Windows 7 PC having major issues

[Broni]

C:\All Files from old Dell\My Documents\Chris Outlook\Chris & Lisa Mail.dbx

Something malicious is located in your mail folder. Since I don't want to remove a whole folder, you'll have to be careful with your current mail. Don't click on any unknown link and scan every attachment with your AV program before opening.
When done with reading, empty your mail folder.

As for the other file...

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  
  :Services
  
  :Reg
  
  :Files
  C:\Windows\Installer\13bb9.msi
  
  :Commands
  [purity]
  [emptytemp]
  [emptyflash]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• You will get a log that shows the results of the fix. Please post it.
  

[clem]

that outlook file was ancient. something that i copied from an older computer. i went ahead and deleted the entire directory.

here is the OLT log:


Files\Folders moved on Reboot...
File\Folder C:\Users\Baby\AppData\Local\Temp\~DF417687930EC596C4.TMP not found!
C:\Users\clem\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GKN98WD7\istay[3].htm moved successfully.
C:\Users\clem\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D5YELU2O\istay[1].htm moved successfully.
C:\Users\clem\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D5YELU2O\showthread[1].htm moved successfully.
C:\Users\clem\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\41NCINT0\downtown-disney[1].htm moved successfully.
C:\Users\clem\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\13FC1JAE\474a53744f5578492f6c5941426c5269[3].htm moved successfully.
C:\Users\clem\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\13FC1JAE\474a53744f5578492f6c5941426c5269[4].htm moved successfully.
C:\Users\clem\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\13FC1JAE\iepngfix[1].htc moved successfully.

Registry entries deleted on Reboot...

[Broni]

You either didn't run my script, or you didn't post a whole fix log.

In any case, go to C:\Windows\Installer folder and see, if 13bb9.msi file is there. If it's there, delete it and empty recycle bin.

When done...

OTL Clean-Up
Clean up with OTL:

* Double-click OTL.exe to start the program.
* Close all other programs apart from OTL as this step will require a reboot
* On the OTL main screen, press the CLEANUP button
* Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

===========================================================

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point.

Turn off System Restore:

- Windows XP:
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore".
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
- Windows Vista and 7:
1. Click Start.
2. Right-click the Computer icon, and then click Properties.
3. Click on System Protection under the Tasks column on the left side
4. Click on Continue on the "User Account Control" window that pops up
5. Under the System Protection tab, find Available Disks
6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:")
7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
8. Click OK

2. Restart computer.

3. Turn System Restore on.

4. Make sure, Windows Updates are current.

5. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

7. Run defrag at your convenience.

8. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

9. Please, let me know, how is your computer doing.

[clem]

i completed your last task. everything is running fine except under my wife's account she cannot use browse the internet. she can use outlook to download email and i can ping google from the desktop. since it looks like everything had been resolved, i ran the IE connection troubleshooter and it told me " the remote device or resourse will not accept the connection." i searched for a fix and found that going under internet options and clicking on reset might fix it. it did, not sure what caused it but its resolved and now im totally clean. i very much appreciate you taking the time to resolve my issues. thanks for everything.

chris

[Broni]

Great news

Good luck and stay safe