Internet Explorer 6 problem after Malaware/Spyware !

[maxmix]

Hi Guys/Gals (Nice site BTW)

Hopefully one of you Guru's can help me here without the need of a reformat.....

Bid long winded here but i'll give you the full story.... This all relates to my shop PC....
At home just now, so hopefully you can give me some ideas to try in the morning on my Non connecting PC

It's 1am here in Scotland so i'll need to check back for any ideas to try tomorrow in a couple of hours before bed lol

Yep.... Long winded

On Friday I went to look for a cover at www.cdcovers.cc for an old Arcade Emulator I have....

Only on the site a few mins and my Avast4 kicked in about some dodgy .dll file being tampered with.... Happened about 5 times with different System32\*.dll's Quickly looked them up and it was a Spyware attack....

So basically it was Spyware that caused my problem.....

My BT Voyager ADSL Modem default changed to my old Dial up modem with a dodgy tel num....

(Not plugged in so it could not get on to any premium numbers etc) But HDD was whirring and whirring (Like a defrag) Mega files or registery entries were being changed at a guess.....

A few restarts later, Avast finally sorted out the .dll's but now my USB ADSL modem connects ok...

But IE6 will not open any pages.... Tried Firefox also.... Checked DNS, all OK....

Phones my ISP tried various CMD ping tests and manual DNS IP entries, all were OK....

Reinstalled IE6 fully (I have it on CD) still the same.... Reinstalled XP Pro over its self..... Still the same....

3 days on (Tried a winsock repairer) all to no avail....

Please help

maxmix

There must be a registry entry or files that are causing this.... I am all backed up, but dont have all my drivers and SW handy to reformat, so this needs to be a last resort, MY ISP came to the end of their tests after 30 mins, they say I am connecting and data is OK etc, and reinstalled modem drivers at the same time...

[TheEmperor]

Get HijackThis and run it and post the log on here. There's a good chance you still have some malware on the system.

[maxmix]

Hi Emp

This ? If so I'll put it on my flash drive and try to post the log tomorrow....

I've seen people use this SW, always looked a bit complicated lol

http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html

maxmix

PS Do you think we will get my connection back without a reformat ?

[patio]

Start Here...

[maxmix]

Thanks Patio.... I have done most of what is said over the last 3 days in the post you directed me to, with similar SW, removed all Spyware etc and installed (I have SP3 for XP Pro) It went on when I tried the Windows installation.... I have XP Pro with SP3 (Hopefully no damage has been done)

But I am downloading everything now to my trusty 16GB Flash Drive and will follow your instructions tomorrow on the suspect PC....

Thanks for now, gives me new hope.... (I normally back customers PC's up and reformat at this stage lol) But not possible ATM with my 3 x 400GB Hdd's..... Too much to go through etc....

maxmix

BTW Your 1st link needs updating.... I sorted it straight away by removing the ''' (It's the 1st download in Step A) Just to help others etc.....

[maxmix]

Also, I'll try and post back what results when I can through the day tomorrow....

I've hooked my little Asus EEE Laptop up so I can access my email server through the day....

Just not feasable to work with for too long....

Only problem I see is.... In your guides about running updates to latest versions etc....

I cant connect remember lol

I'll try my best with what I have downloaded now and your instructions.....

Thanks for your help....

3:15am now Bed time.....

If you can think of anything else I could try tomorrow, I'll check tomorrow to see if there are any additions here

maxmix

[Broni]

In your case, don't worry about updates too much...

[patio]

Not sure what link you say needs updating as i just ran thru them all but thanx for the heads up...

[maxmix]

Thanks.... On Asus EEE ATM Spyware galore found on main PC....

Will report and post logs ASAP, Lo of files to be scanned etc....

Check and edit http://filehippo.com/software/antivirus/"

Remove your last inverted's

L8r

maxmix

[patio]

Check and edit http://filehippo.com/software/antivirus/"

Remove your last inverted's Wink

HuH ? ?

[maxmix]

Yes someone has edited now

Right.... down to business..... Over night to finish all the scanning etc....

All jobs done..... Still wont connect......

