[Resolved] Infected with Worm.Alcra.F and other nasties

Hi EAGLE,

Your doing well

NEXT:
Open notepad and copy and paste next present in the quote box below in it:

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\swearware]

Save this as fix.reg Choose to save as all files and place it on your desktop.

Doubleclick on it and when it asks you if you want to merge the contents to the registry, click yes.

after this reboot and tell me how PC is behaving
good luck mschroe919

Hi mschroe919 I have performed the latest instructions. Unfortunately the Application.NirCmd still appears. Pse see the log below : PC Tools Spyware Doctor Date Status 05/03/2008 19:29:47:359 Immuniser Results ActiveX section has been immunised. No items were processed. 05/03/2008 19:31:39:531 Scan Started Scan Type - Intelli-Scan 05/03/2008 19:32:26:265 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SOFTWARE\swearware, combofix_wow 05/03/2008 19:32:26:281 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SOFTWARE\swearware, Runs 05/03/2008 19:32:26:281 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SOFTWARE\swearware, snapshot 05/03/2008 19:32:26:296 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SOFTWARE\swearware 05/03/2008 19:32:26:328 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME, NextInstance 05/03/2008 19:32:26:343 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME\0000, Service 05/03/2008 19:32:26:343 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME\0000, Legacy 05/03/2008 19:32:26:343 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME\0000, ConfigFlags 05/03/2008 19:32:26:343 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME\0000, Class 05/03/2008 19:32:26:343 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME\0000, ClassGUID 05/03/2008 19:32:26:343 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME\0000, DeviceDesc 05/03/2008 19:32:26:359 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME\0000, Capabilities 05/03/2008 19:32:26:359 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME\0000, Driver 05/03/2008 19:32:26:359 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME\0000\LogConf 05/03/2008 19:32:26:359 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME\0000\Control 05/03/2008 19:32:26:359 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME\0000 05/03/2008 19:32:26:359 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME 05/03/2008 19:32:26:406 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\catchme, Type 05/03/2008 19:32:26:406 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\catchme, ErrorControl 05/03/2008 19:32:26:406 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\catchme, Start 05/03/2008 19:32:26:406 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\catchme, ImagePath 05/03/2008 19:32:26:406 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\catchme, Group 05/03/2008 19:32:26:406 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\catchme\Enum, 0 05/03/2008 19:32:26:421 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\catchme\Enum, Count 05/03/2008 19:32:26:421 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\catchme\Enum, NextInstance 05/03/2008 19:32:26:421 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\catchme\Enum 05/03/2008 19:32:26:421 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\catchme 05/03/2008 19:32:28:187 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile, (Default) 05/03/2008 19:32:28:187 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shell\open, EditFlags 05/03/2008 19:32:28:187 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shell\open\command, (Default) 05/03/2008 19:32:28:187 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shell\open\command 05/03/2008 19:32:28:187 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shell\open 05/03/2008 19:32:28:187 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shell 05/03/2008 19:32:28:187 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shellex\DropHandler, (Default) 05/03/2008 19:32:28:187 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shellex\DropHandler 05/03/2008 19:32:28:203 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shellex\PropertySheetHandlers\PifProps, (Default) 05/03/2008 19:32:28:203 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shellex\PropertySheetHandlers\PifProps 05/03/2008 19:32:28:203 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shellex\PropertySheetHandlers\ShimLayer Property Page, (Default) 05/03/2008 19:32:28:203 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shellex\PropertySheetHandlers\ShimLayer Property Page 05/03/2008 19:32:28:203 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}, (Default) 05/03/2008 19:32:28:234 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 05/03/2008 19:32:28:234 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shellex\PropertySheetHandlers 05/03/2008 19:32:28:234 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shellex 05/03/2008 19:32:28:250 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile 05/03/2008 19:34:27:921 Scan Finished Scan Type - Intelli-Scan Items Processed - 159624 Threats Detected - 1 Infections Detected - 44 Infections Ignored - 0 05/03/2008 19:56:28:734 OnGuard Detection Cleaned Threat Name - Application.TrackingCookies Type - Cookie Risk Level - Low Infection - adecn.com/ adecn.com 05/03/2008 20:02:34:31 OnGuard Detection Cleaned Threat Name - Application.TrackingCookies Type - Cookie Risk Level - Low Infection - adecn.com/ adecn.com 05/03/2008 20:04:54:843 OnGuard Detection Cleaned Threat Name - Application.TrackingCookies Type - Cookie Risk Level - Low Infection - adecn.com/ adecn.com 05/03/2008 20:06:18:218 OnGuard Detection Cleaned Threat Name - Application.TrackingCookies Type - Cookie Risk Level - Low Infection - adecn.com/ adecn.com 05/03/2008 20:10:49:656 OnGuard Detection Cleaned Threat Name - Application.TrackingCookies Type - Cookie Risk Level - Low Infection - adecn.com/ adecn.com 05/03/2008 20:11:41:390 OnGuard