Great, thanks for all of your help. You are a lifesaver, or at least a laptop saver.
;D
Potentially some bad news here, was just readinmg some reviews on Comicbook Resources and the Malicious URL warning started back up again.
The listing on the warning reads like this
Object: 91.217.153.48/…/mJKV_1aeRPYfQdcaaTEWYObOURQTddObRlblQE-6XE
Infection: URL:Mal
Process: C:\WINDOWS\system32\gimf3232.exe
Given my problems originally started with these types warnings the first time around (before getting worse) this is probably something I should mention here.
I think that site is badly infected
Run a fresh OTL scan and I will see what it has dropped, and we will want a copy of that file
Download OTL to your Desktop
[*]Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
[*]Select All Users
[*]Under the Custom Scan box paste this in
netsvcs
%SYSTEMDRIVE%*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
CREATERESTOREPOINT
[*]Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
[*]When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
[*]Attach both logs
Maybe it was something I did, though I wasn’t on the computer when the scan was running, but the only notepad that popped up was the OTL report, which I have attached. I did not get a Extras.txt file. I checked in case it had save without me knowing it,. but the only Extras.txt I have is the one form the original scan on 8/16. Here is the OTL report however.
I would recommend that you stay away from that site for a while
Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
:OTL PRC - [2011/08/19 19:18:46 | 000,705,024 | ---- | M] (People Can Fly) -- C:\WINDOWS\system32\glmf3232.exe PRC - [2011/08/19 19:18:46 | 000,705,024 | ---- | M] (People Can Fly) -- C:\WINDOWS\system32\avicap3232.exe SRV - [2011/08/19 19:18:46 | 000,705,024 | ---- | M] (People Can Fly) [Auto | Running] -- C:\WINDOWS\system32\glmf3232.exe -- (upnphost32) IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 7E 78 FA 01 60 49 AE 43 8B 42 93 FD CA 88 DE A3 [binary data] IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 7E 78 FA 01 60 49 AE 43 8B 42 93 FD CA 88 DE A3 [binary data] IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 7E 78 FA 01 60 49 AE 43 8B 42 93 FD CA 88 DE A3 [binary data] IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 7E 78 FA 01 60 49 AE 43 8B 42 93 FD CA 88 DE A3 [binary data] IE - HKU\S-1-5-21-1693297055-2874526332-239285772-1005\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 7E 78 FA 01 60 49 AE 43 8B 42 93 FD CA 88 DE A3 [binary data] O20 - AppInit_DLLs: (C:\WINDOWS\system32\odbccu3232.dll) - C:\WINDOWS\system32\odbccu3232.dll (People Can Fly) O37 - HKU\.DEFAULT\...exe [@ = exefile] -- "C:\Documents and Settings\LocalService\Local Settings\Application Data\quu.exe" -a "%1" %* O37 - HKU\S-1-5-18\...exe [@ = exefile] -- "C:\Documents and Settings\LocalService\Local Settings\Application Data\quu.exe" -a "%1" %* [2011/08/19 19:19:03 | 000,705,024 | ---- | C] (People Can Fly) -- C:\WINDOWS\System32\avicap3232.exe [2011/08/19 19:18:59 | 000,155,648 | ---- | C] (People Can Fly) -- C:\WINDOWS\System32\odbccu3232.dll [2011/08/19 19:18:58 | 000,705,024 | ---- | C] (People Can Fly) -- C:\WINDOWS\System32\glmf3232.exe [2011/08/19 19:19:03 | 000,000,102 | ---- | M] () -- C:\WINDOWS\System32\1712679816 [2011/08/19 19:18:59 | 000,155,648 | ---- | M] (People Can Fly) -- C:\WINDOWS\System32\odbccu3232.dll [2011/08/19 19:18:46 | 000,705,024 | ---- | M] (People Can Fly) -- C:\WINDOWS\System32\glmf3232.exe [2011/08/19 19:18:46 | 000,705,024 | ---- | M] (People Can Fly) -- C:\WINDOWS\System32\avicap3232.exe:Reg
[HKU.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main]
XMLHTTP_UUID_Default=-
[HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main]
XMLHTTP_UUID_Default=-
[HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main]
XMLHTTP_UUID_Default=-
[HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main]
XMLHTTP_UUID_Default=-
[HKU\S-1-5-21-1693297055-2874526332-239285772-1005\SOFTWARE\Microsoft\Internet Explorer\Main]
XMLHTTP_UUID_Default=-:Files
ipconfig /flushdns /c
C:\Documents and Settings\LocalService\Local Settings\Application Data\quu.exe:Commands
[purity]
[resethosts]
[emptytemp]
[EMPTYFLASH]
[CREATERESTOREPOINT]
[Reboot]
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
Here is the next log after running both the fix and the quick scan after reboot.
