[Resolved] I Need some help

Hi guitargod345,

OK, lets get started getting this junk off your computer. It may take a couple of passes or more to get it all off.

First

Create a System Restore Point

• Click Start > Run
• Copy/Paste C:\Windows\System32\Restore\rstrui.exe into the Open: box.
• Click OK.
• This will open the System Restore window.
• Click on Create a Restore Point then click Next.
• Enter Restore from Reg Changes to the description box, then click Create.
• A new Restore Point will be created, click Close to exit.

Next

• Click Start > Run type Notepad click OK.
• This will open an empty Notepad file.
• Copy/Paste the contents of the box below into Notepad.

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=-
"NoResolveSearch"=-
"NoControlPanel"=-

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=-

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
"FirstRunDisabled"=-

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\winav.exe"=-

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\winav.exe"=-

• Click Format and ensure Wordwrap is unchecked.
• Save as RegFix.reg
• Save as file type All Files or it won't work.
• Now double click on RegFix.reg to run it.
• You will be prompted to allow it to merge with the Registry. Allow it please.

Then

Go to Control Panel > Add/Remove Programs and uninstall

Viewpoint Media Player

Now

Please download ATF Cleaner by Atribune and save it to your Desktop. (Do not run it yet)

Please download SmitfraudFix (by S!Ri) and extract it to your Desktop. (Do not run it yet)

Please download AVG Anti-Spyware.

• Install AVG Anti-Spyware.
• Launch AVG by double-clicking on the icon.
• The program will now open to the main screen.
• You will need to update AVG to the latest definition files.
• At the top of the main screen click Update.
• Then in the Manual Update section, click on Start Update.

[*]The update will start and a progress bar will show the updates being installed.

[*]When updates are completed, close AVG.

If you are having problems with the updater, you can use this link to manually update AVG.
AVG manual updates

Do not run a scan with AVG Anti-Spyware yet.

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Next, please boot your computer into Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, a menu with options should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
• Choose your usual account (as long as it is an account with Administrator privileges).

Once in Safe Mode

• Open the SmitfraudFix folder and double-click smitfraudfix.cmd
• Select option #2 - Clean by typing 2, then press Enter.
• You will be prompted with: Registry cleaning - Do you want to clean the registry?
• Type Y, then press Enter, to remove the Desktop background and clean infected registry keys.
• The tool will now check if wininet.dll is infected.
• You may be prompted to replace the infected file.
• If prompted, type Y, then press Enter.
• The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
• A text file will appear onscreen, with results from the cleaning process.
• Please copy/paste the content of that report into your next reply. The report can also be found at C:\rapport.txt

Warning : running option #2 on a non infected computer will remove your Desktop background.

Clean out your Temp files.

• 1st Ensure your Internet Browser is closed.
• Double click ATF-Cleaner.exe to run the program.
• Check the following boxes:
  • Windows Temp
  • Current User Temp
  • All Users Temp
  • Temporary Internet Files
  • Prefetch
  • Recycle Bin
  • Java Cache
• The rest are optional - if you want to remove the lot, check Select All.
• Now click Empty Selected.
• When you get the Done Cleaning message, click OK.

Run a scan with AVG Anti-Spyware

• Click on the Scanner button at the top.
• Select the Settings tab.
• Under How to act?, click on Recommended actions and select Quarantine.
• Under How to scan?, check (tick) all the boxes.
• Under Possibly unwanted software:, check (tick) all the boxes.
• Under Reports:, uncheck (untick) the Only if threats were found box and select Do not automatically generate report.
• Under What to scan?, select Scan every file.

Next

• Click on the Scanner button at the top.
• Select the Scan tab.
• Click on Complete System Scan to start the scan.
• When the scan has finished, follow the instructions below.
  IMPORTANT: Don't click on the Save Scan Report button before you hit the Apply all Actions button.
  • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
  • At the bottom of the window click on the Apply all Actions button. (3)
    [external image: Posted Image]
• When done, click the Save Scan Report button. (4)
  • Click the Save Report as button.
  • Save the report to your Desktop.
• Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
• Please send me the report please

Open the SmitfraudFix folder again

• Double-click smitfraudfix.cmd
• Select option #3 - Delete Trusted zone by typing 3, then press Enter.

(Note: If you use SpywareBlaster and/or IE-SPYAD, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection.)

Please post the following logs.

• c:\rapport.txt
• AVG log
• A new HijackThis log

Please post each log separately so they don't get cut off by the forum post size limiter.

