Hijack This log file: Infected with "mediacodec"

It also appears that I have another virus/adware problem. Windows Defender keeps finding it, but won't get rid of it. It is titled something similar to: "click.spring.purityscan" Please help me resolve these two matters. Thanks! -Greg

Download and install AVG Anti-Spyware (ewido). Then scan and post the report here.
Instructions and download link can be found here.

Thank you for trying to help me out! I downloaded the AVG Anti-Spyware. I also went to the instructions page that you linked to. The first instruction says to update the software. I have been trying all morning to do that, but I keep getting the same message which says: "Error. Sorry, the server is not ready to serve." I have tried about 10 times over a 4 hour period and I keep getting the same message. Can I proceed without the update? What should be my next step?

Remove the program in add and remove programs and download it again.

Ok, that worked. Here is the Report results: ——————————————————— AVG Anti-Spyware - Scan Report ——————————————————— + Created at: 1:01:27 PM 3/8/2007 + Scan result: C:\Documents and Settings\Greg\Local Settings\Temp\__unin__.exe -> Adware.Altnet : Cleaned. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunWindowsUpdate -> Adware.BrowserAid : Cleaned. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunWindowsUpdate\Active -> Adware.BrowserAid : Cleaned. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Public Messenger ver 2.03 -> Adware.Generic : Cleaned. HKU\S-1-5-21-3141012616-3828071179-3455791352-1006\Software\Internet Security -> Adware.Generic : Cleaned. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Explorer Security Plugin 2006 -> Adware.IntCodec : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP876\A0071036.exe -> Adware.MediaTickets : Cleaned. C:\Documents and Settings\Greg\Local Settings\Temp\wh6s6Xxo.exe -> Adware.Midaddle : Cleaned. HKLM\SOFTWARE\Classes\SearchHelp -> Adware.MidAddle : Cleaned. HKLM\SOFTWARE\Classes\SearchHelp\CLSID -> Adware.MidAddle : Cleaned. HKLM\SOFTWARE\Classes\SearchHelp\CurVer -> Adware.MidAddle : Cleaned. C:\Documents and Settings\Greg\Local Settings\Temp\1J.exe -> Adware.Midadle : Cleaned. C:\Documents and Settings\Greg\Local Settings\Temp\9.dll -> Adware.Midadle : Cleaned. C:\Documents and Settings\Greg\Local Settings\Temp\AC.dll -> Adware.Midadle : Cleaned. C:\Documents and Settings\Greg\Local Settings\Temp\D5t3TLXy.exe -> Adware.Midadle : Cleaned. C:\Documents and Settings\Greg\Local Settings\Temp\En1ECNGw.dll -> Adware.Midadle : Cleaned. C:\Documents and Settings\Greg\Local Settings\Temp\Il.dll -> Adware.Midadle : Cleaned. C:\Documents and Settings\Greg\Local Settings\Temp\clicks.dll -> Adware.Midadle : Cleaned. C:\Documents and Settings\Greg\Local Settings\Temp\f.dll -> Adware.Midadle : Cleaned. C:\Documents and Settings\Greg\Local Settings\Temp\kPhlu.dll -> Adware.Midadle : Cleaned. C:\Documents and Settings\Greg\Local Settings\Temp\p2psetup.exe -> Adware.P2PNet : Cleaned. C:\Config.Msi\4db73ecc.rbf -> Adware.PurityScan : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP811\A0067841.dll -> Adware.PurityScan : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP811\A0067864.dll -> Adware.PurityScan : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP817\A0068214.dll -> Adware.PurityScan : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP817\A0068215.exe -> Adware.PurityScan : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP826\A0068618.dll -> Adware.PurityScan : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP831\A0068846.dll -> Adware.PurityScan : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP838\A0069279.exe -> Adware.PurityScan : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP839\A0069343.dll -> Adware.PurityScan : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP844\A0069585.exe -> Adware.PurityScan : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP848\A0069878.exe -> Adware.PurityScan : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP848\A0069883.dll -> Adware.PurityScan : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP851\A0070016.exe -> Adware.PurityScan : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP852\A0070125.exe -> Adware.PurityScan : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP852\A0070130.dll -> Adware.PurityScan : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP868\A0070842.dll -> Adware.PurityScan : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP872\A0070946.exe -> Adware.PurityScan : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP876\A0071034.exe -> Adware.PurityScan : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP876\A0071040.exe -> Adware.PurityScan : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP877\A0071122.dll -> Adware.PurityScan : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP878\A0071131.dll -> Adware.PurityScan : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP878\A0071132.exe -> Adware.PurityScan : Cleaned. C:\WINDOWS\SYSTEM32\bidz.dll -> Adware.PurityScan : Cleaned. C:\WINDOWS\SYSTEM32\fast.exe -> Adware.PurityScan : Cleaned. C:\WINDOWS\SYSTEM32\zcbckxe.dll -> Adware.PurityScan : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP867\A0070839.exe -> Adware.SpyHeal : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP851\A0070015.exe -> Adware.ValueAd : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP856\A0070448.exe -> Adware.ValueAd : Cleaned. C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\05MN4PYV\TBPS[1].cab/TBPS.exe -> Adware.WebSearch : Cleaned. C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\05MN4PYV\tb3[1].cab/toolbar.dll -> Adware.WebSearch : Cleaned. HKLM\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\res -> Adware.WebSearch : Cleaned. C:\Documents and Settings\Greg\Local Settings\Temp\~344568.tmp -> Adware.Wintol : Cleaned. C:\Documents and Settings\Greg\Local Settings\Temp\~347896.tmp -> Adware.Wintol : Cleaned. C:\Documents and Settings\Greg\Local Settings\Temp\~349871.tmp -> Adware.Wintol : Cleaned. C:\Documents and Settings\Greg\Local Settings\Temp\~371011.tmp -> Adware.Wintol : Cleaned. C:\Documents and Settings\Greg\Local Settings\Temp\~485277.tmp -> Adware.Wintol : Cleaned. C:\Documents and Settings\Greg\Local Settings\Temp\~588122.tmp -> Adware.Wintol : Cleaned. C:\Documents and Settings\Greg\Local Settings\Temp\~671297.tmp -> Adware.Wintol : Cleaned. C:\Documents and Settings\Greg\Local Settings\Temp\~743420.tmp -> Adware.Wintol : Cleaned. C:\Documents and Settings\Greg\Local Settings\Temp\~748615.tmp -> Adware.Wintol : Cleaned. C:\Documents and Settings\Greg\Local Settings\Temp\~759111.tmp -> Adware.Wintol : Cleaned. C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\OXEB0DQR\common[1].cab/common.dll -> Adware.Wintol : Cleaned. C:\WINDOWS\Temp\~351683.tmp -> Adware.Wintol : Cleaned. C:\WINDOWS\Temp\~351802.tmp -> Adware.Wintol : Cleaned. C:\WINDOWS\Downloaded Program Files\ParisVoyeur.exe -> Dialer.CDUpdater : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP876\A0071035.exe -> Downloader.PurityScan.be : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP876\A0071039.exe -> Downloader.Zlob.asv : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP869\A0070926.exe -> Downloader.Zlob.bov : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP869\A0070937.exe -> Downloader.Zlob.bov : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP872\A0070947.exe -> Downloader.Zlob.bov : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP872\A0070948.exe -> Downloader.Zlob.bov : Cleaned. C:\PROGRAMS\vncviewer.exe -> Not-A-Virus.RemoteAdmin.Win32.WinVNC.333 : Cleaned. C:\Documents and Settings\Greg\Cookies\greg@112.2o7[2].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Greg\Cookies\greg@2o7[2].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Greg\Cookies\greg@metacafe.