Here are the logs as requested..... Phew.....

maxmix

[file cleanup - saving space - attachment deleted by admin]

[maxmix]

DrWeb

xxyayay.dll;d:\windows\system32;Trojan.Virtumod.240;Deleted.;

and Hijack this attahed also....

maxmix

[file cleanup - saving space - attachment deleted by admin]

[Broni]

I only checked SAS log, and you had a lot of bad stuff there, so we must clean your computer, first.
I'll take a look at your HJT log, now.

[Broni]

Download Malwarebytes' Anti-Malware (http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html)  to your desktop.

    * Double-click mbam-setup.exe and follow the prompts to install the program.
    * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform full scan, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Be sure that everything is checked, and click Remove Selected.
    * When completed, a log will open in Notepad.
    * Post the log back here.

Be sure to restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

Post new HJT log, as well

[maxmix]

Thank you Broni.... Will D/L Anti Mala now, put on Flash Drive and run on computer tomorrow again....

I'll run Hijack after this and post back tomorrow afternoon.... 2am again lol Bed

NN

maxmix

[Broni]

No problem. Judging from HJT log, a lot of crap was removed by SAS.

[maxmix]

Hi Guys....

Have left this latest full scan running over night.... Another long one etc....

Will post log and new Hijack log tomorrow....

Still Cannot display web page, gave it a quick try with the modem plugged in.... Before starting scan etc....

Do you think I will get this connecting again ?

maxmix

[Broni]

It's hard to say before HJT log is posted, and we can see what's there.

[maxmix]

Sill a load of craf found.... Thank goodness for my little Asus EEE

OK Next 3 logs posteed.... And still wont connect

BTW I remember the file now (I see it in one of the logs) that triggered/caused all this grief last Saturday.....

17PHolmes572.exe (I remember seeing it in a fash then it bypassed my AV SW and killed my connection)

maxmix

[file cleanup - saving space - attachment deleted by admin]

[maxmix]

New Hijackthis log.....

Thanks

maxmix

[file cleanup - saving space - attachment deleted by admin]

[Broni]

Both logs are not readable.
How did you save them?

[maxmix]

Just as txt, But here we go.....

Malwarebytes' Anti-Malware 1.03
Database version: 337

Scan type: Full Scan (C:\|D:\|E:\|F:\|)
Objects scanned: 731782
Time elapsed: 3 hour(s), 18 minute(s), 44 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 17
Registry Values Infected: 4
Registry Data Items Infected: 0
Folders Infected: 2
Files Infected: 18

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{e180f496-8a4b-44e2-9fe0-0364e345db7f} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e180f496-8a4b-44e2-9fe0-0364e345db7f} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a95b2816-1d7e-4561-a202-68c0de02353a} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{00000000-0000-0000-0000-100005000004} (Rogue.Installer) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\aldd (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\MS Juan (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\jkwslist (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Juan (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{e180f496-8a4b-44e2-9fe0-0364e345db7f} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\{6780a29e-6a18-0c70-1dff-1610dde00108} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\{f710fa10-2031-3106-8872-93a2b5c5c620} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
D:\Program Files\dynamic toolbar (Adware.2020search) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\wsnpoem (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
C:\msgid_2513758_Norton_Anti_Virus_2007_(Vista)\Norton Anti Virus 2007 (Vista)\Keygen.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7F83E266-DCC3-4172-A8B1-12821784669D}\RP5\A0000873.exe (Adware.Zango) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7F83E266-DCC3-4172-A8B1-12821784669D}\RP5\A0000874.exe (Adware.Zango) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\wsnpoem\video.dll (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\wsnpoem\audio.dll.cla (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\wsnpoem\audio(2)(3).dll (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\wsnpoem\audio.dll (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\wsnpoem\audio(4)(2).dll (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\wsnpoem\audio(3)(2).dll (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\wsnpoem\audio(2)(2).dll (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\wsnpoem\audio(3)(3).dll (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\wsnpoem\audio(4)(3).dll (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\wsnpoem\audio(3)(4).dll (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\wsnpoem\audio(2)(4).dll (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\17PHolmes572.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\1_exception.nls (Malware.Trace) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\ClickToFindandFixErrors_RON.ico (Malware.Trace) -> Quarantined and deleted successfully.
D:\Documents and Settings\Microsoft User.MICROSOF-D1AB79\~tmp74.exe (Heuristic.Malware) -> Quarantined and deleted successfully.

maxmix

[maxmix]

and.... Log of Trend Micro HijackThis

To big to copy and paste....

maxmix

PS Still cant connect

[file cleanup - saving space - attachment deleted by admin]

[Broni]

Still cant connect

We'll worry about it, when your computer is clean.
I'm also concerned about SP3, you installed. It's still in beta. Where did you get it from?

