Viruses downloading loads - internet usage charges spiralling. Plz hel

_________________________________
Welcome to the Forums.

The fixes we will use are specific to your problems and should only be used for this issue on this machine.

Please only use this topic to reply to. Do not start another thread.
If any other issues arise let me know.
The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear. So lets do this to the end!
Please if you decide to seek help at another forum let us know. There is a shortage of helpers and tying 2 of us up is a waste of time.
If you have any questions about any advice given here please STOP and ask!

I will be back as soon as I can.

Thanks Waiting for instructions Im only using coyote forums.

Please disable SpybotSD TeaTimer, as it may hinder the removal of the infection. You can enable it after you're clean.
To disable SpybotSD TeaTimer:
Open Spybot and click on Mode and check Advanced Mode
Check yes to next window.
Click on Tools in bottom left hand corner.
Click on System Startup icon.
Uncheck Teatimer box.
Click Allow Change box.



______________________________
HJT
Run hijackthis and choose scan only and place a check by the following lines if present.
Close all other windows and browsers except HJT before clicking on Fix Checked

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE


___________________________________
Reconfigure Windows XP to show hidden files::

Click Start. My Computer.
Select the Tools menu Folder Options. Select the View Tab.
Under the Hidden files and folders heading select "Show hidden files and folders".
Uncheck the "Hide protected operating system files (recommended)" option.
Uncheck the "Hide file extensions for known file types" option.
Click Yes to confirm. Click OK.
___________________________________
Search for and remove
Now I want you to search for and delete the following folder and all it's contents if present. If you need help finding them.
Click start /search/ all files and folders/ look for More advanced options. once in there select the first 3 boxes.
Please just remove the files/folders I listed in BOLD

c:/windows/ ALCMTR.EXE



_________________________________
Please do an online scan with Kaspersky Online Scanner
Click on Kaspersky Online Scanner
You will be promted to install an ActiveX component from Kaspersky, Click Yes.
The program will launch and then start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings
In the scan settings make sure that the following are selected:
Scan using the following Anti-Virus database:

Extended (If available otherwise Standard)
Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan select My Computer

The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.

Now click on the Save as Text button:

Save the file to your desktop.

Copy and paste that information in your next post.