Important Questions: Your logs show that you have Zone Alarm fitted, and that you also have Norton Internet Security installed. NIS comes with a firewall, which is shown as disabled, did you disable it?

Also Norton Internet Security is shown as outdated, is this a current and updated version of NIS you are using, if not it needs to be replaced with something with current definitions.

Please reply to these questions, so I can advise you appropriately.

SmitFraudFix v2.250 Scan done at 22:30:40.37, Thu 11/08/2007 Run from C:\Documents and Settings\Travis\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix S!Ri's WS2Fix: LSP not Found. »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files »»»»»»»»»»»»»»»»»»»»»»»» DNS HKLM\SYSTEM\CCS\Services\Tcpip\..\{49DAA6E4-938B-4426-9BD9-7C331C0E57D3}: DhcpNameServer=192.168.0.1 »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End

——————————————————— AVG Anti-Spyware - Scan Report ——————————————————— + Created at: 11:29:17 PM 11/8/2007 + Scan result: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP336\A0059820.exe -> Dropper.Small.avb : Cleaned with backup (quarantined). C:\Deckard\System Scanner\20071108142828\backup\DOCUME~1\Travis\LOCALS~1\Temp\Cookies\travis@networksolutions.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Deckard\System Scanner\20071108142828\backup\DOCUME~1\Travis\LOCALS~1\Temp\Cookies\travis@overture[1].txt -> TrackingCookie.Overture : Cleaned. ::Report end

Looking better, still some work to do.

Download OTMoveIt by OldTimer to your Desktop.

• Double click OTMoveIt.exe to launch it.
• Copy/Paste the contents of the box below into the left hand pane of OTMoveIt.

C:\WINDOWS\system32\ddccc.dll

• Click the Move It button.
• The list will be processed and the results will appear in the right hand pane.
• If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
• When finished click Exit to exit the programme.
• A log C:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log will be created (where mmddyyyy_hhmmss are numbers giving date and time the log was created).
• Post the log back here please.

Run a scan with HJT and when finished check the following items (if found).

R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)

O20 - Winlogon Notify: ddccc - C:\WINDOWS\system32\ddccc.dll (file missing)



Now close all open windows and click Fix Checked to remove them.

Next

• Click Start > Run and type cleanmgr then click OK.
• This will bring up the Disk Cleanup window.
• Check the following entries.
  • Temporary Internet Files.
  • Recycle Bin.
  • Temporary Files.
• Click OK.
• When a prompt pops up click Yes.

Then

Please do an online scan with Kaspersky Online Scanner

Note: You must be using Internet Explorer as your browser as it will be necessary to install an Active X component to your computer.

Important If you have previously used Kaspersky Online Scanner (before 8th Aug 2006), you will have to uninstall the old version using Add/Remove Programs in Control Panel before you can use the new version.

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then start to download the latest definition files.
• Once the scanner is installed and the definitions downloaded, click Next.
• Now click on Scan Settings.
• In the scan settings make sure that the following are selected:
  • Scan using the following Anti-Virus database:
    • Extended (If available otherwise Standard)
  • Scan Options:
    • Scan Archives
    • Scan Mail Bases
• Click OK.
• Now under select a target to scan select My Computer.
• The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
• Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

Note: The Kaspersky online scanner is not yet fully compatible with IE7. You may get returned to a window without the Accept/Decline buttons after allowing the ActiveX control. The buttons are there - you just can't see them! Click on the zoom button (bottom, right of the window) and change it from 100% to 75%. You should now see the buttons. Reset to 100% once the license has been accepted.

OK, if you're not using Norton/Symantec, you'd be better removing it from your computer, an AV with outdated definitions does not protect you at all.

The uninstaller that comes with the programme often does not do a particularly good job of removing all its components, so.

To uninstall Norton go to HERE and follow the directions appropriate to your version. If you're not bothered about re-installing it, it won't be necessary for you to get the product key information.

Once removed you'll need an alternate Anti-Virus programme installed, there's links to a couple of Freeware AVs below.

Anti-Virus
AVG
Anti-Vir

Now run a new HJT scan and send me the log please. (Even the upgraded Norton Uninstaller doesn't always get rid of Norton totally sometimes, so I need to see a log to ensure it's all gone).

Summary of the logs I need from you in your next post:

• OTMoveIt log
• Kaspersky log
• New HJT log

Please post each log separately to prevent them being cut off by the forum post size limiter.

