3 threats reappear

[hweinze]

[attachment=4915][attachment=4916][attachment=4917]

Thanks in advance for your help...I am new to forums and not very familiar with protocol and etiquette...apology if necessary.

 

[kuttus]

Hi and welcome to the malwaretips.com forums!

I'm Kuttus and I am going to try to assist you with your problem. Please take note of the below:

• I will start working on your malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for this issue on this machine!
• The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear.
• If you don't know, stop and ask! Don't keep going on.
• Please reply to this thread. Do not start a new topic.
• Refrain from running self fixes as this will hinder the malware removal process.
• It may prove beneficial if you print of the following instructions or save them to notepad as I post them.

Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.


Before we start:
Please be aware that removing malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

Because of this, I advise you to backup any personal files and folders before you start.
<hr />


STEP 1: Run the below OTL fix
<ol><li>Start <>OTL.exe</></li>
<li>Copy/paste the following text written <>inside of the code box</> into the <>Custom Scans/Fixes</> box located at the bottom of OTL

:OTL
SRV - (SessionLauncher) -- C:\DOCUME~1\Hugo\LOCALS~1\Temp\DX9\SessionLauncher.exe File not found
[2008-06-18 14:57:16 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Hugo\Application Data\Mozilla\Extensions\{6334D996-EA3E-4a0e-AA8D-15BA56B37241}
[2012-08-05 15:13:29 | 000,000,000 | ---D | M] (Babylon) -- C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\ffxtlbr@babylon.com
[2011-09-03 21:23:22 | 000,000,000 | ---D | M] (Ghostery) -- C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\firefox@ghostery.com
[2011-10-03 10:29:19 | 000,109,632 | ---- | M] () (No name found) -- C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\compatibility@addons.mozilla.org.xpi
[2011-04-26 15:17:43 | 000,014,748 | ---- | M] () (No name found) -- C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\{031d3073-ff27-44d8-a805-a78e9664b53e}.xpi
[2011-05-23 08:43:12 | 001,638,611 | ---- | M] () (No name found) -- C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\{22119944-ED35-4ab1-910B-E619EA06A115}.xpi
[2011-10-06 08:54:08 | 000,200,450 | ---- | M] () (No name found) -- C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\{AA052FD6-366A-4771-A591-0D8DC551585D}.xpi
[2011-10-03 10:29:19 | 000,627,675 | ---- | M] () (No name found) -- C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013-03-08 12:36:06 | 000,001,005 | ---- | M] () -- C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\searchplugins\conduit.xml
[2012-06-05 23:06:50 | 002,174,976 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Program Files\Common Files\atimpenc.dll
[2008-04-26 18:28:02 | 000,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\Hugo\Application Data\pcouffin.sys
[2007-04-19 21:22:58 | 000,024,192 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\Hugo\usbsermptxp.sys
[2007-04-19 21:22:58 | 000,022,768 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\Hugo\usbsermpt.sys
[2011-03-25 16:49:56 | 000,158,379 | -H-- | C] () -- C:\Documents and Settings\Hugo\Application Data\Hugo1.dll
[2011-11-25 11:41:18 | 000,000,140 | -H-- | C] () -- C:\Documents and Settings\Hugo\.~lock.bible#
[2010-07-15 20:02:29 | 000,000,040 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\.zreglib
[2008-05-26 22:32:16 | 000,002,528 | ---- | C] () -- C:\Documents and Settings\Hugo\Application Data\$_hpcst$.hpc
[2008-04-26 18:28:03 | 000,087,608 | ---- | C] () -- C:\Documents and Settings\Hugo\Application Data\inst.exe
[2008-04-26 18:28:02 | 000,007,887 | ---- | C] () -- C:\Documents and Settings\Hugo\Application Data\pcouffin.cat
[2008-04-26 18:28:02 | 000,001,144 | ---- | C] () -- C:\Documents and Settings\Hugo\Application Data\pcouffin.inf
[2007-09-05 16:39:10 | 000,000,137 | ---- | C] () -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\fusioncache.dat
[2007-07-28 19:47:24 | 000,000,118 | ---- | C] () -- C:\Documents and Settings\Hugo\ssaver.reg
[2007-04-19 21:22:58 | 000,007,194 | ---- | C] () -- C:\Documents and Settings\Hugo\USBMOT2000.INF
[2007-04-19 21:22:58 | 000,005,877 | ---- | C] () -- C:\Documents and Settings\Hugo\USB_CMCS_2000.INF
[2007-04-19 21:22:58 | 000,005,798 | ---- | C] () -- C:\Documents and Settings\Hugo\USBMOT2000XP.INF
[2006-12-18 17:11:53 | 000,093,696 | ---- | C] () -- C:\Documents and Settings\Hugo\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006-12-12 21:35:46 | 000,012,450 | ---- | C] () -- C:\Documents and Settings\Hugo\Application Data\wklnhst.dat
[2006-12-11 22:57:46 | 000,000,127 | ---- | C] () -- C:\Documents and Settings\Hugo\Local Settings\Application Data\fusioncache.dat
[2005-09-04 18:25:59 | 000,279,633 | -H-- | C] () -- C:\Documents and Settings\Hugo\Application Data\Hugolog.dat


:commands
[emptytemp]
[reboot]

<>NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system</></li>
<li>Then click the <>Run Fix</> button at the top</li>
<li>Let the program run unhindered, reboot when it is done</li>
<li>Attach the new log produced by OTL (C:\_OTL)</li>
</ol>

<hr />

 

[hweinze]

Hi and welcome to the malwaretips.com forums!

