Hi Essexboy;
i’m having trouble reinstalling avast after a malware virus.
The virus seem s to be gone but I still can’t download avast completely.
Someone suggesyted to run OTL and post the logs here for you to see and recomend what to do or any advice, really!
I just did that below
What ca I do?
Thanks
here are the logs
the extras
Go to PROFILE then Modify Profile then Forum Profile Information then Signature: and put information about your system just like my signature about your system just like my signature so that the helpers can offer pertinent advice.
In Account Related Settings select Hide email address from public to prevent scammers and spammers harvesting your comcast.net email address.
I will send Essexboy a PM so he see this. be patient he works in several forums
thanks Pondus!
It seems that thanks to you and Chabbo I got to reinstall avast and get rid of the problem, so far it seems good…
Should I delete the virus from quarantine now?
Do you advise to upgrade to malwarebytes profesional, what’s the difference?
Thanks!
Do you advise to upgrade to malwarebytes profesional, what's the difference?yes if you see my signatur, this is the one i use. It is a one time fee for a liftime license I is very good at detecting and removing rogue programs. The pro have IP block so it will block you from entering websites that are listed,auto update, scheduled scan some info here " How To Use The New Scheduler, Applicable To Versions 1.45 and 1.46 Only " http://forums.malwarebytes.org/index.php?showtopic=45177
MBAM forum http://forums.malwarebytes.org
MBAM web http://www.malwarebytes.org/
thanks Pondus! I’ll look into that.
And thanks YoKenny for telling me about updating my profile for my signature and to hide my email address. I have no experience in Forums and did not know about it.
I’m learning and so far I’ve encountered great teachers! 
Hi just a few bits to kill
Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
:OTL
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555
[2010/05/16 09:35:36 | 000,000,000 | ---D | C] -- C:\Users\Helena Guerrero\AppData\Local\mhfpanjmg
[2010/05/16 16:19:17 | 000,000,000 | ---D | M] -- C:\Users\Helena Guerrero\AppData\Roaming\IObit
:Commands
[CLEARALLRESTOREPOINTS]
[resethosts]
[purity]
[emptytemp]
[EMPTYFLASH]
[Reboot]
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
THEN
Go to Control Panel and select Internet Options
Select the Connections TAB
Select LAN settings button
Ensure there is no tick in the Proxy Server box
Select OK and restart Internet explorer
And for Firefox there are instructions on this page and you want the setting to be no proxy
thanks Essexboy!
Just one question. After I run that OTL log I posted I did a full scan with avast, it found a virus in that same folder
C:\Users\Helena Guerrero\AppData\Local\mhfpanjmg\mjnagrptssd.exe
Win32:Crypt-GKR (Drp)
So that folder is now in the chest.
Do you recomend to run a boot scan after i run the OTL again, should i change something or just do as you advice regardless of the file being in the chest?
Thanks
Intriguing OTL should have removed that folder - ah just reread you did the scan before running the OTL fix ?
Lets now see what MBAM reveals, on completion can you let me now what problems remain
http://img233.imageshack.us/img233/7729/mbamicontw5.gif
Please download Malwarebytes’ Anti-Malware from Here.
Double Click mbam-setup.exe to install the application.
[*]Make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.
[*]If an update is found, it will download and install the latest version.
[*]Once the program has loaded, select “Perform Quick Scan”, then click Scan.
[*]The scan may take some time to finish,so please be patient.
[*]When the scan is complete, click OK, then Show Results to view the results.
[*]Make sure that everything is checked, and click Remove Selected.
[]When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
[]The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
[*]Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.
Hi !
yesterday morning I did the
1- Malaware scan,
2 - I did the OTL which is the log you saw.
I reinstalled Avast! finally…
3 - I did another Malaware scan with no infections found.
4 - I did an Avast full scan and found the file:C:\Users\Helena Guerrero\AppData\Local\mhfpanjmg\mjnagrptssd.exe
Win32:Crypt-GKR (Drp), (for some reason it did not appear in the Malaware scan)
So that folder is now in the chest.
I read your suggestion this morning, but that file is already on the chest.
Should i proceed with your advice (below) as it is knowing that the folder is in the chest already or should I change something before rerunning OTL? And should I schedule a boot scan when rebooting? thanks!
Run OTL
Under the Custom Scans/Fixes box at the bottom, paste in the following
Code:
:OTL
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: “ProxyServer” = http=127.0.0.1:5555
[2010/05/16 09:35:36 | 000,000,000 | —D | C] – C:\Users\Helena Guerrero\AppData\Local\mhfpanjmg
[2010/05/16 16:19:17 | 000,000,000 | —D | M] – C:\Users\Helena Guerrero\AppData\Roaming\IObit
:Commands
[CLEARALLRESTOREPOINTS]
[resethosts]
[purity]
[emptytemp]
[EMPTYFLASH]
[Reboot]
Run OTL with the script and let us see what it says
ok1
i run the Custom Scan and this came up in notepad:
All processes killed
Error: Unable to interpret <[emptytemp]> in the current context!
