Antivir Solution Pro Removal?? Help!

[1two3]

I'm moving my post here from the virus and spyware removal section because nobody seems to be replying there.

My laptop is screwed. I'm on my other computer now that I never use for anything but email etc, so this one is safe. My laptop is Windows 7 Ultimate. Running Avast free (latest version)

I started having a fake AV (Antivir), getting messages telling me that:

 "Application cannot be executed. The file ("sf.bin" or "wltuser.exe") is infected. Do you want to activate your antivirus software now?"

It tries to open up www. *censored* .com on IE (I don't watch porn)

I get, in the bottom right corner, a message telling me that:

Your computer is being attacked by an internet virus. It could be a password-stealing attack, a trojan - dropper or similar.

Details:
Attack from (random ip, random port)
Attacked port (usually 49593)
Threat:  ("Bankerfox.A", or "wsqmcons.xe", or "waucult.exe". Sometimes "win32/Nuqel.e" or something.
(I'm sure it's the fake AV telling me, because it doesn't look like Windows or Avast at all.



I can't open any webpage from Firefox or IE. Tells me that there is a virus warning and to buy some software. If I try to open Chrome, it tells me it can't. It automatically opens IE every few minutes. I think it's going to some webpage but I don't know what as I close it down before it does.


Please help, I've no idea what to do. Scanning with Avast buy it doesn't seem to be doing anything. If you can't help, I'll have to take it into a specialist.

Edit:

For some reason, when I noted up my laptop today, avast blocked the Trojan so there was no Antivir or alerts. I've removed the proxies that Antivir put on IE and Firefox, but I'm not using the computer for anything yet as I want to know if the Trojan is actually gone. If you could still help it would be great thanks.


Moderator edit: At the risk of someone clicking the *censored* link, I "broke" the link so as to prevent this.
- Zylstra555

[Kerjifire]

Read this before requesting malware removal help

[1two3]

Read this before requesting malware removal help

At the risk of sounding obnoxious, I did not ask for a wannabe mod to come along and tell me to read the guidelines before requesting help. You think I haven't done that? I don't think the others that you replied to wanted your "advice" either. If you don't have anything helpful to say, don't bother replying to my topic, Kerjifire.

[SuperDave]

Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer. I am working under the guidance of one of the specialist of this forum so it may take a bit longer to process your logs.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

Windows 7 severely limits the number of tools I can use to clean your computer but I'll try. Sorry. If you can't access the internet, download and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
Save Rkill to your desktop.

There are 4 different versions. If one of them won't run then download and try to run the other one.
 
Vista and Win7 users need to right click Rkill and choose Run as Administrator
 

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

* Rkill.exe
* Rkill.com
* Rkill.scr
* Rkill.pif

Once you've gotten one of them to run then try to immediately run the following.

==================================

SUPERAntiSpyware

If you already have SUPERAntiSpyware be sure to check for updates before scanning!

Download SuperAntispyware Free Edition (SAS)
* Double-click the icon on your desktop to run the installer.
* When asked to Update the program definitions, click Yes
* If you encounter any problems while downloading the updates, manually download and unzip them from here
* Next click the Preferences button.

•Under Start-Up Options uncheck Start SUPERAntiSpyware when Windows starts
* Click the Scanning Control tab.
* Under Scanner Options make sure only the following are checked:

•Close browsers before scanning
•Scan for tracking cookies
•Terminate memory threats before quarantining
•Please leave the others unchecked

•Click the Close button to leave the control center screen.

* On the main screen click Scan your computer
* On the left check the box for the drive you are scanning.
* On the right choose Perform Complete Scan
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete a summary box will appear. Click OK
* Make sure everything in the white box has a check next to it, then click Next
* It will quarantine what it found and if it asks if you want to reboot, click Yes

•To retrieve the removal information please do the following:
•After reboot, double-click the SUPERAntiSpyware icon on your desktop.
•Click Preferences. Click the Statistics/Logs tab.

•Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.

•It will open in your default text editor (preferably Notepad).
•Save the notepad file to your desktop by clicking (in notepad) File > Save As...

* Save the log somewhere you can easily find it. (normally the desktop)
* Click close and close again to exit the program.
*Copy and Paste the log in your post.