I'm Kuttus and I am going to try to assist you with your problem. Please take note of the below:

• I will start working on your malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for this issue on this machine!
• The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear.
• If you don't know, stop and ask! Don't keep going on.
• Please reply to this thread. Do not start a new topic.
• Refrain from running self fixes as this will hinder the malware removal process.
• It may prove beneficial if you print of the following instructions or save them to notepad as I post them.

Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.


Before we start:
Please be aware that removing malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

Because of this, I advise you to backup any personal files and folders before you start.
<hr />


STEP 1: Run the below OTL fix
<ol><li>Start <>OTL.exe</></li>
<li>Copy/paste the following text written <>inside of the code box</> into the <>Custom Scans/Fixes</> box located at the bottom of OTL

:OTL
SRV - (SessionLauncher) -- C:\DOCUME~1\Hugo\LOCALS~1\Temp\DX9\SessionLauncher.exe File not found
[2008-06-18 14:57:16 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Hugo\Application Data\Mozilla\Extensions\{6334D996-EA3E-4a0e-AA8D-15BA56B37241}
[2012-08-05 15:13:29 | 000,000,000 | ---D | M] (Babylon) -- C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\ffxtlbr@babylon.com
[2011-09-03 21:23:22 | 000,000,000 | ---D | M] (Ghostery) -- C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\firefox@ghostery.com
[2011-10-03 10:29:19 | 000,109,632 | ---- | M] () (No name found) -- C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\compatibility@addons.mozilla.org.xpi
[2011-04-26 15:17:43 | 000,014,748 | ---- | M] () (No name found) -- C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\{031d3073-ff27-44d8-a805-a78e9664b53e}.xpi
[2011-05-23 08:43:12 | 001,638,611 | ---- | M] () (No name found) -- C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\{22119944-ED35-4ab1-910B-E619EA06A115}.xpi
[2011-10-06 08:54:08 | 000,200,450 | ---- | M] () (No name found) -- C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\{AA052FD6-366A-4771-A591-0D8DC551585D}.xpi
[2011-10-03 10:29:19 | 000,627,675 | ---- | M] () (No name found) -- C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013-03-08 12:36:06 | 000,001,005 | ---- | M] () -- C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\searchplugins\conduit.xml
[2012-06-05 23:06:50 | 002,174,976 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Program Files\Common Files\atimpenc.dll
[2008-04-26 18:28:02 | 000,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\Hugo\Application Data\pcouffin.sys
[2007-04-19 21:22:58 | 000,024,192 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\Hugo\usbsermptxp.sys
[2007-04-19 21:22:58 | 000,022,768 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\Hugo\usbsermpt.sys
[2011-03-25 16:49:56 | 000,158,379 | -H-- | C] () -- C:\Documents and Settings\Hugo\Application Data\Hugo1.dll
[2011-11-25 11:41:18 | 000,000,140 | -H-- | C] () -- C:\Documents and Settings\Hugo\.~lock.bible#
[2010-07-15 20:02:29 | 000,000,040 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\.zreglib
[2008-05-26 22:32:16 | 000,002,528 | ---- | C] () -- C:\Documents and Settings\Hugo\Application Data\$_hpcst$.hpc
[2008-04-26 18:28:03 | 000,087,608 | ---- | C] () -- C:\Documents and Settings\Hugo\Application Data\inst.exe
[2008-04-26 18:28:02 | 000,007,887 | ---- | C] () -- C:\Documents and Settings\Hugo\Application Data\pcouffin.cat
[2008-04-26 18:28:02 | 000,001,144 | ---- | C] () -- C:\Documents and Settings\Hugo\Application Data\pcouffin.inf
[2007-09-05 16:39:10 | 000,000,137 | ---- | C] () -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\fusioncache.dat
[2007-07-28 19:47:24 | 000,000,118 | ---- | C] () -- C:\Documents and Settings\Hugo\ssaver.reg
[2007-04-19 21:22:58 | 000,007,194 | ---- | C] () -- C:\Documents and Settings\Hugo\USBMOT2000.INF
[2007-04-19 21:22:58 | 000,005,877 | ---- | C] () -- C:\Documents and Settings\Hugo\USB_CMCS_2000.INF
[2007-04-19 21:22:58 | 000,005,798 | ---- | C] () -- C:\Documents and Settings\Hugo\USBMOT2000XP.INF
[2006-12-18 17:11:53 | 000,093,696 | ---- | C] () -- C:\Documents and Settings\Hugo\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006-12-12 21:35:46 | 000,012,450 | ---- | C] () -- C:\Documents and Settings\Hugo\Application Data\wklnhst.dat
[2006-12-11 22:57:46 | 000,000,127 | ---- | C] () -- C:\Documents and Settings\Hugo\Local Settings\Application Data\fusioncache.dat
[2005-09-04 18:25:59 | 000,279,633 | -H-- | C] () -- C:\Documents and Settings\Hugo\Application Data\Hugolog.dat