Error: Unable to interpret <[EMPTYFLASH]> in the current context!
Error: Unable to interpret <[Reboot]> in the current context!
OTL by OldTimer - Version 3.2.4.1 log created on 05202010_142048
Files\Folders moved on Reboot…
Registry entries deleted on Reboot…
2- I did the fix scan and here are the results.
3 - i went to internet options LAN settings and everything is unchecked there ( I unchecked that 3 days ago because the proxy where checked and i could no use my browser, after I unchecked it my IE work), so I did not restart the computer again, do I need to do it anyway? Should automatically detect settings be checked?
so I did not restart the computer again, do I need to do it anyway? Should automatically detect settings be checked?No and yes ;D just a restart of IE will set the settings
What problems do you have now ?
Thank you so much for your help and time…
I run an avast scan and everything seems fine and clean. ;D
The LAN settings window has still everything unchecked, even the “automatically detect settings” option. should that remain unchecked?
Thanks again!
Check the automatically detect option
I will remove my tools now and give some recommendations, but I would like you to run for 24 hours or so and come back if you have any problems
Now the best part of the day ----- Your log now appears clean 
A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:
Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself. MBAM can be uninstalled via control panel add/remove
We will now confirm that your hidden files are set to that, as some of the tools I use will change that
[*]Click Start.
[*]Open My Computer.
[*]Select the Tools menu and click Folder Options.
[*]Select the View Tab.
[*]Under the Hidden files and folders heading select Do not show hidden files and folders.
[]Click Yes to confirm.
[]Click OK.
http://users.telenet.be/bluepatchy/miekiemoes/images/javaicon.gif
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application. Beware it is NOT supported for use in 9x or ME and probably will not install in those systems
Upgrading Java:
[*]Download the latest version of Java SE Runtime Environment (JRE)JRE 6 Update 20.
[*]Click the “Download” button to the right.
[*]Select your Platform and check the box that says: “I agree to the Java SE Runtime Environment 6 License Agreement.”.
[*]Click on Continue.
[*]Click on the link to download Windows Offline Installation (jre-6u20-windows-i586-p.exe) and save it to your desktop. Do NOT use the Sun Download Manager…
[*]Close any programs you may have running - especially your web browser.
[*]Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
[*]Check any item with Java Runtime Environment (JRE or J2SE) in the name.
[*]Click the Remove or Change/Remove button.
[*]Repeat as many times as necessary to remove each Java version.
[*]Reboot your computer once all Java components are removed.
[*]Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u20-windows-i586-p.exe and select “Run as an Administrator.”)
VISTA
To manually create a new Restore Point
[*]Go to Control Panel and select System and Maintenance
[*]Select System
[*]On the left select Advance System Settings and accept the warning if you get one
[*]Select System Protection Tab
[*]Select Create at the bottom
[*]Type in a name i.e. Clean
[*]Select Create
Now we can purge the infected ones
[*]Go back to the System and Maintenance page
[*]Select Performance Information and Tools
[*]On the left select Open Disk Cleanup
[*]Select Files from all users and accept the warning if you get one
[*]In the drop down box select your main drive i.e. C
[*]For a few moments the system will make some calculations
[*]Select the More Options tab
[*]In the System Restore and Shadow Backups select Clean up
[*]Select Delete on the pop up
[]Select OK
[]Select Delete
You are now done
SPRING CLEAN
Download TFC to your desktop
[*]Open the file and close any other windows.
[*]It will close all programs itself when run, make sure to let it run uninterrupted.
[*]Click the Start button to begin the process. The program should not take long to finish its job
[*]Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean
THEN
Download Flush Flash from Here and follow the easy to use instructions on the same page
NEXT
Download and run Puran Disc Defragmenter
Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
[*]SpywareBlaster to help prevent spyware from installing in the first place.
http://img233.imageshack.us/img233/7729/mbamicontw5.gif
Malwarebytes. Run weekly to keep your system clean
It is critical to have both a firewall and anti virus to protect your system and to keep them updated.
To keep your operating system up to date visit
[*]Microsoft Windows Update
To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?
Keep safe 
Hi Essexboy:
Thanks for your recomendations!
I just got back from a 4 day trip and I just started my computer and it seems fine. I will do everything you mention above and let you know.
Thanks again!
Hi:
I did all you recomended till the Flush Flash, I tried but when I checked :-\ “everything” this warning came up:
No Flash Player folder present!
I thougth I had Flash Player…
So I don’t know, should I make a different choice :-[
UPDATE: I do have Adobe Flash Player 10, I’m just watching French Open on ESPN3…but it’s stalling once in a while…
Why does Flush Flash don’t find it?
Good question - I will ask the Author ;D