Search:

It looks like the computer is clean again.

Thanks again

I'll scan a couple more times and see if anything shows up. Thanks for your help!!!!!! Getting back to your comment about one virus program. Is the Microsoft Security any good? My work wants me to...

Spybot doesn't find a problem, but the spybot running at the bottom of the page still shows the coolwwwsearch files still exist.

--- Search result list ---
CoolWWWSearch.Leftovers: [SBI $AD974E97] Autorun settings (sp) (Registry value, nothing done)
...

When I run spybot, coolwwwsearch. shows up on the bottom of the spybot box when the program is running, but it doesn't recognize the viruses.

ComboFix 12-06-19.03 - Dad 06/24/2012 12:29:56.5.2 - x64 MINIMAL
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3836.2520 [GMT -5:00]
Running from: c:\users\Dad\Desktop\ComboFix.exe...

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "sp.DLL" 6/23/2012 5:38:27 PM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this...

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.4.0
Run by Dad at 22:40:30 on 2012-06-22
Microsoft Windows 7 Home Premium ...

C:\ProgramData\Spybot - Search & Destroy\Recovery\CoolWWWSearchLeftovers10.zip Win32/Bagle.gen.zip worm
C:\ProgramData\Spybot - Search &...

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.4.0
Run by Dad at 18:20:53 on 2012-06-21
Microsoft Windows 7 Home Premium ...

The coolwwwsearch virus still shows up when I run Spybot.

ComboFix 12-06-19.03 - Dad 06/19/2012 18:02:51.4.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3836.2389 [GMT -5:00]
Running from: c:\users\Dad\Desktop\ComboFix.exe
Command...

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.4.0
Run by Dad at 10:20:38 on 2012-06-17
Microsoft Windows 7 Home Premium ...

ComboFix attached

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.4.0
Run by Dad at 11:38:47 on 2012-06-16
Microsoft Windows 7 Home Premium ...

I hope that is not against policy.

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.4.0
Run by Dad at 21:27:41 on 2012-06-15
Microsoft Windows 7 Home Premium ...

Before I had a chance to set a restore point my son used my computer and now the same crap is back on it!!!!!!!!!!!! Do you want to guide me back thru the process or just redo the steps we went...

Thanks for working your magic!! Do I need to delete the files I downloaded?

Craig

ComboFix 12-06-11.04 - Dad 06/11/2012 19:53:33.2.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3836.2201 [GMT -5:00]
Running from: c:\users\Dad\Desktop\ComboFix.exe
Command...

When I reboot a Run DLL box comes up and states:

There was a problem starting
c:\users\dad\AppData\Roaming\.#\sp.DLL

Thanks for your help.

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.4.0
Run by Dad at 16:45:05 on 2012-06-10
Microsoft Windows 7 Home Premium ...

I tried running ESET, but when the program tried to download the signature database, program said: Can not get update. Is proxy configured?

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by Dad at 16:13:34 on 2012-06-09
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3836.2246 [GMT -5:00]
....

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by Dad at 18:49:15 on 2012-06-06
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3836.1952 [GMT -5:00]
....

I have this virus that S&D found, but will not remove.

CoolWWWSearch.Leftovers: [SBI $AD974E97] Autorun settings (sp) (Registry value, nothing done)
...