i cant download new programs so wasnt able to post logs from OTL

OK so my computer is infected by some kind of virus or something. windows open randomly and some windows don't open at all, or they don't close without ending the process. thats not the biggest problem though, the host process for windows explorer crashes unexplainably. and it seems I've lost administrative rights and cant download any new programs, or such. since i cant download any new spyware or virus programs i'm stuck with what i got, Norton, but it doesnt find anything, never did dont think it will start now. i really dont know what to do. i need some serious help with this...

Hello.

We need to use the RKill Tool by Grinler

Rkill.com <--- Download site

• Please Download Rkill.com. Save it to your Desktop.
  
• Before we begin, you should disable your anti-malware softwares you have installed so they do not interfere RKill running as some anti-malware softwares detect RKill as malicious. Please refer to this page if you are not sure how.
  
  
• NOTE: If you are unable to connect to the site to download rkill, then you should download it to a clean computer and copy it to the infected one via a USB flash drive or CDROM.
  
  
• Once it is downloaded, double-click on the rkill.com in order to automatically attempt to stop any processes associated with Rogue programs.
  
• Please be patient while the program looks for various malware programs and ends them.
  
• When it has finished, the black window will automatically close and you can continue with the next step.
  

NOTE: If you get a message that rkill is an infection, do not be concerned. This message is just a fake warning given by the rogue program, when it terminates programs that may potentially remove it. If you run into these infections warnings that close Rkill, a trick is to leave the warning on the screen and then run Rkill again. By not closing the warning, this typically will allow you to bypass the malware trying to protect itself so that rkill can terminate the rogue program. So, please try running Rkill until the malware is no longer running. You will then be able to proceed with the rest of the steps.

If you continue having problems running rkill.com, you can download:
iExplore.exe or eXplorer.exe
which are renamed copies of rkill.com, and try them instead.

Can you run OTL now?

i was actually able to download OTL in safemode so i will run it now and post the logs, should i still run Rkill though?

Nah, post OTL logs if possible.

every time i try to post the logs it says the connection to the page has been reset...i dont know what to do.

Hello.
Are you able to attach the logs instead?

no, it wont let me do that either

Okay, can you upload the logs to rapidshare.com and post the share URL please?

http://rapidshare.com/files/434774270/OTL.Txt


this is the link that was below it, i'm guessing it's the one you need..

Hello.
Yep, that was it.

Please run OTL.exe.

• Copy the commands with file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :OTL
  O4 - HKLM..\Run: [] File not found
  O4 - HKLM..\Run: [zzz_ImInstaller_IncrediMail] C:\Users\rac\AppData\Local\Temp\Low\ImInstaller\Complete_IncrediMail.exe File not found
  O4 - HKLM..\Run: [zzz_ImInstaller_Magentic] C:\Users\rac\AppData\Local\Temp\ImInstaller\Magentic\magentic_install.exe File not found
  O4 - HKCU..\Run: [a886b0835fe58dd920844d7de0a5e8f9] C:\Users\rac\DOWNLO~1\TOUGHT~1.EXE File not found
  O4 - HKCU..\Run: [Mqsuc] C:\Windows\lsass.exe File not found
  O4 - HKCU..\Run: [MqsZ] C:\Windows\mdm.exe File not found
  O4 - HKCU..\Run: [MqvPc] C:\Windows\win32.exe File not found
  O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
  
  :files
  C:\Windows\tasks\At*.job
  
  
  
• Return to OTL, right click in the "Custom Scans/Fixes" window (under the light green bar) and choose Paste.
  
  
• Click the red Run Fix button.
  
• A fix log in Notepad will appear. Copy the contents of the fix log to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTL.exe
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\a886b0835fe58dd920844d7de0a5e8f9 deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Mqsuc not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\MqsZ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\MqvPc not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools not found.
========== FILES ==========
File\Folder C:\Windows\tasks\At*.job not found.

OTL by OldTimer - Version 3.2.18.2 log created on 12312010_203531

Sorry I took so long, I've been away.

Hello.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5440

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18975

1/1/2011 8:43:12 PM
mbam-log-2011-01-01 (20-43-12).txt

Scan type: Quick scan
Objects scanned: 162931
Time elapsed: 10 minute(s), 24 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 2
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\AppID\GamevanceText.DLL (Adware.GameVance) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\AppDataLow\gvtl (Adware.GameVance) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
c:\Users\rac\AppData\Roaming\Mozilla\extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@gamevance.com (Adware.GamesVance) -> Delete on reboot.
c:\Users\rac\AppData\Roaming\Mozilla\extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@gamevance.com\components (Adware.GamesVance) -> Quarantined and deleted successfully.

Files Infected:
c:\Users\rac\downloads\retrogamersetup2.3.76.6.rgman000 (1).exe (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Users\rac\downloads\retrogamersetup2.3.76.6.rgman000.exe (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Users\rac\downloads\unconfirmed 50022.crdownload (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Users\rac\AppData\Roaming\Mozilla\extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@gamevance.com\chrome.manifest (Adware.GamesVance) -> Quarantined and deleted successfully.
c:\Users\rac\AppData\Roaming\Mozilla\extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@gamevance.com\components\gvtlf.dll (Adware.GamesVance) -> Quarantined and deleted successfully.

Hello.

• Download combofix from here
  Link 1
  

1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to svchost as follows:





3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. We need to disable your local AV (Anti-virus) before running Combofix.

• See HERE for how to disable your AV.
  
• Double click on svchost.exe.
  
• Follow the prompts. NOTE:
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouse click combofix's window whilst it's running. That may cause it to stall.
  

it wont let me post it, its keeps saying the connection was reset. i uploaded it to the site you told me to upload the otl logs if that helps at all.


http://rapidshare.com/files/440870667/log.txt

Hello.

Please download TDSSKiller from here and save it to your Desktop.

• Doubleclick TDSSKiller.exe to run the tool
  
• Click the Start Scan button
  
• After the scan has finished, click the Close button
  
• Click the Report button and copy/paste the contents of it into your next reply
  

Note:It will also create a log in the C:\ directory.

my computer took a turn for the worst yesterday, it said i had to restart so i did. after that it would get to the windows loading screen and keep crashing and restarting. i ran a system recovery to restore it back to factory settings. i think that got rid of my problem but, do you think there is anything i should do to make sure?

Install an antivirus & antispyware protection, a factory restore wipes everything so once your protected, you should be fine.

ok, i have Norton i think that covers spyware, i know it covers AV. Thanks for all the help!

so Norton should handle all my problems?? or most..??

We don't recommend Norton, it's a resource hog.

You aren't running Anti Virus Software

Please install Avira antivirus otherwise you won't be protected.

1) Antivir PersonalEditionClassic
-Free anti-virus software for Windows.
-Detects and removes more than 50,000 viruses. Free support.

It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts.