I think its infected........(or possessed)

ComboFix Log:
ComboFix 10-11-01.05 - Mark 11/02/2010 11:38:46.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.503.261 [GMT -4:00]
Running from: c:\documents and settings\[removed]\My Documents\Downloads\ComboFix.exe
AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
\\.\PhysicalDrive0 - Bootkit Whistler was found and disinfected
.
\\.\PhysicalDrive0 - Bootkit Whistler was found and disinfected
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SSHNAS


((((((((((((((((((((((((( Files Created from 2010-10-02 to 2010-11-02 )))))))))))))))))))))))))))))))
.

2010-11-02 12:56 . 2010-11-02 12:56 -------- d-----w- c:\documents and settings\Mark\Application Data\Malwarebytes
2010-11-02 12:56 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-02 12:55 . 2010-11-02 12:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-11-02 12:55 . 2010-11-02 12:56 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-11-02 12:55 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-02 12:34 . 2010-11-02 12:34 -------- d-----w- C:\_OTL
2010-10-31 02:48 . 2010-10-31 02:48 -------- d-----w- c:\program files\Crawler
2010-10-31 02:47 . 2010-10-31 02:47 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-10-31 02:47 . 2010-11-02 10:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Spyware Terminator
2010-10-31 02:47 . 2010-11-02 04:01 -------- d-----w- c:\documents and settings\Mark\Application Data\Spyware Terminator
2010-10-31 02:47 . 2010-11-02 04:00 -------- d-----w- c:\program files\Spyware Terminator
2010-10-29 11:12 . 2010-09-18 06:53 953856 -c----w- c:\windows\system32\dllcache\mfc40u.dll
2010-10-29 11:12 . 2010-09-18 06:53 974848 -c----w- c:\windows\system32\dllcache\mfc42.dll
2010-10-29 11:10 . 2010-08-23 16:12 617472 -c----w- c:\windows\system32\dllcache\comctl32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-28 21:17 . 2010-05-08 19:52 16400 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
2010-09-18 16:23 . 2004-08-04 10:00 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2004-08-04 10:00 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2004-08-04 10:00 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2004-08-04 10:00 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-09 14:16 . 2006-03-04 03:33 667136 ----a-w- c:\windows\system32\wininet.dll
2010-09-09 14:16 . 2004-08-04 10:00 61952 ----a-w- c:\windows\system32\tdc.ocx
2010-09-09 14:16 . 2004-08-04 10:00 81920 ----a-w- c:\windows\system32\ieencode.dll
2010-09-08 16:49 . 2004-08-04 10:00 369664 ----a-w- c:\windows\system32\html.iec
2010-09-01 11:51 . 2004-08-04 10:00 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-08-31 13:42 . 2004-08-04 10:00 1852800 ----a-w- c:\windows\system32\win32k.sys
2010-08-27 08:02 . 2004-08-04 10:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:57 . 2004-08-04 10:00 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-26 13:39 . 2004-08-04 10:00 357248 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-26 12:52 . 2009-06-21 11:31 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2010-08-23 16:12 . 2004-08-04 10:00 617472 ----a-w- c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2004-08-04 10:00 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-16 08:45 . 2004-08-04 10:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\snxPluginsShell]
@="{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}"
[HKEY_CLASSES_ROOT\CLSID\{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}]
2010-06-28 20:59 153184 ----a-w- c:\program files\Alwil Software\Avast5\snxPlugins.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Mark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-11-27 135664]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-10-31 3055616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-01-13 131072]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-01-13 163840]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-01-13 135168]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-02-21 819200]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-02-21 970752]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-21 198160]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2007-09-17 124200]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"EPSON Stylus Photo R300 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE" [2003-06-04 99840]
"dleamon.exe"="c:\program files\Dell V310-V510 Series\dleamon.exe" [2010-01-18 770728]
"EzPrint"="c:\program files\Dell V310-V510 Series\ezprint.exe" [2010-01-18 139944]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-04-28 142120]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-01-27 1312848]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-06-28 2837864]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2010-10-31 2174464]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil10h_ActiveX.exe" [2010-07-25 231888]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-01-29 21:17 64592 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\WINDOWS\\system32\\dleacoms.exe"=
"c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\Scan\\ScanMan6.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [7/28/2010 5:08 PM 312912]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [11/1/2009 9:31 PM 165456]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [10/30/2010 10:47 PM 142592]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [11/1/2009 9:31 PM 17744]
R2 dlea_device;dlea_device;c:\windows\system32\dleacoms.exe -service --> c:\windows\system32\dleacoms.exe -service [?]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [6/21/2009 8:43 PM 10384]
R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [6/3/2009 10:24 PM 88192]
S2 dleaCATSCustConnectService;dleaCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\dleaserv.exe [3/7/2010 11:41 AM 98984]
S3 Ptserli;PCTEL Serial Device Driver for INTEL;c:\windows\system32\drivers\ptserli.sys [6/3/2009 10:30 PM 128286]
.
Contents of the 'Scheduled Tasks' folder

