[trex1975]

I only located one folder with the title Mcafee[94]. Above it were two others related to Mcafee, one is named Mcafee and the other is Mcafee.com.

[Cookiegal]

The reason I asked is because the ComboFix log shows several files and/or folders that have numbers in brackets which normally means that they are being recreated rather than being overwritten.

Let's try another one for example:

c:\windows\system32\oleaccrc(482).dll

That file should exist but without any number in brackets. Do you have one without the numbers? Also, do you have several with various numbers like the one above?

[trex1975]

I have one with out numbers oleaccrc.dll
Others with numbers oleaccrc(447).dll
oleaccrc(482).dll

[Cookiegal]

Go to the link below and upload the following file(s) for analysis and post the results are please:

http://virusscan.jotti.org/

c:\windows\system32\oleaccrc.dll
c:\windows\system32\oleaccrc(482).dll
c:\windows\system32\oleaccrc(447).dll

[trex1975]

oleacc.dll Status: Scan finished. 0 out of 21 scanners reported malware.
Scan taken on: Wed 18 Nov 2009 12:17:23 (CET) Permalink
File size: 215040 bytes Filetype: PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit MD5: 97ca916976b4eaed3fd35c238f42bcd9 SHA1: 1ed9e07ef29286deb490eab200d1c0a8eda26b02
this same message appears for all the files. I did find 2 others with numbers behind them -446 and 481, in addition to 482 and 447.

[Cookiegal]

I don't know why it says "no result available" as opposed to "nothing found".

Can you post the link to the results for the other files as well? I would like to see the other information that shows, particularly the MD5.

[trex1975]

File size: 4096 bytes Filetype: PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit MD5: 3551474b2db6312db6df56140a68df6e SHA1: 2c01e6c2d66fe84052ef843053ddcd1f7f1754d1
c:\windows\system32\olearrc.dll (447)

[trex1975]

File size: 4096 bytes Filetype: PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit MD5: 3551474b2db6312db6df56140a68df6e SHA1: 2c01e6c2d66fe84052ef843053ddcd1f7f1754d1
c:\windows\system32\oleacc.dll(487)

[trex1975]

File size: 215040 bytes Filetype: PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit MD5: 97ca916976b4eaed3fd35c238f42bcd9 SHA1: 1ed9e07ef29286deb490eab200d1c0a8eda26b02
c:\windows\system32\oleacc.dll

[Cookiegal]

Those file name are not the same as the one I asked about. Note the different spellings. In your ComboFix log I see:

c:\windows\system32\oleaccrc(482).dll
c:\windows\system32\oleaccrc(447).dll


c:\windows\system32\oleacc(481).dll
c:\windows\system32\oleacc(446).dll

And in each case there should be one without any numbers.

Please scan all of these files, including the ones without the numbers and post those results including the MD5.

[trex1975]

c:\windows\system32\oleaccrc(447).dll


4096 bytes Filetype: PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit MD5: 3551474b2db6312db6df56140a68df6e SHA1: 2c01e6c2d66fe84052ef843053ddcd1f7f1754d1

[trex1975]

c:\windows\system32\oleaccrc.dll

File size: 4096 bytes Filetype: PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit MD5: 3551474b2db6312db6df56140a68df6e SHA1: 2c01e6c2d66fe84052ef843053ddcd1f7f1754d1

[trex1975]

c:\windows\system32\oleacc(481).dll



File size: 234496 bytes Filetype: PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit MD5: 2ed5c3a4cbc59d19881164f697cf960d SHA1: 8c734273ff358780a47c933190aa8b11a415ff98

[trex1975]

The previous were the only files found. I did not locate any with the number 446 behind it.

[Cookiegal]

Please remove ComboFix by dragging it to the recycle bin and then download a fresh copy.

Please visit Combofix Guide & Instructions for instructions for downloading and running ComboFix.

The only thing different from the instructions there is that when downloading and saving the ComboFix.exe I would like you to rename it to puppy.exe please. Be sure to disable all security programs and close all browser windows when scanning.