you need one Antivirus never 2 so if you have McAfee currently running and updating stick there for now.

go here and do the malwarebytes it is free let it clear what it finds.
Malwarebytes' Anti-Malware (Win) - Detecting and Removing Malware
RUN the FULL scan and always hit update before doing any scans.

Then go here and get superantispyware free update and run it also.
SUPERAntiSpyware.exe (17.1MB), Version: 5.5.1006 )

then go do this online scan
Free Online Scanner

the come back and let us know how that went and what all was found.

Have you done all of your widows critical updates? If not those must be done asap.
have you been doing updates for flash, java, adobe etc if not those must be done also. go here and run this scan it will let you know what needs updating and lead you to it.
Secunia Online Software Inspector (OSI)

you can do this same routine at least once a month.

If you want to go from McAfee to the MSE owbist mentioned we can tackle that after this but it requires a full removal of McAfee first.

by the way you are safe to keep all of those programs they will not interfere with your McAfee because they are on demand scanners they do not run full time so no worries about that.

I haven't forgotten you two and I do apppeciate your help. Ravencajun, I'm doing your suggestions and I got through the first three but I'm having problems with the last one. I'm going to run through all of then today to see how it goes. Yesterday I thought it went much faster than it had been but today it seems really slow again. After I run them again I'll let you know where I had trouble. Thanks so much for your help. I'll keep trying.

1. Go to Control Panel/Programs and remove any toolbars that are listed in Programs. Also, remove Windows Live from the Programs list; this will stop the Windows Mail popup from appearing. However, if Windows Mail IS your email program, do not remove the WIndows Mail component from the Windows Live program.

2. Go to Windows Updates and make sure all your necessary updates are currently installed.

3. Run Disk Cleanup.

4. Run Disk Defragmenter.

Do the above listed items in addition to the previous recommendations.

Come back to this forum if you have more questions or are unsure about anything you are doing. Good luck :)

Okay you are making headway, keep up the good work, you go ahead with the scans again and if you are seeing that malwarebytes is finding infections let me know so we can look at the log from it and know where to go from there.
Keep us updated.

Okay, update time. I just ran yet another scan, remembering to update first. Everything went quite well for the first 3 steps of ravencajun. BUT, oh my what problems I had with Secunia. It told me Microsoft is insecure, Macromedia is insecure, Sun Jave is insecure, Adobe flash is insecure. I tied to download all of them and none of them would download. Of course they all say the system is in danger of ...oh...forgot what it said. but didn't sound good. So, now anymore ideas? I am so pleased the first three ran so smoothly. three out of 4 is better than nothing out of 4 I guess. Thanks again all. I appreciate it and sure hope I can get this thing up and running again. (won't without your help for sure.)

I guess I should have mentioned that when I was going to do an update I also clicked on 'quarantine' and it showed that there were 7 trojans in there. Also, many months ago our phone company was sold and so I was working with the new company for setting things up. They were guiding me through what had to be done and I don't know what happened or how but I lost Adobe and haven't had it yet as far as I can tell. When I told them about it they said they could help me but there would be a charge for that help!!!!! When it offers an update it tells me that "it is unable to open this internet site. The requested site is either unavailable or cannot be found. Please try later. " I betcha this means even more trouble, huh? I know that if I go back to the phone company for help they will charge me for the help and I don't want tnat.

I had the same problem with secunia, Java and Adobe being insecure, it would not install the downloads possibly because they were up to date. I think that was one of the software's that wouldn't let me play my games or gave me warnings all the time, can't remember which now. I did figure out how to stop that, but not Java and adobe.

Well if that were me I would get rid of Secunia sudden like, then do the needed updates and consider re-installing Secunia if you feel the need.

No doubt Secunia is a good and well respected program, I have never used it myself.

There is nothing to get rid of it is an online scanning tool secunia is simply a tool that allows you to scan the pc and all in one place find out just what is needing updating that is all. It is a well respected security and AV company. but you can easily just do those updates manually your self it just makes it easier when you have it all in one place. However if it said your windows was not updated then you really do need to go do all your critical windows updates right away.

There is also a version of secunia that you install it may work better for you it is called the PSI
Secunia Personal Software Inspector (PSI)

The thing that has me most concerned is that you said 7 trojans were found.
Please do this so I can see what was found. Open malwarebytes and go to the tab that says logs and copy and paste your logs that show those trojans here in your reply box.

