Random Pop Ups and running VERY slow

Hi....

I'm kevinf80 and I will be helping with any issues you may have. Please be aware that some of the logs I may ask for can be very complex and can take a long time to decipher. I am a volunteer here with a job and family so I ask that you be patient when waiting for replies.
Please DO NOT run any scans/tools/fixes on your own as this will conflict with the tools we are going to use.
Please Print or Save to Notepad all instructions and please follow them carefully and if there's something you don't understand or that will not work please let me know and we will go through it together.
Malware is often buggy and can be very unstable, with that in mind it is advisable to backup any important data before we begin.
If you do not reply within 72 hours the thread will be closed, if you need more time let me know. Likewise if I do not respond within 48 hours feel free to PM me.

* If you are using any cracked software, please remove it. In addition to being illegal, when you install cracked software, you are running executable files from dubious, unknown sources. You are giving these sources access to information on your hard disk, and potential control over operation of your computer. Definition of cracked software HERE

** If you are using any P2P (file sharing) programs, please remove them before we clean your computer. The nature of such software and the high incidence of malware in files downloaded with them is counter productive to restoring your PC to a healthy state. That includes BitTorrent and similar programs. There is a partial list HERE

Please proceed as follows :-

Delete any versions of Combofix that you may have on your Desktop, download a fresh copy from either of the following links :-

Link 1

Link 2

• Ensure that Combofix is saved directly to the Desktop <--- Very important
• Disable all security programs as they will have a negative effect on Combofix, instructions available Here if required. Be aware the list may not have all programs listed, if you need more help please ask.
• Close any open browsers and any other programs you might have running
• Double click the icon to run the tool (Vista or Windows 7 users right click and select "Run as Administrator)
• Instructions for running Combofix available Here if required.
• If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?" Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.
• When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read Here why disabling autoruns is recommended.

*EXTRA NOTES*

• If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
• If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal
• If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)

Post the log in next reply please...

Kevin

Hi Kevin,

Thank you so much for helping me with this! I have downloaded and ran Combo Fix... It did delete somethings and did a log... Here it is!  Again thank you so much!

Joe

ComboFix 11-07-11.04 - Joseph Tavares 07/11/2011  21:11:42.1.1 - x86

Microsoft Windows XP Home Edition  5.1.2600.3.1252.1.1033.18.766.359 [GMT -7:00]

Running from: c:\documents and settings\Joseph Tavares\Desktop\ComboFix.exe

AV: Norton Security Suite *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}

FW: Norton Security Suite *Enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

.

.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\documents and settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65

c:\documents and settings\All Users\Application Data\SeekmoSA

c:\documents and settings\All Users\Application Data\SeekmoSA\SeekmoSA.dat

c:\documents and settings\All Users\Application Data\SeekmoSA\SeekmoSA_gdf.dat

c:\documents and settings\All Users\Application Data\SeekmoSA\SeekmoSA_kyf.dat

c:\documents and settings\All Users\Application Data\SeekmoSA\SeekmoSAAbout.mht

c:\documents and settings\All Users\Application Data\SeekmoSA\SeekmoSAau.dat

c:\documents and settings\All Users\Application Data\SeekmoSA\SeekmoSAEULA.mht

c:\documents and settings\All Users\Start Menu\Programs\Seekmo

c:\documents and settings\All Users\Start Menu\Programs\Seekmo\Reset Cursor.lnk

c:\documents and settings\All Users\Start Menu\Programs\Seekmo\Seekmo Customer Support Center.lnk

c:\documents and settings\All Users\Start Menu\Programs\Seekmo\Seekmo Uninstall Instructions.lnk

c:\documents and settings\Joseph Tavares\Application Data\Seekmo

c:\documents and settings\Joseph Tavares\Local Settings\Application Data\{48E13D2D-7593-4824-8824-B5011AFB9705}

c:\documents and settings\Joseph Tavares\Local Settings\Application Data\{48E13D2D-7593-4824-8824-B5011AFB9705}\chrome.manifest

c:\documents and settings\Joseph Tavares\Local Settings\Application Data\{48E13D2D-7593-4824-8824-B5011AFB9705}\chrome\content\_cfg.js

c:\documents and settings\Joseph Tavares\Local Settings\Application Data\{48E13D2D-7593-4824-8824-B5011AFB9705}\chrome\content\overlay.xul

c:\documents and settings\Joseph Tavares\Local Settings\Application Data\{48E13D2D-7593-4824-8824-B5011AFB9705}\install.rdf

