I think my computer is infected with suspicious.mh690.a virus , can anyone help?

ok done , this is the result :

Bootkit Remover
(c) 2009 eSage Lab
www.esagelab.com

Program version: 1.2.0.0
OS Version: Microsoft Windows Vista Home Premium Edition (build 6000), 32-bit

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000002`ee100000
Boot sector MD5 is: 0ec6b2481fc707d1e901dc2a875f2826

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0 OK (DOS/Win32 Boot code found)


Done;
Press any key to quit...

Okay please do one more scan with MBAM and post the new log.

ok , done as well , this is it :

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4639

Windows 6.0.6000
Internet Explorer 7.0.6000.16916

17/09/2010 22:49:08
mbam-log-2010-09-17 (22-49-08).txt

Scan type: Quick scan
Objects scanned: 129631
Time elapsed: 3 minute(s), 11 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Okay, last scan to do.

Run ESET Online Scan
Please do an online scan with ESET Online Scanner. Please use Internet Explorer as it uses ActiveX.

• Check (tick) this box: YES, I accept the Terms of Use.
  
• Click on the Start button next to it.
  
• When prompted to run ActiveX. click Yes.
  
• You will be asked to install an ActiveX. Click Install.
  
• Once installed, the scanner will be initialized.
  
• After the scanner is initialized, click Start.
  
• Check (tick) Remove found threats box.
  
• Check (tick) Scan unwanted applications.
  
• Click on Scan.
  
• It will start scanning. Please be patient.
  
• Once the scan is done, the log will be saved here: C:\Program Files\esetonlinescanner\log.txt.
  

ok so scan in progress , he found 1 infected file so far (win32/OlmarikZC.trojan )

45% so far.

scan is done , that 1 infected file was all he found.

this is the log:

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=7.00.6000.16386 (vista_rtm.061101-2205)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=77f5191f0022614b8810cc8aa6ffa9b9
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=false
# utc_time=2010-09-17 09:33:23
# local_time=2010-09-17 11:33:23 (+0100, Romance (zomertijd))
# country="Belgium"
# lang=1033
# osver=6.0.6000 NT
# compatibility_mode=1024 16777215 100 0 0 0 0 0
# compatibility_mode=5892 16776574 100 100 26709983 122290103 0 0
# compatibility_mode=8192 67108863 100 0 109 109 0 0
# scanned=90367
# found=1
# cleaned=1
# scan_time=1828
C:\Qoobox\Quarantine\C\Windows\system32\Drivers\volsnap.sys.vir_ Win32/Olmarik.ZC trojan (cleaned - quarantined) AADE54C96E487B15EC810C1204397874 C

Okay, nearly done now.

Hello.

Please download the current version of HijackThis from HERE

• Double click and run the installer.
  
• It will install to C:\Program Files\Trend Micro\HijackThis\hijackthis.exe
  
• After installing, you should get the user agreement, press accept and Hijack This will run.
  
• When Hijack This opens, click "Open the Misc Tools section"
  
• Then select "Open Uninstall Manager"
  
• Click on "Save List..." (generates uninstall_list.txt)
  
• Click Save, copy and paste the results in your next post.
  

and that volsnap.sys , I've seen this somewhere else as well , when I did a scan in the beginning , some program ( but I don't know which one anymore ) asked me to write this down cause we might need it , or something like that ..
don't know if it's of any use ?

Not really, probably just an infected TDL driver, but that's been fixed.

Please do my above instructions.

ok sorry !
this is the uninstall list :

7-Zip 9.16 beta
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe AIR
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.1.2 - Nederlands
Championship Manager 01-02
ESET Online Scanner v3
FirstSteps Diagnostics
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Intel Turbo Memory en Intel Matrix Storage Manager
Java(TM) 6 Update 11
Java(TM) 6 Update 7
Junk Mail filter update
LimeWire 5.4.6
LiveUpdate Notice (Symantec Corporation)
Malwarebytes' Anti-Malware
Microsoft .NET Framework 3.5 Language Pack SP1 - nld
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Choice Guard
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft Visual C++ 2005 Redistributable
Motorola SM56 Data Fax Modem
MSVCRT
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
Nero 7 Essentials
NVIDIA Drivers
OSDInstall
PC Connectivity Solution
PowerDV
Realtek High Definition Audio Driver
SAMSUNG Mobile Composite Device Software
Samsung Mobile Modem Device Software
SAMSUNG Mobile Modem Driver Set
Samsung Mobile phone USB driver Software
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung New PC Studio
Samsung New PC Studio
SAMSUNG USB Mobile Device Software
SamsungConnectivityCableDriver
Taalpakket voor Microsoft .NET Framework 3.5 SP1 - NL
Unibet Poker
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
WebCam
Winamp
Windows Live - Hulpprogramma voor uploaden
Windows Live aanmeldhulp
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Essentials
Windows Live Family Safety
Windows Live Mail
Windows Live Messenger
Windows Live Movie Maker
Windows Live Photo Gallery
Windows Live Sync
Windows Live Toolbar
Windows Live Writer
Windows-stuurprogrammapakket - Nokia pccsmcfd (10/12/2007 6.85.4.0)

Hello.
Now we just need to remove some old outdated software and installed the new version, then were done.

