How to clear up this virus

Viruses and worms
1

Hi there,

This is my first time posting here and I am attempting to remove this virus from my laptop. Everytime that I log in, I get a download option when my start-up programs like msn or yahoo messenger open up. Aside from that my laptop freezes up after about 30 minutes of me using it. I read the sticky on the necessary logs that you need in order to speed up the process. Pasted below you will find the two logs requested. I would appreciate any help that anyone could give me. The OTS log is too long to post, what do I do now?

Thanks
Sandra

mbam-log
Malwarebytes’ Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6555

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

5/11/2011 10:53:34 AM
mbam-log-2011-05-11 (10-53-34).txt

Scan type: Quick scan
Objects scanned: 164978
Time elapsed: 11 minute(s), 24 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 2
Files Infected: 8

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{BEAC7DC8-E106-4C6A-931E-5A42E7362883} (Adware.GameVance) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XP Deluxe Protector (Trojan.FakeAlert) → Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\Control Panel\don’t load\scui.cpl (Hijack.SecurityCenter) → Value: scui.cpl → Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\don’t load\wscui.cpl (Hijack.SecurityCenter) → Value: wscui.cpl → Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
c:\programdata\12927674 (Rogue.Multiple) → Quarantined and deleted successfully.
c:\Users\RD\xp deluxe protector (Rogue.DeluxeProtector) → Quarantined and deleted successfully.

Files Infected:
c:\Users\RD\downloads\bjballroom(2).exe (PUP.Casino.Gen) → Quarantined and deleted successfully.
c:\Users\RD\downloads\bjballroom(3).exe (PUP.Casino.Gen) → Quarantined and deleted successfully.
c:\Users\RD\downloads\bjballroom(4).exe (PUP.Casino.Gen) → Quarantined and deleted successfully.
c:\Users\RD\downloads\bjballroom(5).exe (PUP.Casino.Gen) → Quarantined and deleted successfully.
c:\Users\RD\downloads\bjballroom.exe (PUP.Casino.Gen) → Quarantined and deleted successfully.
c:\Users\RD\AppData\Roaming\microsoft\Windows\start menu\Programs\Startup\scandisk.lnk (Trojan.Downloader) → Quarantined and deleted successfully.
c:\Users\RD\AppData\Local\Temp\nsrbgxod.bak (Trojan.Agent) → Quarantined and deleted successfully.
c:\programdata\12927674\12927674 (Rogue.Multiple) → Quarantined and deleted successfully.

2

Could you attach the OTS log please

When you post there is an additional options link at the bottom left
click that and browse to the OTS log
Then post ;D

3

Thanks, I attached the OTS log

4

I see that you have run Combofix could you attach that log please

Start OTS. Copy/Paste the information in the quotebox below into the panel where it says “Paste fix here” and then click the Run Fix button.

[Unregister Dlls]
[Registry - Safe List]
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
YN -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar
YN -> "{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< Internet Explorer ToolBars [HKEY_USERS\S-1-5-21-1342607339-3503443595-3247478025-1000\] > -> HKEY_USERS\S-1-5-21-1342607339-3503443595-3247478025-1000\Software\Microsoft\Internet Explorer\Toolbar\
YN -> WebBrowser\\"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< File Associations - Select to Repair > -> HKEY_USERS\S-1-5-21-1342607339-3503443595-3247478025-1000\SOFTWARE\Classes\<extension>\
YN -> .exe [@ = exefile] -> Reg Error: Key error.
[Empty Temp Folders]
[EmptyFlash]
[CreateRestorePoint]

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here

I will review the information when it comes back in.

THEN

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the “Scan” button to start scan

http://public.avast.com/~gmerek/aswMBR1.png

On completion of the scan click save log, save it to your desktop and post in your next reply

http://public.avast.com/~gmerek/aswMBR2.png