==============================

Please download Malwarebytes Anti-Malware from here.

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Full Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• Please save the log to a location you will remember.
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

=================================

Please download: HiJackThis to your Desktop.

• Double Click the HijackThis icon, located on your Desktop.
  
• By Default, it will install to: C:\Program Files\Trend Micro\HijackThis
• Accept the license agreement.
• Click the Open the Misc Tools section button.
  
• Place a checkmark beside Calculate MD5 of files if possible. Then, click Back.
  
• Click Do a System Scan and Save a Logfile. Or, if you see a white screen, click Scan.
  
• Please post the log in your next reply.
  

[harry 48]

At the risk of sounding obnoxious, I did not ask for a wannabe mod to come along and tell me to read the guidelines before requesting help. You think I haven't done that? I don't think the others that you replied to wanted your "advice" either. If you don't have anything helpful to say, don't bother replying to my topic, Kerjifire.

people are always asked to do what Kerjifire asked you to do , superdave has asked you to do the same with one difference , you will not get help until you do these check's , so i and other's who have read this post will think you are wrong in what you said

[1two3]

people are always asked to do what Kerjifire asked you to do , superdave has asked you to do the same with one difference , you will not get help until you do these check's , so i and other's who have read this post will think you are wrong in what you said

I would have gladly done it had a more established person come along and asked me. Having been in many forums, I have have met this kind of person before. Maybe he had good intent, but I am too stressed at the moment  with this problem to lnot reply so harshly. And superdave, I will get bak to you asap. My Internet has been playing up so tomorrow (it is 11pm) I will get tthe logs.

[harry 48]

I would have gladly done it had a more established person come along and asked me. Having been in many forums, I have have met this kind of person before. Maybe he had good intent, but I am too stressed at the moment  with this problem to lnot reply so harshly. And superdave, I will get bak to you asap. My Internet has been playing up so tomorrow (it is 11pm) I will get tthe logs.

read my signature ( just below ) , thats what i have lived by for 50+ years 

[patio]

I would have gladly done it had a more established person come along and asked me. Having been in many forums, I have have met this kind of person before. Maybe he had good intent, but I am too stressed at the moment  with this problem to lnot reply so harshly. And superdave, I will get bak to you asap. My Internet has been playing up so tomorrow (it is 11pm) I will get tthe logs.

You need to start realising what Free Help is all about...i could care less how many other Forums you have visited.
Your stress level and how you are dealing with it have nothing to do with recieving qualified advice.
Adjust your attitude...things will go smoother after that.

Just a simple heads up...

[1two3]

You need to start realising what Free Help is all about...i could care less how many other Forums you have visited.
Your stress level and how you are dealing with it have nothing to do with recieving qualified advice.
Adjust your attitude...things will go smoother after that.

Just a simple heads up...

Oh my goodness.



Anyway, thank you SuperDave for helping. I will post the logs as soon as they are finished.

Not sure if it's needed, but the Rkill log:

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.
Ran as Jimbo on 10/08/2010 at 14:59:40.


Processes terminated by Rkill or while it was running:


C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Jimbo\Desktop\rkill.exe


Rkill completed on 10/08/2010  at 14:59:46.

[1two3]

Here is the SUPERAntiSpyware log. A lot of tracking cookies  :

UPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 08/10/2010 at 05:06 PM

Application Version : 4.41.1000

Core Rules Database Version : 5341
Trace Rules Database Version: 3153

Scan type       : Complete Scan
Total Scan Time : 01:57:44

Memory items scanned      : 737
Memory threats detected   : 0
Registry items scanned    : 9945
Registry threats detected : 0
File items scanned        : 188318
File threats detected     : 264