You do not need adobe actually it is better not to have it, you can remove it from the pc where you do add remove programs. In place of Adobe you can use PDFxchange, sumatra, foxit, etc all of which do what Adobe did. So if you need to we can help with that.

to manually update your java go to control panel in your list there look for java the coffee cup icon, click that, go to the update tab, choose update now. It will take you through updating, watch carefully that you do not get any added stuff like toolbars, etc if they have something like that checked just uncheck it and continue.

to update your flash that must be done with each browser on the computer because each uses it's own version. I do not know which browsers you have and use. here is the link for the IE flash update
Flash Player click the green download latest version arrow on right. Do the same with this watch for any extras that might be checked.

If you have firefox you need to open firefox and go here to install the one for it.
Flash Player

do you have your windows updates set to automatically install them ?

When Secunia OSI couldn't complete updates on a certain web item like Java etc, I had to uninstall all versions of it and start over with the Windows 7 32 bit item. That seemed to help clear the way for smooth updates.

I tried it twice and liked it when it worked. It came to be to much trouble. The stuff it wanted me to update was up to date.

Ravencajun, as much as I appreciate your help, I'm at a loss now. I wanted to print out some of the things I'm finding and now the printer won't even work! Tells me there is no printer installed and that I should install it. It HAS been installed (long ago)
so I doh't know what that is all about. Also, I guess I don't know how to cut and paste from Malware. I suppose I have to take each trojan separately as I don't see how they can be done all at once, but then I'm stumped. I do know how to cut & paste if I'm typing something I want to change but this is over my head. Also the pc is slower again today. more so than yesterday. So sorry to be such a dunce. BT

Can you do this.

DDS is a program that will scan your computer and create logs that can be used to display various startup, configuration, and file information from your computer.

The program will also display information about the computer that will allow us to quickly ascertain whether or not malware may be running on your computer.

To use DDS, simply download the executable and save it to your desktop or other location on your computer. You should then double-click on the DDS.scr icon to launch the program. DDS will then start to scan your computer and compile the information found into two log files. When DDS has finished it will launch the two Notepad windows that display the contents of these log files. Copy and paste the log reports in your next reply.

See link for download

Here is a link that might be useful: DDS

To copy and paste any log, open malwarebytes as if you want to scan, on top there's a row of tabs choose the one that says logs, there will be entries for each time you scanned click one to view it, the log that shows you the Trojan results is the one you want. Once you get viewing it use your cursor to start at the very beginning and hilight all of the writing then right click on the hilighted text and choose copy. Come here open a new reply box put cursor in box right click choose paste. It should put all the log text into the box. Submit as normal reply.

Try what Zep suggested too.

It is sounding like you may have some infections remaining to deal with.

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Database version: v2012.07.11.11

Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
rolapete :: ROLAPETE-HP [administrator]

7/11/2012 6:20:57 PM
mbam-log-2012-07-11 (18-20-57).txt

Scan type: Full scan (C:\:)
Scan options enabled: Memory : Startup : Registry : File System : Heuristics/Extra : Heuristics/Shuriken : PUP : PUM
Scan options disabled: P2P
Objects scanned: 606943
Time elapsed: 1 hour(s), 27 minute(s), 43 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 1
HKLM\SOFTWARE\Microsoft\Security Center:UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.

Folders Detected: 0
(No malicious items detected)

Files Detected: 4
C:\Users\rolapete\AppData\Local\Temp\i4b2408262764878063192.tmp (Exploit.Drop.3P) -> Quarantined and deleted successfully.
C:\Users\rolapete\AppData\Local\(1ffaadfd-f713-3d77-b823-dd61c5aa7ec3)\n (Rootkit.0Access) -> Delete on reboot.
C:\Windows\Installer\(1ffaadfd-f713-3d77-b823-dd61c5aa7ec3)\n (Rootkit.0Access) -> Quarantined and deleted successfully.
C:\Windows\Installer\(1ffaadfd-f713-3d77-b823-dd61c5aa7ec3)\U\00000008.@ (Trojan.Dropper.BCMiner) -> Quarantined and deleted successfully.

(end)
I can only highlight one at a time. This is the first one. Bet you need them all right?

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Database version: v2012.07.13.06

Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
rolapete :: ROLAPETE-HP [administrator]

7/13/2012 1:02:27 PM
mbam-log-2012-07-13 (13-02-27).txt

Scan type: Custom scan (C:\HarddiskVolume2:)
Scan options enabled: File System : Heuristics/Shuriken : PUP : PUM
Scan options disabled: Memory : Startup : Registry : Heuristics/Extra : P2P
Objects scanned: 1
Time elapsed: 3 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Database version: v2012.07.12.08

Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
rolapete :: ROLAPETE-HP [administrator]

7/12/2012 9:38:40 AM
mbam-log-2012-07-12 (09-38-40).txt

Scan type: Full scan (C:\:)
Scan options enabled: Memory : Startup : Registry : File System : Heuristics/Extra : Heuristics/Shuriken : PUP : PUM
Scan options disabled: P2P
Objects scanned: 608491
Time elapsed: 57 minute(s), 28 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Windows\Installer\(1ffaadfd-f713-3d77-b823-dd61c5aa7ec3)\U\00000008.@ (Trojan.Dropper.BCMiner) -> Quarantined and deleted successfully.