Hi The report for the scan is Saturday, December 09, 2006 3:07:55 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 9/12/2006 Kaspersky Anti-Virus database records: 253597 Scan Settings Scan using the following antivirus database extended Scan Archives true Scan Mail Bases true Scan Target My Computer A:\ C:\ D:\ E:\ F:\ G:\ Scan Statistics Total number of scanned objects 71244 Number of viruses found 3 Number of infected objects 122 / 0 Number of suspicious objects 0 Duration of the scan process 00:58:30 Infected Object Name Virus Name Last Action C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\00D40000\45F497F0.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\00D40000\45F497F0.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\00D40000\45F497F0.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01780000\45790E6C.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01780000\45790E6C.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01780000\45790E6C.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01780001\45790F00.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01780001\45790F00.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01780001\45790F00.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01780002\4579553B.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01780002\4579553B.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01780002\4579553B.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01780003\457958FE.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01780003\457958FE.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01780003\457958FE.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01A00000\45E0B600.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01A00000\45E0B600.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\01A00000\45E0B600.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04FC0000\45FFBE7B.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04FC0000\45FFBE7B.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04FC0000\45FFBE7B.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04FC0001\45FFBE8F.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04FC0001\45FFBE8F.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04FC0001\45FFBE8F.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04FC0002\45FFBEA1.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04FC0002\45FFBEA1.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04FC0002\45FFBEA1.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04FC0003\45FFBEB4.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04FC0003\45FFBEB4.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04FC0003\45FFBEB4.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05180000\455DFDAD.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05180000\455DFDAD.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05180000\455DFDAD.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05180001\455E1B97.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05180001\455E1B97.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05180001\455E1B97.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05580002\457FAF43.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05580002\457FAF43.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05580002\457FAF43.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05580003\457FAF5A.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05580003\457FAF5A.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05580003\457FAF5A.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05580004\457FAF6F.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05580004\457FAF6F.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05580004\457FAF6F.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05580005\457FAF86.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05580005\457FAF86.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\05580005\457FAF86.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07300000\47775898.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07300000\47775898.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07300000\47775898.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07300001\477758AF.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07300001\477758AF.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07300001\477758AF.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07300002\477758BC.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07300002\477758BC.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07300002\477758BC.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07300003\477758C8.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07300003\477758C8.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07300003\477758C8.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08AC0000\4DAC0D4A.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08AC0000\4DAC0D4A.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08AC0000\4DAC0D4A.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08CC0000.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08CC0000.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08CC0000.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08DC0000.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08DC0000.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08DC0000.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08F40000\4DF433F7.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08F40000\4DF433F7.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08F40000\4DF433F7.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0B380000.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0B380000.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0B380000.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0BFC0000\4FFEFDF8.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0BFC0000\4FFEFDF8.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0BFC0000\4FFEFDF8.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40000\4CEF485A.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40000\4CEF485A.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40000\4CEF485A.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40001\4CEF486C.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40001\4CEF486C.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40001\4CEF486C.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40002\4CEF487D.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40002\4CEF487D.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40002\4CEF487D.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40003\4CEF4881.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40003\4CEF4881.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40003\4CEF4881.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40004\4CEF4886.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40004\4CEF4886.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40004\4CEF4886.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40005\4CEF488A.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40005\4CEF488A.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40005\4CEF488A.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40006\4CEF4894.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40006\4CEF4894.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40006\4CEF4894.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40007\4CEF4898.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40007\4CEF4898.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40007\4CEF4898.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40008\4CEF48A5.VBN/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40008\4CEF48A5.VBN Embedded: infected - 1 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CE40008\4CEF48A5.VBN CryptZ: infected - 1 skipped C:\Documents and Settings\Happy Dog\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Happy Dog\Desktop\Ajay\Downloads\avgas-setup-7.5.0.50.exe/stream/data0292 Infected: Trojan-Downloader.Win32.Agent.bcw skipped C:\Documents and Settings\Happy Dog\Desktop\Ajay\Downloads\avgas-setup-7.5.0.50.exe/stream Infected: Trojan-Downloader.Win32.Agent.bcw skipped C:\Documents and Settings\Happy Dog\Desktop\Ajay\Downloads\avgas-setup-7.5.0.50.exe NSIS: infected - 2 skipped C:\Documents and Settings\Happy Dog\Desktop\Ajay\FR\Frank SE Bill.zip/Frank SE Bill/Bank CA Cert Sony.doc/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\Happy Dog\Desktop\Ajay\FR\Frank SE Bill.zip/Frank SE Bill/Bank CA Cert Sony.doc Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\Happy Dog\Desktop\Ajay\FR\Frank SE Bill.zip/Frank SE Bill/Bank Rem Sony.doc/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\Happy Dog\Desktop\Ajay\FR\Frank SE Bill.zip/Frank SE Bill/Bank Rem Sony.doc Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\Happy Dog\Desktop\Ajay\FR\Frank SE Bill.zip/Frank SE Bill/CA Rem Sony.doc/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\Happy Dog\Desktop\Ajay\FR\Frank SE Bill.zip/Frank SE Bill/CA Rem Sony.doc Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\Happy Dog\Desktop\Ajay\FR\Frank SE Bill.zip/Frank SE Bill/Happy Dog FORM A2 Sony.doc/ThisDocument Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\Happy Dog\Desktop\Ajay\FR\Frank SE Bill.zip/Frank SE Bill/Happy Dog FORM A2 Sony.doc Infected: Virus.MSWord.Marker.kl skipped C:\Documents and Settings\Happy Dog\Desktop\Ajay\FR\Frank SE Bill.zip ZIP: infected - 8 skipped C:\Documents and Settings\Happy Dog\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Happy Dog\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Happy Dog\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Happy Dog\Local Settings\History\History.IE5\MSHist012006120920061210\index.dat Object is locked skipped C:\Documents and Settings\Happy Dog\Local Settings\Temp\Free Download Manager\tic30.tmp Object is locked skipped C:\Documents and Settings\Happy Dog\Local Settings\Temp\Free Download Manager\tic36.tmp Object is locked skipped C:\Documents and Settings\Happy Dog\Local Settings\Temp\Free Download Manager\tic37.tmp Object is locked skipped C:\Documents and Settings\Happy Dog\Local Settings\Temp\hpodvd09.log Object is locked skipped C:\Documents and Settings\Happy Dog\Local Settings\Temp\~DF3B75.tmp Object is locked skipped C:\Documents and Settings\Happy Dog\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Happy Dog\My Documents\My Music\iTunes\iTunes Library.itl Object is locked skipped C:\Documents and Settings\Happy Dog\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Happy Dog\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe/stream/data0006 Infected: Trojan-Downloader.Win32.Agent.bcw skipped C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe/stream Infected: Trojan-Downloader.Win32.Agent.bcw skipped C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe NSIS: infected - 2 skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\BWKDLogs\BWTargetInf.log Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\chandir.dat Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\chandir.idx Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\chn.dat Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\chn.idx Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\D0000000.FCS Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\inuse.txt Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\L0000016.FCS Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\main.log Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs.dat Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs.idx Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_die.dat Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_die.idx Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_dnd.dat Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_dnd.idx Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_ext.dat Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_ext.idx Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_rcv.dat Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_rcv.idx Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\storydb.dat Object is locked skipped C:\Program Files\Kodak\KODAK Software Updater\7288971\Users\Default\Data\storydb.idx Object is locked skipped C:\Program Files\Symantec AntiVirus\SAVRT\0076NAV~.TMP Object is locked skipped C:\Program Files\Symantec AntiVirus\SAVRT\0735NAV~.TMP Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{85E1D03A-A684-4D97-AD5B-9C49F076514C}\RP219\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{8F19EBFC-6B87-489C-9D07-65D32FE92E07}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped D:\System Volume Information\_restore{85E1D03A-A684-4D97-AD5B-9C49F076514C}\RP219\change.log Object is locked skipped D:\System Volume Information\_restore{A5C851F8-F7CB-483B-9BB3-8DEEE6549947}\RP2\A0000025.exe/DAP.exe Infected: not-a-virus:AdWare.Win32.Dap.a skipped D:\System Volume Information\_restore{A5C851F8-F7CB-483B-9BB3-8DEEE6549947}\RP2\A0000025.exe ZIP: infected - 1 skipped E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped E:\System Volume Information\_restore{85E1D03A-A684-4D97-AD5B-9C49F076514C}\RP219\change.log Object is locked skipped Scan process completed. THanks