Adware.Tracking Cookie
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@atdmt[7].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@atdmt[9].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][11].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@doubleclick[5].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@serving-sys[9].txt
   atdmt.com [ C:\Users\Guest\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\C4QVHLZP ]
   spe.atdmt.com [ C:\Users\Guest\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\C4QVHLZP ]
   uk.2mdn.net [ C:\Users\Guest\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\C4QVHLZP ]
   C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
   C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\guest@atdmt[2].txt
   C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\guest@doubleclick[1].txt
   C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@adrevolver[2].txt
   C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@advertising[2].txt
   C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@atdmt[2].txt
   C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@casalemedia[2].txt
   C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@doubleclick[2].txt
   C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@fastclick[2].txt
   C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@indextools[2].txt
   C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
   C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][3].txt
   C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@mediaplex[1].txt
   C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@questionmarket[1].txt
   C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@serving-sys[1].txt
   C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@tacoda[1].txt
   C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@tradedoubler[2].txt
   C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Cookies\Low\guest@tribalfusion[2].txt
   .doubleclick.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .media6degrees.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .media6degrees.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .media6degrees.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .atdmt.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   ad.yieldmanager.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   ad.yieldmanager.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .adviva.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .adviva.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .advertising.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .tribalfusion.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .traveladvertising.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .traveladvertising.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .invitemedia.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .invitemedia.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .atdmt.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .invitemedia.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   advancedsearch.virginmedia.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   advancedsearch.virginmedia.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .atdmt.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .atdmt.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .msnportal.112.2o7.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   www.googleadservices.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   www.googleadservices.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .lfstmedia.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .lfstmedia.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .lfstmedia.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .statcounter.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .fastclick.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .fastclick.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .fastclick.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .questionmarket.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   www.googleadservices.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   www.skyscanner.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   www.skyscanner.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .skyscanner.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .skyscanner.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .skyscanner.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   www.googleadservices.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .2o7.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .2o7.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .apmebf.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .mediaplex.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .mediaplex.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .questionmarket.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .interclick.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .interclick.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .interclick.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .imrworldwide.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .imrworldwide.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .bs.serving-sys.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .serving-sys.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .serving-sys.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .serving-sys.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .serving-sys.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .serving-sys.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .serving-sys.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .serving-sys.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .zedo.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .zedo.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .zedo.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .ads.pointroll.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .pointroll.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .ads.pointroll.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .pointroll.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .ads.pointroll.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .ads.pointroll.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .ads.pointroll.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .ads.pointroll.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .ads.pointroll.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .ads.pointroll.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   www.googleadservices.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   uk.sitestat.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   www.googleadservices.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   www.googleadservices.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .tacoda.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .tacoda.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .tacoda.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .trvlnet.adbureau.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .advertising.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .at.atwola.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .at.atwola.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .trvlnet.adbureau.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .trvlnet.adbureau.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .mediaplex.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .revsci.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .revsci.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   ad.yieldmanager.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   ad.yieldmanager.com [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .revsci.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .revsci.net [ C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\r20bz17h.default\cookies.sqlite ]