1. Print this post out, since you won't have an access to it, at some point.

2. Close all windows, except for HijackThis.

3. Put a checkmark next to the following HijackThis entries (some entries will be checkmarked to disable unnecessary startups; in those cases (marked with *), no actual program will be removed):

- F2 - REG:system.ini: UserInit=D:\WINDOWS\system32\userinit.exe,D:\WINDOWS\system32\ntos.exe,
- O2 - BHO: (no name) - {3E8F7140-F3D1-42B9-BD02-420E662CABD3} - (no file)
- *O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
- *O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
- *O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
- O4 - HKCU\..\Run: [userinit] D:\WINDOWS\system32\ntos.exe
- *O4 - HKCU\..\Run: [SUPERAntiSpyware] D:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
- O4 - HKUS\S-1-5-18\..\Run: [userinit] D:\WINDOWS\system32\ntos.exe (User 'SYSTEM')
- O20 - Winlogon Notify: bqxztdsw - bqxztdsw.dll (file missing)
- O20 - Winlogon Notify: p2k32reg - D:\Documents and Settings\All Users.WINDOWS\Documents\Settings\p2k32.dll (file missing)
- O20 - Winlogon Notify: xxyayay - xxyayay.dll (file missing)
- O23 - Service: COM+ Messages - Unknown owner - -e,mc-110-12-0000272, (file missing)

4. Click on "Fix checked" button.

5. Restart your computer in Safe Mode (keep tapping F8 key, when your computer starts)

6. Open Windows Explorer. Go Tools>Folder Options>View tab, put a checkmark next to "Show hidden files, and folders".

7. Delete following files/folders (if present):

- ntos.exe file from D:\WINDOWS\system32

8. Turn off System Restore:

- Windows XP:
   1. Click Start.
   2. Right-click the My Computer icon, and then click Properties.
   3. Click the System Restore tab.
   4. Check "Turn off System Restore".
   5. Click Apply.   
   6.  When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
   7. Click OK.
- Windows Vista:
   1. Click Start.
   2. Right-click the Computer icon, and then click Properties.
   3. Click on System Protection under the Tasks column on the left side
   4. Click on Continue on the "User Account Control" window that pops up
   5. Under the System Protection tab, find Available Disks
   6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:")
   7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
   8. Click OK

9. Restart in Normal Mode.

10. Turn System Restore on.

11. Post new HijackThis log.

[maxmix]

Thanks Broni

Here we go....

Got to stage 7 NP.... (No ntos.exe file or folder) closest in the System32 Dir was a Kernal file (ntoskrnl @ 2.09MB)

Got to stage 11 NP.... Log attached now.... (Tried a quick connect still nothing) Fair enough....

**** Update... While I was connected to my ISP at 7.6MB in the Systray etc (Bottom right) I tried clicking on home (www.yahoo.com) etc.... The error is displayed for a millisecond down the bottom left of IE

I tried clicking as fast as I could for a bit and managed eventually to write down the error that IE briefly displays before 404 not found etc....

''d:\Windows\System32\xpsp3res.dll\dnserror.htm (I wonder if this is to do with the Beta SP3 I downloaded to try and update my settings before I came to you guys for help....

Anyway.... At the ready tomorrow

maxmix

[file cleanup - saving space - attachment deleted by admin]

[Broni]

OK. The log is clean. We still have long way to go.

What do you mean by:

While I was connected to my ISP

Were you able to connect briefly?

xpsp3res.dll is Service Pack 3 Messages service.
Said that, I want you to completely uninstall SP3, and we'll go from there.

[maxmix]

My USB Voyager (ADSL) Modem has always connected from the start and still will if I plug it in....

But IE Cannot open any pages (From the start) I tried IE7 SP3 Reinstall XP everything but no www can be displayed....