:commands
[emptytemp]
[reboot]

<>NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system</></li>
<li>Then click the <>Run Fix</> button at the top</li>
<li>Let the program run unhindered, reboot when it is done</li>
<li>Attach the new log produced by OTL (C:\_OTL)</li>
</ol>

<hr />

Hi Kittus my name is Hugo and I want to thanks you for your assistance.
Well the first thing I did was to run only part of the fix you sent in OTL because I did not copy all of it into the Custom Scans/Fixes box located at the bottom of OTL, I then re-ran OTL with the complete text. Now when I try to Attach the new log produced by OTL (C:\_OTL) I get the msg

"Please correct the following errors before continuing:
The type of file that you attached is not allowed. Please remove the attachment or choose a different type."

I am here copying the text found in the log files, the first one from the first run of OTL fix and the second.

========== OTL ==========
Service SessionLauncher stopped successfully!
Service SessionLauncher deleted successfully!
File C:\DOCUME~1\Hugo\LOCALS~1\Temp\DX9\SessionLauncher.exe File not found not found.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Extensions\{6334D996-EA3E-4a0e-AA8D-15BA56B37241} folder moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio folder moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs folder moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\ffxtlbr@babylon.com\content\imgs folder moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\ffxtlbr@babylon.com\content folder moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\ffxtlbr@babylon.com\components folder moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\ffxtlbr@babylon.com folder moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\firefox@ghostery.com\META-INF folder moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\firefox@ghostery.com\defaults\preferences folder moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\firefox@ghostery.com\defaults folder moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\firefox@ghostery.com\components folder moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\firefox@ghostery.com\chrome\locale\ru-RU folder moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\firefox@ghostery.com\chrome\locale\ja-JP folder moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\firefox@ghostery.com\chrome\locale\fr-FR folder moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\firefox@ghostery.com\chrome\locale\es-ES folder moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\firefox@ghostery.com\chrome\locale\en-US folder moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\firefox@ghostery.com\chrome\locale\de-DE folder moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\firefox@ghostery.com\chrome\locale folder moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\firefox@ghostery.com\chrome\content\first-run\images folder moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\firefox@ghostery.com\chrome\content\first-run folder moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\firefox@ghostery.com\chrome\content\affils folder moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\firefox@ghostery.com\chrome\content folder moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\firefox@ghostery.com\chrome folder moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\firefox@ghostery.com folder moved successfully.
File C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\compatibility@addons.m​ozilla.org.xpi not found.
File C:\Documents and Settings\Hugo\Application not found.

OTL by OldTimer - Version 3.2.69.0 log created on 06212013_064629

All processes killed
========== OTL ==========
Error: No service named SessionLauncher was found to stop!
Service\Driver key SessionLauncher not found.
File C:\DOCUME~1\Hugo\LOCALS~1\Temp\DX9\SessionLauncher.exe File not found not found.
Folder C:\Documents and Settings\Hugo\Application Data\Mozilla\Extensions\{6334D996-EA3E-4a0e-AA8D-15BA56B37241}\ not found.
Folder C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\ffxtlbr@babylon.com\ not found.
Folder C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\firefox@ghostery.com\ not found.
File C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\compatibility@addons.m​ozilla.org.xpi not found.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\{031d3073-ff27-44d8-a805-a78e9664b53e}.xpi moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\{22119944-ED35-4ab1-910B-E619EA06A115}.xpi moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\{AA052FD6-366A-4771-A591-0D8DC551585D}.xpi moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi moved successfully.
C:\Documents and Settings\Hugo\Application Data\Mozilla\Firefox\Profiles\nxzelg5r.default\searchplugins\conduit.xml moved successfully.
C:\Program Files\Common Files\atimpenc.dll moved successfully.
C:\Documents and Settings\Hugo\Application Data\pcouffin.sys moved successfully.
C:\Documents and Settings\Hugo\usbsermptxp.sys moved successfully.
C:\Documents and Settings\Hugo\usbsermpt.sys moved successfully.
C:\Documents and Settings\Hugo\Application Data\Hugo1.dll moved successfully.
C:\Documents and Settings\Hugo\.~lock.bible# moved successfully.
C:\Documents and Settings\All Users\Application Data\.zreglib moved successfully.
C:\Documents and Settings\Hugo\Application Data\$_hpcst$.hpc moved successfully.
C:\Documents and Settings\Hugo\Application Data\inst.exe moved successfully.
C:\Documents and Settings\Hugo\Application Data\pcouffin.cat moved successfully.
C:\Documents and Settings\Hugo\Application Data\pcouffin.inf moved successfully.
C:\Documents and Settings\NetworkService\Local Settings\Application Data\fusioncache.dat moved successfully.
C:\Documents and Settings\Hugo\ssaver.reg moved successfully.
C:\Documents and Settings\Hugo\USBMOT2000.INF moved successfully.
C:\Documents and Settings\Hugo\USB_CMCS_2000.INF moved successfully.
C:\Documents and Settings\Hugo\USBMOT2000XP.INF moved successfully.
C:\Documents and Settings\Hugo\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini moved successfully.
C:\Documents and Settings\Hugo\Application Data\wklnhst.dat moved successfully.
C:\Documents and Settings\Hugo\Local Settings\Application Data\fusioncache.dat moved successfully.
C:\Documents and Settings\Hugo\Application Data\Hugolog.dat moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 626431 bytes
->Temporary Internet Files folder emptied: 235455 bytes
->Google Chrome cache emptied: 12203084 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32969 bytes
->Flash cache emptied: 41 bytes