c:\documents and settings\Joseph Tavares\WINDOWS

c:\documents and settings\LocalService\Application Data\Seekmo

c:\program files\FunWebProducts

c:\program files\FunWebProducts\ScreenSaver\Images\17B5CB7E.urr

c:\program files\MyWebSearch

c:\program files\MyWebSearch\bar\History\search3

c:\program files\MyWebSearch\bar\Settings\s_pid.dat

c:\program files\MyWebSearch\bar\Settings\setting2.htm

c:\program files\MyWebSearch\bar\Settings\settings.dat

c:\program files\Search Toolbar

c:\program files\Search Toolbar\icon.ico

c:\program files\Search Toolbar\SearchToolbar.dll

c:\program files\Search Toolbar\SearchToolbarUninstall.exe

c:\program files\Search Toolbar\SearchToolbarUpdater.exe

c:\windows\Downloaded Program Files\f3initialsetup1.0.1.1.inf

c:\windows\system32\drivers\etc\lmhosts

c:\windows\system32\twain.dll

.

.

(((((((((((((((((((((((((   Files Created from 2011-06-12 to 2011-07-12  )))))))))))))))))))))))))))))))

.

.

2011-07-12 04:04 . 2011-07-12 04:05 -------- d-----w- C:\32788R22FWJFW

2011-07-09 05:27 . 2011-07-09 05:27 388096 ----a-r- c:\documents and settings\Joseph Tavares\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-07-09 05:27 . 2011-07-09 05:27 -------- d-----w- c:\program files\Trend Micro

2011-07-09 00:43 . 2011-07-09 00:43 -------- d-----w- c:\documents and settings\Joseph Tavares\Local Settings\Application Data\FixItCenter

2011-07-09 00:36 . 2011-07-09 00:36 -------- d-----w- c:\windows\MATS

2011-07-09 00:36 . 2011-07-09 00:36 -------- d-----w- c:\program files\Microsoft Fix it Center

2011-07-09 00:34 . 2011-07-09 00:34 -------- d-----w- c:\documents and settings\Joseph Tavares\Application Data\ElevatedDiagnostics

2011-07-08 23:59 . 2011-07-08 23:59 -------- d-----w- c:\windows\Performance

2011-07-08 23:58 . 2011-07-08 23:58 -------- d-----w- c:\documents and settings\Joseph Tavares\Local Settings\Application Data\Microsoft Corporation

2011-07-08 23:58 . 2011-07-08 23:58 -------- d-----w- c:\program files\Microsoft Windows 7 Upgrade Advisor

2011-07-06 15:33 . 2011-07-06 15:33 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-07-06 15:03 . 2011-07-06 18:12 -------- d-----w- c:\documents and settings\Joseph Tavares\Local Settings\Application Data\NPE

2011-07-01 15:41 . 2011-07-01 15:41 -------- d-----w- c:\windows\system32\winrm

2011-07-01 15:41 . 2011-07-01 15:42 -------- dc-h--w- c:\windows\$968930Uinstall_KB968930$

2011-07-01 15:41 . 2011-07-01 15:41 -------- d-----w- c:\documents and settings\Joseph Tavares\Application Data\Windows Desktop Search

2011-07-01 15:40 . 2011-07-02 07:57 -------- d-----w- c:\program files\Windows Desktop Search

2011-07-01 15:40 . 2011-07-01 15:40 -------- d-----w- c:\windows\system32\GroupPolicy

2011-07-01 15:37 . 2008-03-07 17:02 98304 ------w- c:\windows\system32\dllcache\nlhtml.dll

2011-07-01 15:37 . 2008-03-07 17:02 29696 ------w- c:\windows\system32\dllcache\mimefilt.dll

2011-07-01 15:37 . 2008-03-07 17:02 192000 ------w- c:\windows\system32\dllcache\offfilt.dll

2011-07-01 08:42 . 2004-08-04 10:00 5632 ----a-w- c:\windows\system32\wbem\snmp\smimsgif.dll

2011-07-01 08:42 . 2004-08-04 10:00 5632 ----a-w- c:\windows\system32\wbem\snmp\smierrsy.dll

2011-07-01 08:42 . 2004-08-04 10:00 5632 ----a-w- c:\windows\system32\dllcache\smimsgif.dll

2011-07-01 08:42 . 2004-08-04 10:00 5632 ----a-w- c:\windows\system32\dllcache\smierrsy.dll

2011-07-01 08:42 . 2004-08-04 10:00 15872 ----a-w- c:\windows\system32\wbem\snmp\smierrsm.dll

2011-07-01 08:42 . 2004-08-04 10:00 15872 ----a-w- c:\windows\system32\dllcache\smierrsm.dll

2011-07-01 08:42 . 2004-08-04 10:00 10240 ----a-w- c:\windows\system32\wbem\snmpstup.dll