Hello again Gary R. Here are the next set of logs. When OTmoveit finished running, a popup informed me that the report could not be generated. Here is what was in the pane on the right hand side. File/Folder C:\WINDOWS\system32\ddccc.dll not found. Created on 11/09/2007 14:49:37

——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Friday, November 09, 2007 2:46:59 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 9/11/2007 Kaspersky Anti-Virus database records: 455534 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ Scan Statistics: Total number of scanned objects: 59664 Number of viruses found: 6 Number of infected objects: 18 Number of suspicious objects: 0 Duration of the scan process: 01:10:34 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Confid.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Content.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Privacy.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Restrict.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\WebHist.log Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Travis\Application Data\GTek\GTUpdate\AUpdate\DellSupport\DSAgnt.log Object is locked skipped C:\Documents and Settings\Travis\Application Data\GTek\GTUpdate\AUpdate\DellSupport\DSAgnt_GTActions.log Object is locked skipped C:\Documents and Settings\Travis\Application Data\GTek\GTUpdate\AUpdate\DellSupport\gdql_d_DSAgnt.log Object is locked skipped C:\Documents and Settings\Travis\Application Data\GTek\GTUpdate\AUpdate\DellSupport\glog.log Object is locked skipped C:\Documents and Settings\Travis\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Travis\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\Travis\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Travis\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Travis\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Travis\Local Settings\History\History.IE5\MSHist012007110920071110\index.dat Object is locked skipped C:\Documents and Settings\Travis\Local Settings\Temp\~DF35C7.tmp Object is locked skipped C:\Documents and Settings\Travis\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Travis\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Travis\ntuser.dat.LOG Object is locked skipped C:\Program Files\Common Files\Symantec Shared\AntiSpam\Log\Spam.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\AVApp.log Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\AVError.log Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\AVVirus.log Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\Savrt\83NAV~.TMP Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\Savrt957NAV~.TMP Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP335\A0058843.exe Infected: Trojan.Win32.Qhost.vb skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP335\A0058844.exe Infected: Trojan.Win32.Qhost.vb skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP336\A0059827.exe Infected: Trojan.Win32.Qhost.ue skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP336\A0059828.exe Infected: Trojan.Win32.Qhost.ue skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP336\A0059829.exe Infected: Trojan.Win32.Qhost.ue skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP336\A0059840.exe Infected: Trojan.Win32.Qhost.ue skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP336\A0059841.exe Infected: Trojan.Win32.Qhost.ue skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP336\A0059842.exe Infected: Trojan.Win32.Qhost.ue skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP336\A0059843.dll Infected: Backdoor.Win32.Small.cls skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP336\A0059844.exe Infected: Trojan.Win32.Qhost.ue skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP336\A0060063.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP336\A0060063.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP336\A0060063.exe RarSFX: infected - 2 skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP336\A0060072.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP339\A0060555.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP339\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped C:\WINDOWS\Internet Logs\IVYS.ldb Object is locked skipped C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped C:\WINDOWS\porkaa.exe Infected: Trojan-Downloader.Win32.Tibs.pf skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\DEFAULT Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SYSTEM Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped C:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\ZLT076e8.TMP Object is locked skipped C:\WINDOWS\Temp\ZLT076eb.TMP Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped C:\WINDOWS\xlavba8.exe Infected: Trojan-Downloader.Win32.Wixud.i skipped Scan process completed.

Kaspersky has found a couple of items we need to get rid of.

• Double click OTMoveIt.exe to launch it.
• Copy/Paste the contents of the box below into the left hand pane of OTMoveIt.

C:\WINDOWS\porkaa.exe
C:\WINDOWS\xlavba8.exe

• Click the Move It button.
• The list will be processed and the results will appear in the right hand pane.
• If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
• When finished click Exit to exit the programme.
• A log C:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log will be created (where mmddyyyy_hhmmss are numbers giving date and time the log was created).
• Post the log back here please.

I don't see an Anti-Virus programme in your latest HJT log, it is essential that you install one. The Anti-Spyware programmes you have installed do not target the same type of infections, they are specifically designed to target Trojans, so will not protect you against viruses.

Please install an Anti-Virus programme as soon as possible. The links in my last post lead to two of the more popular Freeware programmes, either will give excellent protection. Only install 1 anti-virus programme, more than that will cause conflict problems giving less not more potection. AV programmes will not conflict with your Anti-Spyware programmes.

Please send me a new HJT log as well as the OTMoveIt log.

Hi there. Again, OTMoveIt did not generate a report other than that in the right hand pane. I have included those results. C:\WINDOWS\porkaa.exe moved successfully. C:\WINDOWS\xlavba8.exe moved successfully. Created on 11/09/2007 17:20:01