I will try and uninstall SP3 tomorrow and LYK how I get on.... Any tips about this....

I used an XP Pro CD (Hmmm) with SP3 intregrated (All I could lay my hands on at the time)

I may have to install XP again (I have since found my original XP Pro CD) with SP1 or 2 (Original etc)

maxmix

PS Late one tonight.... 3:30am here lol (NN)

[patio]

If you have an XPPro CD with SP3 integrated then it is a bootleg and all bets are off...

[Broni]

I will try and uninstall SP3 tomorrow and LYK how I get on.... Any tips about this....

I have no clue, since I didn't play with it.

[maxmix]

Right new news.... I could not remove SP3 manually so I installed the XP Pro CD again (Sorry it's SP2 integrated) SP3 came form here 330MB I download (Full version)

So Installed a fresh XP this time into my d:\windows folder all went well obviously I have had to reinstall all my drivers and progs again etc (Still at that) but I have net access again....

But getting a lot of .dll erros popping up.... and a new 'Windows Messenger' spyware box that I cant get rid off...

Once I have all my progs installed again, what AV and Spyware should I reinstall and run.... I'll post up logs as before and then re run Hijack this etc....

Thanks

maxmix

[Broni]

Download, and install AVG free antivirus: http://free.grisoft.com/
OR...
Download, and install Avast! free antivirus: http://filehippo.com/download_avast_antivirus/
AND...
Download, and install Comodo free firewall: http://www.personalfirewall.comodo.com/ (don't forget to disable Windows firewall before Comodo installation)

Download, and install free ThreatFire: http://www.threatfire.com/, which will give you real-time protection against malwares.
It won't interfere with your antivirus, nor firewall.

You should be OK, but post HJT log, just in case...

[maxmix]

OK

I had to reinstall XP (I used my XP Home original with SP2) onto my F: Drive....

Never had any versions of Windows in there in the past etc.... Too many conflicts when I was installing all my programs over the D: (Old XP Pro Dir) Program Files folder.....

So all 99% ATM.... I cannot install Nero or WinDVD I keep getting an IKernal error and the installation aborts, Firewall on or off etc

I had to uninstall Avast, every 2 seconds it warned me about dll changes to every startup program when windows booted..... Non stop....

Here is the current Hijack log posted from my old PC....

''Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:08:39, on 20/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\csrss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\COMODO\Firewall\cmdagent.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\ThreatFire\TFService.exe
F:\WINDOWS\System32\alg.exe
F:\WINDOWS\Explorer.EXE
F:\Program Files\Voyager 105 ADSL Modem\dslstat.exe
F:\WINDOWS\SOUNDMAN.EXE
F:\Program Files\COMODO\Firewall\cfp.exe
F:\Program Files\ThreatFire\TFTray.exe
F:\Program Files\VIA\RAID\raid_tool.exe
F:\Program Files\Messenger\msmsgs.exe
F:\Program Files\Seiko Instruments USA Inc\Smart Label Printer 6.6\slpcap.exe
F:\WINDOWS\system32\wpabaln.exe
F:\Program Files\Internet Explorer\IEXPLORE.EXE
F:\Program Files\Trend Micro\HijackThis\HijackThis.exe
F:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [DSLSTATEXE] F:\Program Files\Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] F:\Program Files\Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [COMODO Firewall Pro] "F:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [ThreatFire] F:\Program Files\ThreatFire\TFTray.exe
O4 - HKLM\..\Run: [RaidTool] F:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NeroCheck] F:\WINDOWS\system32\\NeroCheck.exe
O4 - HKCU\..\Run: [MSMSGS] "F:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: SmartCapture.lnk = F:\Program Files\Seiko Instruments USA Inc\Smart Label Printer 6.6\slpcap.exe
O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{5B9A74ED-12FC-4776-9442-750CE158ABB1}: NameServer = 80.189.92.2 80.189.94.2
O20 - AppInit_DLLs:  F:\WINDOWS\system32\guard32.dll
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - F:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: ThreatFire - PC Tools - F:\Program Files\ThreatFire\TFService.exe

--
End of file - 3001 bytes''

maxmix

[Broni]

The log is clean, but you HAVE TO have AV program. Try AVG, if you didn't like Avast!