2011-07-01 08:42 . 2004-08-04 10:00 10240 ----a-w- c:\windows\system32\dllcache\snmpstup.dll

2011-07-01 08:37 . 2011-07-01 08:37 -------- d-----w- c:\documents and settings\All Users\Application Data\{AB2D8F2E-F7AD-4446-A11A-50D846B2CF2A}

2011-06-27 20:27 . 2011-07-04 07:25 -------- d-----w- c:\documents and settings\Joseph Tavares\Local Settings\Application Data\Conduit

2011-06-27 06:29 . 2011-06-27 06:29 -------- d-----w- c:\documents and settings\Joseph Tavares\Local Settings\Application Data\Dell

2011-06-27 05:47 . 2011-06-27 05:47 -------- d-----w- c:\documents and settings\Joseph Tavares\Application Data\Uniblue

2011-06-27 05:47 . 2011-06-27 05:47 -------- d-----w- c:\program files\Uniblue

2011-06-27 05:47 . 2011-06-27 05:47 -------- d-----w- c:\documents and settings\Joseph Tavares\Local Settings\Application Data\PackageAware

2011-06-16 04:40 . 2011-04-21 13:37 105472 ------w- c:\windows\system32\dllcache\mup.sys

.

.

.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-06-03 00:11 . 2011-06-02 23:04 60872 ----a-w- c:\windows\system32\S32EVNT1.DLL

2011-06-03 00:11 . 2011-06-02 23:04 126584 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS

2011-05-02 15:31 . 2004-08-10 18:02 692736 ----a-w- c:\windows\system32\inetcomm.dll

2011-04-29 17:25 . 2004-08-10 17:51 151552 ----a-w- c:\windows\system32\schannel.dll

2011-04-29 16:19 . 2006-05-11 11:52 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-04-25 16:11 . 2004-08-10 17:51 916480 ----a-w- c:\windows\system32\wininet.dll

2011-04-25 16:11 . 2004-08-10 17:51 43520 ------w- c:\windows\system32\licmgr10.dll

2011-04-25 16:11 . 2004-08-10 17:51 1469440 ------w- c:\windows\system32\inetcpl.cpl

2011-04-25 12:01 . 2004-08-10 17:51 385024 ----a-w- c:\windows\system32\html.iec

2011-04-21 13:37 . 2004-08-10 17:51 105472 ----a-w- c:\windows\system32\drivers\mup.sys

.

.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B84CDBE7-1B46-494B-A188-01D4C52DEB61}]

2011-06-02 19:07 99912 ----a-w- c:\program files\Constant Guard Protection Suite\NativeBHO.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-14 206064]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-15 1404928]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-04-06 94208]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-04-06 77824]

"Persistence"="c:\windows\system32\igfxpers.exe" [2005-04-06 114688]

"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]

"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-05-11 98304]

"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-14 206064]

"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 1121792]

"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]

"ddoctorv2"="c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe" [2008-04-24 202560]

"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-02-18 49208]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Constant Guard.lnk - c:\program files\Constant Guard Protection Suite\IDVault.exe [2011-6-14 3231816]

Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-5-11 24576]

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624]

Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ   \0

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\WINDOWS\\system32\\mmc.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management

.

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0501000.01D\symds.sys [6/2/2011 5:11 PM 340088]

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0501000.01D\symefa.sys [6/2/2011 5:11 PM 744568]

R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20110701.001\BHDrvx86.sys [7/5/2011 1:00 PM 810616]

R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0501000.01D\ironx86.sys [6/2/2011 5:11 PM 136312]

R2 IDVaultSvc;CGPS Service;c:\program files\Constant Guard Protection Suite\IDVaultSvc.exe [6/14/2011 12:24 PM 60488]

R2 N360;Norton Security Suite;c:\program files\Norton Security Suite\Engine\5.1.0.29\ccsvchst.exe [6/2/2011 5:11 PM 130008]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [7/3/2011 9:53 AM 105592]

R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20110708.032\IDSXpx86.sys [7/8/2011 8:24 PM 355256]

R3 MatSvc;Microsoft Automated Troubleshooting Service;c:\program files\Microsoft Fix it Center\Matsvc.exe [6/13/2011 10:09 PM 267568]

S1 MpKsl7c64d9fa;MpKsl7c64d9fa;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{31A346DE-A14C-4D65-B765-168701664CB8}\MpKsl7c64d9fa.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{31A346DE-A14C-4D65-B765-168701664CB8}\MpKsl7c64d9fa.sys [?]

S1 papycpu;papycpu;c:\windows\system32\drivers\papycpu.sys --> c:\windows\system32\drivers\papycpu.sys [?]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [7/6/2011 8:34 AM 136176]

S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [8/10/2004 10:51 AM 14336]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

getPlusHelper REG_MULTI_SZ   getPlusHelper

WINRM REG_MULTI_SZ   WINRM

.

