\users\Acer Customer\AppData\Local\Temp\Low\SkillGround\SkillGround.exe:SkillGround "{7CE5AB06-D81A-4308-8F08-1832BF18E5E5}"= UDP:80:UboOnline "{0A8AEEDD-A397-42C8-9E6F-E95526F829D9}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger "{438FFEC7-C9AE-4EC5-8B81-04AAE0096601}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger "{AE266608-371D-4388-93C4-9C58317B6D2F}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server "{8B3ED5E8-CF71-4834-B05D-67E38A1811A6}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server "{8ED2B660-FC68-469D-8071-44695271CD78}"= TCP:1795:Madden NFL 08 "{F514BD65-CBD9-4E8F-97FF-D19AF088C7D9}"= Disabled:UDP:c:\program files\NETAMIN\UBO_2007\game\UBO.exe:UBOnline "{76095243-2B9C-4C66-B4BD-7585626EDB7C}"= Disabled:TCP:c:\program files\NETAMIN\UBO_2007\game\UBO.exe:UBOnline "{4927D45B-8C68-4BA9-8B09-E064D0EEBF6F}"= UDP:20794:Listen Port "{E2EB49FD-664C-4464-90C6-136A4BA3D1BD}"= TCP:20794:Listen Port "{7C1EDB82-DCD9-4BE6-9E61-410519678847}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire "{59205151-02C2-4147-A8BE-538CD37F39A7}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire "{131D0409-42BC-4C95-A5A6-FC4881E9D60C}"= UDP:c:\program files\RapidSolution\Tunebite\TunebiteHelper.exe:TunebiteHelper "{1A8F26A6-7BB1-444E-ADEF-0764FB902BCC}"= TCP:c:\program files\RapidSolution\Tunebite\TunebiteHelper.exe:TunebiteHelper "{ED83413A-1671-495F-BA10-4CA69378A4FA}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger "{1182B1AA-2248-41ED-AF5A-E2EA38053FDC}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger "{C7B21412-5E5A-44B5-BF4B-A20936356FCD}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server "{52778063-2533-4765-9113-49BCF5A8EE6B}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server "{DF9CEA85-B580-4802-AD12-6E563C39DF4A}"= UDP:25255:BitComet 25255 TCP "{56AECB60-9494-4C86-9B7D-9FB48312198C}"= TCP:25255:BitComet 25255 UDP "{E2F3066F-795A-4C24-85FA-413E56A591A0}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{D60C66FF-0806-4EA8-BEB2-2549E6C170F4}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA "{2BA65706-EBEC-4899-97A5-E92EBA147943}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "{6AE93025-68DC-44D3-AB9D-5175C683B571}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB "{D897C687-77F0-4441-96C1-115974349B18}"= Disabled:UDP:c:\program files\NETAMIN\Real Baseball\game\RealBaseball.exe:RealBaseball "{A9DE3D1C-DD65-4007-9B6B-7DA06DFB09F0}"= Disabled:TCP:c:\program files\NETAMIN\Real Baseball\game\RealBaseball.exe:RealBaseball "{97C7D09F-02EA-495B-92B3-737ECDF4D276}"= UDP:25255:BitComet 25255 TCP "{DE2370A7-CAE1-4C64-96B2-F2E921B94DE6}"= TCP:25255:BitComet 25255 UDP "{CCA05282-AA35-4721-B9D2-4497A089BDB7}"= UDP:c:\program files\NETAMIN\Real Baseball\patcher\fc.exe:Cal Ripken's Real Baseball SysAnalyzer "{240DFC1E-5C47-4C68-B088-237FF491D4A4}"= TCP:c:\program files\NETAMIN\Real Baseball\patcher\fc.exe:Cal Ripken's Real Baseball SysAnalyzer "{BC3A9B40-1AC9-427C-99D5-D6EEBE445882}"= UDP:c:\programdata\NexonUS\NGM\NGM.exe:Nexon Game Manager "{7DCE1087-75BF-4E71-8F1F-9EAE26B2F0D0}"= TCP:c:\programdata\NexonUS\NGM\NGM.exe:Nexon Game Manager "{014416C1-A747-49C0-812F-2FC119B2F9DE}"= UDP:c:\nexon\Combat Arms\NMService.exe:Nexon Messenger Core "{66B0E6DB-731C-4C46-833F-32B85F9CF12B}"= TCP:c:\nexon\Combat Arms\NMService.exe:Nexon Messenger Core "{63BC3AE7-DB55-4F2B-8D57-A46054B22197}"= Disabled:UDP:c:\program files\NETAMIN\Real Baseball\game\RealBaseball.exe:RealBaseball "{1F5605D4-05DC-4136-9909-4F94F00F3970}"= Disabled:TCP:c:\program files\NETAMIN\Real Baseball\game\RealBaseball.exe:RealBaseball "{8EDC9F58-0BD2-486B-A696-CE9D73B61AAB}"= UDP:c:\users\Acer Customer\AppData\Local\F4\ClientUpdater\ClientUpdater.exe:F4 Game Client Updater "{E3544F85-91E1-4778-A31C-1347DD121ACB}"= TCP:c:\users\Acer Customer\AppData\Local\F4\ClientUpdater\ClientUpdater.exe:F4 Game Client Updater "{EFB02161-ACE3-4F8F-B61D-098C6FFC1040}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{EAF753B8-ADD6-4419-BF8E-27662DAE4905}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{4E045EE4-B711-4A0A-807A-19076A1F56A5}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe "{EDBA8797-4BA2-46BE-9F8B-B769DFBC838E}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes "{BF245018-3391-432F-941B-3EB2BA2B3546}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "DoNotAllowExceptions"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System] "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic| [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List] "c:\\Nexon\\Combat Arms\\CombatArms.exe"= c:\nexon\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe "c:\\Nexon\\Combat Arms\\Engine.exe"= c:\nexon\Combat Arms\Engine.exe:*Enabled:Engine.exe R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-10-27 97928] R1 SASDIFSV;SASDIFSV;\??