2010-10-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2010-10-31 c:\windows\Tasks\File Helper.job
- c:\program files\File Helper\1.1.0.4\FileHelper.exe [2009-11-20 18:49]

2010-11-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1844237615-688789844-839522115-1003Core.job
- c:\documents and settings\Mark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-11-27 13:29]

2010-11-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1844237615-688789844-839522115-1003UA.job
- c:\documents and settings\Mark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-11-27 13:29]

2010-11-02 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 19:07]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: Crawler Search - tbr:iemenu
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
FF - ProfilePath - c:\documents and settings\Mark\Application Data\Mozilla\Firefox\Profiles\lshiwz9l.default\
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - prefs.js: browser.search.selectedEngine - Mp3Rocket
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-02 11:53
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(880)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\windows\System32\BCMLogon.dll

- - - - - - - > 'explorer.exe'(2036)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\WLKeeper.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\System32\SCardSvr.exe
c:\program files\Apoint\Apntex.exe
c:\program files\Apoint\HidFind.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
c:\windows\system32\basfipm.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\dleacoms.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\pctspk.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
c:\program files\Java\jre6\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2010-11-02 11:58:34 - machine was rebooted
ComboFix-quarantined-files.txt 2010-11-02 15:58

Pre-Run: 43,232,358,400 bytes free
Post-Run: 43,154,591,744 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 99B2D2A033885F263F0F578494F2A741

Hi Deogee,

Please reboot the computer and then run another quick scan with Malwarebytes and post the log in your next reply.

Please also let me know how the computer is running now.

deltalima,

My PC seems to be cured!! Things are running much faster & much more reliably! Many, MANY thanks!!

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 5021

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

11/2/2010 4:25:56 PM
mbam-log-2010-11-02 (16-25-56).txt

Scan type: Quick scan
Objects scanned: 133818
Time elapsed: 11 minute(s), 14 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Hi Deogee,

My PC seems to be cured!! Things are running much faster & much more reliably!

It's looking good, let's do some final checks to make sure.

You should Download and Install the newest version of Adobe Reader for reading pdf files, due to the vulnerabilities in earlier versions.
All versions numbered lower than 9.4 are vulnerable.

• Go HERE, UNCHECK any Free Add-Ons, and click Download to install the latest version of Adobe Acrobat Reader.
• After it completes the Installation, close the Download Manager.

Update Java Runtime
You are using an old version of Java. Sun's Java is sometimes updated in order to eliminate the exploitation of vulnerabilities in an existing version. For this reason, it's extremely important that you keep the program up to date, & also remove the older more vulnerable versions from your system. The most current version of Sun Java is: Java Runtime Environment Version 6 Update 22.

• Download the latest version of Java Runtime Environment (JRE) 6 Here
• Scroll down to where it says "JDK 6 Update 22 (JDK or JRE)"
• Click the orange Download JRE button to the right
• Select the Windows platform from the dropdown menu
• Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh
• Click on the link to download Windows Offline Installation & save the file to your desktop
• Close any programs you may have running - especially your web browser
• Go to Start > Settings > Control Panel, double-click on Add/Remove Programs & remove all older versions of Java
• Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java(TM) 6) in the name
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions
• Reboot your computer once all Java components are removed
• Then from your desktop double-click on jre-6u22-windows-i586-p.exe to install the newest version

Please go to Kaspersky website and perform an online antivirus scan.