Contents of the 'Scheduled Tasks' folder

.

2011-07-12 c:\windows\Tasks\ConfigExec.job

- c:\program files\Microsoft Fix it Center\MatsApi.dll [2011-06-14 05:09]

.

2011-07-12 c:\windows\Tasks\DataUpload.job

- c:\program files\Microsoft Fix it Center\MatsApi.dll [2011-06-14 05:09]

.

2011-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-06 15:34]

.

2011-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-06 15:34]

.

2011-07-11 c:\windows\Tasks\User_Feed_Synchronization-{01F6BAB1-137E-4B93-81D5-086313018064}.job

- c:\windows\system32\msfeedssync.exe [2006-10-17 11:31]

.

.

------- Supplementary Scan -------

.

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_43C348BC2E93EB2B.dll/cmsidewiki.html

TCP: DhcpNameServer = 68.87.69.150 68.87.85.102

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-Locked - (no file)

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

HKCU-Run-updateMgr - c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

AddRemove-AOL Toolbar 5.0 - c:\program files\AOL\AOL Toolbar 5.0\uninstall.exe

AddRemove-Search Toolbar - c:\program files\Search Toolbar\SearchToolbarUninstall.exe

AddRemove-WebCyberCoach_wtrb - c:\program files\WebCyberCoach\b_Dell\WCC_Wipe.exe WebCyberCoach ext\wtrb

AddRemove-{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} - c:\documents and settings\All Users\Application Data\{AB2D8F2E-F7AD-4446-A11A-50D846B2CF2A}\bm_installer.exe

AddRemove-CodecsDivX - c:\program files\DivXCodecs\Uninstall.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-07-11 21:33

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...  

.

scanning hidden autostart entries ...

.

scanning hidden files ...  

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N360]

"ImagePath"="\"c:\program files\Norton Security Suite\Engine\5.1.0.29\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Engine\5.1.0.29\diMaster.dll\" /prefetch:1"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'explorer.exe'(600)

c:\windows\system32\WININET.dll

c:\program files\Windows Desktop Search\deskbar.dll

c:\program files\Windows Desktop Search\en-us\dbres.dll.mui

c:\program files\Windows Desktop Search\dbres.dll

c:\program files\Windows Desktop Search\wordwheel.dll

c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui

c:\program files\Windows Desktop Search\msnlExtRes.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\netdde.exe

c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

c:\windows\system32\msiexec.exe

c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

c:\windows\System32\snmp.exe

c:\program files\Comcast\Desktop Doctor\bin\sprtsvc.exe

c:\program files\Dell Support Center\bin\sprtsvc.exe

c:\windows\system32\SearchIndexer.exe

c:\windows\system32\wscntfy.exe

c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe

c:\windows\system32\SearchProtocolHost.exe

c:\windows\system32\SearchFilterHost.exe

.

**************************************************************************

.

Completion time: 2011-07-11  21:41:34 - machine was rebooted

ComboFix-quarantined-files.txt  2011-07-12 04:41

.

Pre-Run: 43,046,273,024 bytes free

Post-Run: 43,849,052,160 bytes free

.

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

.

- - End Of File - - 0AFA3AE68E47BE838A025A1A03690AEA

Hiya Joe,

Continue as follows please :-

Step 1

We need to upload a file to Jotti

1. Click HERE to get to Jotti's site.

2. At the top of the Jotti window, use the Browse button to locate the following file on your system:

c:\windows\system32\drivers\papycpu.sys

3. Once you have located the file, click SUBMIT and the content of the file will be uploaded by the site and analysed.

4. Please provide me with the results of the analysis.

Upload same File to Virustotal

Please visit Virustotal

• Click the Browse... button
• Navigate to the file c:\windows\system32\drivers\papycpu.sys
• Click the Open button
• Click the Send button
• If you get a message saying File has already been analyzed: click Reanalyze file now
• Copy and paste the results back here please.

Step 2

Please download Malwarebytes Anti-Malware and save it to your desktop.
Alernative D/L mirror
Alternative D/L mirror

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• Please save the log to a location you will remember.
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Step 3

Run ESET Online Scan

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.ESET OnlineScan
• Click the button.
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on to download the ESET Smart Installer. Save it to your desktop.
• Double click on the icon on your desktop.

• Check
• Click the button.
• Accept any security warnings from your browser.
• Check
• Leave the tick out of remove found threats
• Push the Start button.
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• When the scan completes, push
• Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
• Push the button.
• Push

You can refer to this animation by neomage if needed.
Frequently asked questions available Here Please read them before running the scan.

