Win32/Olmarik.RJ trojan Trojan causing browser process to run continuously

Win32/Olmarik.RJ trojan Trojan causing browser process to run continuously

Trojan causing browser process to run continuously A few days ago I attempted to download a file which apparently was a trojan. I've since had issues with the firefox.exe process continuously running and receiving the "Firefox has stopped running" error. My ESET A/V identified "a variant of Win32/Olmarik.RJ trojan" and quarantined it. I've ran Malwarebytes Anti-Malware 1.41 multiple times and it has quarantined/deleted the same 7 entries/files (log files available), but I still receive the firefox process error. I changed my default browser to IE8 and the problem has switched to the iexplore.exe process, so this problem is most assuredly a trojan. I need help in removing this one. I'm running Windows Vista Home Premium 64-bit SP1...thanks in advance for your time and help.

snpperhd

Hello please post the Malwarebytes log..
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.


Next run ATF and SAS:

Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".

From your regular user account..
Download Attribune's ATF Cleaner and then SUPERAntiSpyware , Free Home Version. Save both to desktop ..
DO NOT run yet.
Open SUPER from icon and install and Update it
Under Scanner Options make sure the following are checked (leave all others unchecked):
Close browsers before scanning.
Scan for tracking cookies.
Terminate memory threats before quarantining.
Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet.

Now reboot into Safe Mode: How to enter safe mode(XP)
Using the F8 Method
Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode.

Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox or Opera browser click that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

NOW Scan with SUPER
Open from the desktop icon or the program Files list
On the left, make sure you check C:\Fixed Drive.
Perform a Complete scan. After scan,Verify they are all checked.
Click OK on the summary screen to quarantine all found items.
If asked if you want to reboot, click "Yes" and reboot normally.

To retrieve the removal information after reboot, launch SUPERAntispyware again.
Click Preferences, then click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
If there are several logs, click the current dated log and press View log.
A text file will open in your default text editor.
Please copy and paste the Scan Log results in your next reply.
Click Close to exit the program.


Please ask any needed questions,post logs and Let us know how the PC is running now.

Thanks for the help boopme...I performed all requested actions, below are the requested MBAM & SUPER logs. Though I just finished these actions and haven't had a chance to test the computer's performance, I did notice that the browser process (iexplore.exe *32), still restarts after I kill it in Task Manager.

MBAM Log

Malwarebytes' Anti-Malware 1.41
Database version: 3235
Windows 6.0.6001 Service Pack 1

12/3/2009 6:01:42 PM
mbam-log-2009-12-03 (18-01-42).txt

Scan type: Quick Scan
Objects scanned: 102632
Time elapsed: 3 minute(s), 7 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 6

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Slysbleep (Bifrose.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinDefence32 (Backdoor.Bifrose) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Users\snpperhd\AppData\Local\Temp\earning.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\snpperhd\AppData\Roaming\WinDefence\windefence32.exe (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Users\snpperhd\AppData\Local\Temp\installcon.exe (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Users\snpperhd\AppData\Roaming\logs.dat (Bifrose.Trace) -> Quarantined and deleted successfully.
C:\Users\snpperhd\AppData\Local\Temp\UuU.uUu (Malware.Trace) -> Quarantined and deleted successfully.
C:\Users\snpperhd\AppData\Local\Temp\XxX.xXx (Malware.Trace) -> Quarantined and deleted successfully.


SUPER Log

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 12/03/2009 at 08:23 PM

Application Version : 4.31.1000

Core Rules Database Version : 4334
Trace Rules Database Version: 2188

Scan type : Complete Scan
Total Scan Time : 01:56:26

Memory items scanned : 136
Memory threats detected : 0
Registry items scanned : 7543
Registry threats detected : 0
File items scanned : 252193
File threats detected : 222

