Multiple Infections

I strongly advise you to cleanup your Desktop. Remove eveything but links to run programs. Do not download and save programs here and defintely do not use it for long term storage. You need to keep ComboFix.exe here for now as we need it, but we will be removing it when we are finished with your cleanup. A cluttered Desktop is malware's playground and it can also cause performance degradation especially when you start saving large files here.

Viewpoint Media Player <--- uninstall this if you are able to.

Give this a run. SUPERAntiSpyware Portable

If you did not deliberately set this proxy yourself then please include it in the HJT fix below:

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix exit HJT.

Download and run OTM.

Download OTM by Old Timer and save it to your Desktop.

• Right-click OTM.exe And select " Run as administrator " to run it.
• Paste the following code under the http://farm3.static.flickr.com/2455/4173556815_a721a91733_o.png area. Do not include the word Code.

Code:

:Files
C:\Users\Raymond\AppData\Local\qjrlhjemt
C:\Users\Raymond\AppData\Local\qnudshyjd
C:\Users\Raymond\AppData\Local\Temp\FONBF5.tmp
C:\Users\Raymond\AppData\Local\Temp\browserview-3e23bf8.htm
C:\Users\Raymond\AppData\Local\Temp\browserview-3e5d2f0.htm
C:\Users\Raymond\AppData\Local\Temp\browserview-3eb60f0.htm
C:\Users\Raymond\AppData\Local\Temp\browserview-3f0c168.htm
C:\Users\Raymond\AppData\Local\Temp\browserview-40b4cb0.htm
C:\Users\Raymond\AppData\Local\Temp\browserview-4142960.htm
C:\Users\Raymond\AppData\Local\Temp\FonF073.tmp
C:\Users\Raymond\AppData\Local\Temp\FonF0C2.tmp
C:\Users\Raymond\AppData\Local\Temp\Low
C:\Users\Raymond\AppData\Local\Temp\resource.h
C:\Users\Raymond\AppData\Local\Temp\rmVYvyiQ.exe.part
C:\Users\Raymond\AppData\Local\Temp\uttA754.tmp
C:\Users\Raymond\AppData\Local\Temp\uttA754.tmp.old

:reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"=-
"EA Core"=-
"WMPNSCFG"=-
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\NoExplorer]

:Commands
[emptytemp]
[Reboot]

• Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
• Push the large http://farm3.static.flickr.com/2782/4174320048_f01c448b32_o.png button.
• OTM may ask to reboot the machine. Please do so if asked.
• Copy everything in the Results window (under the green bar), and paste it in your next reply.

NOTE: If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Also delete all files in the below bold folders except ones from the current date (Windows will not let you delete the files from the current day).

C:\Windows\TEMP
C:\Users\Raymond\AppData\Local\Temp

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.

Let me know how things are running now.

 

Are you able now to uninstall the old Java? If not try JavaRA 1.15

Reboot your machine and install the most current and up to date version of Java available here at the below link:

Java Runtime 6

• Right-click OTM.exe And select " Run as administrator " to run it.
• Paste the following code under the http://farm3.static.flickr.com/2455/4173556815_a721a91733_o.png area. Do not include the word Code.

Code:

:services
Viewpoint Service

:Commands
[emptytemp]
[Reboot]

• Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
• Push the large http://farm3.static.flickr.com/2782/4174320048_f01c448b32_o.png button.
• OTM may ask to reboot the machine. Please do so if asked.
• Copy everything in the Results window (under the green bar), and paste it in your next reply.

NOTE: If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Now tell me how everything is running before I give you final steps.

 

That's great.

Now just let me have one final sweep through the logs:

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.