Also be aware this scan can take between one and several hours to complete depending on the size of your system.

ESET log can be found here "C:\Program Files\ESET\EsetOnlineScanner\log.txt".

Step 4

Download Security Check by screen317 from HERE or HERE.
Save it to your Desktop.
Double click SecurityCheck.exe (Vista or Windows 7 users right click and select "Run as Administrator") and follow the onscreen instructions inside of the black box. Press any key when asked.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

What i`d like in your reply :-

• Results from Jotti and VirusTotal
• Log from Malwarebytes
• Log from ESET
• Log from Security Checks
• Update on issues/concerns

Kevin

Hi Kevin,

I attempted all the steps, I am not sure if this all worked or not but below are the copies of the logs. Please let me know if I am missing something.   So far the computer is still running very slow and freezing. Again, i appreciate all your help with this!!!

Joe

Jotti's malware scan

Filename:  log.txt  

Status:  Acquiring previous results...

--------------------------------------------------------------------------------

Additional info

File size:  18658 bytes  

Filetype:  ASCII English text, with very long lines, with CRLF line terminators  

MD5:  8f20e3419f992f8131ce3a6cfedad6ce  

SHA1:  054e3eaa9b4f41bc9c08a40d36e17eb5ddfd4e44  

Scanners

 No result available   No result available

 No result available   No result available

 No result available   No result available

 No result available   No result available

 No result available   No result available

 No result available   No result available

 No result available   No result available

 No result available   No result available

 No result available   No result available

 No result available   No result available

File name:

log.txt

Submission date:

2011-07-12 18:00:42 (UTC)

Current status:

finished

Result:

0 /43 (0.0%)

VT Community

not reviewed

Safety score: -

Compact

Print results

Antivirus

Version

Last Update

Result

AhnLab-V3

2011.07.13.00

2011.07.12

-

AntiVir

7.11.11.93

2011.07.12

-

Antiy-AVL

2.0.3.7

2011.07.12

-

Avast

4.8.1351.0

2011.07.12

-

Avast5

5.0.677.0

2011.07.12

-

AVG

10.0.0.1190

2011.07.12

-

BitDefender

7.2

2011.07.12

-

CAT-QuickHeal

11.00

2011.07.11

-

ClamAV

0.97.0.0

2011.07.12

-

Commtouch

5.3.2.6

2011.07.12

-

Comodo

9362

2011.07.12

-

DrWeb

5.0.2.03300

2011.07.12

-

Emsisoft

5.1.0.8

2011.07.12

-

eSafe

7.0.17.0

2011.07.12

-

eTrust-Vet

36.1.8439

2011.07.12

-

F-Prot

4.6.2.117

2011.07.12

-

F-Secure

9.0.16440.0

2011.07.12

-

Fortinet

4.2.257.0

2011.07.12

-

GData

22

2011.07.12

-

Ikarus

T3.1.1.104.0

2011.07.12

-

Jiangmin

13.0.900

2011.07.12

-

K7AntiVirus

9.108.4894

2011.07.11

-

Kaspersky

9.0.0.837

2011.07.12

-

McAfee

5.400.0.1158

2011.07.12

-

McAfee-GW-Edition

2010.1D

2011.07.12

-

Microsoft

1.7000

2011.07.12

-

NOD32

6288

2011.07.12

-

Norman

6.07.10

2011.07.12

-

nProtect

2011-07-12.03

2011.07.12

-

Panda

10.0.3.5

2011.07.12

-

PCTools

8.0.0.5

2011.07.12

-

Prevx

3.0

2011.07.12

-

Rising

23.66.00.03

2011.07.11

-

Sophos

4.67.0

2011.07.12

-

SUPERAntiSpyware

4.40.0.1006

2011.07.12

-

Symantec

20111.1.0.186

2011.07.12

-

TheHacker

6.7.0.1.253

2011.07.12

-

TrendMicro

9.200.0.1012

2011.07.12

-

TrendMicro-HouseCall

9.200.0.1012

2011.07.12

-

VBA32

3.12.16.4

2011.07.12

-

VIPRE

9843

2011.07.12

-

ViRobot

2011.7.12.4564

2011.07.12

-

VirusBuster

14.0.121.0

2011.07.12

-

Additional information

Show all

MD5 : 8f20e3419f992f8131ce3a6cfedad6ce

SHA1 : 054e3eaa9b4f41bc9c08a40d36e17eb5ddfd4e44

SHA256: 7429dc88d2720ea97afab8411709a9318c620b07b3025573356ad115275732a2

VT Community

Information Registry enforcer 2011-07-12 14:09:25 Inspecting WinSock registry (LSP Chain)