OK lets now sweep for any orphans
Could you zip the following folder please and upload to mediafire and post the sharing link
C:_OTL
Please download Malwarebytes’ Anti-Malware
Double Click mbam-setup.exe to install the application.
[*]Make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.
[*]If an update is found, it will download and install the latest version.
[*]Once the program has loaded, select “Perform Quick Scan”, then click Scan.
[*]The scan may take some time to finish, so please be patient.
[*]When the scan is complete, click OK, then Show Results to view the results.
[*]Make sure that everything is checked, and click Remove Selected.
[]When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
[]The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
[*]Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.
Hopefully I did this correctly in uploading, but here is the link to the upload on mediafire
http://www.mediafire.com/?nu229shmbyddz47
Going to run Malware now.
And here is the MBAM log
Malwarebytes’ Anti-Malware 1.51.1.1800
www.malwarebytes.org
Database version: 7520
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
8/20/2011 3:41:34 PM
mbam-log-2011-08-20 (15-41-34).txt
Scan type: Quick scan
Objects scanned: 153498
Time elapsed: 2 minute(s), 56 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 8
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
c:\documents and settings\localservice\application data\020000005685e7cb1406c.manifest (Malware.Trace) → Quarantined and deleted successfully.
c:\documents and settings\localservice\application data\020000005685e7cb1406o.manifest (Malware.Trace) → Quarantined and deleted successfully.
c:\documents and settings\localservice\application data\020000005685e7cb1406p.manifest (Malware.Trace) → Quarantined and deleted successfully.
c:\documents and settings\localservice\application data\020000005685e7cb1406s.manifest (Malware.Trace) → Quarantined and deleted successfully.
c:\WINDOWS\system32\020000005685e7cb1406c.manifest (Malware.Trace) → Quarantined and deleted successfully.
c:\WINDOWS\system32\020000005685e7cb1406o.manifest (Malware.Trace) → Quarantined and deleted successfully.
c:\WINDOWS\system32\020000005685e7cb1406p.manifest (Malware.Trace) → Quarantined and deleted successfully.
c:\WINDOWS\system32\020000005685e7cb1406s.manifest (Malware.Trace) → Quarantined and deleted successfully.
How is the computer behaving now ?
So far no issues, I haven’t seen the Network Shield alert from Avast since we started this process today, and checking the status since the last reboot (after MBAM) it hasn’t picked up anything that would set it off (243 connections scanned/0 infected). So far so good.
OK if all is well tomorrow let me know and I will remove my bits and bobs ;D
So far the network shield has checked 10262 connections and not a single warning. No noticeable problems online either, no reidrects or anything like that.
Subject to no further problems 
I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems
Now the best part of the day ----- Your log now appears clean 
A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:
Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
:Commands [resethosts] [purity] [emptytemp] [EMPTYFLASH] [CLEARALLRESTOREPOINTS] [Reboot]
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
.
Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.
.
We will now confirm that your hidden files are set to that, as some of the tools I use will change that
[*]Click Start.
[*]Open My Computer.
[*]Select the Tools menu and click Folder Options.
[*]Select the View Tab.
[*]Under the Hidden files and folders heading select Do not show hidden files and folders.
[]Click Yes to confirm.
[]Click OK.
.
http://users.telenet.be/bluepatchy/miekiemoes/images/javaicon.gif
Your Java is out of date.
Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version of Java components and upgrade the application.
Upgrading Java:
[] Go to this site and click Do I have Java
[] It will check your current version and then offer to update to the latest version
.
SPRING CLEAN
Download and run Puran Disc Defragmenter
For the first run I would recommend a boot defrag and disk check
http://i1224.photobucket.com/albums/ee362/Essexboy3/Puran-1.gif
Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
http://img233.imageshack.us/img233/7729/mbamicontw5.gif
Malwarebytes.
Update and run weekly to keep your system clean
Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link
It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit
[*]Microsoft Windows Update
To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?Keep safe 
I left it go for a couple days, didn’t notice any problems so I finished with the clean up and added the programs you suggested. Just wanted to thank you again for all of your help, most appreciated.
No problem glad to help