\c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2008-11-17 8944] R1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-11-17 55024] R2 acedrv10;acedrv10;\??\c:\windows\system32\drivers\acedrv10.sys [2007-07-24 328824] R2 acehlp10;acehlp10;\??\c:\windows\system32\drivers\acehlp10.sys [2007-07-11 201848] R2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;system32\libusbd-nt.exe [] R2 LicCtrlService;LicCtrl Service;c:\windows\runservice.exe [2007-09-27 2560] R2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" [2007-11-08 24652] R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [2008-04-19 33792] R3 lv321av;Logitech USB PC Camera (VC0321);c:\windows\system32\DRIVERS\lv321av.sys [2006-12-01 847392] R3 SASENUM;SASENUM;\??\c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-11-17 7408] R3 SYMNDISV;SYMNDISV;c:\windows\system32\Drivers\SYMNDISV.SYS [2008-06-13 41008] R3 whmice2k;Advanced Wheel Mouse Upper Filter Driver;c:\windows\system32\DRIVERS\whmice2k.sys [2004-04-25 6885] S2 DNADownloader;DNADownloader;c:\program files\GameSpot\DownloadManager_Win32.exe [2007-08-28 708608] S3 ASPI;Advanced SCSI Programming Interface Driver;\??\c:\windows\System32\DRIVERS\ASPI32.sys [2008-07-15 84832] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2006-11-02 167936] S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys [2008-12-04 38496] S3 SMSCIRDA;SMSC Infrared Device Driver;c:\windows\system32\DRIVERS\SMSCirda.sys [2006-12-02 31232] S3 whfltr2k;WheelMouse USB Lower Filter Driver;c:\windows\system32\DRIVERS\whfltr2k.sys [2007-01-25 6784] S4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-10-27 231704] *Newly Created Service* - CATCHME [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{582610B8-E496-4813-993C-4B027173FE38}] c:\program files\PixiePack Codec Pack\InstallerHelper.exe . Contents of the 'Scheduled Tasks' folder 2008-12-04 c:\windows\Tasks\GoogleUpdateTaskUser.job - c:\users\Acer Customer\AppData\Local\Google\Update\GoogleUpdate.exe [2008-11-28 00:05] . - - - - ORPHANS REMOVED - - - - WebBrowser-{A057A204-BACC-4D26-9A9E-3AF287E2699B} - (no file) MSConfigStartUp-My Web Search Bar Search Scope Monitor - c:\progra~1\MYWEBS~1\bar\3.bin\m3SrchMn.exe MSConfigStartUp-MyWebSearch Email Plugin - c:\progra~1\MYWEBS~1\bar\3.bin\mwsoemon.exe MSConfigStartUp-MyWebSearch Plugin - c:\progra~1\MYWEBS~1\bar\3.bin\M3PLUGIN.DLL MSConfigStartUp-SelectRebates - c:\program files\SelectRebates\SelectRebates.exe MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre1.6.0_07\bin\jusched.exe . ------- Supplementary Scan ------- . uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7 mStart Page = hxxp://en.us.acer.yahoo.com uInternet Settings,ProxyOverride = *.local IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - FireFox -: Profile - c:\users\Acer Customer\AppData\Roaming\Mozilla\Firefox\Profiles\c4id5533.default\ FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll FF -: plugin - c:\program files\Download Manager\npfpdlm.dll FF -: plugin - c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll FF -: plugin - c:\program files\Microsoft Silverlight\2.0.30523.8\npctrl.dll FF -: plugin - c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll FF -: plugin - c:\program files\Yahoo!\Shared\npYState.dll FF -: plugin - c:\programdata\NexonUS\NGM\npNxGameUS.dll FF -: plugin - c:\users\Acer Customer\AppData\Local\Google\Update\1.2.131.27\npGoogleOneClick6.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-04 15:29:18 Windows 6.0.6000 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... c:\users\ACERCU~1\AppData\Local\Temp\catchme.dll 53248 bytes executable scan completed successfully hidden files: 1 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(644) c:\windows\system32\avgrsstx.dll - - - - - - - > 'lsass.exe'(676) c:\windows\system32\avgrsstx.dll . Completion time: 2008-12-04 15:31:29 ComboFix-quarantined-files.txt 2008-12-04 21:31:02 Pre-Run: 21,915,156,480 bytes free Post-Run: 21,915,787,264 bytes free 427 --- E O F --- 2008-08-22 20:30:27