Information Registry enforcer 2011-07-12 14:09:25 Inspecting WinSock registry (LSP Chain)

Information Registry enforcer 2011-07-12 14:09:24 Inspecting WinSock registry (LSP Chain)

Information Registry enforcer 2011-07-12 14:09:21 Inspecting WinSock registry (LSP Chain)

Information Registry enforcer 2011-07-12 14:09:18 Inspecting WinLogon notification handlers and modules loaded by WinLogon

Information Registry enforcer 2011-07-12 14:09:18 Inspecting WinSock registry (LSP Chain)

Information Registry enforcer 2011-07-12 14:09:00 Inspecting WinLogon notification handlers and modules loaded by WinLogon

Information Registry enforcer 2011-07-12 14:09:00 Inspecting WinSock registry (LSP Chain)

Block/Extraction NT Service enforcer 2011-07-12 14:08:49 Disabled service: messenger -

Block/Extraction NT Service enforcer 2011-07-12 14:08:48 Disabled service: messenger -

Information General 2011-07-12 14:08:41 Completed system scan.

Block/Extraction NT Service enforcer 2011-07-12 14:00:36 Disabled service: messenger -

Block/Extraction NT Service enforcer 2011-07-12 14:00:36 Disabled service: messenger -

Information General 2011-07-12 13:58:37 Started system scan.

Block/Extraction NT Service enforcer 2011-07-12 13:58:37 Disabled service: messenger -

Block/Extraction NT Service enforcer 2011-07-12 13:58:34 Disabled service: messenger -

Information Registry enforcer 2011-07-12 13:58:17 Inspecting WinSock registry (LSP Chain)

Information Registry enforcer 2011-07-12 13:58:13 Inspecting WinSock registry (LSP Chain)

Information Registry enforcer 2011-07-12 13:58:07 Inspecting WinSock registry (LSP Chain)

Information Registry enforcer 2011-07-12 13:58:07 Inspecting WinLogon notification handlers and modules loaded by WinLogon

Block/Extraction NT Service enforcer 2011-07-12 13:57:58 Disabled service: messenger -

Block/Extraction NT Service enforcer 2011-07-12 13:57:58 Disabled service: messenger -

Information Registry enforcer 2011-07-12 13:57:57 Inspecting WinSock registry (LSP Chain)

Information Registry enforcer 2011-07-12 13:57:55 Inspecting WinLogon notification handlers and modules loaded by WinLogon

Information General 2011-07-12 13:57:48 Completed system scan.

Information General 2011-07-12 13:56:51 Started system scan.

Information Internet ExplorerSiteguard 2011-07-12 13:55:37 Inspecting registered Internet Explorer toolbars

Block/Extraction NT Service enforcer 2011-07-12 13:55:19 Disabled service: messenger -

Block/Extraction NT Service enforcer 2011-07-12 13:55:16 Disabled service: messenger -

Information Registry enforcer 2011-07-12 13:55:16 Inspecting registered Explorer bars

Information Registry enforcer 2011-07-12 13:55:16 Inspecting WinLogon notification handlers and modules loaded by WinLogon

Information Registry enforcer 2011-07-12 13:54:56 Inspecting WinSock registry (LSP Chain)

Information Registry enforcer 2011-07-12 13:54:54 Inspecting registered Browser Helper Objects (BHOs)

Block/Extraction NT Service enforcer 2011-07-12 13:54:41 Disabled service: messenger -

Information Process enforcer 2011-07-12 13:54:39 Starting process watcher

Block/Extraction NT Service enforcer 2011-07-12 13:49:59 Disabled service: messenger -

Block/Extraction NT Service enforcer 2011-07-12 13:49:55 Disabled service: messenger -

Block/Extraction NT Service enforcer 2011-07-12 13:48:58 Disabled service: messenger -

Block/Extraction NT Service enforcer 2011-07-12 13:48:58 Disabled service: messenger -

Block/Extraction NT Service enforcer 2011-07-12 13:47:24 Disabled service: messenger -

Block/Extraction NT Service enforcer 2011-07-12 13:47:24 Disabled service: messenger -

Block/Extraction NT Service enforcer 2011-07-12 13:47:18 Disabled service: messenger -

Block/Extraction NT Service enforcer 2011-07-12 13:47:18 Disabled service: messenger -

Block/Extraction NT Service enforcer 2011-07-12 13:47:02 Disabled service: messenger -

Block/Extraction NT Service enforcer 2011-07-12 13:47:02 Disabled service: messenger -

Information Registry enforcer 2011-07-12 13:46:50 Inspecting WinSock registry (LSP Chain)

Information Registry enforcer 2011-07-12 13:46:49 Inspecting WinLogon notification handlers and modules loaded by WinLogon

