I already contacted you about getting infected with a virus or Trojan.
I did as instructed, which was:
I uninstalled/re-installed avast anti-virus. It gave me some problems at first, but finally was able to accomplish it.
I ran a full in-depth scan and it found a virus labeled: “Win32 Smokeloader-AG [Trj]”
I had it move to the chest, but it now says an error on the log page: System cannot find the file specified (2)"
I reran several scans after, and it has not detected anything since. I ran 3 boot scans that never found anything. (Altho, I am in question that my boot is functioning properly. It shows just a black screen with a few colored lines at the top, but shows in the log that it did the boot scan.)
There is no evidence now that a virus or trojan is still on my system, but I am not convinced that it is truly gone. Is there anything I can run to be sure? I saw in the forum that someone ran something to eliminate a trojan. I am scared to download anything off the internet to do this task in my own as I am concerned it might really be a trojan itself.
PLEASE HELP!!! I want to make sure I have a safe system once again.
(BTW: I believe I am running Internet Security 8. I did pay $30.00 for it)
Hi where did you get that information from ? As a malware infection does not need a re-install of Avast
Lets check it out, it does sound like some bad toolbars
CLEAR THE BAD TOOLBARS
Download AdwCleaner from here to your desktop
Run AdwCleaner and select Delete
https://dl.dropbox.com/u/73555776/AdwCleaner.GIF
Once done it will ask to reboot, allow this
On reboot a log will be produced please attach that
THEN
Download OTL to your Desktop
Secondary link
[*]Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
https://dl.dropbox.com/u/73555776/OTL_Main_Tutorial.gif
[*]Select All Users
[*]Under the Custom Scan box paste this in
netsvcs
BASESERVICES
%SYSTEMDRIVE%*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
winsock.*
/md5stop
CREATERESTOREPOINT
[*]Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
[*]When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
[*]Post both logs
I submitted a ticket to the support tech. I got an email with instructions as I mentioned.
To back up, it all started when my husband clicked on a link in an email froma friend.
Avast said it detected something. I’m not sure the actual message as it was my husband who told me about it.
(FYI: I really can’t tell you if it was rebooted afterthat and before I looked at it)
I tried to, then run a scan, but it showed the anti-virus was disabled & said FIX NOW, but it wouldnt let me fix it.
I could not use the scan at all. That is when I contacted Avast Tech support and they said to uninstall & reinstall.
Is this a malware or Trojan or what?
It may be part of the Whitesmoke toolbar bad ware if you run the two programmes I will be able to ensure that it has gone
OK. I did the 2 things you recommended. The only thing I didnt get was I didnt check ALL USERS
in OTL (dumb) sorry.
BUT, when I went to attach the files from the logs, they WERE in my DOWNLOADS file, but now
they are not there! When I hit the drop down menu for files, they are listed, but say they dont exist.
WHAT HAPPENED TO THEM. This is scaring me! I even did a search and nothing. HELP!
OK. I did finally find the log for ADWCleaner. It is attached. Still dont know why the OTL log is gone.
I restored them with my Carbonite. Cant figure out how the log files got deleted.
Weird. They are attached. HELP! Am I clean now???
I reran OTL with ALL USERS selected. The file log is attached for it too as OTL txt.2
Thanks
Yep it looks like it was just some bad toolbars
All programmes are best run from the desktop then they do not get lost
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot
Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
https://dl.dropbox.com/u/73555776/OTL_Fix.GIF
:OTL
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-2349216015-2044274021-1134175567-1001\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
[2013/02/27 11:36:49 | 000,000,000 | ---D | C] -- C:\Users\Tammy\AppData\Local\MFAData
[2013/02/27 11:35:40 | 000,000,000 | ---D | C] -- C:\Users\Tammy\AppData\Local\Avg2013
[2013/02/27 11:09:51 | 000,326,144 | ---- | C] (AVAST Software) -- C:\Users\Tammy\Desktop\aswclear.exe
:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
I did as you said. Attached is the log. Am I clean now???
Thanks so much for your help!!!
How is the computer behaving now, is everything working as it should ?
Yes it seems to be now. I don’t notice any problems. I know they can hide tho.
Do you think it is free of badware and all now???
I sure hope so.
Oh, is it safe to run the ADWCleaner in the future on my computer to check for bad ware?
I can see no additional signs, if you are happy tomorrow let me know and I will remove my tools
OK. Thanks!!!
I’ll let you know.
Yes. far, so good. Everything seems to be good.
THANK YOU SO MUCH FOR YOUR HELP!!!
Subject to no further problems 
I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems
Now the best part of the day ----- Your log now appears clean 
A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:
Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.
We will now confirm that your hidden files are set to that, as some of the tools I use will change that
[*]Click Start.
[*]Open My Computer.
[*]Select the Tools menu and click Folder Options.
[*]Select the View Tab.
[*]Under the Hidden files and folders heading select Do not show hidden files and folders.
[]Click Yes to confirm.
[]Click OK.
Clear Restore Points
Go Start > All Programmes > Accessories > System tools
Right click Disc Cleanup and select run as administrator
Select More Options tab
Press Sytem Restore and Shadow Copies Cleanup button
https://dl.dropbox.com/u/73555776/disc%20clean.JPG
: Keep Java Updated :
WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article and this article.
I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)
Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
http://img233.imageshack.us/img233/7729/mbamicontw5.gif
Malwarebytes.
Update and run weekly to keep your system clean
Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link
If you use on-line banking then as an added layer of protection install Trusteer Rapport
It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit
[*]Microsoft Windows Update
To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?Keep safe 
My situation just got more complicated it seems…
I turned on my computer to do the clean up you wrote about.
My computer did not want to boot. The repair thing came on
and did a system restore and it then booted.
BUT, it took it back to BEFORE the OTL & ADWCleaner were installed.
What just happened? Does it put the bad files back on?
Have I started over now or what?
I’m very confused what to do now.
Was this the infection that did this to me or what?
Also, I wanted to ask you, when running an Avast full scan,it is showing several files that cannot be scanned.
It says they are password protected. Are they legit files?
Thought I was out of the woods. Now not so sure.
UPDATE: I did another system restore for after these 2 tools were run. I have the logs on here now so I
think it is OK. Whew! What do you think???
Run one further OTL quick scan for me to look at
Normally password protected files are security related… But Avast will scan them once they are opened
Attached is the log of my quick scan you requested.
Also, how do I open those files that are password protected to get Avast to scan them?
There are quite a few.
Thanks.
They may be your backup files and the only programme that can unlock the password is the one that made them. But, they will be scanned by Avast on launch
How is the computer behaving now ?