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Greg\Cookies\greg@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Greg\Cookies\greg@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned. C:\Documents and Settings\Greg\Cookies\greg@adrevolver[3].txt -> TrackingCookie.Adrevolver : Cleaned. C:\Documents and Settings\Greg\Cookies\greg@advertising[2].txt -> TrackingCookie.Advertising : Cleaned. C:\Documents and Settings\Greg\Cookies\greg@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned. C:\Documents and Settings\Greg\Cookies\greg@bfast[2].txt -> TrackingCookie.Bfast : Cleaned. C:\Documents and Settings\Greg\Cookies\greg@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned. C:\Documents and Settings\Greg\Cookies\[removed][1].txt -> TrackingCookie.Burstnet : Cleaned. C:\Documents and Settings\Greg\Cookies\greg@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned. C:\Documents and Settings\Greg\Cookies\[removed][1].txt -> TrackingCookie.Coremetrics : Cleaned. C:\Documents and Settings\Greg\Cookies\greg@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned. C:\Documents and Settings\Greg\Cookies\[removed][1].txt -> TrackingCookie.Euroclick : Cleaned. C:\Documents and Settings\Greg\Cookies\[removed][1].txt -> TrackingCookie.Falkag : Cleaned. C:\Documents and Settings\Greg\Cookies\greg@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned. C:\Documents and Settings\Greg\Cookies\greg@mediaplex[2].txt -> TrackingCookie.Mediaplex : Cleaned. C:\Documents and Settings\Greg\Cookies\greg@overture[1].txt -> TrackingCookie.Overture : Cleaned. C:\Documents and Settings\Greg\Cookies\[removed][1].txt -> TrackingCookie.Overture : Cleaned. C:\Documents and Settings\Greg\Cookies\[removed][1].txt -> TrackingCookie.Pointroll : Cleaned. C:\Documents and Settings\Greg\Cookies\greg@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned. C:\Documents and Settings\Greg\Cookies\greg@realmedia[2].txt -> TrackingCookie.Realmedia : Cleaned. C:\Documents and Settings\Greg\Cookies\greg@revsci[1].txt -> TrackingCookie.Revsci : Cleaned. C:\Documents and Settings\Greg\Cookies\greg@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned. C:\Documents and Settings\Greg\Cookies\greg@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned. C:\Documents and Settings\Greg\Cookies\greg@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned. C:\Documents and Settings\Greg\Cookies\greg@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned. C:\Documents and Settings\Greg\Cookies\[removed][2].txt -> TrackingCookie.Valuead : Cleaned. C:\Documents and Settings\Greg\Cookies\[removed][1].txt -> TrackingCookie.Webtrendslive : Cleaned. C:\Documents and Settings\Greg\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned. C:\Documents and Settings\Greg\Cookies\greg@zedo[2].txt -> TrackingCookie.Zedo : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP809\A0067751.exe -> Trojan.Small : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP811\A0067866.exe -> Trojan.Small : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP817\A0068216.exe -> Trojan.Small : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP823\A0068432.exe -> Trojan.Small : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP831\A0068833.exe -> Trojan.Small : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP838\A0069284.exe -> Trojan.Small : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP846\A0069682.exe -> Trojan.Small : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP849\A0069925.exe -> Trojan.Small : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP851\A0070020.exe -> Trojan.Small : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP856\A0070449.exe -> Trojan.Small : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP876\A0071041.exe -> Trojan.Small : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP878\A0071135.exe -> Trojan.Small : Cleaned. C:\WINDOWS\SYSTEM32\wapisvcc.exe -> Trojan.Small : Cleaned. ::Report end

