c:\windows\system32\proper.exe

[Malware Removal Specialist]

sn12.mailshell.net has to do with AVG antivirus (I think), why it is suddenly popping up I am not sure. maybe check the settings in AVG. Or even check for updates.

Go to C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe <--Delete the whole CA folder.

Also download and use the Norton removal Tool

One more HijackThis log please.

That folder was automatically removed when I uninstalled the eTrust EZ Antivirus software two days ago. But just to be sure, I did a file search, and nothing came back.

I ran the Norton Removal Tool as requested.

Here is the hjt log after norton.

thx.


[saving space - attachment deleted by admin]

[Malware Removal Specialist]

The logs are clean.

Run CCleaner.

Go to Start > Run and copy and paste next command in the field:

ComboFix /u



Make sure there's a space between Combofix and /
Then hit Enter.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again


I will look around for some info. on the sn12.mailshell.net pop up and see what I can find.

that is such a kewl little program (combofix)

I will search around as well and see what i can find. So far, all i've found is a bunch of jargon, but that's what i get for googling.  I wish I knew more places to look. What do you when you want to find something? Besides checking the popular search engines....

[Malware Removal Specialist]

Google is the best tool there is.

I visit a lot of security related forums so sometimes it is things I have either seen before or read about.

Just be careful with combofix, it is an advanced tool and should be used with caution for good reason.

Towards the bottom of this post is a discussion on sn12.mailshell.net

Hey thanks for everything. You are a tremendous help. My client will be so pleased.

I look forward to working with you in the future.

Have a great evening.