User: Guest
->Temp folder emptied: 286 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: Hugo
->Temp folder emptied: 450621 bytes
->Temporary Internet Files folder emptied: 281516 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 54153987 bytes
->Google Chrome cache emptied: 222920452 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 3042973 bytes
->Temporary Internet Files folder emptied: 23565681 bytes

User: NetworkService
->Temp folder emptied: 2069802 bytes
->Temporary Internet Files folder emptied: 250053578 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 200209 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 49667 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 363192433 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 1491002657 bytes

Total Files Cleaned = 2,312.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 06212013_070149

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\Hugo\Local Settings\Temp\Temporary Internet Files\Content.IE5\C5U38L2F\Type=click&FlightID=91149&AdID=125961&TargetID=913&Segments=730,2259,2743,3030,3285,3800,4635,6089,6520,7324,7603,8463,8796,9496,9632,9742,9779,9781,9853,10088,10381,11307,1[1].htm not found!
File\Folder C:\Documents and Settings\Hugo\Local Settings\Temp\tmp23.tmp not found!
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_9d0.dat not found!

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

 

[kuttus]

Okay this one is fine... Now follow this steps


STEP 1: Run a scan with AdwCleaner

<ol><li>Download AdwCleaner from the below link.
<><a href="http://general-changelog-team.fr/fr/downloads/finish/20-outils-de-xplode/2-adwcleaner" target="_blank">ADWCLEANER DOWNLAOD LINK</a></> (This link will automatically download Security Check on your computer)</li>

<li>Close all open programs and internet browsers.</li>
<li>Double click on <>adwcleaner.exe</> to run the tool.</li>
<li>Click on <>Delete</>,then confirm each time with <>Ok</>.</li>
<li>Your computer will be rebooted automatically. A text file will open after the restart.</li>
<li>Please post the contents of that logfile with your next reply.</li>
<li>You can find the logfile at <>C:\AdwCleaner[S1].txt</> as well.</li>
</ol>
<hr/>

STEP 2: Run a scan with Junkware Removal Tool

Please download Junkware Removal Tool to your desktop from here

• Turn off your antivirus software now to avoid potential conflicts
• Double-click to run the tool. For Windows Vista or 7 users, right-click the file and select Run as Administrator
• The tool will open and start scanning your system
• Please be patient as this can take a while to complete depending on your system's specifications
• On completion, a log (JRT.txt) will be saved to your desktop and will automatically open
• Post the contents of JRT.txt into your next reply

---

Download Malwarebytes Anti-Rootkit from here to your Desktop

• Unzip the contents to a folder on your Desktop.
• Open the folder where the contents were unzipped and run mbar.exe
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
• Make sure there is a check next to Create Restore Point and click the Cleanup button to remove any threats. Reboot if prompted to do so.
• After the reboot, perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If there are threats, click Cleanup once more and reboot.
• When done, please post the two logs in the MBAR folder(mbar-log.txt and system-log.txt)

---

Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to
  • Update Malwarebytes' Anti-Malware
  • and Launch Malwarebytes' Anti-Malware
• then click Finish.
• If an update is found, it will download and install the latest version.
• When it prompts you to try their 30-day trail, click decline
• Once the program has loaded, select Perform quick scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is Checked (ticked) except items in the C:\System Volume Information folder and click on Remove Selected.
• When completed, a log will open in Notepad. please copy and paste the log into your next reply
  • If you accidently close it, the log file is saved here and will be named like this:
  • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

---

 

[hweinze]

Okay this one is fine... Now follow this steps


STEP 1: Run a scan with AdwCleaner

<ol><li>Download AdwCleaner from the below link.
<><a href="http://general-changelog-team.fr/fr/downloads/finish/20-outils-de-xplode/2-adwcleaner" target="_blank">ADWCLEANER DOWNLAOD LINK</a></> (This link will automatically download Security Check on your computer)</li>

<li>Close all open programs and internet browsers.</li>
<li>Double click on <>adwcleaner.exe</> to run the tool.</li>
<li>Click on <>Delete</>,then confirm each time with <>Ok</>.</li>
<li>Your computer will be rebooted automatically. A text file will open after the restart.</li>
<li>Please post the contents of that logfile with your next reply.</li>
<li>You can find the logfile at <>C:\AdwCleaner[S1].txt</> as well.</li>
</ol>
<hr/>

