[Resolved] Ucleaner Help

Hi! Welcome to the WTT forums.
I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient and I'd be grateful if you would note the following:

• I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for this issue on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

Please make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.

Run Smitfraudfix
Open the SmitfraudFix folder again and double-click smitfraudfix.cmd
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Warning : running option #2 on a non infected computer will remove your Desktop background.

Download ATF (Atribune Temp File) Cleaner by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it.

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

*Note* If you do not have Firefox or Opera, those options will be greyed out.

• Please go HERE to run PandaActiveScan…
  
  
• Once you are on the Panda site click the Scan your PC button
  
• A new window will open…click the Check Now button
  
• Enter your Country
  
• Enter your State/Province
  
• Enter your e-mail address and click send
  
• Select either Home User or Company
  
• Click the big Scan Now button
  
• If it wants to install an ActiveX component allow it
  
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  
  
• When download is complete, click on My Computer to start the scan
  
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to your desktop.

thanks so much for your help, i'll go through your instructions……. here is the uninstall list……… AC3Filter (remove only) Adobe Flash Player ActiveX Adobe Reader 7.0 Adobe Shockwave Player AppCore Apple Software Update ATI - Software Uninstall Utility ATI Catalyst Control Center ATI Display Driver Audacity 1.2.6 AV BlueSoleil ccCommon Creatix V.92 Data Fax Modem DivX DivX Converter DivX Converter DivX Player DVB-T USB 2.0 EPSON PhotoQuicker3.4 EPSON PRINT Image Framer Tool2.1 FinePixViewer Ver.4.2 Flock (Photobucket Edition) 0.7 Football Manager 2006 FUJIFILM USB Driver Google Earth High Definition Audio Driver Package - KB888111 HijackThis 2.0.2 Hotfix for Windows Media Player 10 (KB903157) Hotfix for Windows XP (KB888795) Hotfix for Windows XP (KB891593) Hotfix for Windows XP (KB893357) Hotfix for Windows XP (KB895953) Hotfix for Windows XP (KB895961) Hotfix for Windows XP (KB896256) Hotfix for Windows XP (KB896344) Hotfix for Windows XP (KB899337) Hotfix for Windows XP (KB899510) Hotfix for Windows XP (KB902841) Hotfix for Windows XP (KB906569) Hotfix for Windows XP (KB910728) Hotfix for Windows XP (KB912024) Hotfix for Windows XP (KB914906) HP Document Viewer 5.3 HP Image Zone 5.3 HP Imaging Device Functions 5.3 HP PSC & OfficeJet 5.3.A HP Software Update HP Solution Center & Imaging Support Tools 5.3 ImageMixer VCD2 for FinePix iTunes J2SE Runtime Environment 5.0 Update 10 J2SE Runtime Environment 5.0 Update 11 J2SE Runtime Environment 5.0 Update 8 Java™ SE Runtime Environment 6 Update 1 LADSPA_plugins-win-0.4.15 LiveUpdate 3.2 (Symantec Corporation) LiveUpdate Notice (Symantec Corporation) Microsoft .NET Framework 1.0 Hotfix (KB887998) Microsoft .NET Framework 1.0 Hotfix (KB930494) Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft .NET Framework 2.0 Microsoft Base Smart Card Cryptographic Service Provider Package Microsoft Office FrontPage 2003 Microsoft Office Standard Edition 2003 Microsoft Works MSRedist MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) Nokia Connectivity Cable Driver Norton AntiVirus Norton Confidential Browser Component Norton Confidential Web Protection Component Norton Internet Security Norton Internet Security Norton Internet Security Norton Internet Security Norton Internet Security Norton Internet Security (Symantec Corporation) Norton Protection Center OCA Client history tool install Paint Shop Pro 7 ESD PartyPoker PIF DESIGNER2.1 Power2Go 4.0 PowerDVD QuickTime RAW FILE