Block/Extraction NT Service enforcer 2011-07-12 13:46:37 Removed service: catchme - catchme

Information Registry enforcer 2011-07-12 13:46:36 Inspecting WinSock registry (LSP Chain)

Information Registry enforcer 2011-07-12 13:46:36 Inspecting WinLogon notification handlers and modules loaded by WinLogon

Block/Extraction Registry enforcer 2011-07-12 13:46:29 Extracted registry key HKLM\SYSTEM\CurrentControlSet\Services\catchme

Block/Extraction Registry enforcer 2011-07-12 13:46:18 Deleted registry value DisableRegistryTools in hklm\software\microsoft\windows\currentversion\policies\system

Warning/Detection COM enforcer 2011-07-12 13:46:18 Detected malicious registry entry DisableRegistryTools in hklm\software\microsoft\windows\currentversion\policies\system

Block/Extraction Registry enforcer 2011-07-12 13:46:10 Extracted registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME

Block/Extraction Registry enforcer 2011-07-12 13:46:08 Deleted registry value system in hklm\software\microsoft\windows nt\currentversion\winlogon

Information Registry enforcer 2011-07-12 13:46:05 Inspecting WinSock registry (LSP Chain)

Information Registry enforcer 2011-07-12 13:46:04 Inspecting WinLogon notification handlers and modules loaded by WinLogon

Information General 2011-07-12 13:45:52 Request to update definitions completed successfully.

Information General 2011-07-12 13:43:31 Anti-Spyware Incremental definition update 5.0.91.78 successfully applied.

Block/Extraction NT Service enforcer 2011-07-12 13:42:46 Removed driver: c:\combofix\catchme.sys

Information Internet ExplorerSiteguard 2011-07-12 13:42:15 Inspecting registered Internet Explorer toolbars

Information Registry enforcer 2011-07-12 13:42:15 Inspecting registered Explorer bars

Information Registry enforcer 2011-07-12 13:42:15 Inspecting registered Browser Helper Objects (BHOs)

Information Process enforcer 2011-07-12 13:42:14 Starting process watcher

C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Start Menu\Programs\Seekmo\Seekmo Customer Support Center.lnk.vir LNK/URL.B trojan

C:\Qoobox\Quarantine\C\Program Files\Search Toolbar\SearchToolbar.dll.vir Win32/Toolbar.Zugo application

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1867\A0072290.lnk LNK/URL.B trojan

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1867\A0072294.dll Win32/Toolbar.Zugo application

Results of screen317's Security Check version 0.99.17  

Windows XP Service Pack 3  

Internet Explorer 8  

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Disabled!  

ESET Online Scanner v3  

```````````````````````````````

Anti-malware/Other Utilities Check:

Java 2 Runtime Environment, SE v1.4.2_03

Adobe Flash Player  

````````````````````````````````

Process Check:  