STEP 2: Run a scan with Junkware Removal Tool

Please download Junkware Removal Tool to your desktop from here

• Turn off your antivirus software now to avoid potential conflicts
• Double-click to run the tool. For Windows Vista or 7 users, right-click the file and select Run as Administrator
• The tool will open and start scanning your system
• Please be patient as this can take a while to complete depending on your system's specifications
• On completion, a log (JRT.txt) will be saved to your desktop and will automatically open
• Post the contents of JRT.txt into your next reply

---

Download Malwarebytes Anti-Rootkit from here to your Desktop

• Unzip the contents to a folder on your Desktop.
• Open the folder where the contents were unzipped and run mbar.exe
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
• Make sure there is a check next to Create Restore Point and click the Cleanup button to remove any threats. Reboot if prompted to do so.
• After the reboot, perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If there are threats, click Cleanup once more and reboot.
• When done, please post the two logs in the MBAR folder(mbar-log.txt and system-log.txt)

---

Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to
  • Update Malwarebytes' Anti-Malware
  • and Launch Malwarebytes' Anti-Malware
• then click Finish.
• If an update is found, it will download and install the latest version.
• When it prompts you to try their 30-day trail, click decline
• Once the program has loaded, select Perform quick scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is Checked (ticked) except items in the C:\System Volume Information folder and click on Remove Selected.
• When completed, a log will open in Notepad. please copy and paste the log into your next reply
  • If you accidently close it, the log file is saved here and will be named like this:
  • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

---

---

---

---

OK Kuttus...(sorry I misspelled your name earlier) I have followed the steps you suggested and have posted and copy and pasted the log files requested...thank you!

Malwarebytes Anti-Malware (Trial) 1.75.0.1300
www.malwarebytes.org

Database version: v2013.06.21.10

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Hugo :: HUGOCOMPUTER [administrator]

Protection: Disabled

21-Jun-2013 9:49:08 PM
mbam-log-2013-06-21 (21-49-08).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 267340
Time elapsed: 17 minute(s), 32 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

[attachment=4927]
[attachment=4928]
[attachment=4929]
[attachment=4930]

 

[kuttus]

STEP 1: Run a HitmanPro scan
<ol>
<li><>Download the latest official version of HitmanPro</>.
<a href="http://www.surfright.nl/en/hitmanpro/" rel="nofollow" target="_blank"> <>HITMANPRO DOWNLOAD LINK</></a> <em>(This link will open a download page in a new window from where you can download HitmanPro)</em></li>
<li>Start HitmanPro by <>double clicking on the previously downloaded file.</> and then following the prompts.
<img src="http://malwaretips.com/images/removalguide/hpro4.png" alt="[Image: hitmanproscan4.png]" border="0" /></li>
<li>Once the scan is complete, a screen displaying all the malicious files that the program found will be shown as seen in the image below.After reviewing each malicious object click <>Next</> .
<img src="http://malwaretips.com/blogs/wp-content/uploads/2012/02/rsz_hpro5.png" alt="[Image: hitmanproscan5.png]" border="0" /></li>
<li>Click <>Activate free license</> to start the free 30 days trial and remove the malicious files.
<img src="http://malwaretips.com/images/removalguide/hpro6.png" alt="[Image: hitmanproscan6.png]" border="0" /></li>
<li>HitmanPro will now start removing the infected objects, and in some instances, may suggest a reboot in order to completely remove the malware from your system. In this scenario, always confirm the reboot action to be on the safe side.
</ol>
Add to your next reply, any log that HitmanPro might generate.
<hr />
STEP 2: Run a scan with ESET Online Scanner
<ol>
<li>Download ESET Online Scanner utility from the below link
<><a title="External link" href="http://download.eset.com/special/eos/esetsmartinstaller_enu.exe" rel="nofollow">ESET ONLINE SCANNER DOWNLOAD LINK</a></> <em>(This link will automatically download ESET Online Scanner on your computer.)</em></li>
<li>Double click on the Eset installer program (esetsmartinstaller_enu.exe).</li>
<li>Check <>Yes, I accept the Terms of Use</></li>
<li>Click the <>Start</> button.</li>
<li>Check <>Scan archives</></li>
<li>Push the <>Start</> button.</li>
<li>ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.</li>
<li>When the scan completes, push <>List of found threats</></li>
<li>Push <>Export to Text file </> and save the file to your desktop using a unique name, such as <>ESET Scan</>. Include the contents of this report in your next reply.Note - when ESET doesn't find any threats, no report will be created.</li>
<li>Push the <>back</> button.</li>
<li>Push <>Finish</></li>
</ol>
<hr />
STEP 3: Run a scan with Kaspersky Virus Removal Tool
<ol><li>Download Kaspersky Virus Removal Tool from the below link and then double click on it to start this utility.
<><a title="External link" href="http://www.kaspersky.com/antivirus-removal-tool?form=1" rel="nofollow">KASPERSKY VIRUS REMOVAL TOOL</a></> <em>(This link open an new webpage from where you can download Kaspersky Virus Removal Tool on your computer.)</em></li>
<li>Follow the onscreen prompts until it is installed</li>
<li>Click the Options button (the 'Gear' icon), then make sure only the following are ticked:
<ul>
<li><span style="color: #ff0000;">System Memory</span></li>
<li><span style="color: #ff0000;">Hidden startup objects</span></li>
<li><span style="color: #ff0000;">Disk boot sectors</span></li>
<li><span style="color: #ff0000;">Local Disk (C: )</span></li>
<li><span style="color: #ff0000;">Also any other drives (Removable that you may have)</span></li>
</ul>
</li>
<li>Then click on <>Actions</> on the left hand side</li>
<li>Click <>Select Action</>, then make sure both <>Disinfect</> and <>Delete if disinfection fails</> are ticked</li>
<li>Click on <>Automatic Scan</></li>
<li>Now click the <>Start Scanning</> button, to run the scan</li>
<li>After the scan is complete, click the reports button ('Paper icon', next to the 'Gear' icon) on the right hand side</li>
<li>Click <>Detected threats</> on the left</li>
<li>Now click the <>Save</> button, and save it as <>kaslog.txt</> to your <>Desktop</></li>
<li>Please attach kaslog.txt in your next reply.</li>
</ol>
<hr />

 

[hweinze]

STEP 1: Run a HitmanPro scan
<ol>
<li><>Download the latest official version of HitmanPro</>.
<a href="http://www.surfright.nl/en/hitmanpro/" rel="nofollow" target="_blank"> <>HITMANPRO DOWNLOAD LINK</></a> <em>(This link will open a download page in a new window from where you can download HitmanPro)</em></li>
<li>Start HitmanPro by <>double clicking on the previously downloaded file.</> and then following the prompts.
<img src="http://malwaretips.com/images/removalguide/hpro4.png" alt="[Image: hitmanproscan4.png]" border="0" /></li>
<li>Once the scan is complete, a screen displaying all the malicious files that the program found will be shown as seen in the image below.After reviewing each malicious object click <>Next</> .
<img src="http://malwaretips.com/blogs/wp-content/uploads/2012/02/rsz_hpro5.png" alt="[Image: hitmanproscan5.png]" border="0" /></li>
<li>Click <>Activate free license</> to start the free 30 days trial and remove the malicious files.
<img src="http://malwaretips.com/images/removalguide/hpro6.png" alt="[Image: hitmanproscan6.png]" border="0" /></li>
<li>HitmanPro will now start removing the infected objects, and in some instances, may suggest a reboot in order to completely remove the malware from your system. In this scenario, always confirm the reboot action to be on the safe side.
</ol>
Add to your next reply, any log that HitmanPro might generate.
<hr />
STEP 2: Run a scan with ESET Online Scanner
<ol>
<li>Download ESET Online Scanner utility from the below link
<><a title="External link" href="http://download.eset.com/special/eos/esetsmartinstaller_enu.exe" rel="nofollow">ESET ONLINE SCANNER DOWNLOAD LINK</a></> <em>(This link will automatically download ESET Online Scanner on your computer.)</em></li>
<li>Double click on the Eset installer program (esetsmartinstaller_enu.exe).</li>
<li>Check <>Yes, I accept the Terms of Use</></li>
<li>Click the <>Start</> button.</li>
<li>Check <>Scan archives</></li>
<li>Push the <>Start</> button.</li>
<li>ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.</li>
<li>When the scan completes, push <>List of found threats</></li>
<li>Push <>Export to Text file </> and save the file to your desktop using a unique name, such as <>ESET Scan</>. Include the contents of this report in your next reply.Note - when ESET doesn't find any threats, no report will be created.</li>
<li>Push the <>back</> button.</li>
<li>Push <>Finish</></li>
</ol>
<hr />
STEP 3: Run a scan with Kaspersky Virus Removal Tool
<ol><li>Download Kaspersky Virus Removal Tool from the below link and then double click on it to start this utility.
<><a title="External link" href="http://www.kaspersky.com/antivirus-removal-tool?form=1" rel="nofollow">KASPERSKY VIRUS REMOVAL TOOL</a></> <em>(This link open an new webpage from where you can download Kaspersky Virus Removal Tool on your computer.)</em></li>
<li>Follow the onscreen prompts until it is installed</li>
<li>Click the Options button (the 'Gear' icon), then make sure only the following are ticked:
<ul>
<li><span style="color: #ff0000;">System Memory</span></li>
<li><span style="color: #ff0000;">Hidden startup objects</span></li>
<li><span style="color: #ff0000;">Disk boot sectors</span></li>
<li><span style="color: #ff0000;">Local Disk (C: )</span></li>
<li><span style="color: #ff0000;">Also any other drives (Removable that you may have)</span></li>
</ul>
</li>
<li>Then click on <>Actions</> on the left hand side</li>
<li>Click <>Select Action</>, then make sure both <>Disinfect</> and <>Delete if disinfection fails</> are ticked</li>
<li>Click on <>Automatic Scan</></li>
<li>Now click the <>Start Scanning</> button, to run the scan</li>
<li>After the scan is complete, click the reports button ('Paper icon', next to the 'Gear' icon) on the right hand side</li>
<li>Click <>Detected threats</> on the left</li>
<li>Now click the <>Save</> button, and save it as <>kaslog.txt</> to your <>Desktop</></li>
<li>Please attach kaslog.txt in your next reply.</li>
</ol>
<hr />

OK. Below is text of Hitman Pro log as it would not attach properly.