Adware.Tracking Cookie
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@112.2o7[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@247realmedia[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@a1.interclick[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@accountonline[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ad.yieldmanager[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ad1.clickhype[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@adbrite[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@adbureau[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@adcentriconline[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@adinterax[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@adrevolver[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ads.addynamix[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ads.adgoto[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ads.aspalliance[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ads.asp[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ads.associatedcontent[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ads.bnmedia[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ads.bootcampmedia[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ads.bridgetrack[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ads.cnn[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ads.fatvine[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ads.gamersmedia[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ads.lycos[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ads.mobihand[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ads.nba[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ads.ookla[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ads.pointroll[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ads.pugetsoundsoftware[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ads.techguy[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ads.telegraph.co[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ads.tnt[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ads.undertone[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ads.vidsense[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@adserv.brandaffinity[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@adserver.adtechus[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@adserver.warpradio[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@adserver1.backbeatmedia[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@adtech[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@advertising[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@adxpose[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ai.drivingrevenue[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@apmebf[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@associatedcontent.112.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@at.atwola[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@atdmt[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@avl.112.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@azjmp[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@banners.sys-con[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@beacon.dmsinsights[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@bet.burstnet[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@bizjournals.112.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@bizrate[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@bluestreak[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@breakmedia.checkm8[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@bs.serving-sys[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@burstbeacon[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@burstnet[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@buycom.122.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@buycom.db.advertising[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@casalemedia[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@cbs.112.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@cdn4.specificclick[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@celebrity-sunglasses-finder[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@cgm.adbureau[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@chengbanner952[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@chitika[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@classmates.112.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@clickbank[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@clicksor[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@clickthrough.kanoodle[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@collective-media[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@content.yieldmanager[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@content.yieldmanager[3].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@counter.hitslink[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@coursefinder.uprogps[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@crackle[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@d.mediaforceads[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@data.coremetrics[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@dc.tremormedia[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@deal-of-the-day-tracker[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@dmtracker[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@dodtracker[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@doubleclick[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@eas.apm.emediate[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@eb.adbureau[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@edge.ru4[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ehg-eset.hitbox[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ehg-newyorkpost.hitbox[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ehg-researchinmotion.hitbox[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ehg-sportingbet.hitbox[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ehg-techtarget.hitbox[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ehg-vitamix.hitbox[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@ext-us.bestofmedia[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@eyewonder[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@fastclick[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@findingsingles[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@findmysoft[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@foundbanner[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@gettyimages.122.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@gmgmacmortgage.112.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@googleads.g.doubleclick[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@gsicace.112.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@hairycelebrity[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@highbeam.122.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@hitbox[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@iacas.adbureau[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@imagevenue.advertserve[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@imrworldwide[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@insightexpressai[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@interclick[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@intermundomedia[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@invitemedia[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@kontera[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@lfstmedia[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@linksynergy[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@media.adrevolver[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@media.adrevolver[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@media.photobucket[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@media6degrees[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@mediafire[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@mediamonkey[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@mediaplex[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@microsoftinternetexplorer.112.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@microsoftsto.112.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@microsoftwindows.112.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@msnaccountservices.112.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@msnportal.112.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@myaccounts.navyfcu[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@myroitracking[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@network.realmedia[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@newsday.122.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@newsinternational.122.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@nextag[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@nitropayouts.directtrack[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@oasc12.247realmedia[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@oasn03.247realmedia[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@oasn04.247realmedia[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@onetoone.112.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@optimost[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@overture[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@paypal.112.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@pointroll[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@porn.naughtyfiles[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@pornstarnetwork[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@poweredbanner[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@precisionclick[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@premierfarnell.112.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@pro-market[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@questionmarket[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@realmedia[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@revsci[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@richmedia.yahoo[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@rotator.adjuggler[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@rovedbanner321[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@sales.liveperson[10].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@sales.liveperson[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@sales.liveperson[3].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@sales.liveperson[4].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@sales.liveperson[5].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@sales.liveperson[6].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@sales.liveperson[7].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@sales.liveperson[8].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@sales.liveperson[9].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@samsclub.112.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@sanfordcorporation.112.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@secure.dhdmedia[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@server.iad.liveperson[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@server.iad.liveperson[3].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@server.iad.liveperson[4].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@server.iad.liveperson[5].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@server.iad.liveperson[6].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@server.iad.liveperson[7].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@serving-sys[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@sixapart.adbureau[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@smartadserver[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@sojern.122.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@specificclick[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@specificmedia[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@spylog[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@stampscom.112.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@stat.dealtime[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@stat.onestat[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@statcounter[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@stats.gamestop[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@stats.networldalliance[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@stats.paypal[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@stats.sanford[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@statse.webtrendslive[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@tacoda[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@tagscanner.software.informer[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@teamcanteen[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@thefind[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@timeinc.122.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@trackalyzer[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@traffic.buyservices[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@trafficdashboard[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@trafficmp[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@traveladvertising[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@tribalfusion[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@tripod[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@trvlnet.adbureau[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@viacomedycentralrl.112.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@videoegg.adbureau[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@webstat.pge[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@webstat.pge[3].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@winzip.122.2o7[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@www.accountonline[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@www.accountonline[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@www.burstbeacon[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@www.burstnet[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@www.clickerpicker[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@www.googleadservices[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@www.hotsexyscenes[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@www.mediamonkey[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@www.pornstarnetwork[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@www.solanocounty.worldweb[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@www.teamcanteen[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@xiti[1].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@yieldmanager[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@z.blogads[2].txt
C:\Users\snpperhd\AppData\Roaming\Microsoft\Windows\Cookies\Low\snpperhd@zedo[1].txt