   .doubleclick.net [ C:\Users\Jimbo\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   statse.webtrendslive.com [ C:\Users\Jimbo\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   C:\Users\Jimbo\AppData\Local\Temp\Cookies\jimbo@atdmt[1].txt
   C:\Users\Jimbo\AppData\Local\Temp\Cookies\[email protected][2].txt
   C:\Users\Jimbo\AppData\Local\Temp\Cookies\jimbo@doubleclick[1].txt
   C:\Users\Jimbo\AppData\Local\Temp\Cookies\jimbo@questionmarket[1].txt
   C:\Users\Jimbo\AppData\Local\Temp\Cookies\jimbo@serving-sys[2].txt
   C:\Users\Jimbo\AppData\Local\Temp\Cookies\jimbo@tradedoubler[2].txt
   C:\Users\Jimbo\AppData\Local\Temp\Low\Cookies\jimbo@atdmt[1].txt
   131.memecounter.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   2mdn.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   acvs.mediaonenetwork.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   atdmt.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   breakbeatdotca.trackitdown.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   cdn.insights.gravity.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   cdn4.specificclick.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   cdn5.specificclick.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   cloud.video.unrulymedia.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   core.insightexpressai.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   dennis.cerosmedia.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   ds.serving-sys.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   ec.atdmt.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   files.adbrite.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   googleads.g.doubleclick.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   ia.media-imdb.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   img-cdn.mediaplex.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   interclick.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   m.uk.2mdn.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   m1.2mdn.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   m1.emea.2mdn.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   media.a123.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   media.ign.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   media.mtvnservices.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   media.play.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   media.podaddies.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   media.scanscout.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   media.tattomedia.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   media1.break.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   media1.thegamehomepage.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   mediacloud.whirled.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   mediaplex.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   memecounter.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   msntest.serving-sys.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   objects.tremormedia.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   oddcast.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   richmedia247.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   s0.2mdn.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   secure-us.imrworldwide.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   serving-sys.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   spe.atdmt.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   static.2mdn.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   track.webgains.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   udn.specificclick.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   uk.2mdn.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   video.unrulymedia.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   www.soundclick.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   www.trackitdown.net [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   yo.static.presidiomedia.com [ C:\Users\Jimbo\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\R7CD292T ]
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@247realmedia[1].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@247realmedia[2].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@adrevolver[2].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][4].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][6].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@adtech[1].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@advertising[1].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@advertising[2].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@adviva[2].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@apmebf[1].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@apmebf[2].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@apmebf[3].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@atdmt[1].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@atdmt[2].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@atdmt[3].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@atdmt[4].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@atdmt[5].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@atdmt[6].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@atdmt[8].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@bluestreak[2].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][10].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][4].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][5].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][6].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][7].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][8].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][9].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@doubleclick[1].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@doubleclick[2].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@doubleclick[3].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@doubleclick[4].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@imrworldwide[2].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@imrworldwide[3].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@insightexpressai[1].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@mediaplex[1].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@mediaplex[2].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@mediaplex[4].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@myroitracking[1].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@pointroll[1].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@pointroll[2].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@pointroll[4].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@pointroll[5].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@pointroll[6].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@pro-market[2].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@questionmarket[1].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@questionmarket[2].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@questionmarket[3].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@questionmarket[4].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@serving-sys[1].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@serving-sys[2].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@serving-sys[3].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@serving-sys[4].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@serving-sys[5].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@serving-sys[6].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@serving-sys[8].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@specificclick[2].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@tradedoubler[1].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@tradedoubler[3].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@tradedoubler[4].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@tradedoubler[5].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@zedo[2].txt
   C:\Users\Jimbo\AppData\Roaming\Microsoft\Windows\Cookies\jimbo@zedo[3].txt

