urgent! help assistant virus!

I recently found I ve been affected with HELP aSSISTANT. Here is an OTL report

TL Extras logfile created on: 4/17/2010 5:46:46 PM - Run 1
OTL by OldTimer - Version 3.2.1.1 Folder = C:\Documents and Settings\Priscilla\My Documents\Downloads
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

702.00 Mb Total Physical Memory | 225.00 Mb Available Physical Memory | 32.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 63.00% Paging File free
Paging file location(s): C:\pagefile.sys 1056 2112 [binary data]

Edit by chaslang: Inline OTL log removed. Logs need to be attachments.

 

Here is another OTL report:-

I deleted the Help Assistant folder and files it seems it was created this morning around 1 am. I have run scans with OTL Report


Edit by chaslang: Inline OTL log removed. Logs need to be attachments.

 

Ok, I went ahead and followed this guy's advice in another post:-

Hi,

if you are blanking out part of the user name please bear in mind that you need to change it back before running any fixes I post you where your name figures.

Please download HelpAsst_mebroot_fix.exe and save it to your desktop.
Close out all other open programs and windows.
Double click the file to run it and follow any prompts.
If the tool detects an mbr infection, please allow it to run mbr -f and shutdown your computer.
Upon restarting, please wait about 5 minutes, click Start>Run and type the following bolded command, then hit Enter.

helpasst -mbrt

Make sure you leave a space between helpasst and -mbrt !

When it completes, a log will open.

Please post the contents of that log.



In the event the tool does not detect an mbr infection and completes, click Start>Run and type the following bolded command, then hit Enter.

mbr -f

Now, please do the Start>Run>mbr -f command a second time.

Now shut down the computer (do not restart, but shut it down), wait a few minutes then start it back up.

Give it about 5 minutes, then click Start>Run and type the following bolded command, then hit Enter.

helpasst -mbrt

Make sure you leave a space between helpasst and -mbrt !

When it completes, a log will open.

Please post the contents of that log.

**Important note to Dell users - fixing the mbr may prevent access the the Dell Restore Utility, which allows you to press a key on startup and revert your computer to a factory delivered state. There are a couple of known fixes for said condition, though the methods are somewhat advanced. If you are unwilling to take such a risk, you should not allow the tool to execute mbr -f nor execute the command manually, and you will either need to restore your computer to a factory state or allow your computer to remain having an infected mbr (the latter not recommended).

 

After I downloaded and ran the mbr fix. exe, it shut down my computer and I restarted it . Then I ran helpasst and -mbrt and it did not detect anything.

C:\Documents and Settings\Priscilla\My Documents\Downloads\HelpAsst_mebroot_fix.exe
Sat 04/17/2010 at 18:33:08.20

HelpAssistant account Inactive

~~ Checking for termsrv32.dll ~~

termsrv32.dll present! ~ attempting to remove
termsrv32.dll successfully removed

~~ Checking firewall ports ~~

HKLM\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\globallyopenports\list

HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\globallyopenports\list

~~ Checking profile list ~~

No HelpAssistant profile in registry

~~ Checking mbr ~~

user & kernel MBR OK

Ok, I did the second helpasst -mbr I got this log

C:\Documents and Settings\Priscilla\My Documents\Downloads\HelpAsst_mebroot_fix.exe
Sat 04/17/2010 at 19:07:11.10

HelpAssistant account Inactive

~~ Checking for termsrv32.dll ~~

termsrv32.dll not found

~~ Checking firewall ports ~~

HKLM\~\services\sharedaccess\parameters\firewallpolicy\domainprofile\globallyopenports\list

HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\globallyopenports\list

~~ Checking profile list ~~

No HelpAssistant profile in registry

~~ Checking mbr ~~

user & kernel MBR OK

 

Thank you so much for your timely response. I'm sorry that I posted that previous log wrong but I followed your links and I have attached the logs to this post.

 

Also, here is the last log MGTOOls, I got an error message at the end saying something failed, some kind of prompt??? But it still created a log file.

 

Ok, whew, yes looks it cleared up. No, I don't detect any malware problems. But it was there and I found it just because I ran the Super Anti Spyware scan and it detected cookies from a Help Assistant folder when I looked at C: Documents and Settings then I saw the Help Assistant folder. I deleted it and it had copied my files. After I used the HelpAsst_mebroot_fix, it detected it and appeared to have deleted it. So am I good now? Is there anything else I need to do? How did I manage to get this virus in the first place? I was watching a show that was on Megavideo and I fell asleep and my pc and net was still on. I woke up later and turned it off. Could someone have snuck past my firewall cos I have Comodo firewall as well as AVG. How can I prevent this from happening again?

Last but not least can i delete all the downloaded files- combofix, cccleaner, root repeal, Helpasst_ backup files (from mebroot fix) and enable cd emulation?

 

Thanks a lot for your help! Wow, I can't believe that they are putting malware on these video sites now. But I often use Megavideo and Zshare and the ads are dangerous. This never ue to happen before- just in the last month and a half. But where do I go then when I want to watch something? This is tough, Oh, I have AVG but I am wondering if it's effective, what is the best other free antivirus to use? Antivir or Avast??