Angelfire777

Hi,

I noticed that you installed the wrong package for recovery console you should've downloaded the one for professional. Nevertheless, this one should work ok in case we need it.

I see you have a lot of "extra" programs that came in from some of the programs you download like toolbars, etc. When you install programs, make sure you read every thing that it is showing you. Most of the time it suggests you to install their sponsors or some extra stuff. Avoid them most of the time. They are usually adwares and some of them are spyware because they track your internet usage.

*I see you have P2P software ( BitComet 1.02 ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

References for the risk of these programs are here, here, and here.

I would strongly recommend that you uninstall it, however that choice is up to you. If you choose to remove this program, you can do so via Control Panel >> add/remove programs

If you decide to uninstall BitComet 1.02, also delete this Folder if they still exist:

C:\Program Files\BitComet


*CarbonPoker
Celeb Poker
Ladbrokes Poker
Littlewoods Poker
PartyPoker
Poker.com
PokerStars
Titan Poker
Are you using all these poker programs? Take note that most of these programs are bundled with adwares and are vectors for malware to enter your system. I suggest removing them unless you're using all of them.

*DAEMON Tools Toolbar << daemon tools toolbar is adware. please remove it from your system.
_________

*Open HijackThis > choose Scan Only > Place a checkmark in the boxes beside these entries in bold.

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKCU\..\Run: [93751330765667180758236897386253] C:\Program Files\AV9\av2009.exe
O9 - Extra button: (no name) - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - (no file)
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
O20 - AppInit_DLLs: buknzu.dll

Close your browsers and all open windows except for HijackThis, then click "Fix checked". Exit HijackThis.


*delete this file:

C:\WINDOWS\system32\scui.cpl

delete these folders:

C:\Program Files\Free Offers from Freeze.com
C:\Documents and Settings\All Users\Application Data\Winferno
C:\Documents and Settings\All Users\Application Data\Napster <<i dont see napster installed in your system so it should be a leftover folder
C:\Program Files\free-downloads.net
C:\Program Files\AV9
__________

Your Java is out of date....
Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components.

• Click Start > Control Panel
• Click Add/Remove Programs
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove button.
• Repeat as many times as necessary to remove all versions of Java.
• Reboot your computer once all Java components are removed.

Then download Java Runtime Environment 6u7, and install it to your computer.

• Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)
• On the General tab, under Temporary Internet Files, click the Settings button.
• Next, click on the Delete Files button
• There are two options in the window to clear the cache - Leave BOTH Checked
  • Applications and Applets
    Trace and Log Files
• Click OK on Delete Temporary Files Window
  Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
• Click OK to leave the Temporary Files Window
• Click OK to leave the Java Control Panel.

_________

Please run this online scan to help look for remnants.

First, Go to Start>Control Panel>Add/Remove Programs and remove Kaspersky online scanner if present prior to downloading the most up-to-date one.

Next, establish an internet connection & perform an online scan using Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.

• The program will then begin downloading the latest definition files.
• Once the files have been downloaded click on NEXT
• Locate the Scan Settings button & configure to:
  • Scan using the following Anti-Virus database:
    • Extended
  • Scan Options:
    • Scan Archives
    • Scan Mail Bases
• Click OK & have it scan My Computer
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  
  
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

**Note**

To optimize scanning time and produce a more sensible report for review:

• Close any open programs
• Turn off the real time scanner of any existing antivirus program while performing the online scan. You may disconnect from the internet once you begin the scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

On your next reply, please include a

• Fresh HijackThis log.
• kaspersky scan log