CONVERTER LE RealPlayer Roxio Burn Engine ScanToWeb Security Update for Microsoft .NET Framework 2.0 (KB928365) Security Update for Step By Step Interactive Training (KB898458) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 10 (KB911565) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 10 (KB936782) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows XP (KB883939) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB896688) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899588) Security Update for Windows XP (KB899589) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901190) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB903235) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB905915) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB911280) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911567) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913433) Security Update for Windows XP (KB913446) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB916281) Security Update for Windows XP (KB917159) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB918899) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920214) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921398) Security Update for Windows XP (KB921503) Security Update for Windows XP (KB921883) Security Update for Windows XP (KB922616) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923694) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925454) Security Update for Windows XP (KB925902) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928090) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) Security Update for Windows XP (KB929123) Security Update for Windows XP (KB929969) Security Update for Windows XP (KB930178) Security Update for Windows XP (KB931261) Security Update for Windows XP (KB931768) Security Update for Windows XP (KB931784) Security Update for Windows XP (KB932168) Security Update for Windows XP (KB933566) Security Update for Windows XP (KB935839) Security Update for Windows XP (KB935840) Security Update for Windows XP (KB936021) Security Update for Windows XP (KB937143) Security Update for Windows XP (KB938127) Security Update for Windows XP (KB938829) Sibelius v3.0 Sony Ericsson PC Suite SopCore 1.1.2 SPBBC 32bit SpyHunter SUPER © Version 2007.bld.23 (July 4, 2007) Symantec Real Time Storage Protection Component Symantec Technical Support Web Controls SymNet Update for Windows Media Player 10 (KB910393) Update for Windows Media Player 10 (KB913800) Update for Windows Media Player 10 (KB926251) Update for Windows XP (KB894391) Update for Windows XP (KB896727) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB900930) Update for Windows XP (KB904942) Update for Windows XP (KB908531) Update for Windows XP (KB910437) Update for Windows XP (KB912945) Update for Windows XP (KB916595) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB927891) Update for Windows XP (KB929338) Update for Windows XP (KB930916) Update for Windows XP (KB931836) Update for Windows XP (KB933360) Update for Windows XP (KB936357) Update for Windows XP (KB938828) Update Rollup 2 for Windows XP Media Center Edition 2005 VIA Platform Device Manager Video Piggy Windows Installer 3.1 (KB893803) Windows Installer 3.1 (KB893803) Windows Media Connect Windows Media Format Runtime Windows XP Hotfix - KB834707 Windows XP Hotfix - KB867282 Windows XP Hotfix - KB873333 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB885884 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890047 Windows XP Hotfix - KB890175 Windows XP Hotfix - KB890546 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB890923 Windows XP Hotfix - KB891220 Windows XP Hotfix - KB891781 Windows XP Hotfix - KB893066 Windows XP Hotfix - KB893086 Windows XP Hotfix - KB896178 Windows XP Media Center Edition 2005 KB908246 Windows XP Media Center Edition 2005 KB919803