snpperhd

Edited by snpperhd, 03 December 2009 - 11:44 PM.

Ok we nned to Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.


I am leaving now. Let me know how it's running and I;'ll look back.

You have Vista with SP2 and IE8??
Use Process Explorer to see what's running at startup.


Please download and run Process Explorer v11.33
Click on File then Save As, create a log.
Copy and paste it into your next reply.

Here are the new logs...I'm running Vista with SP1 & IE8.

MBAM Log

Malwarebytes' Anti-Malware 1.42
Database version: 3291
Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.18828

12/3/2009 9:22:25 PM
mbam-log-2009-12-03 (21-22-25).txt

Scan type: Quick Scan
Objects scanned: 104304
Time elapsed: 3 minute(s), 22 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Slysbleep (Bifrose.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windefence32 (Backdoor.Bifrose) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Users\snpperhd\AppData\Roaming\logs.dat (Bifrose.Trace) -> Quarantined and deleted successfully.
C:\Users\snpperhd\AppData\Local\Temp\UuU.uUu (Malware.Trace) -> Quarantined and deleted successfully.
C:\Users\snpperhd\AppData\Local\Temp\XxX.xXx (Malware.Trace) -> Quarantined and deleted successfully.


Process Explorer Log

Process PID CPU Description Company Name
System Idle Process 0 58.91
Interrupts n/a 0.75 Hardware Interrupts
DPCs n/a 2.24 Deferred Procedure Calls
System 4 1.49
smss.exe 564
csrss.exe 632
wininit.exe 688
services.exe 748
svchost.exe 964 14.17
WmiPrvSE.exe 4084
ehmsas.exe 3100 Media Center Media Status Aggregator Service Microsoft Corporation
acevents.exe 4540 ActivIdentity Event Service ActivIdentity
BTStackServer.exe 5696 Bluetooth Stack COM Server Broadcom Corporation.
BluetoothHeadsetProxy.exe 5896 Bluetooth Headset Skype Proxy Broadcom Corporation.
WmiPrvSE.exe 2804
hpqbam08.exe 4076 HP CUE Alert Popup Window Objects Hewlett-Packard Co.
hpqgpc01.exe 4504 GPCore COM object Hewlett-Packard
HpqToaster.exe 5796 HpqToaster Module
wltuser.exe 1140 Windows Live Toolbar User Elevation Helper Microsoft Corporation
FlashUtil10c.exe 5388 Adobe Flash Player Helper 10.0 r32 Adobe Systems, Inc.
svchost.exe 124
svchost.exe 360
Ati2evxx.exe 440
Ati2evxx.exe 1536
svchost.exe 468
audiodg.exe 1220
svchost.exe 612 0.75
dwm.exe 3488 0.75 Desktop Window Manager Microsoft Corporation
svchost.exe 1008
taskeng.exe 700
taskeng.exe 3288 Task Scheduler Engine Microsoft Corporation
stacsv64.exe 1056
svchost.exe 1268
SLsvc.exe 1284
svchost.exe 1328 3.73
hpservice.exe 1388
spoolsv.exe 1652
svchost.exe 1684
accoca.exe 1908
acevents.exe 2036
AESTSr64.exe 1940
agr64svc.exe 1988
AppleMobileDeviceService.exe 2008
mDNSResponder.exe 2024
svchost.exe 1068
svchost.exe 1276
ekrn.exe 1816 2.98
svchost.exe 2104
LSSrvc.exe 2136
svchost.exe 2200
svchost.exe 2248 0.75
svchost.exe 2272
BLService.exe 2304
RichVideo.exe 2328
SeaPort.exe 2368
svchost.exe 2464
TVCapSvc.exe 2504
TVSched.exe 2528
svchost.exe 2564
SearchIndexer.exe 2620
SDWinSec.exe 2740
svchost.exe 960 1.49
hpqWmiEx.exe 3480
wmpnetwk.exe 544 4.47
iPodService.exe 4264
Com4QLBEx.exe 4368
HPHC_Service.exe 5328
PresentationFontCache.exe 5572