ESET did not find any threats, therefore no report was created.

Kaspersky Virus Removal Tool would not install in normal mode, it kept aborting with the message "Client Register Error: -2147024894" so I ran it in Safe Mode which produced the kaslog1 attached and kaslog2 which will not attach properly and is too large to paste into this post. What should I do?

Thanks for your patience...Hugo.

HitmanPro 3.7.6.201
www.hitmanpro.com

   Computer name . . . . : HUGOCOMPUTER
   Windows . . . . . . . : 5.1.3.2600.X86/2
   User name . . . . . . : HUGOCOMPUTER\Hugo
   License . . . . . . . : Trial (26 days left)

   Scan date . . . . . . : 2013-06-24 14:18:38
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 10m 19s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 0
   Traces  . . . . . . . : 124

   Objects scanned . . . : 1,171,624
   Files scanned . . . . : 54,963
   Remnants scanned  . . : 259,124 files / 857,537 keys

Miniport ____________________________________________________________________

   Primary
      DriverObject . . . : 8A8F0A68
      DriverName . . . . : \Driver\atapi
      DriverPath . . . . : atapi.sys
      StartIo  . . . . . : B9DE9864 atapi.sys+30820
      IRP_MJ_SCSI  . . . : B9DEBB40 atapi.sys+39744
   Solution
      DriverObject . . . : 8A8F0A68
      DriverName . . . . : \Driver\atapi
      DriverPath . . . . : atapi.sys
      StartIo  . . . . . : B9DE9864 atapi.sys+30820
      IRP_MJ_SCSI  . . . : B9DE8852 atapi.sys+26706

Suspicious files ____________________________________________________________

   C:\System Volume Information\_restore{98F833F7-368A-46D0-8190-E8CC52059E7E}\RP1547\A0465068.dll
      Size . . . . . . . : 17,443,544 bytes
      Age  . . . . . . . : 2.3 days (2013-06-22 07:13:26)
      Entropy  . . . . . : 6.4
      SHA-256  . . . . . : 298E5F790BAFD90DEDE9FDC51DAFF5B5CD9719AE1D3C1DDF53D6413927566232
      Product  . . . . . : RoboForm
      Publisher  . . . . : Siber Systems Inc.
      Description  . . . : RoboForm Main Module
      Version  . . . . . : 7-8-6-5
      Copyright  . . . . : Copyright (C) 1999-2012 Siber Systems Inc.
      RSA Key Size . . . : 2048
      Authenticode . . . : Invalid
      Fuzzy  . . . . . . : 25.0
         Program is altered or corrupted since it was code signed by its author. This is typical for malware and pirated software.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.
      Forensic Cluster
         -2.4s C:\System Volume Information\_restore{98F833F7-368A-46D0-8190-E8CC52059E7E}\RP1547\A0465061.manifest
         -2.2s C:\System Volume Information\_restore{98F833F7-368A-46D0-8190-E8CC52059E7E}\RP1547\A0465062.dll
         -1.6s C:\System Volume Information\_restore{98F833F7-368A-46D0-8190-E8CC52059E7E}\RP1547\A0465063.exe
         -1.2s C:\System Volume Information\_restore{98F833F7-368A-46D0-8190-E8CC52059E7E}\RP1547\A0465064.exe
         -1.0s C:\System Volume Information\_restore{98F833F7-368A-46D0-8190-E8CC52059E7E}\RP1547\A0465065.exe
         -0.6s C:\System Volume Information\_restore{98F833F7-368A-46D0-8190-E8CC52059E7E}\RP1547\A0465066.dll
         -0.6s C:\System Volume Information\_restore{98F833F7-368A-46D0-8190-E8CC52059E7E}\RP1547\A0465067.exe
          0.0s C:\System Volume Information\_restore{98F833F7-368A-46D0-8190-E8CC52059E7E}\RP1547\A0465068.dll
          4.6s C:\System Volume Information\_restore{98F833F7-368A-46D0-8190-E8CC52059E7E}\RP1547\A0465069.exe
          4.8s C:\System Volume Information\_restore{98F833F7-368A-46D0-8190-E8CC52059E7E}\RP1547\A0465070.exe
          7.8s C:\Documents and Settings\All Users\Start Menu\Programs\AI RoboForm\
          8.9s C:\Documents and Settings\All Users\Start Menu\Programs\AI RoboForm\Uninstall.lnk


Cookies _____________________________________________________________________

   C:\Documents and Settings\Hugo\Local Settings\Application Data\Google\Chrome\User Data\Default\Cookies:ad.yieldmanager.com
   C:\Documents and Settings\Hugo\Local Settings\Application Data\Google\Chrome\User Data\Default\Cookies:doubleclick.net
   C:\Documents and Settings\Hugo\Local Settings\Application Data\Google\Chrome\User Data\Default\Cookies:invitemedia.com
   C:\Documents and Settings\Hugo\Local Settings\Application Data\Google\Chrome\User Data\Default\Cookies:linksynergy.com
   C:\Documents and Settings\Hugo\Local Settings\Application Data\Google\Chrome\User Data\Default\Cookies:oracle.112.2o7.net
   C:\Documents and Settings\Hugo\Local Settings\Application Data\Google\Chrome\User Data\Default\Cookies:revsci.net
   C:\Documents and Settings\Hugo\Local Settings\Application Data\Google\Chrome\User Data\Default\Cookies:statcounter.com

 

[kuttus]

Okay. How's Everything working now?