here is rapport/txt……… SmitFraudFix v2.219 Scan done at 10:59:40.42, 05/09/2007 Run from C:\Documents and Settings\Ian Raisbeck\My Documents\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files C:\WINDOWS\main_uninstaller.exe Deleted C:\WINDOWS\mxduo.dll Deleted C:\WINDOWS\privacy_danger\ Deleted C:\WINDOWS\wmphost.dll Deleted C:\DOCUME~1\IANRAI~1\Desktop\Error Cleaner.url Deleted C:\DOCUME~1\IANRAI~1\Desktop\Privacy Protector.url Deleted C:\DOCUME~1\IANRAI~1\Desktop\Spyware?Malware Protection.url Deleted C:\DOCUME~1\IANRAI~1\FAVORI~1\Error Cleaner.url Deleted C:\DOCUME~1\IANRAI~1\FAVORI~1\Privacy Protector.url Deleted C:\Program Files\VideoAccessCodec\ Deleted »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: VIA Compatable Fast Ethernet Adapter - Packet Scheduler Miniport DNS Server Search Order: 192.168.1.254 DNS Server Search Order: 62.31.144.39 DNS Server Search Order: 195.188.53.175 HKLM\SYSTEM\CCS\Services\Tcpip\..\{C4CABB35-B6DB-4996-9135-4321BF9FB1F8}: DhcpNameServer=192.168.1.254 [removed] [removed] HKLM\SYSTEM\CS1\Services\Tcpip\..\{C4CABB35-B6DB-4996-9135-4321BF9FB1F8}: DhcpNameServer=192.168.1.254 [removed] [removed] HKLM\SYSTEM\CS2\Services\Tcpip\..\{C4CABB35-B6DB-4996-9135-4321BF9FB1F8}: DhcpNameServer=192.168.1.254 [removed] [removed] HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254 [removed] [removed] HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254 [removed] [removed] HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254 [removed] [removed] »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End

Just the Panda scan and a new HijackThis log now.

pandascan is currently underway, about 25% done and so far showing: Spyware 18 detected Hacking Tools and rootkits 2 detected

