Computer takes a LONG time to boot/printer driver messed up?

Hi

I deleted the old e-mail backup files. Could they have reinfected me if they were archive form?

In archive form, probably not. However released from the archive then a good possibility.

Other than that everything else looks good.

Clean Up
Now we need to clear out the programs we've been using to clean up your computer, they are not suitable for general malware removal and could cause damage if used inappropriately.
Remove ComboFix
The following will implement some cleanup procedures as well as reset System Restore points:
Click Start > Run then copy/paste the following bolded text into the Run box and click OK:
ComboFix /Uninstall
OTC
Download OTC by Old Timer here & save it to your desktop.
Double click on OTC.exe. Click on CleanUp!.
You will receive a prompt that it needs to restart the computer to remove the files. Click Yes.
It will restart your computer automatically. If it doesn't, please restart your computer manually.
You can delete the following from your desktop:
DDS.scr
The Gmer.exe file (it will be randomly named .exe file)
RootRepeal.exe & it's zip file
Any logs that may have been saved to your desktop
You should also remove HijackThis. You can do this by going to C:\Program Files\Trend Micro\HijackThis

• Double click HijackThis.exe
• From the Main menu click Open the Misc Tools section
• Using the scroll bar, scroll down to Uninstall HijackThis
• Click Uninstall HijackThis & exit then click Yes at the prompt

Any problems?

ESET Log File

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=989d615eab1e5d41a18341f42137ae3e
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-01-16 03:30:13
# local_time=2010-01-16 10:30:13 (-0500, Eastern Standard Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# compatibility_mode=9217 16776869 100 77 2108280 6936024 0 0
# scanned=379700
# found=17
# cleaned=0
# scan_time=37526
C:\Documents and Settings\Brian\My Documents\Downloads\S\System Mechanic\7 Pro\7.5.1\SystemMechanic7Pro.exe probably unknown NewHeur_PE virus 00000000000000000000000000000000 I
C:\Documents and Settings\Brian\My Documents\Downloads\S\System Mechanic\7 Pro\7.5.2\SystemMechanic7Pro.exe probably unknown NewHeur_PE virus 00000000000000000000000000000000 I
C:\Documents and Settings\Simona\Application Data\#ISW.FS#\Normal\20000000030d61.isw.sect Win32/Adware.Toolbar.Dealio application 00000000000000000000000000000000 I
C:\DOWNLOADS\U\UBCD4Win\3.50\UBCD4WinV350.exe multiple threats 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Program Files\pdfforge Toolbar\SearchSettings.dll.vir Win32/Adware.Toolbar.Dealio application 00000000000000000000000000000000 I
C:\Qoobox\Quarantine\C\Program Files\pdfforge Toolbar\SearchSettings.exe.vir Win32/Adware.Toolbar.Dealio application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{5D463703-BC8B-44E4-8480-54140A67AA9D}\RP1\A0000068.dll Win32/Adware.Toolbar.Dealio application 00000000000000000000000000000000 I
C:\System Volume Information\_restore{5D463703-BC8B-44E4-8480-54140A67AA9D}\RP2\A0001303.exe Win32/Adware.Toolbar.Dealio application 00000000000000000000000000000000 I
C:\UBCD4Win\BartPE\programs\Crossloop\winvnc.exe Win32/RemoteAdmin.WinVNC application 00000000000000000000000000000000 I
C:\UBCD4Win\BartPE\programs\sdfix\SDFix.exe Win32/PrcView application 00000000000000000000000000000000 I
C:\UBCD4Win\plugin\Cleanup Tools\SDFix\SDFix.exe Win32/PrcView application 00000000000000000000000000000000 I
C:\UBCD4Win\plugin\Network\CrossLoop\files\winvnc.exe Win32/RemoteAdmin.WinVNC application 00000000000000000000000000000000 I
C:\UBCD4Win2\plugin\Cleanup Tools\SDFix\SDFix.exe Win32/PrcView application 00000000000000000000000000000000 I
C:\UBCD4Win2\plugin\Network\CrossLoop\files\winvnc.exe Win32/RemoteAdmin.WinVNC application 00000000000000000000000000000000 I
G:\Taken from C\F\Firefox Downloads\Boot CD FIles\Autorun.inf INF/Autorun.gen trojan 00000000000000000000000000000000 I
G:\Taken from C\F\Firefox Downloads\crap\instantcake-tcd240040-401b02.iso INF/Autorun.gen trojan 00000000000000000000000000000000 I
G:\Taken from C\F\Firefox Downloads\crap\ptvlba48-4.01DD.iso INF/Autorun.gen trojan 00000000000000000000000000000000 I

Hi

My only concern in that log is the following:
C:\Qoobox\Quarantine\C\Program Files\pdfforge Toolbar\SearchSettings.dll.vir
C:\Qoobox\Quarantine\C\Program Files\pdfforge Toolbar\SearchSettings.exe.vir
C:\System Volume Information\_restore{5D463703-BC8B-44E4-8480-54140A67AA9D}\RP1\A0000068.dll
C:\System Volume Information\_restore{5D463703-BC8B-44E4-8480-54140A67AA9D}\RP2\A0001303.exe

Did you uninstall ComboFix as instructed in my last post? If so was this scan conducted after that? Or was that scan conducted before ComboFix was uninstalled?