objlist.exe by Laurent

Norton ccSvcHst.exe

``````````End of Log````````````

Hiya Joe,

Did you upload the correct file for analysis, the Jotti log is indicating this file :-

Filename: log.txt

You should have uploaded c:\windows\system32\drivers\papycpu.sys

OK just leave that for now, if there are still issues we need a deeper scan to see if we`ve missed something....

Download the GMER Rootkit Scanner. Unzip it to your Desktop.
Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur

Disable the active protection component of your antivirus and antispyware programs by following the directions that apply here:
Temporarily disable Security

Do not use your computer for anything else during the scan.

• Double click GMER.exe.
• If it gives you a warning about rootkit activity and asks if you want to run a full scan...click on NO Then use the following settings for a more complete scan..
• In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED ...
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
    
    Click the image to enlarge it
    
    
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "ark.txt"
• Save the log where you can easily find it, such as your desktop.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

Please copy and paste the report into your Post.

Hi Kevin,

I apologize I havent gotten back to you on this... I think I did everything right. I am not very good at the computer and this is a lot for me! Thank you for your understanding!

Here is the log

GMER 1.0.15.15641 - http://www.gmer.net

Rootkit scan 2011-07-17 19:04:16

Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD800BB-75JHC0 rev.06.01C06

Running: gmer.exe; Driver: C:\DOCUME~1\JOSEPH~1\LOCALS~1\Temp\pxtdypow.sys

---- System - GMER 1.0.15 ----

SSDT            83578610                                                                                    ZwAlertResumeThread

SSDT            8357C170                                                                                    ZwAlertThread

SSDT            8365CA08                                                                                    ZwAllocateVirtualMemory

SSDT            8355E4F0                                                                                    ZwAssignProcessToJobObject

SSDT            838B84B0                                                                                    ZwConnectPort

SSDT            \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)  ZwCreateKey [0xEE1E6710]

SSDT            838B2710                                                                                    ZwCreateMutant

SSDT            83449880                                                                                    ZwCreateSymbolicLinkObject

SSDT            83894C20                                                                                    ZwCreateThread

SSDT            835630D8                                                                                    ZwDebugActiveProcess

SSDT            \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)  ZwDeleteKey [0xEE1E6990]

SSDT            \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)  ZwDeleteValueKey [0xEE1E6EF0]

SSDT            83832C88                                                                                    ZwDuplicateObject

SSDT            83816138                                                                                    ZwFreeVirtualMemory

SSDT            83578460                                                                                    ZwImpersonateAnonymousToken

SSDT            83578538                                                                                    ZwImpersonateThread

SSDT            8353FA18                                                                                    ZwLoadDriver

SSDT            8383F6F0                                                                                    ZwMapViewOfSection

SSDT            83574E90                                                                                    ZwOpenEvent

SSDT            838A53B0                                                                                    ZwOpenProcess

SSDT            83590E08                                                                                    ZwOpenProcessToken

SSDT            83569350                                                                                    ZwOpenSection

SSDT            8364AC10                                                                                    ZwOpenThread

SSDT            8343B970                                                                                    ZwProtectVirtualMemory

SSDT            8357E0D8                                                                                    ZwResumeThread

SSDT            8343B140                                                                                    ZwSetContextThread

SSDT            83511910                                                                                    ZwSetInformationProcess

SSDT            83563350                                                                                    ZwSetSystemInformation

SSDT            \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)  ZwSetValueKey [0xEE1E7140]

SSDT            8356A990                                                                                    ZwSuspendProcess

SSDT            83580BF0                                                                                    ZwSuspendThread

SSDT            83588E08                                                                                    ZwTerminateProcess

SSDT            83596EC8                                                                                    ZwTerminateThread

SSDT            83587578                                                                                    ZwUnmapViewOfSection

SSDT            83611EC8                                                                                    ZwWriteVirtualMemory

---- Kernel code sections - GMER 1.0.15 ----

.text           ntoskrnl.exe!_abnormal_termination + 7C                                                     804E26E8 6 Bytes  [10, 86, 57, 83, 70, C1] {ADC [ESI-0x3e8f7ca9], AL}

.text           ntoskrnl.exe!_abnormal_termination + 83                                                     804E26EF 1 Byte  [83]

.text           ntoskrnl.exe!_abnormal_termination + 1B8                                                    804E2824 2 Bytes  [38, 85]

.text           ntoskrnl.exe!_abnormal_termination + 1BB                                                    804E2827 1 Byte  [83]

.text           ntoskrnl.exe!_abnormal_termination + 214                                                    804E2880 2 Bytes  [90, 4E] {NOP ; DEC ESI}

.text           ...                                                                                        

?               SYMDS.SYS                                                                                   The system cannot find the file specified. !

?               SYMEFA.SYS                                                                                  The system cannot find the file specified. !

init            C:\WINDOWS\system32\drivers\senfilt.sys                                                     entry point in "init" section [0xF64E0F80]

---- User code sections - GMER 1.0.15 ----

.text           C:\WINDOWS\system32\SearchIndexer.exe[2016] kernel32.dll!WriteFile                          7C810E27 7 Bytes  JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                      szkgfs.sys (STOPzilla Kernel Guard File System, x86-32 /iS3, Inc.)

AttachedDevice  \Driver\Tcpip \Device\Ip                                                                    SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                   SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

AttachedDevice  \Driver\Tcpip \Device\Udp                                                                   SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                 SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device                                                                                                      mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation)

Device                                                                                                      EBF51D20

AttachedDevice                                                                                              szkgfs.sys (STOPzilla Kernel Guard File System, x86-32 /iS3, Inc.)

---- EOF - GMER 1.0.15 ----

Hello Joseph,

Before we clean up I need to see the log from an online AV scan, if this comes back clean we can remove the tools we have installed/used....

As follows please:

Run ESET Online Scan

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.ESET OnlineScan
• Click the button.
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on to download the ESET Smart Installer. Save it to your desktop.
• Double click on the icon on your desktop.

• Check
• Click the button.
• Accept any security warnings from your browser.
• Check
• Leave the tick out of remove found threats
• Push the Start button.
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• When the scan completes, push
• Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
• Push the button.
• Push

You can refer to this animation by neomage if needed.
Frequently asked questions available Here Please read them before running the scan.

Also be aware this scan can take between one and several hours to complete depending on the size of your system.

ESET log can be found here "C:\Program Files\ESET\EsetOnlineScanner\log.txt".

Kevin