results of the pandascan: Incident Status Location Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Ian Raisbeck\Application Data\Flock\Browser\Profiles\7giex020.default\cookies.txt[.atdmt.com/] Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Ian Raisbeck\Application Data\Flock\Browser\Profiles\7giex020.default\cookies.txt[.adrevolver.com/] Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Ian Raisbeck\Application Data\Flock\Browser\Profiles\7giex020.default\cookies.txt[.adtech.de/] Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Ian Raisbeck\Application Data\Flock\Browser\Profiles\7giex020.default\cookies.txt[.zedo.com/] Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Ian Raisbeck\Application Data\Flock\Browser\Profiles\7giex020.default\cookies.txt[.statcounter.com/] Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Ian Raisbeck\Application Data\Flock\Browser\Profiles\7giex020.default\cookies.txt[.advertising.com/] Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Ian Raisbeck\Application Data\Flock\Browser\Profiles\7giex020.default\cookies.txt[.c5.zedo.com/] Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Ian Raisbeck\Application Data\Flock\Browser\Profiles\7giex020.default\cookies.txt[.fastclick.net/] Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Ian Raisbeck\Application Data\Flock\Browser\Profiles\7giex020.default\cookies.txt[.mediaplex.com/] Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Ian Raisbeck\Application Data\Flock\Browser\Profiles\7giex020.default\cookies.txt[.apmebf.com/] Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Ian Raisbeck\Application Data\Flock\Browser\Profiles\7giex020.default\cookies.txt[.serving-sys.com/] Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Ian Raisbeck\Application Data\Flock\Browser\Profiles\7giex020.default\cookies.txt[.tribalfusion.com/] Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Ian Raisbeck\Application Data\Flock\Browser\Profiles\7giex020.default\cookies.txt[.tradedoubler.com/] Spyware:Cookie/Adviva Not disinfected C:\Documents and Settings\Ian Raisbeck\Application Data\Flock\Browser\Profiles\7giex020.default\cookies.txt[.adviva.net/] Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Ian Raisbeck\Application Data\Flock\Browser\Profiles\7giex020.default\cookies.txt[.bs.serving-sys.com/] Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Ian Raisbeck\Application Data\Flock\Browser\Profiles\7giex020.default\cookies.txt[.2o7.net/] Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Ian Raisbeck\Application Data\Flock\Browser\Profiles\7giex020.default\cookies.txt[.questionmarket.com/] Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Ian Raisbeck\Application Data\Flock\Browser\Profiles\7giex020.default\cookies.txt[.doubleclick.net/] Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Ian Raisbeck\My Documents\SmitfraudFix\SmitfraudFix\Process.exe Potentially unwanted tool:Application/SuperFast Not disinfected C:\Documents and Settings\Ian Raisbeck\My Documents\SmitfraudFix\SmitfraudFix\restart.exe Spyware:Cookie/RealMedia Not disinfected C:\Program Files\Enigma Software Group\SpyHunter\Backup\ian raisbeck@247realmedia[1].txt.dat[Documents and Settings/Ian Raisbeck/Cookies/ian raisbeck@247realmedia[1].txt] Spyware:Cookie/2o7 Not disinfected C:\Program Files\Enigma Software Group\SpyHunter\Backup\ian raisbeck@2o7[2].txt.dat[Documents and Settings/Ian Raisbeck/Cookies/ian raisbeck@2o7[2].txt] Spyware:Cookie/Adrevolver Not disinfected C:\Program Files\Enigma Software Group\SpyHunter\Backup\ian raisbeck@adrevolver[1].txt.dat[Documents and Settings/Ian Raisbeck/Cookies/ian raisbeck@adrevolver[1].txt] Spyware:Cookie/Adrevolver Not disinfected C:\Program Files\Enigma Software Group\SpyHunter\Backup\ian raisbeck@adrevolver[2].txt.dat[Documents and Settings/Ian Raisbeck/Cookies/ian raisbeck@adrevolver[2].txt] Spyware:Cookie/Adtech Not disinfected C:\Program Files\Enigma Software Group\SpyHunter\Backup\ian raisbeck@adtech[2].txt.dat[Documents and Settings/Ian Raisbeck/Cookies/ian raisbeck@adtech[2].txt] Spyware:Cookie/Advertising Not disinfected C:\Program Files\Enigma Software Group\SpyHunter\Backup\ian raisbeck@advertising[1].txt.dat[Documents and Settings/Ian Raisbeck/Cookies/ian raisbeck@advertising[1].txt] Spyware:Cookie/Advertising Not disinfected C:\Program Files\Enigma Software Group\SpyHunter\Backup\ian raisbeck@advertising[2].txt.dat[Documents and Settings/Ian Raisbeck/Cookies/ian raisbeck@advertising[2].txt] Spyware:Cookie/Apmebf Not disinfected C:\Program Files\Enigma Software