deleted by Knightspeed
deleted by Knightspeed
It is much easier for you and those reading to just attach the file to your post (see image, click to expand), when you click the Reply button, in that window you will see the Additional Options, clicking that will expand the window allowing for the attachment of files to your post (200KB limit for .txt, .log, gif, .jpg and .png file types)
Lets now close the open ports - have the redirects finished
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
- Open notepad and copy/paste the text in the quotebox below into it:
Registry:: [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "135:TCP"=- "5000:TCP"=- "5001:TCP"=- "5002:TCP"=- "5003:TCP"=- "5004:TCP"=- "5005:TCP"=- "5006:TCP"=- "5007:TCP"=- "5008:TCP"=- "5009:TCP"=- "5010:TCP"=- "5011:TCP"=- "5012:TCP"=- "5013:TCP"=- "5014:TCP"=- "5015:TCP"=- "5016:TCP"=- "5017:TCP"=- "5018:TCP"=- "5019:TCP"=- "5020:TCP"=-Save this as [b]CFScript.txt[/b], in the same location as ComboFix.exe
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
Refering to the picture above, drag CFScript into ComboFix.exeWhen finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
ComboFix.txt
Are you still getting redirects ? If so are they to a specific stite ?
I have not opened Google since we started thi$ FiX …
Could you try please
" WoW " … U RULE essexboy !
i did a te$t @ gifsoup.com …
everything loaded @ Light[color=pink]ning $peeD[/color] …
thi$ XP/PC is faster than my Win7/PC now.
" i would like 2 Thank U & U’re colleague$ 4 U’re …
quick re$ponce & $peedy FiX 2 my Viru$ dilemma "
I LOvE u …
‘Quick Questions’ / should i run my Wise Reg Cleaner now ?
and … can i tweek my (licenced) Ava$t to prevent another infection ?
My personal opinion is that registry cleaners are more trouble than they are worth and I would never recommend using them
Subject to no further problems 
I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems
Now the best part of the day ----- Your log now appears clean 
A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:
Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
:Commands [resethosts] [purity] [emptytemp] [EMPTYFLASH] [CLEARALLRESTOREPOINTS] [Reboot]
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
Remove ComboFix
[*]Hold down the Windows key + R on your keyboard. This will display the Run dialogue box
[*]In the Run box, type in ComboFix /Uninstall
(Notice the space between the “x” and “/”)
then click OK
http://i1224.photobucket.com/albums/ee362/Essexboy3/Misc%20screen%20shots/CF_Uninstall-1.jpg
[]Follow the prompts on the screen
[]A message should appear confirming that ComboFix was uninstalled
Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.
We will now confirm that your hidden files are set to that, as some of the tools I use will change that
[*]Click Start.
[*]Open My Computer.
[*]Select the Tools menu and click Folder Options.
[*]Select the View Tab.
[*]Under the Hidden files and folders heading select Do not show hidden files and folders.
[]Click Yes to confirm.
[]Click OK.
http://users.telenet.be/bluepatchy/miekiemoes/images/javaicon.gif
Your Java is out of date.
Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version of Java components and upgrade the application.
Upgrading Java:
[] Go to this site and click Do I have Java
[] It will check your current version and then offer to update to the latest version
Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
http://img233.imageshack.us/img233/7729/mbamicontw5.gif
Malwarebytes.
Update and run weekly to keep your system clean
Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link
It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit
[*]Microsoft Windows Update
To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?Keep safe 
“ThAnk U [color=blue]essexboy[/color]” …
I will adhere 2 all of U’re recommendations & instructions.
my utmost gratitude 2 U … Thank U so very much …
Now that you have 20 posts you could go to PROFILE then Modify Profile then update your Signature: with information like my signature as this helps the helpers offer pertinent advice.
also your text would be much easier to read if you used standard black…
Would probably take a lot less time to compile the post too ;D
Hi everyone,
I was Googling a picture for a friends birthday to post on their Facebook wall and as I clicked on A pic, “Avast” advised threat detected, Trojan Worm (I’m not computer savvie at all so please respond in basic computer jargon)!
What does this mean and how do I check pics before clicking on them… thankfully Avast picked this threat up and I opted out of images
Anyone advise/help please?
Adam in Australia
Whilst not entirely related to the original topic and we don’t like to stray to wide or the topic gets confused.
It is not unusual to get images that links, etc. have been hacked when doing a google image search. This is a common tactic of malware writers, in the same way they hack sites. You shouldn’t have to do anything special, before clicking the image, hover over it and see what link shows up on the browser status bar. Other than that I let avast take care of that sort of issue.
If you feel you need any other information, you can create a new topic and we will try and help.
looks like i still have it …
i went to : Google/ images/ j lo …
and all hell broke lose … i was bombarded with
multiple sites trying to open …
Well this may well be different as google image searches are a bit of a minefield; there are many hacked images, places were they use the legit image to display it but the URL if you happen to click on it is crafted to go to a malicious site.
Generally I don’t use the google image search, but when I do, I hover the mouse pointer over the image and check the URL to see where it is going or it is very long with other stuff in there other than the URL.
Going over your previous posts, I don’t see if this was using the standard google search and not the google image search ?
If the same then you are going to have to repeat the process of downloading, running the same tools and ‘attaching’ the same logs.
new scan
OTL.Txt