open CCleaner
click on tools
highlight uninstall

down on the bottom click save to text file.
Save it to your desktop and post
the contents
of that log for me.

Do you or anyone using this computer play online games? What games ?

I am still going through the logs be back as soon as I can.

Hi yes…Miniclip games occasionally. 3ivx D4 4.5.1 (remove only) Ad-Aware SE Personal Adobe MPEG Encoder Adobe Photoshop CS Adobe Premiere 6.5 Adobe Reader 7.0 Advanced RealMedia Export Plug-in for Premiere 6.0 AngelPotion Video Codec V1 ArcSoft PhotoBase 3 ArcSoft PhotoStudio 5 ARES ATI Display Driver AVG Anti-Spyware 7.5 AviSynth 2.5 BufferChm BulletProof FTP Canon CanoScan Toolbox 4.1 CardRd81 CCleaner (remove only) CCScore ConvertMovie 4.1 CorelDRAW Graphics Suite 12 CR2 CustomerResearchQFolder D2300_Help D2300 DeviceManagementQFolder Disc2Phone ESSBrwr ESSCDBK ESScore ESSgui ESShelp ESSini ESSPCD ESSPDock ESSSONIC ESSTOOLS essvatgt essvcpt eSupportQFolder Free Download Manager 2.1 FTP Explorer Google Toolbar for Internet Explorer High Definition Audio Driver Package - KB888111 HijackThis 1.99.1 HLPPDOCK HP Customer Participation Program 7.0 HP Imaging Device Functions 7.0 HP Photosmart and Deskjet 7.0 Software HP Photosmart Essential HP Software Update HP Solution Center 7.0 hph_ProductContext hph_readme hph_software_req hph_software HPPhotoSmartExpress HPProductAssistant HPSU306Stub Indeo® software iTunes J2SE Runtime Environment 5.0 Update 6 Kaspersky Online Scanner kgcbase Kodak EasyShare software KSU LG USB Modem driver LimeWire 4.12.6 LiveUpdate 2.6 (Symantec Corporation) Macromedia Flash Player 8 MarketResearch Microsoft .NET Framework 1.1 Hotfix (KB886903) Microsoft .NET Framework 1.1 Microsoft Office Professional Edition 2003 MSN Messenger 7.5 MSN MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 Parser and SDK M²Convert Pro Nero Suite Notifier OfotoXMI OmniPage SE OTtBPSDK OTtBP Panda ActiveScan Post-it® Software Notes Lite PowerDVD PPP over Ethernet Protocol 0.98 Puma Video To MOV Converter 2.32 QuickTime REALTEK Gigabit and Fast Ethernet NIC Driver Realtek High Definition Audio Driver Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 10 (KB911565) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899589) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB905915) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB908531) Security Update for Windows XP (KB911280) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911567) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912812) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913446) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB916281) Security Update for Windows XP (KB917159) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB918899) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920214) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921398) Security Update for Windows XP (KB921883) Security Update for Windows XP (KB922616) Security Update for Windows XP (KB922760) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB925486) SFR2 SFR SHASTA SKIN0001 SKINXSDK Skype 2.5 SmartSound Quicktracks Plugin SolutionCenter Sony Ericsson PC Suite SoulSeek Client 156c Spybot - Search & Destroy 1.4 staticcr Status Symantec AntiVirus TC Native Essentials 2.02 Toolbox TrayApp Ulead VideoStudio 8.0 Unload Update for Windows XP (KB894391) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB910437) Update for Windows XP (KB916595) Update for Windows XP (KB920872) Update for Windows XP (KB922582) VPRINTOL WebFldrs XP WebReg Windows Genuine Advantage Notifications (KB905474) Windows Installer 3.1 (KB893803) Windows Media Encoder 9 Series Windows Media Format Runtime Windows Media Player 10 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891781 WinRAR archiver WinZip WIRELESS YOUConnect 3.0.2 Thanks