Group\SpyHunter\Backup\ian raisbeck@apmebf[1].txt.dat[Documents and Settings/Ian Raisbeck/Cookies/ian raisbeck@apmebf[1].txt] Spyware:Cookie/Atlas DMT Not disinfected C:\Program Files\Enigma Software Group\SpyHunter\Backup\ian raisbeck@atdmt[2].txt.dat[Documents and Settings/Ian Raisbeck/Cookies/ian raisbeck@atdmt[2].txt] Spyware:Cookie/Azjmp Not disinfected C:\Program Files\Enigma Software Group\SpyHunter\Backup\ian raisbeck@azjmp[1].txt.dat[Documents and Settings/Ian Raisbeck/Cookies/ian raisbeck@azjmp[1].txt] Spyware:Cookie/bravenetA Not disinfected C:\Program Files\Enigma Software Group\SpyHunter\Backup\ian raisbeck@bravenet[1].txt.dat[Documents and Settings/Ian Raisbeck/Cookies/ian raisbeck@bravenet[1].txt] Spyware:Cookie/Serving-sys Not disinfected C:\Program Files\Enigma Software Group\SpyHunter\Backup\ian [removed]-sys[1].txt.dat[Documents and Settings/Ian Raisbeck/Cookies/ian [removed]-sys[1].txt] Spyware:Cookie/Doubleclick Not disinfected C:\Program Files\Enigma Software Group\SpyHunter\Backup\ian raisbeck@doubleclick[1].txt.dat[Documents and Settings/Ian Raisbeck/Cookies/ian raisbeck@doubleclick[1].txt] Spyware:Cookie/Mediaplex Not disinfected C:\Program Files\Enigma Software Group\SpyHunter\Backup\ian raisbeck@mediaplex[1].txt.dat[Documents and Settings/Ian Raisbeck/Cookies/ian raisbeck@mediaplex[1].txt] Spyware:Cookie/QuestionMarket Not disinfected C:\Program Files\Enigma Software Group\SpyHunter\Backup\ian raisbeck@questionmarket[2].txt.dat[Documents and Settings/Ian Raisbeck/Cookies/ian raisbeck@questionmarket[2].txt] Spyware:Cookie/Serving-sys Not disinfected C:\Program Files\Enigma Software Group\SpyHunter\Backup\ian raisbeck@serving-sys[1].txt.dat[Documents and Settings/Ian Raisbeck/Cookies/ian raisbeck@serving-sys[1].txt] Spyware:Cookie/Statcounter Not disinfected C:\Program Files\Enigma Software Group\SpyHunter\Backup\ian raisbeck@statcounter[1].txt.dat[Documents and Settings/Ian Raisbeck/Cookies/ian raisbeck@statcounter[1].txt] Spyware:Cookie/Tradedoubler Not disinfected C:\Program Files\Enigma Software Group\SpyHunter\Backup\ian raisbeck@tradedoubler[1].txt.dat[Documents and Settings/Ian Raisbeck/Cookies/ian raisbeck@tradedoubler[1].txt] Spyware:Cookie/Tribalfusion Not disinfected C:\Program Files\Enigma Software Group\SpyHunter\Backup\ian raisbeck@tribalfusion[2].txt.dat[Documents and Settings/Ian Raisbeck/Cookies/ian raisbeck@tribalfusion[2].txt] Spyware:Cookie/Weborama Not disinfected C:\Program Files\Enigma Software Group\SpyHunter\Backup\ian raisbeck@weborama[1].txt.dat[Documents and Settings/Ian Raisbeck/Cookies/ian raisbeck@weborama[1].txt] Spyware:Cookie/Xiti Not disinfected C:\Program Files\Enigma Software Group\SpyHunter\Backup\ian raisbeck@xiti[1].txt.dat[Documents and Settings/Ian Raisbeck/Cookies/ian raisbeck@xiti[1].txt] Spyware:Cookie/Zedo Not disinfected C:\Program Files\Enigma Software Group\SpyHunter\Backup\ian raisbeck@zedo[1].txt.dat[Documents and Settings/Ian Raisbeck/Cookies/ian raisbeck@zedo[1].txt] Adware:Adware/VideoAccess Not disinfected C:\Program Files\Enigma Software Group\SpyHunter\Backup\Uninstall.exe.dat[Program Files/VideoAccessCodec/Uninstall.exe] Potentially unwanted tool:Application/Processor Not disinfected C:\RECYCLER\S-1-5-21-3675966129-272395341-609989957-1006\Dc7.zip[SmitfraudFix/Process.exe] Potentially unwanted tool:Application/SuperFast Not disinfected C:\RECYCLER\S-1-5-21-3675966129-272395341-609989957-1006\Dc7.zip[SmitfraudFix/restart.exe]

Download and Run ComboFix

• Download this file from below:
  
  Here
  
• Disconnect from the Internet, than disable your anti-virus and any real-time anti-spyware monitors that are running.
• Then double click combofix.exe & follow the prompts.
• When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.

Note 1: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Note 2:Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.

Hi

Open Notepad and Copy/Paste the text in the codebox below into it:

File::
C:\WINDOWS\msmdev.dll
C:\WINDOWS\msmhost.dll
C:\WINDOWS\nsduo.dll

Folder::
C:\Program Files\Enigma Software Group
C:\Program Files\VideoAccessCode

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{88418AA3-16F5-4FC2-A9D8-90B1266DF841}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyHunter"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"msmhost"=-
"msmdev"=-

Save this as "CFScript" to your Desktop.

[external image: Posted Image]


Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log with a new HijackThis log.

And the new HJT log? Tell me how things are now too.