[Resolved] Vundo, Trace, Zlobe, Zango and more

Hello

Download and unzip BFUzip from http://www.merijn.org/files/bfu.zip
Run the program and click the Web button as shown here:
[external image: Posted Image]

Use this URL to copy into the address bar of the Download script window:
http://metallica.geekstogo.com/MediaGateway.BFU

Make sure all IE windows are closed.

Execute the script by clicking the Execute button.

If you have any questions about the use of BFU please read here:
http://metallica.geekstogo.com/BFUinstructions.html




Please download RUNSCANNER to your desktop and run it.

• When the first page comes up select Beginner Mode
• On the next page select Save a binary .Run file (Recommended) then click Start full scan at the top.
• At this time Runscanner.exe may request access to the Internet through your firewall please allow it to do so, it will then run for two or three minutes.
• On completion it will ask for a location to save the file and a name. It will do this for both the .run file and the log
• Call the file "Select a file name here" and save it to your desktop. You will see the .run file on your desktop. Please zip the .run file by right clicking and selecting send to Zip file

Then upload that as an attachment in your next post.

Hi Rorschach, Finished what you directed to do, then went to upload file as requested but the attachment system here on whatthetech would not allow me to upload a .zip file. What to do now? Also I did not see that you requested the .log file. Did you need that as well or is it in the .zip file? Thank you, Infosuperhwy

Can you host the zip file at a site like mediafire.com and post the link here

O.K.,

Lets try to see if this will work…. I usually do this for .jpg's

http://home.wbcable.net/~pnw_ent/files/draft1.zip

and if you need the log, etc., replace /draft1.zip for: /draft1.run or /draft2.log

Thank you, Infosuperhwy

Hello

1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: {c018f6d1-df24-07a9-4514-21bf8c6a8699} - {9968a6c8-fb12-4154-9a70-42fd1d6f810c} - C:\WINDOWS\system32\spnthipq.dll
O3 - Toolbar: (no name) - {9FB3908C-6565-4CB0-95F8-E9F85258723C} - (no file)

2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.




Please download the OTMoveIt2 by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt2.exe to run it.
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  [kill explorer]
  C:\WINDOWS\system32\spnthipq.dll
  C:\WINDOWS\system32\jlnmp.bak2
  HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\2ca27ea4
  C:\WINDOWS\system32\eciorava.dll
  HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BM2f914d38
  C:\WINDOWS\system32\dytvqiav.dll
  HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\My Web Search Bar
  C:\PROGRA~1\MYWEBS~1
  purity 
  EmptyTemp
  [start explorer]

• Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the light Yellow bar) and choose Paste.
• Click the red Moveit! button.
• A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
• Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.



Reboot and post a new DSS log

Looking good

Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner and click Accept

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Extended (if available otherwise Standard)
  
  • Scan Options:
  Scan Archives
  Scan Mail Bases
• Click OK
• Now under select a target to scan:Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  
  • Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