0

Open Notepad and copy/paste everything between the X"s into it and make sure the first word (such as KILLALL, Or File, etc.) is at the very top of the page. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX KILLALL:: File:: c:\windows\E80F62FF5D3C4A1984099721F2928206.TMP Folder:: c:\windows\E80F62FF5D3C4A1984099721F2928206.TMP XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop. Then drag/drop the CFScript.txt onto ComboFix.exe (the red symbol on your desktop) if combofix does not auto start click "run". Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Download ATF Cleaner from this link: http://www.majorgeeks.com/ATF_Cleaner_d4949.html Run ATF-Cleaner Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. Please run Esets online scanner from this link: ESET 1. Note: You will need to use Internet explorer for this scan 2. Tick the box next to YES, I accept the Terms of Use. 3. Click Start 4. When asked, allow the activex control to install 5. Click Start 6. Make sure that the option Remove found threats is unticked ( I want to see what is found first), and the option Scan unwanted applications is checked 7. Click Scan 8. Wait for the scan to finish 9. Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt 10. Copy and paste that log in your next reply.

0

IE Crashes on me before i get the chance to run ESET.... i cant use like Opera? cuz that browser doesnt crash much....

0

keep trying it on Internet Explorer but closest i can get is it loading the whole page...then it crashes

0

i have it working for now..its at the INitialization of the ESET Online scanner part..it hasnt had me uncheck "remove found threats" though..is that after this? just making sure so i dont remove them EDIT-nvm got it.. its scanning now..but have to see if it will complete the scan with out closing...

0

We want to see them before they are removed, sometimes these scanners will wrongly identify a system file and can cause a system to get in a boot loop or not boot at all.

0

k its finally done.. # version=4 # OnlineScanner.ocx=1.0.0.56 # OnlineScannerDLLA.dll=1, 0, 0, 51 # OnlineScannerDLLW.dll=1, 0, 0, 51 # OnlineScannerUninstaller.exe=1, 0, 0, 49 # vers_standard_module=3665 (20081204) # vers_arch_module=1.064 (20080214) # vers_adv_heur_module=1.064 (20070717) # EOSSerial=8b82433d7e00974ab4098188f781dc5e # end=finished # remove_checked=false # unwanted_checked=true # utc_time=2008-12-05 12:29:38 # local_time=2008-12-04 06:29:38 (-0600, Central Standard Time) # country="United States" # osver=6.0.6000 NT # scanned=512125 # found=4 # scan_time=5337 C:\Users\Acer Customer\AppData\Roaming\Google\wincore.exe probably unknown NewHeur_PE virus 00000000000000000000000000000000 D:\New Folder\1984.rar probably unknown TSR.COM.exe virus 00000000000000000000000000000000 D:\New Folder\1984.rar »RAR »1984\BC's_Quest_for_Tires_[Sierra_On-Line][1984][rip].rar probably unknown TSR.COM.exe virus 00000000000000000000000000000000 D:\New Folder\1984.rar »RAR »1984\BC's_Quest_for_Tires_[Sierra_On-Line][1984][rip].rar »RAR »BC.COM probably unknown TSR.COM.exe virus 00000000000000000000000000000000

0

Open Notepad and copy/paste everything between the X"s into it and make sure the first word (such as KILLALL, Or File, etc.) is at the very top of the page. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX KILLALL:: File:: C:\Users\Acer Customer\AppData\Roaming\Google\wincore.exe XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop. Then drag/drop the CFScript.txt onto ComboFix.exe (the red symbol on your desktop) if combofix does not auto start click "run". Navigate to and make sure this file has been deleted: C:\Users\Acer Customer\AppData\Roaming\Google\wincore.exe If you know what D:\Newfolder is and know it is not infected I would not worry about it, but if you are not sure it would be best to delete it. You computer should be clean now. Navigate to and delete this folder: C:\SDFix Empty the recycle bin. Go to start> run> combofix /u (note the space after combofix) then press enter> run. This will uninstall combofix so give the uninstaller a minute to run. Go to start> control panel> add/remove programs and uninstall these programs: Hijack This Malwarebytes Eset You should keep AFT Cleaner and run it weekly. You should consider adding "Spywareblaster" to your arsenol of antispyware tools, you can download it from this link Spywareblaster Just download it,install it, and update it. Its free and runs in the background, so you don't actually run it, and re-writes malicious script before it can install on your computer. Look for updates weekly as there is no auto-update on the free version. How is the computer operating?

0

havent uninstalled every thing but it looks good...can get on msn now, before it would just freeze..and i can use all my browsers and no lame pop up sayin i have a virus so far... so thanks for the help..ill get to uninstalling that stuff now

0

Glad we could help.

0