 

[hweinze]

Okay. How's Everything working now?

Well... everything seems to working OK but AVG is still reporting these threats from scheduled scan.

"";"atapi.sys, hooked import HAL.dll READ_PORT_UCHAR -> spnf.sys +0x2042, C:\WINDOWS\system32\drivers\spnf.sys";"Infected"
severity: medium, identified by:Anti-Rootkit

"";"atapi.sys, hooked import HAL.dll READ_PORT_BUFFER_USHORT -> spnf.sys +0x213E, C:\WINDOWS\system32\drivers\spnf.sys";"Infected"
severity: medium, identified by:Anti-Rootkit

"";"i8042prt.sys, hooked import HAL.dll READ_PORT_UCHAR -> spnf.sys +0x11B90, C:\WINDOWS\system32\drivers\spnf.sys";"Infected"
severity: medium, identified by:Anti-Rootkit

 

[kuttus]

Upload a File to Virustotal
Please visit Virustotal.com

• Click the Browse... button
• Navigate to the file C:\WINDOWS\system32\drivers\spnf.sys
• Click the Open button
• Click the Send button
• Copy and paste the results back here please.

 

[hweinze]

Upload a File to Virustotal
Please visit Virustotal.com

• Click the Browse... button
• Navigate to the file C:\WINDOWS\system32\drivers\spnf.sys
• Click the Open button
• Click the Send button
• Copy and paste the results back here please.

spnf.sys not found

 

[kuttus]

Please select the Tools menu and click Folder Options.
After the new window appears select the View tab.
Put a checkmark in the checkbox labeled Display the contents of system folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.
After this please press the Apply button and then the OK

Now check if you are able to see it...

 

[hweinze]

Upload a File to Virustotal
Please visit Virustotal.com

• Click the Browse... button
• Navigate to the file C:\WINDOWS\system32\drivers\spnf.sys
• Click the Open button
• Click the Send button
• Copy and paste the results back here please.

spnf.sys not found

Idon't know if this helps but over time Avg has been reporting similar threats at the same location with different filenames such as:

6/20/2013
"";"i8042prt.sys, hooked import HAL.dll READ_PORT_UCHAR -> spqj.sys +0x11B90, C:\WINDOWS\system32\drivers\spqj.sys";"Secured"

6/22/2013
"";"i8042prt.sys, hooked import HAL.dll READ_PORT_UCHAR -> spws.sys +0x11B90, C:\WINDOWS\system32\drivers\spws.sys";"Infected"


6/23/2013
"";"i8042prt.sys, hooked import HAL.dll READ_PORT_UCHAR -> spbo.sys +0x11B90, C:\WINDOWS\system32\drivers\spbo.sys";"Infected"


6/24/2013
"";"i8042prt.sys, hooked import HAL.dll READ_PORT_UCHAR -> sper.sys +0x11B90, C:\WINDOWS\system32\drivers\sper.sys";"Infected"

None of these files are found at C:\WINDOWS\system32\drivers\

 

[kuttus]

Run FRST and type spws.sys in the search box. Then press search. Post the log that will be create on the USB

Repeat the same for
spbo.sys
sper.sys

 

[hweinze]

Please select the Tools menu and click Folder Options.
After the new window appears select the View tab.
Put a checkmark in the checkbox labeled Display the contents of system folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.
After this please press the Apply button and then the OK

Now check if you are able to see it...

following your instructions I still am not able to see the file.

I do see sptd.sys (similar) but cannot open.

 

[hweinze]

Run FRST and type spws.sys in the search box. Then press search. Post the log that will be create on the USB

Repeat the same for
spbo.sys
sper.sys

Windows cannot find FRST.

 

[hweinze]

Run FRST and type spws.sys in the search box. Then press search. Post the log that will be create on the USB

Repeat the same for
spbo.sys
sper.sys

OK..I finally figured it out...downloaded FRST and ran searches as you instructed...
[attachment=4968][attachment=4967][attachment=4966]

 

[kuttus]

Do you run it from Advance Boot Options or Normally ?

 

[hweinze]

Do you run it from Advance Boot Options or Normally ?

I ran it in normal mode.

 

[kuttus]

Can you please try to run a scan with Farbar Recovery Scan Tool. You will need a USB (Flash) pendrive.

For x32 (x86) bit systems download Farbar Recovery Scan Tooland save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
• Click on Repair your computer menu item.
• Select US as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account and click Next.

On the System Recovery Options menu you will get the following options:
Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt

• Select Command Prompt
• In the command window type in notepad and press Enter.
• The notepad opens. Under File menu select Open.
• Select "Computer" and find your flash drive letter and close the notepad.
• In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
  Note: Replace letter e with the drive letter of your flash drive.
• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the flash drive. Please copy and paste it to your reply.

Now Do the Search also.........