Trojan.Agent/Gen-Frauder
   C:\PROGRAM FILES\CHEAT ENGINE\EMPTYPROCESS.EXE

[1two3]

Here is the Malwarebyte's Anti-Malware log:

Internet Explorer 8.0.7600.16385

10/08/2010 19:11:04
mbam-log-2010-08-10 (19-11-04).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 336148
Time elapsed: 1 hour(s), 22 minute(s), 49 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\Software\SolutionAV (Rogue.AntivirSolutionPro) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fglfulcn (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[1two3]

Here is the HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:22:25, on 10/08/2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Hp\HP Software Update\hpwuschd2.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\System32\spool\drivers\w32x86\3\E_FATICDE.EXE
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=73&bd=Pavilion&pf=laptop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=73&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=73&bd=Pavilion&pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:6522
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (filesize 62080 bytes, MD5 C11F6A1F61481E24BE3FDC06EA6F7D2A)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (filesize 137600 bytes, MD5 F655CDD5506FBB4C40C08C9C6A66F7C8)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (filesize 408448 bytes, MD5 B7899C3E21B299D7A3C0DA96CAE340BD)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll (filesize 762864 bytes, MD5 927558FA159FED54852692D729039E67)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (filesize 41760 bytes, MD5 385BD69743EA92E76CDF07B3345A25D5)
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (filesize 1068904 bytes, MD5 28455424E3C8B81661C5A40E18066BB1)
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (filesize 1068904 bytes, MD5 28455424E3C8B81661C5A40E18066BB1)
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" (filesize 39792 bytes, MD5 8B9145D229D4E89D15ACB820D4A3A90F)
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exeC:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto (filesize 233984 bytes, MD5 93BA58F2CFA194A23A72FE86EABD680D)
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe" (filesize 176128 bytes, MD5 F1544FC4D25FD26B0CF805BD913D4ECA)
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exeC:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exeC:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exeC:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exeC:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" (filesize 248040 bytes, MD5 52DB6CDAC5BC7A1FC884E97C41C91213)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime (filesize 421888 bytes, MD5 ED7A6D40B20DC34BE06F4AE196AE7D50)
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" (filesize 500208 bytes, MD5 5447AF432CDA61159ADDE218C468FFD9)
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exeC:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin (filesize 406992 bytes, MD5 D5B783DACE1BBDD382A63C894BAB8E1E)
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" (filesize 141608 bytes, MD5 E840A9AEA5D59A5E9C1C4F1AB24D197A)
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (filesize 1173504 bytes, MD5 EA6EADF6314E43783BA8EEE79F93F73C)
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exeC:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (filesize 3883856 bytes, MD5 D39DA5B7139B4B5147B3C6A94978B5AA)
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" (filesize 68856 bytes, MD5 E616A6A6E91B0A86F2F6217CDE835FFE)
O4 - HKCU\..\Run: [EPSON Stylus DX7400 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICDE.EXE /FU "C:\Windows\TEMP\E_S9636.tmp" /EF "HKCU" (filesize 182272 bytes, MD5 9AD31D8018B72E1013CFD012619E0232)
O4 - HKCU\..\Run: [Google Update] "C:\Users\Jimbo\AppData\Local\Google\Update\GoogleUpdate.exe" /c (filesize 136176 bytes, MD5 F02A533F517EB38333CB12A9E8963773)
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (filesize 97680 bytes, MD5 32C26797AB646074A2BB562F9D10ADB5)
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (filesize 186192 bytes, MD5 F008B25C34C98E4F207B00852E25E97D)
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (filesize 186192 bytes, MD5 F008B25C34C98E4F207B00852E25E97D)
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll (filesize 603040 bytes, MD5 79F7DB36E67B9E8365FA824AD96DF400)
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll (filesize 603040 bytes, MD5 79F7DB36E67B9E8365FA824AD96DF400)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL (filesize 39464 bytes, MD5 AEF204E782BFA2C8448CB43A58960744)
O13 - Gopher Prefix:
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-1054b06ff577c5e3.spaces.live.com/PhotoUpload/VistaMsnPUplden-gb.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeC:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exeC:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exeC:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exeC:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exeC:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXEC:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeC:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exeC:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exeC:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeC:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeC:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exeC:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exeC:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exeC:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exeC:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exeC:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 13196 bytes

[SuperDave]

Windows 7 severely limits the number of tools I can use to clean your computer but I will try my best. Sorry.

Open HijackThis and select Do a system scan only

Place a check mark next to the following entries: (if there)

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:6522
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

Important: Close all open windows except for HijackThis and then click Fix checked.

Once completed, exit HijackThis.

==================================

Download OTL  to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Under the Custom Scan box paste this in

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%SYSTEMDRIVE%\*.exe
%systemroot%\*. /mp /s
c:\$recycle.bin\*.* /s
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
nvstor32.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
explorer.exe
svchost.exe
userinit.exe
qmgr.dll
ws2_32.dll
proquota.exe
imm32.dll
kernel32.dll
ndis.sys
autochk.exe
spoolsv.exe
xmlprov.dll
ntmssvc.dll
mswsock.dll
Beep.SYS
ntfs.sys
termsrv.dll
sfcfiles.dll
st3shark.sys
ahcix86.sys
srsvc.dll
nvrd32.sys
/md5stop
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles

• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time
    

==================================

Download Security Check by screen317 from one of the following links and save it to your desktop.

Link 1
Link 2

* Unzip SecurityCheck.zip and a folder named Security Check should appear.
* Open the Security Check folder and double-click Security Check.bat
* Follow the on-screen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt
* Post the contents of that document in your next reply.

Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.

[1two3]

Windows 7 severely limits the number of tools I can use to clean your computer but I will try my best. Sorry.

Don't say sorry. You're doing more than I ever, ever could without paying the £50 to go and get it fixed. Thanks so much. 

Will do everything tomorrow as it is late again. Best to do these things on a fresh, awake mind, no?

Also, is it badly infected? I can't read these to save my life so I wouldn't know if it was clean or overrun with malware. 

Thanks again, SuperDave.

[SuperDave]

Also, is it badly infected? I can't read these to save my life so I wouldn't know if it was clean or overrun with malware

No. I don't think so but I'll know more after I've seen more scans.