[RESOLVED] I may have a virus

Hi Broni,

This is the log from OTL.

Regards,

Glyn

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Admin
->Temp folder emptied: 280780 bytes
->Temporary Internet Files folder emptied: 6366687 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 611 bytes

User: All Users

User: AppData

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Glyn
->Temp folder emptied: 316089 bytes
->Temporary Internet Files folder emptied: 35834194 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 823 bytes

User: Matthew
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Mum
->Temp folder emptied: 2111878 bytes
->Temporary Internet Files folder emptied: 27137143 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 1001 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 4259 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 69.00 mb


[EMPTYFLASH]

User: Admin
->Flash cache emptied: 0 bytes

User: All Users

User: AppData

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Glyn
->Flash cache emptied: 0 bytes

User: Matthew
->Flash cache emptied: 0 bytes

User: Mum
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.31.0 log created on 12292011_090911

Files\Folders moved on Reboot...
File move failed. C:\Users\Glyn\AppData\Local\Temp\FXSAPIDebugLogFile.txt scheduled to be moved on reboot.
C:\Users\Glyn\AppData\Local\Temp\~DF0A1E09B0F45E89F1.TMP moved successfully.
File\Folder C:\Users\Glyn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\Y1060032\bind[1].htm not found!
C:\Users\Glyn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\Y1060032\fastbutton[2].htm moved successfully.
C:\Users\Glyn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\Y1060032\frame[2].htm moved successfully.
C:\Users\Glyn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\Y1060032\mail[1].htm moved successfully.
C:\Users\Glyn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MU5C3ZO0\frame[2].htm moved successfully.
C:\Users\Glyn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MU5C3ZO0\mail[2].htm moved successfully.
C:\Users\Glyn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MU5C3ZO0\plusone_gadget[1].htm moved successfully.
C:\Users\Glyn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\7X0UFXQM\918[1].htm moved successfully.
C:\Users\Glyn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\7X0UFXQM\fastbutton[4].htm moved successfully.
C:\Users\Glyn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\7X0UFXQM\frame[1].htm moved successfully.
C:\Users\Glyn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\7X0UFXQM\mail[2].htm moved successfully.
C:\Users\Glyn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\7X0UFXQM\partner[1].htm moved successfully.
C:\Users\Glyn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1GZNOZCR\showthread[1].htm moved successfully.
File move failed. C:\Users\Glyn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat scheduled to be moved on reboot.
C:\Users\Glyn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.
File move failed. C:\Users\Glyn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\SuggestedSites.dat scheduled to be moved on reboot.
File move failed. C:\Windows\temp\WebEx\Log\1229\atashost.log scheduled to be moved on reboot.
File\Folder C:\Windows\temp\ZLT00fe7.TMP not found!

Registry entries deleted on Reboot...

Quote:

---

13. Please, let me know, how your computer is doing.

---

Whenever ready....

Hi Broni,

I have now completed all the tasks. I tried to update ZoneAlarm and I got the same message as when we started "Unable to connect to the download server. Please check your Internet connection and try the installation again." So I downloaded the full file "zaSetup_92_102_000_en" and it will not run. It is of type file and when I double click on it I am asked if I want to open it and then what application I want to use to open it.

I then tried PersonalVPN and it still will not connect.

Regards,

Glyn

Hi Broni,

I just got this error when I started IE. Please see attached.

Regards,

Glyn

Because your computer was infected some files got possibly corrupted.
Some programs, like ZA or PersonalVPN may need to be reinstalled.

As for IE...that's pretty common error.
Open IE, go Tools>Internet options>Advanced tab, click on "Reset" button.
Restart IE.

Hi Broni,

Will do. Thank you very much for all your help.

Regards,

Glyn

You're very welcome https://discussions.virtualdr.com/

https://discussions.virtualdr.com/