I see that you are running Limewire.
P2P(Peer to peer) applications are designed to help you easily share and distribute files between you and a group of people. But they can also be used to distribute malware, and thus are not considered safe.
The removal of these programs is optional, but highly recommended.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

Adobe Reader 8.1.2 - Nederlands
Java(TM) 6 Update 11
Java(TM) 6 Update 7
LimeWire 5.4.6

Updating Java:

• Download the latest version of Java SE Runtime Environment (JRE) 6 Update 21.
  
• Click the "Download JRE" button to the right.
  
• In the Window that opens, select your platform, check the "agree" box, and click Continue.
  
• Click on the link to download Windows Offline Installation and save to your desktop.
  
• Close any programs you may have running - especially your web browser.
  
• Then from your desktop double-click on jre-6u21-windows-i586.exe that you downloaded to install the newest version.
  

Then download and install Adobe Reader 9.3.4

How is the machine running now?

yeah apparently my brother is using that , I never use it cause I had some problems with it in the past .

ok I'll do everything you told me and get back to you when I'm done .

the computer is running smoothly now !!!
so does this mean that the virus is gone and everything is fixed ??

ok so I guess it is ? please confirm ?

In 4 to 5 weeks I'll have money on my paypal and I'll buy your book , you've helped me a LOT !
thank you so much ! I'll be back to buy that book and I might subscribe to learn how to fight malware and viruses etc !

once again thanks !

Yep, it all is running well, this should be fine now.

We need to make a new restore point.

To turn off System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
4. Click Yes when you receive the prompt to the turn off System Restore.

Now we need to make a new restore point.
To turn on System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (To turn on System Restore), and then click OK.

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers.

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
https://addons.mozilla.org/en-US/firefox/addon/722
https://addons.mozilla.org/en-US/firefox/addon/1865
https://addons.mozilla.org/en-US/firefox/addon/433

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
Update Checker

5) Finally, consider maintaining a firewall. Some good free firewalls are Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found here.

Hopefully this should take care of your problems! Good luck.

hmm for some reason I cant find what you mean with the system restore ?
could it be that it is different with vista ?
cause if I right click on computer in the start section I don't see any tabs ?

Sorry, yes it is. Ignore that bit, it's for XP.

oh ok , I'll wait for further instructions then :p

See here for Vista.

http://en.kioskea.net/faq/584-activation-deactivation-of-system-restore-under-windows-vista

That should be it.

ok sorry to bother you once more but when I try to update I get an error ?

it's error code 80072EFD , it says that there is an unknown error in windows update ?

well I'll go to bed now , hope to hear from you tomorrow mate
thanks a lot for the help already , now I just need to fix this minor problem

cheers and until then !

ok sorry to bother you once more but when I try to update I get an error ?

it's error code 80072EFD , it says that there is an unknown error in windows update ?

Have you added Windows Updates to the trusted sites list?

http://windows.microsoft.com/en-US/windows-vista/Windows-Update-error-80072efd

yeah but it's still like that , really weird , tried everything that the help pages are suggesting.

don't find what's wrong , but is it bad that the laptop doesn't have windows update ?

nevermind then.....

Hello.

• Now open a new notepad file.
  
• Input this into the notepad file:
  

  
  Windows Registry Editor Version 5.00
  
  REGEDIT4
  [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
  [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges]
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges]
  [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
  [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges]
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges]
  [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains]
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains]
  
  

  
  
• Save this as fix.reg, save it to your desktop.
  
• Double click fix.reg to run it.
  
• Select yes to the registry merge prompt.
  

Reboot the machine after, can you update now?

ok did it , but he's still giving the error when I try to look for updates

80072EFD

Hello.
Please locate this folder:
C:\Windows\Minidumps

Inside will be several .dmp files, please zip them all up and attach them here.

sorry for not responding but I haven't spoke my brother and the laptop is with him again , I will test it out asap ; many thanks in advance!