tetonbob

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------

1. Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
   
2. Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add or Remove Programs) if they exist:
   
   Messenger Service
   RelevantKnowledge
   
   You may receive notification that it's already been uninstalled, or is otherwise corrupted, would you like to remove it from the list. Click on Yes, or OK.
   
   optional but recommended uninstall:
   
   ShopperReports
   
   Here's why:
   
   http://www.bleepingcomputer.com/unin...erReports.html
   
   
   Quote:

   This Add or Remove Programs entry corresponds to a program that is either malware, installs malware, or is bundled with malware. It is advised that you uninstall this program from your computer due to the above reasons. If this program gave you the option to not install the malware or adware during setup, and you chose that option, then it should be safe to leave the program installed.

   ---------------------------------------------------------------------------------------------
   
   
3. P2P - I see you have P2P software (Frostwire ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.
   
   Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.
   
   Please see this topic for more information:
   
   http://www.techsupportforum.com/security-center/hijackthis-log-help/resolved-hjt-threads/305923-perils-p2p-file-sharing.html
   
   I would strongly recommend that you uninstall this. You can do so via Control Panel >> Add or Remove Programs.
   
   
   ---------------------------------------------------------------------------------------------
   
   
4. Open notepad and copy/paste the text in the quotebox below into it:
   
   
   Quote:

   http://www.techsupportforum.com/security-center/hijackthis-log-help/308378-computer-running-very-slow.html#post1787386 File:: c:\windows\system32\byfulyj.bat c:\windows\cose.scr c:\documents and settings\Fabiola Kelly\Application Data\irodyt.pif c:\windows\ytisinyg._dl c:\windows\system32\yvyvyvaqag.bin c:\windows\ogekyb.reg c:\windows\tidixyw._sy c:\windows\system32\ybatadylug._sy c:\windows\naxez._sy c:\Program Files\Common Files\axiwi.pif c:\Program Files\Common Files\obirolan.dat c:\documents and settings\Fabiola Kelly\Application Data\erutyxyzi.bin c:\documents and settings\All Users\Application Data\povyjek.vbs c:\Program Files\Common Files\ymazoxu.dll c:\Program Files\Common Files\afirarovuv.db c:\windows\Tasks\At1.job Folder:: c:\Program Files\yzivowb c:\documents and settings\All Users\Application Data\nqrslypg c:\Program Files\RelevantKnowledge Collect:: c:\program files\yzivowb\SysMon.dll Registry:: [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"=- [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\program files\\relevantknowledge\\rlvknlg.exe"=-

   Save this as CFScript.txt
   
   
   
   
   Referring to the picture above, drag CFScript.txt into ComboFix.exe
   
   
   
5. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
   
6. When finished, it shall produce a log for you. Post that log in your next reply
   
   Note:
   Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
   
   When ComboFix finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis.
   
   Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file.
   
7. Ensure your AntiVirus and AntiSpyware applications are re-enabled. A reboot should have done this.
   
   
   ---------------------------------------------------------------------------------------------
   
   
8. I see no evidence of an AntiVirus program on your system. This must be resolved. Connecting to the Internet without antivirus protection is a "Welcome" doormat for malware. It can take as little as eight seconds to infect an unprotected computer.
   
   
   Install this FREE AntiVirus program, update it, and run a full system scan.
   
   Avira AntiVir Personal
   
   Here is a tutorial on it's setup and use:
   
   http://www.techsupportforum.com/cont...ticles/64.html
   
   When the scan is complete, click on the Report button. A log file will open. Please post that in your next reply.
   
   Do not install more than one antivirus program because they will conflict with each other. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out.
   
   ---------------------------------------------------------------------------------------------
   
   
9. You have two versions of HijackThis on the machine. One is outdated. Please delete v 1.99.1, located here:
   
   C:\Program Files\Hijackthis\HijackThis.exe
   
   The most recent version is located here:
   
   C:\Program Files\trend micro\HijackThis.exe
   
10. Open HijackThis (C:\Program Files\trend micro\HijackThis.exe) and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.
    
    ---------------------------------------------------------------------------------------------