That got the one I was worried most about.
But there are a few still left.
Download
OTM by OldTimer to your desktop.
Note: If you are running on Vista, right-click on OTM.exe and choose
Run As Administrator.
*
Save it to your
Desktop.
* Double-click
OTM.exe to run it.
*
Copy the lines in the codebox below to the clipboard by highlighting
ALL of them and
pressing CTRL + C (or, after highlighting, right-click and choose
Copy)
Code:
:Processes
explorer.exe
:reg
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9420:TCP"=-
"5000:UDP"=-
"8085:TCP"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
:Commands
[purity]
[emptytemp]
[start explorer]
* Return to OTM, right click in the
"Paste Instructions for Items to be Moved" window
(under the yellow bar) and choose
Paste.
* Click the red
Moveit! button.
*
Copy everything in the Results window (under the green bar) to the clipboard by highlighting
ALL of them and
pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close
OTM Note: If a file or folder cannot be moved immediately you may be asked to reboot your computer in order to finish the move process. If asked to reboot, choose
Yes.
----------
Before or after posting the OTM log...
Please scan your computer with
Panda ActiveScan
* Once you are on the Panda site click the
Scan your PC now button.
* A new window will open...click the
Scan Now button.
* If it wants to install an ActiveX component allow it.
* It will start downloading the files it requires for the scan.
(Note: It may take a couple of minutes)
* You may get a warning from Internet Explorer that Panda is ready to install, please allow it.
*
The scan will begin. Please be patient as it can take an hour or more to complete.
* When the scan completes, if anything malicious is detected, click the
Export to: button (looks like a little Notepad).
* Save the ActiveScan.txt to a convenient location like your desktop.
*
Note: You
do not need to select any of the Disinfect options. We will remove any threats manually.
* Post the contents of the ActiveScan report in your next reply.