Detection Cleaned Threat Name - Application.TrackingCookies Type - Cookie Risk Level - Low Infection - adecn.com/ adecn.com 05/03/2008 20:16:52:203 OnGuard Detection Cleaned Threat Name - Application.TrackingCookies Type - Cookie Risk Level - Low Infection - adecn.com/ adecn.com 05/03/2008 20:20:37:984 OnGuard Detection Cleaned Threat Name - Application.TrackingCookies Type - Cookie Risk Level - Low Infection - adecn.com/ adecn.com 05/03/2008 20:24:38:187 OnGuard Detection Cleaned Threat Name - Application.TrackingCookies Type - Cookie Risk Level - Low Infection - adecn.com/ adecn.com 05/03/2008 20:30:47:546 OnGuard Detection Cleaned Threat Name - Application.TrackingCookies Type - Cookie Risk Level - Low Infection - adecn.com/ adecn.com 05/03/2008 20:36:36:312 OnGuard Detection Cleaned Threat Name - Application.TrackingCookies Type - Cookie Risk Level - Low Infection - adecn.com/ adecn.com 05/03/2008 20:42:50:390 OnGuard Detection Cleaned Threat Name - Application.TrackingCookies Type - Cookie Risk Level - Low Infection - adecn.com/ adecn.com 05/03/2008 20:48:51:46 OnGuard Detection Cleaned Threat Name - Application.TrackingCookies Type - Cookie Risk Level - Low Infection - adecn.com/ adecn.com 05/03/2008 20:54:51:937 OnGuard Detection Cleaned Threat Name - Application.TrackingCookies Type - Cookie Risk Level - Low Infection - adecn.com/ adecn.com 05/03/2008 21:00:53:46 OnGuard Detection Cleaned Threat Name - Application.TrackingCookies Type - Cookie Risk Level - Low Infection - adecn.com/ adecn.com 05/03/2008 21:28:49:859 Service Stopped Spyware Doctor Service Application Stopped 05/03/2008 21:30:50:812 Service Started Spyware Doctor Service Application started 05/03/2008 21:30:51:15 OnGuards status All OnGuards were Enabled 05/03/2008 21:30:52:46 Immuniser Results ActiveX section has been immunised. No items were processed. 05/03/2008 21:34:16:734 Scan Started Scan Type - Intelli-Scan 05/03/2008 21:34:58:15 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME, NextInstance 05/03/2008 21:34:58:31 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME\0000, Service 05/03/2008 21:34:58:31 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME\0000, Legacy 05/03/2008 21:34:58:31 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME\0000, ConfigFlags 05/03/2008 21:34:58:31 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME\0000, Class 05/03/2008 21:34:58:31 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME\0000, ClassGUID 05/03/2008 21:34:58:46 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME\0000, DeviceDesc 05/03/2008 21:34:58:62 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME\0000, Capabilities 05/03/2008 21:34:58:62 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME\0000, Driver 05/03/2008 21:34:58:62 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME\0000\LogConf 05/03/2008 21:34:58:62 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME\0000\Control 05/03/2008 21:34:58:62 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME\0000 05/03/2008 21:34:58:62 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME 05/03/2008 21:34:58:93 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\catchme, Type 05/03/2008 21:34:58:93 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\catchme, ErrorControl 05/03/2008 21:34:58:93 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\catchme, Start 05/03/2008 21:34:58:93 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\catchme, ImagePath 05/03/2008 21:34:58:93 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\catchme, Group 05/03/2008 21:34:58:93 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\catchme\Enum, 0 05/03/2008 21:34:58:93 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\catchme\Enum, Count 05/03/2008 21:34:58:93 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\catchme\Enum, NextInstance 05/03/2008 21:34:58:93 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\catchme\Enum 05/03/2008 21:34:58:93 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\catchme 05/03/2008 21:34:59:984 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile, (Default) 05/03/2008 21:34:59:984 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shell\open, EditFlags 05/03/2008 21:34:59:984 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shell\open\command, (Default) 05/03/2008 21:35:00:0 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shell\open\command 05/03/2008 21:35:00:0 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shell\open 05/03/2008 21:35:00:0 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shell 05/03/2008 21:35:00:0 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shellex\DropHandler, (Default) 05/03/2008 21:35:00:0 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shellex\DropHandler 05/03/2008 21:35:00:0 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shellex\PropertySheetHandlers\PifProps, (Default) 05/03/2008 21:35:00:0 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shellex\PropertySheetHandlers\PifProps 05/03/2008 21:35:00:15 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shellex\PropertySheetHandlers\ShimLayer Property Page, (Default) 05/03/2008 21:35:00:15 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shellex\PropertySheetHandlers\ShimLayer Property Page 05/03/2008 21:35:00:15 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Value Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}, (Default) 05/03/2008 21:35:00:15 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} 05/03/2008 21:35:00:15 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shellex\PropertySheetHandlers 05/03/2008 21:35:00:15 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile\shellex 05/03/2008 21:35:00:15 Infection was detected on this computer Threat Name - Application.NirCmd Type - Registry Key Risk Level - Info & PUAs Infection - HKEY_CLASSES_ROOT\crexefile 05/03/2008 21:36:45:500 Scan Finished Scan Type - Intelli-Scan Items Processed - 179343 Threats Detected - 1 Infections Detected - 40 Infections Ignored - 0