Can you run it again and see if anything reinstalled after it was deleted. Post the new log here.

Here is the new report: ——————————————————— AVG Anti-Spyware - Scan Report ——————————————————— + Created at: 9:38:45 AM 3/9/2007 + Scan result: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunWindowsUpdate -> Adware.BrowserAid : Cleaned. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunWindowsUpdate\Active -> Adware.BrowserAid : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP879\A0071160.rbf -> Adware.PurityScan : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP879\A0071161.dll -> Adware.PurityScan : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP879\A0071162.exe -> Adware.PurityScan : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP879\A0071163.dll -> Adware.PurityScan : Cleaned. C:\WINDOWS\SYSTEM32\WіnSxS\spool32.exe -> Adware.PurityScan : Cleaned. C:\WINDOWS\SYSTEM32\wtjbf.dll -> Adware.PurityScan : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP879\A0071164.exe -> Not-A-Virus.RemoteAdmin.Win32.WinVNC.333 : Cleaned. C:\Documents and Settings\Greg\Cookies\greg@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned. C:\Documents and Settings\Greg\Cookies\greg@revsci[2].txt -> TrackingCookie.Revsci : Cleaned. C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP879\A0071159.exe -> Trojan.Small : Cleaned. C:\WINDOWS\SYSTEM32\wapisvcc.exe -> Trojan.Small : Cleaned. ::Report end

Run this online scan and post the results here.

Also post a new hijackthis log.

Download SmitfraudFix (by S!Ri) to your Desktop.
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Extract all the files to your Destop. A folder named SmitfraudFix will be created on your Desktop.

[external image: Posted Image]

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press Enter

[external image: Posted Image]

This program will scan large amounts of files on your computer for known patterns so please be patient while it works.
It will create a file named: c:\rapport.txt
Please post the C:\rapport.txt in your next reply

IMPORTANT: Do NOT run any other options until you are asked to do so!

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

Here is the log file: SmitFraudFix v2.148 Scan done at 11:34:12.98, Tue 03/13/2007 Run from C:\Documents and Settings\Greg\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 C:\WINDOWS\system32\casino.ico FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Greg »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Greg\Application Data C:\Documents and Settings\Greg\Application Data\Install.dat FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» Start Menu C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url FOUND ! C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Greg\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{aed6f6a3-183c-488d-9f90-23db99f56e7f}"="apathies" »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"=" netdde.dll " »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32-huy32 »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End

Reboot your computer in Safe Mode. Instructions here if needed.

Open the SmitfraudFix Folder, then double-click smitfraudfix.cmd file to start the tool.
Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.

[external image: Posted Image]

The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Post that log along with all others requested in your next reply.

Run ATF Cleaner

Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware, and run a full scan.
IMPORTANT: Do not open any other windows or
programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess.

• Lauch AVG Anti-Spyware by double-clicking the icon on your desktop.
• Select the "Scanner" icon at the top and then the "Scan" tab
  then click on "Complete System Scan".
• ewido will now begin the scanning process, be patient this may take a little
  time.
  Once the scan is complete do the following:
• If you have any infections you will prompted, then select "Apply all
  actions"
• Next select the "Reports" icon at the top.
• Select the "Save report as" button in the lower left hand of the
  screen and save it as a text file on your Desktop (make sure to remember where you saved that file).

Close AVG Anti-Spyware and Reboot in Normal Mode.


Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #3 - Delete Trusted zone by typing 3 and press Enter
Answer Yes to the question "Restore Trusted Zone ?" by typing
Y and hit Enter.

Note, if you use SpywareBlaster and/or IE-SPYAD, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection.

Then post:
1.c:rapport.txt
2.AVG Anti-Spyware log
3.A new HijackThis log

Your may need several replies to post the requested logs, otherwise they might get cut off.

Rapport Log: SmitFraudFix v2.148 Scan done at 10:48:46.51, Wed 03/14/2007 Run from C:\Documents and Settings\Greg\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{aed6f6a3-183c-488d-9f90-23db99f56e7f}"="apathies" »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files C:\WINDOWS\system32\casino.ico Deleted C:\Documents and Settings\Greg\Application Data\Install.dat Deleted C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url Deleted C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url Deleted »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End