TrustedInstaller.exe 4892
lsass.exe 792
lsm.exe 800
csrss.exe 708
winlogon.exe 776
explorer.exe 3528 Windows Explorer Microsoft Corporation
SynTPEnh.exe 3064 Synaptics TouchPad Enhancements Synaptics, Inc.
SynTPHelper.exe 5932
SmartMenu.exe 3608 HP MediaSmart SmartMenu Hewlett-Packard
MSASCui.exe 2764 Windows Defender User Interface Microsoft Corporation
egui.exe 904 ESET GUI ESET
sttray64.exe 2172 IDT PC Audio IDT, Inc.
LightScribeControlPanel.exe 3392 Hewlett-Packard Company
HPAdvisor.exe 540 HP Advisor Hewlett-Packard
ehtray.exe 3736 Media Center Tray Applet Microsoft Corporation
msnmsgr.exe 3560 Windows Live Messenger Microsoft Corporation
SansaDispatch.exe 3256 Sansa Dispatcher SanDisk Corporation
TeaTimer.exe 3728 2.24 System settings protector Safer-Networking Ltd.
SUPERAntiSpyware.exe 3740 SUPERAntiSpyware Application SUPERAntiSpyware.com
acsagent.exe 3788 ActivClient Agent ActivIdentity
BTTray.exe 3640 Bluetooth Tray Application Broadcom Corporation.
hpqtra08.exe 3536 HP Digital Imaging Monitor Hewlett-Packard Co.
hpqste08.exe 4928 HP CUE Status Root Hewlett-Packard Co.
LogitechDesktopMessenger.exe 3952 Logitech Desktop Messenger Logitech Inc.
WZQKPICK.EXE 3956 WinZip Executable WinZip Computing, S.L.
wmpnscfg.exe 2944 Windows Media Player Network Sharing Service Configuration Application Microsoft Corporation
procexp.exe 3600 Sysinternals Process Explorer Sysinternals - www.sysinternals.com
procexp64.exe 4672 0.75 Sysinternals Process Explorer Sysinternals - www.sysinternals.com
iexplore.exe 5820 Internet Explorer Microsoft Corporation
iexplore.exe 3692 Internet Explorer Microsoft Corporation
MOM.exe 2860 Catalyst Control Center: Monitoring program Advanced Micro Devices Inc.
CCC.exe 5312 Catalyst Control Centre: Host application ATI Technologies Inc.
DVDAgent.exe 2964 HP DVDSmart Resident Program CyberLink Corp.
TSMAgent.exe 3424 CyberLink PowerCinema Resident Program CyberLink Corp.
CLMLSvc.exe 3876 CyberLink MediaLibray Service CyberLink
QLBCTRL.exe 3996 Quick Launch Buttons Hewlett-Packard Development Company, L.P.
jusched.exe 1812 Java™ Platform SE binary Sun Microsystems, Inc.
hpwuSchd2.exe 4020 hpwuSchd Application Hewlett-Packard
HPWAMain.exe 3804 HP Wireless Assistant main program Hewlett-Packard
TVAgent.exe 4088 HP MediaSmart TV Resident Program CyberLink Corp.
accrdsub.exe 2972 ActivIdentity card event handler ActivIdentity
acrotray.exe 2496 AcroTray Adobe Systems Inc.
iTunesHelper.exe 1336 iTunesHelper Module Apple Inc.
Ext2Mgr.exe 4884
explorer.exe 4508 Windows Explorer Microsoft Corporation
iexplore.exe 5184 Internet Explorer Microsoft Corporation
iexplore.exe 5800 4.47 Internet Explorer Microsoft Corporation
iexplore.exe 5808 Internet Explorer Microsoft Corporation
explorer.exe 5408 Windows Explorer Microsoft Corporation

Hello Bifrose is realted to the Sality Trojan .. Vil Nai.. A very dangerous Backoor family

A backdoor Trojan can allow an attacker to
gain control of the system, log keystrokes, steal passwords, access personal
data, send malevolent outgoing traffic, and close the security warning
messages displayed by some anti-virus and security programs.