Just finished…. tried this first actually but it locked up the computer before it could finish. Here's the list: ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Saturday, June 28, 2008 1:44:21 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 28/06/2008 Kaspersky Anti-Virus database records: 895473 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ Scan Statistics: Total number of scanned objects: 57511 Number of viruses found: 29 Number of infected objects: 81 Number of suspicious objects: 0 Duration of the scan process: 00:37:07 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3ad391678a806ec4d691e83aaa393b6f_24adf822-76f7-4481-b30b-ff1b40f8687f Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\SupportSoft\DellSupportCenter\SYSTEM\state\logs\sprtcmd.log Object is locked skipped C:\Documents and Settings\Kaitana Davis\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\DSAgnt.log Object is locked skipped C:\Documents and Settings\Kaitana Davis\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\DSAgnt_GTActions.log Object is locked skipped C:\Documents and Settings\Kaitana Davis\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\gdql_d_DSAgnt.log Object is locked skipped C:\Documents and Settings\Kaitana Davis\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\glog.log Object is locked skipped C:\Documents and Settings\Kaitana Davis\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Kaitana Davis\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Kaitana Davis\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Kaitana Davis\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Kaitana Davis\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Kaitana Davis\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Kaitana Davis\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Kaitana Davis\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Hijackthis\backups\backup-20080627-222515-450.dll Infected: Trojan.Win32.Monder.gen skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP258\A0159861.exe Infected: not-a-virus:AdWare.Win32.HotBar.ck skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP258\A0159862.dll Infected: not-a-virus:AdWare.Win32.HotBar.ch skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP258\A0159863.dll Infected: not-a-virus:AdWare.Win32.HotBar.be skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP258\A0159865.dll Infected: not-a-virus:AdWare.Win32.180Solutions.bl skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP258\A0159868.dll Infected: not-a-virus:AdWare.Win32.HotBar.ck skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP258\A0159872.exe Infected: not-a-virus:AdWare.Win32.180Solutions.bp skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP258\A0159873.dll Infected: not-a-virus:AdWare.Win32.180Solutions.bq skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP258\A0159874.exe/stream/data0002 Infected: not-a-virus:AdWare.Win32.180Solutions.bj skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP258\A0159874.exe/stream Infected: not-a-virus:AdWare.Win32.180Solutions.bj skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP258\A0159874.exe NSIS: infected - 2 skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP258\A0159955.dll Infected: not-a-virus:AdWare.Win32.HotBar.ck skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP262\A0161578.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.i skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP262\A0161579.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.l skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP262\A0161582.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.al skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP262\A0161584.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP262\A0161586.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.an skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP262\A0161588.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.cy skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP262\A0161590.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch.a skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP262\A0161592.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.al skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP262\A0161598.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.an skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP262\A0161599.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.ad skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP262\A0161601.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.q skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP262\A0161602.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP262\A0161603.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.i skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP263\A0162606.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.qrm skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP271\A0165825.dll Infected: Trojan.Win32.Monder.gen skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP271\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\ModemLog_Intel® 537EP V9x DF PCI Modem.txt Object is locked skipped C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{9DBDE27A-8DA6-4171-B688-86E29AABF50C}.crmlog Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\akqbrfrw.dll Infected: Trojan.Win32.BHO.rg skipped C:\WINDOWS\system32\bdmudnfv.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\bmitgxgd.dll Infected: Trojan.Win32.Monder.gen skipped C:\WINDOWS\system32\bsduohdb.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edbtmp.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\DEFAULT Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SYSTEM Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\cpythkxc.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\cqbbyknd.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\dhgcnpmo.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\docyoyix.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\ebraubgj.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\egxhtyuk.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ag skipped C:\WINDOWS\system32\elxgsyjn.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\elxoadsd.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\erodfrdh.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\ertqarvb.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\frlimdik.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\gvnajjmv.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\hqydwogc.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\ifcpelem.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\ifhkpmod.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\ifjlfuhk.dll Infected: Trojan.Win32.Monder.gen skipped C:\WINDOWS\system32\ismcjpfl.dll Infected: Trojan.Win32.BHO.re skipped C:\WINDOWS\system32\jatythbv.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\jnrrnbgq.dll Infected: Trojan.Win32.BHO.rd skipped C:\WINDOWS\system32\jpsiwhon.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\jqbengus.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\jruokrbh.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\kcjwesnh.dll Infected: Trojan.Win32.Monder.gen skipped C:\WINDOWS\system32\laf1.0ll Infected: Trojan-Downloader.Win32.Agent.dsn skipped C:\WINDOWS\system32\laf3.0ll Infected: Trojan-Downloader.Win32.Agent.dsn skipped C:\WINDOWS\system32\laf4.dll Infected: Trojan-Downloader.Win32.Agent.fbv skipped C:\WINDOWS\system32\laf5.dll Infected: Trojan-Downloader.Win32.Agent.fbv skipped C:\WINDOWS\system32\LAF8.0LL Infected: Trojan-Downloader.Win32.Agent.dth skipped C:\WINDOWS\system32\laf9.0ll Infected: Trojan-Downloader.Win32.Agent.dth skipped C:\WINDOWS\system32\liyijjta.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\lmjfhhsj.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\lreagrbl.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\mbxhvdwy.dll Infected: Trojan.Win32.Monder.gen skipped C:\WINDOWS\system32\npwcpogb.exe/data0006/data0002 Infected: not-a-virus:AdWare.Win32.180Solutions.ay skipped C:\WINDOWS\system32\npwcpogb.exe/data0006/data0003 Infected: not-a-virus:AdWare.Win32.180Solutions.ay skipped C:\WINDOWS\system32\npwcpogb.exe/data0006/data0004 Infected: not-a-virus:AdWare.Win32.180Solutions.ay skipped C:\WINDOWS\system32\npwcpogb.exe/data0006 Infected: not-a-virus:AdWare.Win32.180Solutions.ay skipped C:\WINDOWS\system32\npwcpogb.exe NSIS: infected - 4 skipped C:\WINDOWS\system32\oifsnryn.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\pbkvprhg.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\pfrecepx.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\qatuijgb.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\sggkhkes.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\tcgymmvl.dll Infected: not-a-virus:AdWare.Win32.SuperJuan.ae skipped C:\WINDOWS\system32\ufilukwp.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\uouthysx.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\vwlolgvk.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\system32\wdrjstjp.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.acd skipped C:\WINDOWS\system32\wpxflycf.dll Infected: Trojan.Win32.Monder.gen skipped C:\WINDOWS\system32\ybreilxu.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.agh skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed.

Hello


Please visit this web page for instructions for downloading and running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

This includes installing the Windows XP Recovery Console in case you have not installed it yet.

For more information on the Windows XP Recovery Console read http://support.microsoft.com/kb/314058.

Once you install the Recovery Console, when you reboot your computer, you'll see the option for the Recovery Console now as well. Don't select Recovery Console as we don't need it. By default, your main OS is selected there. The screen stays for 2 seconds and then it proceeds to load Windows. That is normal.

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.

Hello

Click here to use the F-Secure Online Scanner

• Then click the Start Scanning button below.
• You should get a notification (bar on top) to install the activeX. Click on it and select to install the ActiveX.
• Once the ActiveX is installed, you should accept the License terms by clicking OK below to start the scan.
• In case you are having problems with installing the ActiveX/starting the scan, please read here.
• Click the Full System Scan button.
• It will start to download scanner components and databases. This can take a while.
• The main scan will start.
• Once the scan finished scanning, click the Automatic cleaning (recommended) button
• It could be possible that your firewall gives an alert - allow it, because that's a connection you establish to submit infected files to F-Secure.
• The cleaning can take a while, so please be patient.
• Then click the Show report button and copy and paste what's present under results in your next reply.

Also post a new HijackThis log