(end)

Rootkit.0Access "Backdoor Trojan"

Post the log that I asked for too.

You should get additional help with this, that is more thorough scans at a Malwaer removal forum

I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Joe

FYI,

Rootkit.0access.H is a hazardous rootkit which can access the infected PC system through the security holes generated by its allies. Generally, uses may get this virus while downloading files/drivers from unreliable web sites or opening unknown email or downloading media files that contain the activation code of the virus. After it sneaks into the target computers, it can disable security applications, connect to a remote server and open up a backdoor into the victims computer system. Moreover, this Rootkit may infect the MBR (Master Boot Record) of an infected PCs hard drive.Thus, even if you reinstall Windows, the stubborn rootkit infection still remains in your computer firmly.

1 It is a pesky rootkit that spreads by e-mail, in file sharing networks or through unprotected network shares.

2 It can record the information, log the strokes of the keys in your keyboard, and store the personal data in your system.

3 It can notably slow down PC performance and distribute pop-up ads on the compromised machine.

even if you reinstall Windows, the stubborn rootkit infection still remains in your computer firmly.

Not so sure that part is correct though.

oh crud that is what I was afraid of!
Ok yes you definitely need to go to LzD forum, register there then post your own thread there in the area I am going to link to here. In your post tell them what you have done and post the logs there, I will watch for it and post the link back to here.
Analysis and Malware Removal

the team there will help you with this really serious infection. You will do it step by step and any time you have a question must stop and ask. I am there too so if you need help getting there or setting up your registration let me know. Don't get over whelmed but this is a must do situation.

If you need me to go ahead and start the thread for you over there just let me know here and I will be happy to do that.

Hi, brownthumbia.

To answer you initial question about what happens when you take your computer to a repair shop -- they usually just wipe and reinstall the operating system.

Although sometimes that is the best solution, I may be able to help you if you follow ravencajun's advice and post the requested logs at LandzDown.

Since you have McAfee installed, you are correct in following the advice of the phone company not to install a second antivirus program.

I hope to see you at LzD.

Regards,

Corrine

Thanks Corrine, I will be watching to see if I can be of assistance on this end to help brownthumbia make it to LzD.

I did as Zep said to do...turned off the pc, changed a password and still have one more to do today. To do this I used my iPad, hope that is okay because I was told there is no virus in an iPad. My granddaughter is coming in a day or two and I will have her work on this with your generous help. She is so much smarter than I am and sometime it is all Greek to me. Again you are so special in your willingness to help and Im sorry I just can't grasp it all. I assume it is not safe to use the pc even with the changed password, right? BT

Hi brownthumbia:

I would STRONGLY suggest that you use the resource of the Landzdown forum to help you resolve your computer infection. On your iPad, you can go to their website (www.landzdown.com) and under the "Analysis and Malware Removal" heading you will find a thread where Corrine helped someone remove an infection that is similar to yours. When your grandaughter arrives, she can work with Corrine to clean up your computer.

The landzdown forum is an excellent resource for your type of situation. I STRONGLY recommend it.

Hi, brownthumbia.

Yes, it was fine to change your passwords with the iPad. However, don't be under the false impression that iPads are immune to malware. They are not the large target of Windows OS but can be infected.

Don't use the infected computer to do any banking, bill paying, online purchases.

When your granddaughter posts the logs at LandzDown, please have her reference this topic so I'll know it is for you.

Agree strongly advise going to LzD, I promise you the team there and Corrine will guide you or your grand daughter step by step with easy to understand instructions to help you rid your pc of this very serious infection.

I have sent many many people from here at GW there to get the expert help that is provided totally free by the wonderful volunteers there.

As I said if you need help in any of this just let me know I can help you get to LzD if need be.

Raven and all, just wanted to let you know my Granddaughter is not coming until July 25th. Wanted to let everyone know so you don't keep watching for her. I'll remind you all later and hope we can get this worked out. Thanks again to all of you. BTW no wonder it's such a mess. I did NOT have virus protection. My phone co. was supposed to be providing McAfee for their customers. Seems mine expired, and who knows how many others, and was never renewed. Gee, just the kind of service I want from them. Later!