I would advise you to disconnect this PC from the Internet, and then go to
a known clean computer and change any passwords or security information held
on the infected computer. In particular, check whatever relates to online
banking financial transactions, shopping, credit cards, or sensitive
personal information. It is also wise to contact your financial institutions
to apprise them of your situation.

We will do our best to clean the computer of any infections seen on the log.
However, because of the nature of this Trojan, I cannot offer a total
guarantee that there are no remnants left in the system, or that the
computer will be trustworthy.

Many security experts believe that once infected with this type of Trojan,
the best course of action is to reformat and reinstall the Operating System.
Making this decision is based on what the computer is used for, and what
information can be accessed from it.

Knowing the above, let us know if you wish to proceed.

If you wish to safely clean this you will need to run HJT/DDS.
Please follow this guide. Preparation Guide For Use Before Using Hijackthis. Then go here HijackThis Logs and Virus/Trojan/Spyware/Malware Removal ,click New Topic,give it a relevant Title and post that complete log.

Let me know if it went OK.

Thanks. Now I am continully getting this security warning from my ESET AV "Variant of Win32/Injector.AKF trojan=cleaned by deleting" Is there any chance my password/info is safe since I have always kept my ESET up to date?

I could not say..How long ago the infection got in and the amount of time exposed to the net?? I would lean to the not safe side.

Thanks...I guess I'll backup and rebuild. I appreciate your help.

Not an unwise decision to make. In some instances an infection may have caused so much damage to your system that it cannot be completely cleaned or repaired. Wiping your drive, reformatting, and performing a clean install of the OS or doing a factory restore removes everything and is the safest action but I cannot make that decision for you.

Reformatting a hard disk deletes all data. If you decide to reformat, you can back up all your important documents, data files and photos. The safest practice is not to backup any autorun.ini or .exe files because they may be infected. Some types of malware may disguise itself by adding and hiding its extension to the existing extension of files so be sure you take a close look at the full name. After reformatting, as a precaution, make sure you scan these files with your anti-virus prior to copying them back to your hard drive.

The best proceedure is a low level format. This completely wipes the drive. Then reinstall the OS.
Use the free version of Active@ KillDisk.
Or Darik's Boot And Nuke

The best sources of Information on this are
Reformatting Windows XP
Michael Stevens Tech

Of course also feel free to ask anything on this in the XP forum. They'd be glad to help.

==============================

2 guidelines/rules when backing up

1) Backup all your important data files, pictures, music, work etc... and save it onto an external hard-drive. These files usually include .doc, .txt, .mp3, .jpg etc...
2) Do not backup any executables files or any window files. These include .exe/.scr/.htm/.html/.xml/.zip/.rar files as they may contain traces of malware. Also, .html or .htm files that are webpages should also be avoided.

Download Belarc Advisor - builds a detailed profile of your installed software and hardware, including Microsoft Hotfixes, and displays the results in your Web browser.
Run it and then print out the results, they may be handy.

Since we don't know exactly which infections we're dealing with here, we should take some precautions before we attempt to move files from the infected machine. Run the following on your clean computer, and make sure you insert your flash drives at the prompt.
Download and Run FlashDisinfector

Please download Flash_Disinfector.exe by sUBs and save it to your desktop.

• Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
• The utility may ask you to insert your flash drive and/or other removable drives. Please do so and allow the utility to clean up those drives as well.
• Hold down the Shift key when inserting the drive until Windows detects it to keep autorun.inf from executing if it is present.
• Wait until it has finished scanning and then exit the program.
• Reboot your computer when done.

Note: As part of its routine, Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive that was plugged in when you ran it. Do not delete this folder...it will help protect your drives from future infection by keeping the autorun file from being installed on the root drive and running other malicious files.


Reinstall Windows Vista

Thanks again...when you say run Flash_Disinfector.exe and connect the flash when prompted, do you mean the flash and/or external HDD that was used to backup my data? I purchased Windows 7 Professional and plan to do a clean install, the instructions recommend NOT to use a third-party software to format the drive...I have a set of recovery disks for my PC, should I perform a recovery disk install before upgrading to Windows 7 Pro?

Ok, yes I had not updated my Format reply for Win7.. I would ask that question in the Win 7 forum until I can find a definate answer.
I would Flash my mobile drive, PC and external.