Run this online scan Click HERE to run Panda's ActiveScan
You need to use IE to run this scan
Once you are on the Panda site click the Scan your PC button
A new window will open…click the Check Now button
Enter your Country
Enter your State/Province
Enter your e-mail address and click send
Select either Home User or Company
Click the big Scan Now button
If it wants to install an ActiveX component allow it
It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
When download is complete, click on My Computer to start the scan
When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report
In your next reply please post:
Panda ActiveScan report
new HijackThis log
Tomk,
Sigh, couldn't get there with either browser. Thanks loads for all you have done to help me this evening. I'm guessing ur headed that way and I will soon b also, so gnite and thanks again
newbe17
Your Java is out of date and you have other old versions still on your computer, those old versions are now a security vulnerability:
Please download JavaRa to your desktop and unzip it to its own folder
Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.
Open JavaRa.exe again and select Search For Updates.
Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer - Version 6 update 12
We need to repair some of windows' internal registration settings
Please download Dial-A-Fix from one of the following mirrors:
Hi Tomk,
I hope this day finds you doing well I think I made a mistake and downloaded the wrong version of java because when I try to install it , it tells me jre-6u12-windows-x64.exe is not a valid windows 32 application, to put it as closely as I can remember… So I'm currently downloading this version: jre-6u12-windows-i586-p.exe
Is it the correct one? pls let me know so I can stop this one and get the correct one, ty
newbe17
Tomk,
Do I need to download the Java installer for windows and mozilla firefox ? that is what a box on the page urged me to do, but I am leary - plus i lost my connection earlier and lost my download, ran the javara again to get back to the download link, started another download and all of a sudden they told me there was like 7 or 8 hourse before my download would b finished…. whats going on here?
newbe 17
Ignore the last set of instructions for now. I want you to run a different tool.
Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
Doubleclick the drweb-cureit.exe file and Allow to run the express scan
This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
Once the short scan has finished, mark the drives that you want to scan.
Select all drives. A red dot shows which drives have been chosen.
Click the green arrow at the right, and the scan will start.
Click Yes to all if it asks if you want to cure/move the file.
When the scan has finished, look if you can click next icon next to the files found:[external image: Posted Image]
If so, click it and then click the next icon right below and select Move incurable as you'll see in next image: [external image: Posted Image]
This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
Save the report to your desktop. The report will be called DrWeb.csv
Close Dr.Web Cureit.
Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
After reboot, post the contents of the log from Dr.Web you saved previously in your next reply.
The number of programs that won't run on your system right now is becoming annoying. This is beginning to sound like Virut. I need you to upload me a couple more files to either confirm or rule it out.
Please visit this site and follow the instructions for uploading the C:\WINDOWS\system32\userinit.exe file.
Also please upload the C:\WINDOWS\explorer.exe file also.
Tomk,
I finally found a site that would let me download DrWebCurlt (tucows.com or something like that, lol. It will finish downloading in about thirty minuts from now. I downloaded jxpinstall-6u12-fcs-bin-b04-windows-i586-17 it's a java installer, is that ok so far as java goes?
newbe17,
No. JXP is not the same as JRE. Leave it until I can figure something out about why stuff isn't working.
Please try to run ComboFix again (Worknow.com).
Tomk,
Good morning Dude… I'm running a DrCurit scan right now at this moment and it's found one object so far: KillWind.exe which is located in C:\hp\bin . Tried one last download of drcurit left my puter online and went to sleep and i guess it finally worked,lol. ill have the log 4 ya shortly
newbe17
I think I made a mistake and downloaded the wrong version of java because when I try to install it , it tells me jre-6u12-windows-x64.exe is not a valid windows 32 application, to put it as closely as I can remember… So I'm currently downloading this version: jre-6u12-windows-i586-p.exe
Is it the correct one? pls let me know so I can stop this one and get the correct one, ty 
newbe17
This is beginning to sound like Virut. I need you to upload me a couple more files to either confirm or rule it out.
Welcome to MY world, hehe… Remember what u told me? (b patient?)
The DrCurelt download didt work, so im gonna try another one, ok?
Newbe17 
newbe17