I Need Some Serious Help.

Go here and run online scans, allow them to delete whatever they find:

TrendMicro HouseCall
eTrust AntiVirus Web Scanner

Note any thing that can't be fixed
Reboot when done. Rescan with HJT and post a new log here.


Then Download the trial version of TDS-3
Install it, but do not launch it yet

Update it hereright click, select "save as"

Save it to the directory where you installed TDS-3, overwriting the previous radius.td3.

Then launch TDS-3. in the top bar of tds window click system testing> full system scan.
detections will appear in the lower pane of tds window. after the scan is finished ( it'll take a while )
right click the list> select save as txt. save it and post the contents of the scandump.txt here.

After posting the scandump go ahead and right click the list of detections again. this time select delete!
Only delete those with positive identification.

Follow the instruction HERE

Then post another log sorry for the double scans.

And here is the log of TDS-3: Scan Control Dumped @ 13:16:18 08-04-05 Positive identification: TrojanClicker.Win32.Spywad.b File: c:\windows\system32\edd.exe RegVal Trace: RAT.The Kill Trojan: HKEY_LOCAL_MACHINE File: SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Abj=C:\WINDOWS\System32\Atb.exe] RegVal Trace: Worm.P2P.Krypton: HKEY_LOCAL_MACHINE File: Software\Microsoft\Windows\CurrentVersion\Run [CMD=C:\WINDOWS\System32\Edd.exe] Positive identification: TrojanClicker.Win32.Spywad.b File: c:\windows\gng.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\windows\system32\edd.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\windows\system32\mvv.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\windows\system32\nst.exe Positive identification (embedded in file): Adware.WinAD.u (dll) File: c:\windows\backup\s\50306000.dat Positive identification (embedded in file): Adware.Sahat.k File: c:\windows\backup\s\50306000.dat Suspicious Filename: Dual extensions File: c:\documents and settings\administrator\desktop\programs\setupdvddecrypter_3.5.1.0.exe Suspicious Filename: Dual extensions File: c:\documents and settings\administrator\desktop\programs\bittorrent-3.4.2.exe Suspicious Filename: Dual extensions File: c:\documents and settings\administrator\desktop\programs\setupdvddecrypter_3.5.2.0.exe Positive identification: Riskware.ProcessRestart File: c:\program files\kodak\kodak software updater\7288971\6.3.2.62-7288971l\program\restart.exe Positive identification: Adware.BargainBuddy.n9 File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp99\a0046577.exe Positive identification: Adware.BargainBuddy.n2 File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp99\a0046578.exe Positive identification: Adware.BargainBuddy.n9 File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp105\a0058935.exe Positive identification: Adware.BargainBuddy.n2 File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp105\a0058936.exe Positive identification (DLL): Adware.WinAD.u (dll) File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp148\a0101848.dll Positive identification: Trojan.Win32.ShowAds File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0143785.exe Positive identification: TrojanDropper.Win32.Microjoin.u File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0143787.exe Positive identification: Trojan.Win32.ShowAds File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0143788.exe Positive identification: Adware.WinAD.k3 File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0143790.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144809.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144810.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144811.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144812.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144813.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144814.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144815.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144816.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144817.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144818.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144819.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144820.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144821.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144822.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144823.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144824.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144825.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144826.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144827.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144828.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144829.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144830.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144831.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144832.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144833.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144834.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144835.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144836.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144837.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144838.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144839.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144840.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144841.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144842.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144843.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144844.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144845.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144846.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144847.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144848.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144849.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144850.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144851.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144852.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144853.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144854.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144855.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144856.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144857.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144858.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144859.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144860.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144861.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144862.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144863.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144864.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144865.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144866.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144867.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144868.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144869.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144870.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144871.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144872.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144873.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144874.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144875.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144876.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144877.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144878.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144879.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144880.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144881.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144882.exe Positive identification: TrojanClicker.Win32.Spywad.b File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144883.exe Positive identification: RAT.Haxdoor.cn File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144887.exe Positive identification: RAT.Haxdoor.cn File: c:\system volume information\_restore{6a761cdd-0274-4fba-80f6-434dc6ee3137}\rp183\a0144898.exe

P ost a hijackthis log when done. doing good

Download the attached SpywadFix.zip file. written by Mosaic1
Unzip it to your Desktop
Open the SpywadFix folder
DOuble click on the fix.vbs file

If you Anti-Virus gives you warning, allow the file to run

These instructions are for this user

OK, thats done. I can now right click on my desktop, but IE still doesn't stay open for more than a second. Does that have anything to do with kaspersky?

Can you post another log from hijackthis.

Delete this one with hijackthis

O4 - HKLM\..\Run: [Upb] C:\WINDOWS\Qnp.exe
Then delete the file


To create a mergeable .reg file follow these simple instructions

1) Create a new file on your Desktop with Notepad
2) Copy the information with CTRL+C in the quote box
3) Paste the information into the Notepad file
4) You must hit the Enter Key to place an extra line at the end
5) Then save it with a descriptive name and the extension .reg
6) Double click to merge it into your registry. That's it.

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"
"CustomizeSearch"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="Search Bar"="http://search.msn.com/intl/searchpane/en-au/prov2.htm"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
""="http://home.microsoft.com/access/autosearch.asp?p=%s"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\main]
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://search.msn.com/spbasic.htm"
"Use Custom Search URL"= dword:00000000

[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix]
@="http://"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes]
"ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://"

OK, i did that, but IE still will not open. When I open it, I can see a small kaspersky icon in the right hand side of the lower bar. It then closes. Should I delete kaspersky? Is there a point in having Norton Anti-virus on my computer?