Hi EAGLE,
looks like thery put the name Application.NirCmd on all infractions
Unless spyware doctor doesn't name the threaat I think your allrighrt;
the name Application.NirCmd refers to see below.

Application.NirCmd is a collection of third party tools packed in one executable that can be used to remove threats in an infected machine. However it can also be used by users with malicious intent to do a different activity.

NEXT:
Open HJT and click on Open the Misc Tools section
Click Open Uninstall Manager…
Click Save list… and save it to your Desktop.
Copy and paste the file uninstall_list.txt here
NEXT:
Since you can't run F-Secure on line (of course we could try again.
If not lets run your spybot S&D
let me know if found anything that couldn't be fixed
make sure you spybot is updated
mschroe929.

Hi mschroe919 Things are looking good , after running spybot S & D no virus was found. On the hijackthis uninstall list I saw authentium antivirus listed . I dont remember loading this software. It doesnt show under add/remove programs. I would like to get rid of this software I am not aware of. I have pasted below the HJT uninstall_list . 3D Groove Playback Engine Acoustica Effects Pack Ad-Aware 2007 Adobe Flash Player ActiveX Adobe Reader 8.1.1 Adobe Shockwave Player Adobe® Photoshop® Album Starter Edition 3.2 Amazing Adventures The Lost Tomb Apple Mobile Device Support Apple Software Update Audacity 1.2.4 Authentium AntiVirus SDK - 2 AVG Anti-Spyware 7.5 Azureus Vuze BCM V.92 56K Modem Bonjour Dell Picture Studio - Dell Image Expert DivX DivX Player Driving Test Success 2005/6 EPSON Attach To Email EPSON Easy Photo Print EPSON File Manager EPSON Printer Software EPSON Scan Assistant EPSON Web-To-Page Family Tree Maker 2005 FIFA 2005 DEMO Full Marks Key Stage 3 Science Google Toolbar for Internet Explorer Hijackthis 1.99.1 HijackThis 1.99.1 HP Customer Participation Program 7.0 HP Imaging Device Functions 7.0 HP Photosmart Essential HP Photosmart, Officejet and Deskjet 7.0.A HP Software Update HP Solution Center 7.0 Intel® Extreme Graphics Driver InterActual Player iTunes Java™ 6 Update 2 Java™ SE Runtime Environment 6 Update 1 Jimmy Neutron Boy Genius Jimmy Neutron vs. Jimmy Negatron Macromedia Flash Player 8 Microsoft Office PowerPoint Viewer 2003 Microsoft Works 7.0 MSN MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) Nero 6 Enterprise Edition Nokia PC Suite OCR Software by I.R.I.S 7.0 Paint Shop Pro 7 PerfectDisk PowerDVD PowerISO PPSDKRedistributables QuickTime Radialpoint Security Services RPS Ad Blocker RPS AntiFraud RPS AntiSpyware RPS AntiVirus RPS App Detector RPS AsRealtime RPS Backup RPS Burn RPS Diagnostic Utility RPS Firewall RPS ParentalControl RPS Performance Tool RPS PopupBlocker RPS Privacy Manager RPS RpsCore RPS Security Cleanup RPS Zip Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 10 (KB936782) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows Media Player 9 (KB917734) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB896688) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911567) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB916281) Security Update for Windows XP (KB917159) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB918899) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920214) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921398) Security Update for Windows XP (KB921503) Security Update for Windows XP (KB921883) Security Update for Windows XP (KB922616) Security Update for Windows XP (KB922760) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923694) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925486) Security Update for Windows XP (KB925902) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) Security Update for Windows XP (KB929123) Security Update for Windows XP (KB929969) Security Update