1. Read through the requirements and privacy statement and click on Accept button.
2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
3. When the downloads have finished, click on Settings.
4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
   Spyware, Adware, Dialers, and other potentially dangerous programs
   Archives
   
5. Click on My Computer under Scan.
6. Once the scan is complete, it will display the results. Click on View Scan Report.
7. You will see a list of infected items there. Click on Save Report As....
8. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
9. Please post this log in your next reply.

deltalima,

Kaspersky has my browser listed as a Safari , when I'm using Chrome. Is it alright to run this scan using either Firefox, or IE as the browser? I didn't see Chrome listed as an approved type of browser.

Internet Explorer should be fine.

Well, Kaspersky doesn't seem to like running on either Firefox or IE. I get to the scanning part & the scan starts, but seems to not move beyond 2% after an hour (or better) of scan time.
I have the anti-virus programs (Avast & Spyware Terminator) shut down (which makes me feel pretty vulnerable).
Anything else I can/should do?
Thanks.

Hi Deogee,

Kaspersky doesn't seem to like running

It can take a long time as it is very thorough.

If it refuses to progress any further then please run this alternative scan

ESET online scannner

• Please go Here then click on:
  

  Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
  All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

• Select the option YES, I accept the Terms of Use then click on:
• When prompted allow the Add-On/Active X to install.
• Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
• Now click on Advanced Settings and select the following:

• Scan for potentially unwanted applications
  
• Scan for potentially unsafe applications
• Enable Anti-Stealth Technology


• Now click on:
• The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
• Now click on:
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
• Copy and paste that log as a reply to this topic.

deltalima,
I managed to get Kaspersky to run & apparently, I still have a bug:


--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Wednesday, November 3, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Wednesday, November 03, 2010 10:45:51
Records in database: 4205373
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Objects scanned: 53251
Threats found: 1
Infected objects found: 1
Suspicious objects found: 0
Scan duration: 03:04:46


File name / Threat / Threats count
C:\Qoobox\Quarantine\MBR_HardDisk0.mbr Infected: Trojan-Clicker.Win32.Wistler.a 1

Selected area has been scanned.

Hi Deogee,

apparently, I still have a bug:

C:\Qoobox\Quarantine\MBR_HardDisk0.mbr Infected

That is OK!, it is the folder that Combofix makes a backup of items that it removes, we will remove that folder in the steps below, if you wish run another Kaspersky scan later to confirm.

Now that you are clean, please follow these steps in order to keep your computer clean and secure.

Remove GMER

Delete the GMER icon from your desktop.

Uninstall ComboFix

• Click START then RUN
  
• Now type Combofix /Uninstall in the runbox and click OK

Clean up with OTL

• Double-click OTL.exe to start the program. This will remove all the tools we used to clean your pc.
• Close all other programs apart from OTL as this step will require a reboot
• On the OTL main screen, press the CleanUp! button
• Say Yes to the prompt and then allow the program to reboot your computer.

Create a new, clean System Restore point which you can use in case of future system problems:

• Press Start >> All Programs >> Accessories >>System Tools >> System Restore
• Select Create a restore point, then Next, type a name like All Clean then press the Create button and once it's done press Close
• Now remove old, infected System Restore points:
• Next click Start >> Run and type cleanmgr in the box and press OK
• Ensure the boxes for Recycle Bin, Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
• Select the More Options tab, under System Restore press Clean up... and say Yes to the prompt
• Press OK and Yes to confirm

Update your AntiVirus Software and keep your other programs up-to-date
Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check


You MUST upgrade Internet Explorer from version 6 to version 8!!!!
Security Updates for Windows, Internet Explorer & Microsoft Office
Whenever a security problem in its software is found, Microsoft will usually create a patch so that after the patch is installed, attackers can't use the vulnerability to install malicious software on your PC. Keeping up with these patches will help to prevent malicious software being installed on your PC. Ensure you are registered for Windows updates via Start > right-click on My Computer > Properties > Automatic Updates tab or visit the Microsoft Update site on a regular basis.


Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware


Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.Follow this list and your potential for being infected again will reduce dramatically.

Here are some additional utilities that will enhance your safety

• MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
• Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
  Using Winpatrol to protect your computer from malicious software

Also, please read this great article by Tony Klein So How Did I Get Infected In First Place

Happy surfing and stay clean!

Who-HOO!! <insert dance of joy here> That's good news Deltalima!!
I'll follow the above recommendations, but I want to thank you--no way I could've done this without your EXCELLENT help!!
You guys/gals are the BEST!!

You're welcome!

Glad we could help.

As your problems appear to have been resolved,