Oh, sorry. I haven't done the cleanup yet. I did this scan before it. I will try the cleanup now. This scan was before ComboFix was uninstalled. I will uninstall it now with the directions from previous post.

I had a window named grep.cfxxe that stated something like this application failed to initialize because the window station is shutting down. Then I got a yellow box from the taskbar that stated hidec.exe DLL initialization failed and in the taskbar was a yellow triangle with an exclamation point. Also, I got a window stating Java was taking a long time to respond the window title bar had the directory for java.exe and the options were end now or cancel. I cancelled it and then did a manual restart of the system (start>Turn off computer>restart) as opposed to hard restart with power button. Zone Alarm threw a message about Widgi Toolbar Platform Patcher (apatch.exe) trying to access trusted zone. I denied it. I am not sure if that was due to opening Firefox or what prompted it. The location of the file is C:\Documents and Settings\Power User\Local Settings\Temp. The properties of the file list an original name of WTPatch.exe from Spigot, Inc.

regarding HijackThis: I can't find C:\Program Files\Trend Micro\HijackThis.

Hi

Did that all happen as attempted uninstall ComboFix?

With regard to HijackThis... Try uninstalling it from Add or Remove programs. I also see you have it at C:\Documents and Settings\Power User\Desktop\HijackThis.exe.

it was after clicking on otc.exe. I checked add/remove programs and there is no listing there either. I already deleted the desktop one as well. Should I reinstall then uninstall?

Hi

Appears as though HijackThis is gone. I assume you only used the executable & did not install it.

With regard to OTC. Is that still on your desktop, or did it delete itself as it was supposed to?

OTC is no longer on the desktop. It must have deleted itself.

The system seems to run pretty good. It still takes awhile to boot, but I think it is all the files that load at startup. I had in the past (before coming here) used System Mechanic to trim some of the useless files from startup. So I think most of the ones that load I actually use in some way.

Is there anything I should do to help prevent malware/infection in the future?

Hi
Good to hear your computer is running well.

All Clean
Congratulations, good work, your system is now appears to be clean. Now that your system is safe we would like you to keep it that way.
Take the time to follow these recommendations & it will greatly reduce the risk of further infections and greatly diminish the chances of you having to visit here again.

Create a Clean System Restore Point
Create a new, clean System Restore point which you can use in case of future system problems:
Press Start->All Programs->Accessories->System Tools->System Restore
Select Create a restore point, then Next, type a name like All Clean then press the Create button and once it's done press Close
Now remove old, infected System Restore points:
Next click Start->Run and type cleanmgr in the box and click OK
Ensure the boxes for Temporary Files & Temporary Internet Files are checked. You can choose to check other boxes if you wish but they are not required.
Select the More Options tab, under System Restore click Clean up... and click Yes to the prompt
Click OK and Yes to confirm.

Microsoft Windows Update
Microsoft releases patches for Windows and Office products regularly to patch up Windows and Office products loopholes and fix any bugs found. Install the updates immediately if they are found.
To update Windows
Go to Start > All Programs > Windows Update
To update Office
Open up any Office program.
Go to Help > Check for Updates

Malwarebytes' Anti-Malware
Malwarebytes' Anti-Malware is a new and powerful anti-malware tool. It is totally free but for real-time protection you will have to pay a small one-time fee.
You can download it here & find a tutorial here. Keep it updated & run it regularly.

SpywareBlaster
I note that you have this already installed. SpywareBlaster adds a list of ActiveX controls, tracking cookies and sites which will be blocked in either Internet Explorer or Firefox browsers. Unless you have the paid version, you need to manually check for updates regularly.

Download and Install a HOSTS File
A HOSTS file is a big list of bad web sites. The list has a specific format, a specific name, (name is just HOSTS with no file extension), and a specific location. Your machine always looks at that file in that location before connecting to a web site to verify the address. So the HOSTS listing can be used to "short circuit" a request to a bad website by giving it the address of your own machine.

Download BlueTack's HOSTS Manager here, using Internet Explorer (Firefox won't work) & save hosts20setup.exe to your desktop:

• Double click Hosts20setup.exe on your desktop and let it Install the Hosts Manager
• After the installation is complete, click on the Hosts Manager icon on your desktop. (You can delete the other Hosts Switch icon from your desktop)
• When the Hosts Manager comes up, click the small down arrows on the right side of the bar labeled Options and Tools,
• Click Disable DNS Service. This is important
• In the Left Pane, click Download
• It will load 80,000 lines or more. When it finishes, also in the left pane, click Replace, and then click Save

You can use this manager to handle your HOSTS file download, edits, and most any other HOSTS issue.
If you have a separate party firewall or Winpatrol, you may have to give permissions at various times to Unlock the present default HOSTS file and install the new one.

Install WinPatrol
Download it here
You can find information about how WinPatrol works here

Read some information here on how to prevent Malware.

Hopefully these steps will help keep your computer clean.

Stand Up and Be Counted ---> Malware Complaints <--- where you can make difference!
The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.

If there are any other questions then feel free to ask or in future do not hesitate to contact us here at The Malware Removal Forums

As your problems appear to have been resolved,