for Windows XP (KB930178) Security Update for Windows XP (KB931261) Security Update for Windows XP (KB931768) Security Update for Windows XP (KB931784) Security Update for Windows XP (KB932168) Security Update for Windows XP (KB933566) Security Update for Windows XP (KB933729) Security Update for Windows XP (KB935839) Security Update for Windows XP (KB935840) Security Update for Windows XP (KB936021) Security Update for Windows XP (KB937143) Security Update for Windows XP (KB938127) Security Update for Windows XP (KB938829) Security Update for Windows XP (KB939653) Security Update for Windows XP (KB941202) Security Update for Windows XP (KB941568) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB941644) Security Update for Windows XP (KB942615) Security Update for Windows XP (KB943055) Security Update for Windows XP (KB943460) Security Update for Windows XP (KB943485) Security Update for Windows XP (KB944533) Security Update for Windows XP (KB944653) Security Update for Windows XP (KB946026) SoundMAX Spybot - Search & Destroy 1.4 Spyware Doctor 5.5 SpywareBlaster v3.5.1 SpywareGuard v2.2 SUPERAntiSpyware Free Edition Symantec Technical Support Web Controls The Lion (remove only) Update for Windows XP (KB894391) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB908531) Update for Windows XP (KB910437) Update for Windows XP (KB911280) Update for Windows XP (KB916595) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB927891) Update for Windows XP (KB930916) Update for Windows XP (KB931836) Update for Windows XP (KB933360) Update for Windows XP (KB936357) Update for Windows XP (KB938828) Update for Windows XP (KB942763) Update for Windows XP (KB942840) Update for Windows XP (KB946627) VideoLAN VLC media player 0.8.6d Virgin Broadband advisor 1.5.14 Virgin Broadband PCguard Warblade v1.2Y.6 WG111v2 Configuration Utility Windows Installer 3.1 (KB893803) Windows Media Format Runtime Windows Media Player 10 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891781 Yahoo! Toolbar

Hi mschroe919
The pat on the back should certainly be yours. I cannot thank you enough. All that work you do , going through those miles and miles of logs I posted. I am really really grateful for all your assistance my PC is a lot better now.
Oh one thing I forgot to ask you, at some point during the pc clean-ups I got a warning from spyware guard that an attempt was being made to change my browser home-page to what it is now i.e http://uk.msn.com. I cant remember what it was before I should have taken note of it. But anyway I accepted the change and clicked ok. Is this the authentic page for msn or some fake one. And I have just got this warning again from spyware guard.. WARNING ! Your IE default search url has been changed. Your Internet Explorer local machine default search url has been changed http://go.microsoft.com/fwlink/?Linkld
to http://www.google.com/ie
Again is this okay or not ?

Regards

Hi EAGLE,
Yes it is a authentic page:
However you can change it to anything you want,
I have www.google.com as my home page.
Here easy steps to change:
First click on TOOLS on the main menu at the top of the screen, then click on INTERNET OPTIONS as see fig 1.1 below:

🖼Click to load external image (Posted Image)

next you will see the Internet Options dialogue box as shown below in fig 1.2

🖼Click to load external image (Posted Image)

Type in the address of the homepage you would like to set, or if it is the one you are currently visiting just click Use Current.

then simply click on the OK button.


Happy surfing mschroe919

Hi mschroe919 So I am clean now ! Once again I would like to say thank you very much for your help in cleaning my PC. I really appreciate it. You guys are doing a wonderful job. Take care and God bless. Regards Eagle

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.