ok I did all the scans now what here are the logs

[sparowha]

My computer was running real slow so I posted in a different area my hyjack this log the evil fantasy was nice enough to set me straight I have now downloaded and used all of the programs in the malware forum and here are my logs also my comp is still running slow I think there is alot more work to do so I just want to know what to do next thank you

[attachment deleted by admin]

[evilfantasy]

You sure picked up a nice variety of baddies

Looks like a lot was removed though so that's a good start.

Download random's system information tool (RSIT) by random/random from and save it to your Desktop.

• Double click on RSIT.exe to run.
  
• Click Continue at the disclaimer screen.
  
• Once it has finished, two logs will open.
• log.txt <will be maximized and info.txt <will be minimized
  
• Please post the contents of both logs in the next reply.

[sparowha]

Here are the logs evil thank you so much do you think ill ever be able to clean this computer up completly

[attachment deleted by admin]

[evilfantasy]

Well get it cleaned. Shouldn't be too hard now.

Open HijackThis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

• F3 - REG:win.ini: load=C:\WINDOWS\svchost.exe
• O4 - HKLM\..\Run: [rtasks] C:\Program Files\TrojansFilter\rtasks.exe

.
Important: Close all windows except for HijackThis and then click Fix checked.

Exit HijackThis.

Before we continue, did you set these desktop pictures? It's OK if you did I just need to know to remove them or not.

Code: [Select]

O24 - Desktop Component 0: (no name) - http://aosd.net/2005/local/photos/chicago/Buckingham_Night.jpg
O24 - Desktop Component 1: (no name) - http://rds.yahoo.com/_ylt=A0Je5mwvtHBGjfQAGjWjzbkF/SIG=1286ofnfc/EXP=1181877679/**http%3A//www.eberelaw.com/pictures/chicagoSkyline4.jpg
O24 - Desktop Component 2: (no name) - http://rds.yahoo.com/_ylt=A0WTbx6hFZVILF0ANXKjzbkF/SIG=126kfjg29/EXP=1217816353/**http%3A//www.solarnavigator.net/images/brad_pitt.jpg
O24 - Desktop Component 3: (no name) - http://cdn.buzznet.com/media/jj1/2006/12/brad_pitt_birthday/brad-pitt-birthday-02.jpg
O24 - Desktop Component 4: (no name) - http://www.celebrific.com/wp-content/uploads/2007/08/brad-pitt-new-orleans-8-22-07.jpg
O24 - Desktop Component 5: (no name) - http://cdn.buzznet.com/media/jj1/2006/12/brad_pitt_birthday/brad-pitt-birthday-07.jpg
O24 - Desktop Component 6: (no name) - file:///C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/msohtml1/01/clip_image001.gif

[evilfantasy]

Download the OTMoveIt3 by OldTimer

Note: If you are running on Vista, right-click on OTMoveIt3.exe and choose Run As Administrator.

* Save it to your Desktop.
* Double-click OTMoveIt3.exe to run it.
* Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy)

Code: [Select]

:Processes
explorer.exe

:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"rtasks"=-

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{188b6971-2358-11dc-8037-000b5d502a78}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{364ddba0-2a89-11dc-8042-000b5d502a78}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7f3d1f49-6ff4-11dd-810c-000b5d502a78}]

:files
C:\WINDOWS\system32\SET2C.tmp
C:\WINDOWS\system32\SET2B.tmp
C:\WINDOWS\system32\SET30.tmp
C:\WINDOWS\system32\SET24.tmp
C:\WINDOWS\system32\SET3C.tmp
C:\WINDOWS\system32\SET39.tmp
C:\WINDOWS\system32\SET34.tmp
C:\WINDOWS\system32\SET23.tmp
C:\WINDOWS\system32\SET21.tmp
C:\WINDOWS\system32\SET32.tmp

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

* Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
* Click the red Moveit! button.
* Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot your computer in order to finish the move process. If asked to reboot, choose Yes.

----------

Download ComboFix© by sUBs from one of the below links. Be sure top save it to the Desktop.

Link #1
Link #2

**Note:  It is important that it is saved directly to your Desktop

Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your antivirus, and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.
 
Double click combofix.exe & follow the prompts.
When finished ComboFix will produce a log for you.
Post the ComboFix log in your next reply.

Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your antivirus and antispyware protection when ComboFix is complete.

If you have problems with ComboFix usage, see How to use ComboFix

----------

Go to Add/Remove Programs and uninstall:

• Java(TM) 6 Update 7

.

[sparowha]

yes at least some of those were set on the computer by my wife we can remove them if you think it will help just let me know how

[sparowha]

here are the logs and i removed the java

[attachment deleted by admin]

[evilfantasy]

Looks OK now. How is the computer running?

[sparowha]

faster but it is still starting up slow
shoukd i defrag ?

[evilfantasy]

Let's do some cleanup and then you can defrag.

• Click START then RUN
  
• Now type Combofix /u in the runbox
  
• Make sure there's a space between Combofix and /u
• Then hit Enter.

.
.
The above procedure will:

• Delete:
• ComboFix and its associated files and folders.
• VundoFix backups, if present
• The C:\Deckard folder, if present
• The C:_OtMoveIt folder, if present

• Reset the clock settings.
• Hide file extensions, if required.
• Hide System/Hidden files, if required.
• Set a new, clean Restore Point.

.
----------

1. Double click OTMoveIt3.exe to launch it.
Vista users right click and choose Run As Administrator
2. Click on the CleanUp! button.
3. OTMoveIt2 will download a list from the Internet, if your firewall or other defensive programs alerts you, allow it access.
4. Click YES at the next prompt (list downloaded, Do you want to begin cleanup process?)
5. Once complete exit out of OTMoveIt3

----------

Use the Secunia Software Inspector to check for out of date software.

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.

.
----------

Go to Microsoft Windows Update and get all critical updates.

----------

Here are some great FREE tools to help you keep from getting infected again. These tools use little or no resources so won't slow down your PC.

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster - Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.