Why don't you give it a try your self you might find your able to do it and it is a great learning experience. They will take it slow at your pace. If you want to just let me know.

brownthumbia, you can do this and it will be a great learning experience. After it is finished and your computer is clean again, you are really gonna feel good about what was accomplished. You aren't going to break anything or mess anything up. It was only 3 years ago that I only knew how to check e-mail and surf the web. Because I crawled out of my shell and tried to explore on a computer, I gained the confidence to earn a career in the computer industry. I am now CompTIA certified as a computer technician (Security+, Network+, A+) and will be attempting this Fall for my CCNA certification. I am doing all this over the age of 50.

YOU CAN DO THIS!!!!!!!!

Raven, your recent accomplishments are spectacular. I wondered if you were professional in the computer arena. Three years of dedication is spectacular.

I know you follow thru with people who have problems and even are up late with them here and at LzD. I have noticed that some drift away as you and your pros here are on standby. We are very lucky to have you all. I hope people like brownthumbia will try as you ask after all the work that was done for him or her and the level of trust that developed.

Okay, tomorrow I'm gonna give it a try. I sneaked over there and took a peek and now I must ask, do I use my email address for the username or brownthumbia, or make up another one.
Also for the password, make up a new one or use the one I use on garden web forum. Gotta make sure I at least START out right. See you tomorrow and if at any time, while you're helping me, you get the urge to bang your head on the table, please feel free. I'll wait. LOL. sleep well. BT

I would think you could use brownthumbia as your username and your GW password would be ok as well. Good luck, and I am confident that you will NOT regret the decision to move forward with this process. You will have knowledgeable people along side you every step of the way. And remember to stay patient during this process. You will do fine.

I went to Landzdown, got a nickname typed in...Guest23739. But then it stops and it looks like, along the bottom, that it does not connect to the internet?? it says "waiting for http://landzdown.com/irc/cgiirc-05.10/nph-irc.cgi? etc,etc, etc. It this something beyond my control or what do I do now?

When I see that message it's a momentary thing. The server's busy or temporarily off. Try again a few minutes later.

Hi, brownthumbia.

You used the link for logging on to the LandzDown IRC chat server, not for creating an account. (IRC stands for Internet Relay Channel. It is something like Messenger.)

Please go to http://www.landzdown.com/register/
Register with your brownthumbia name.

Although it likely would not hurt to use the same password you use here, I personally do not recommend using the same password everywhere.

Not sure how that happened I had posted the link to the malware area, we are watching for you brownthumbia just use the same name so we know it is you.

This is the link to the main page at LzD
LandzDown Forum

Raven I tried to register but I tried several different names but it just says it does not recognize my name. I put in mt email then brownthumbia and I get the same thing. Just can't get registered I know it does 't recognize it because it doesn't let me in.

Okay let's see what we can do for you.

one thing I thought about before we clean this up...I do not have any virus protection as of now. As I said my server ws supposed to provide this. Should I get one installed before we go any further or do it after we're done?

Raven I tried to register but I tried several different names but it just says it does not recognize my name. I put in mt email then brownthumbia and I get the same thing. Just can't get registered I know it does 't recognize it because it doesn't let me in.

Raven I tried to register but I tried several different names but it just says it does not recognize my name. I put in mt email then brownthumbia and I get the same thing. Just can't get registered I know it does 't recognize it because it doesn't let me in.

Hi, brownthumbia.

1) Regarding antivirus software, you said when asked earlier that you have McAfee through the phone company. So, don't install anything else.

2) Please send me an e-mail and I will pre-register your account. Send the e-mail to corrine-lzd @ hotmail.com (without the spaces).

Your account has been created and the logon information sent in a reply to your e-mail, brownthumbia.

Corrine has already set up your own post for you over at LzD so you can just jump in there and start to work she has your first set of instructions up for you.
Here is the link to your thread there

Topic for Brownthumbia!

Just use the login info that was sent to your email and you are good to go.

Raven, yes, bless her heart she has tried so hard. I had to be gone today so I haven't let her know, as yet, that I clicked on DDS, then got this box:
This operating system is not supported!
DDS only runs on: Windows 2000, Windows XP (32 bit), Windows Vista (32/64 bit), Windows 7 (32/64 bit).

But you have windows 7 which it supports. Go ahead and just post over there now so we can keep it all in one place and avoid confusion.

Hi, brownthumbia.

Try the download link for DDS.scr again. If you get the same message again, please post in the topic I created for you and I will provide alternate instructions. It will involve downloading two files, but don't worry. We'll manage just fine.