Ok unforgiven you have a bit of work to do.

go to this site download and run this tool to be sure ist bar is gone.


Next
___________________________________
Reconfigure Windows XP to show hidden files::

Click Start. My Computer.
Select the Tools menu Folder Options. Select the View Tab.
Under the Hidden files and folders heading select "Show hidden files and folders".
Uncheck the "Hide protected operating system files (recommended)" option.
Uncheck the "Hide file extensions for known file types" option.
Click Yes to confirm. Click OK.

create a new txt document on your desk top and copy the following into it and just click file/save No ned to close it you'll be looking at it for a while.

LDecH2643.dll
LFDCR14n.dll
LDecAACKrn.dll
LENCMPG2P2.dll
LTStlImgWrt.dll
LEncH264P2.dll
LtDicWrt2.dll
LCMW3.dll
LMJ2K2.dll
H263Decoder2.dll
LMVVOvLy2.dll
LCODC26D2.dll
LCODCCMW3.dll
LMAVUMeter.dll
LMVUsMsk2.dll
LCODCJ2K2.dll
LMAMpgCnv.dll
LMVAutoInt.dll
LMVAutoCont.dll
LEncAC3Krn.dll
lcodc26x2.dll
LEncH264Krn2.dll
LDecMPG4Krn.dll
H263Encoder2.dll

With the following list you will have to navigate to c:/windows/system32.
Once there you will have to look at each of these files .
This is how to do it.

open c:/windows/system32 folder. click search at the top choose all files and folders
now one at a time copy from the list you made and paste it in to the seach box. The file will show up.


Right click on it.
choose
properties/version
Once there you will see the company name ..You will be able to copy and paste the name down the name down. Copy the name of the company that made the file and paste it next to the file name in the list.

then click back in the search window and copy and paste the next one in there.

Once done post that for me .You will find that many of them are from the same company. But I have to be sure.


In your next reply I would like to see:

• A new hjt log
• the txt document from the system 32 folder
• let me know if things are running any better

So you think downloading has gone down since we started ?

Try this for wpfind.

Please download WinPFind2.

• Extract the files to a folder(eg: C:\WinPFind2).
• Double click WinPFind2.exe to start the program.
• Click the Select All button in the File Options box of the Configuration tab(this is the tab the program opens up to by default).
• Click the Run all Scans button.
• When its finished scanning you will see Scans Complete! at the bottom left of the program.
• Click the Export to Text button.
• Notepad will open with the results of the scan and the log will be saved to the folder that you extracted the program to(C:\WinPFind2\WinPFind2.txt)
• Post the log in your next reply please. You may need to split the log over a couple posts so that it doesn't get cut off. If so please use the [Start Post #1] and [Start Post #2] deliminators in the log to split the log up.

Please post the contents of that log for me.

Still with me Unforgiven ?