Double click on fix.bat desktop icon (Haxfix) Close all other open windows since this step requires a reboot. Select option 2. Run auto fix by typing 2, and then pressing Enter. If an infection is found, you'll get a message to close all other open windows. Close them, except the red dos window from haxfix and then press Enter. The computer will reboot. After reboot a logfile will open. Post the contents of that logfile along with a new hijackthislog.

0

Haxfix logfile: HAXFIX logfile - by Marckie version 4.31 Mon 12/18/2006 17:13:39.54 --- Auto Haxdoorfix --- searching for files: searching for services.... service xmm13g found [SWSC] DeleteService SUCCESS service mmx19g found [SWSC] DeleteService SUCCESS --- Goldunfix --- searching for files: searching for SSODLkeys: no SSODLkeys found searching for notifykeys: no notifykeys found searching for services: no services found .....rebooting the computer..... searching for ssodlkeys not needed searching for notifykeys notifykey xmm13g not found searching for services service xmm13g not found service mmx19g not found searching for safeboot services safeboot service xmm13g.sys not found safeboot service mmx19g.sys not found searching for files xmm13g.dll exists deleting xmm13g.dll xmm13g.dll has been deleted mmx19g.sys exists deleting mmx19g.sys mmx19g.sys has been deleted checking for other files qz.dll exists deleting qz.dll qz.dll has been deleted qz.sys exists deleting qz.sys qz.sys has been deleted aszzxewaqo.vb exists deleting aszzxewaqo.vb aszzxewaqo.vb has been deleted wa114.ini exists deleting wa114.ini wa114.ini has been deleted checking for a3d files ps.a3d deleting a3d files a3d files are deleted Finished

0

Hijackthis. Logfile of HijackThis v1.99.1 Scan saved at 5:17:14 PM, on 12/18/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\USB Manager\Manager.exe C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe C:\WINDOWS\winapi32.exe3072.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3T1.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\Program Files\Nikon\PictureProject\NkbMonitor.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Hijackthis\HijackThis.exe C:\WINDOWS\system32\wuauclt.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie... R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [EPSON Stylus C45 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3T1.exe /P23 "EPSON Stylus C45 Series" /O6 "USB001" /M "Stylus C45" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [USB Manager] C:\Program Files\USB Manager\Manager.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.exe" /background O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" -quiet O4 - HKCU\..\Run: [WinMedia] C:\WINDOWS\winapi32.exe3072.exe O4 - HKCU\..\Run: [EPSON Stylus C45 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3T1.exe /P23 "EPSON Stylus C45 Series" /M "Stylus C45" /EF "HKCU" O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe O4 - Global Startup: Shortcut to WINDOWXP.exe.LNK = C:\WINDOWS\WINDOWXP.exe O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/h... O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{9FB38E7C-40D6-4349-BDE7-64BB5E4E20DC}: NameServer = 202.188.0.133,202.188.1.5 O23 - Service: wampapache - Unknown owner - D:\Program Files\wamp\apache2\bin\Apache.exe" -k runservice (file missing) O23 - Service: wampmysqld - Unknown owner - D:\Program Files\wamp\mysql\bin\mysqld-nt.exe" "--defaults-file=D:\Program Files\wamp\mysql\my.ini" wampmysqld (file missing)

0

Looks better. Please download ATF-Cleaner to your desktop from this link http://www.atribune.org/content/view/19/2/ We will need it later in safe mode Download and install AVG Anti-Spyware We will need this later in safe mode Be sure to update AVG Anti- Spyware Download Killbox to your desktop from this link Killbox by Option^Explicit. If you already have "Killbox" update to this newer version. We will need it later in safe mode Next, please reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select the first option, to run Windows in Safe Mode, then press "Enter". Choose your usual account. Run Hijack This from safe mode, close all windows except Hijack This, place a check to the left of the following items and press "fix checked": O4 - HKCU\..\Run: [WinMedia] C:\WINDOWS\winapi32.exe3072.exe Exit Hijack This but remain in safe mode. Run Killbox from safe mode. Please double-click Killbox.exe to run it. Select: Delete on Reboot then Click on the All Files button. Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy): C:\WINDOWS\winapi32.exe3072.exe Return to Killbox, go to the File menu, and choose Paste from Clipboard. Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let us know if you receive this message!). If your computer does not restart automatically, please restart it manually. If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click Here to download and run missingfilesetup.exe. Then try Killbox again. Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Reboot into safe mode. Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. In Safe Mode, run AVG Anti-spyware and click on the Scanner tab at the top. Click the "Settings" tab and then change the recommended action to Quarantine and click Automatically generate report after every scan. Click back to the "Scan" tab and then click on Complete System Scan. This scan can take quite a while to run, so be prepared. AVG Anti-Spyware will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. AVG Anti-Spyware will display "All actions have been applied" on the right hand side. Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop). Post the AVG-AntiSpyware log on your desktop and a new Hijack This log please.

0

windows.exe still prompt, together with this pop-up(with close & ignore option): 16 bit ms dos subsystem C;\windows\windows.exe the ntvdm cpu has encountered an illegal operation CS:0540 IP:fff5 OP:ff f8 ff fa ff Choose close to terminate the apllication. Here is AVG report: AVG Anti-Spyware - Scan Report + Created at: 10:34:49 PM 12/18/2006 + Scan result: C:\WINDOWS\kernel32.exe -> Backdoor.Haxdoor.jr : Cleaned. C:\WINDOWS\winapi32.exe -> Downloader.Tiny.bo : Cleaned. C:\Documents and Settings\user\Desktop\yana documents\FLASH\hantu.exe/hauntpc.exe -> Not-A-Virus.BadJoke.Win32.Hauntpc : Cleaned. :mozilla.131:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.247:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.281:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.39:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.76:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.143:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.144:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.145:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.146:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.147:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.148:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.149:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.150:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.151:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.152:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.153:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.154:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.155:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.156:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.173:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.174:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.211:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.212:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.353:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Adtech : Cleaned. :mozilla.354:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Adtech : Cleaned. :mozilla.213:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.214:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.216:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.215:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.303:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned. :mozilla.22:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.86:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.87:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.88:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned. :mozilla.229:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.230:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.231:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.232:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.43:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned. :mozilla.289:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.290:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.291:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.292:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned. :mozilla.282:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.283:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.284:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.196:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.197:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.198:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.199:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.200:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.201:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.83:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.84:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.85:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.285:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.286:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.287:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.288:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.21:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.52:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.53:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.54:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.55:C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\mmkcryhf.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. ::Report end

0

Hijackthis logfile; Logfile of HijackThis v1.99.1 Scan saved at 10:42:22 PM, on 12/18/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\Explorer.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\USB Manager\Manager.exe C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Nikon\PictureProject\NkbMonitor.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Hijackthis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie... R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [EPSON Stylus C45 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3T1.exe /P23 "EPSON Stylus C45 Series" /O6 "USB001" /M "Stylus C45" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [USB Manager] C:\Program Files\USB Manager\Manager.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.exe" /background O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" -quiet O4 - HKCU\..\Run: [EPSON Stylus C45 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3T1.exe /P23 "EPSON Stylus C45 Series" /M "Stylus C45" /EF "HKCU" O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe O4 - Global Startup: Shortcut to WINDOWXP.exe.LNK = C:\WINDOWS\WINDOWXP.exe O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/h... O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{9FB38E7C-40D6-4349-BDE7-64BB5E4E20DC}: NameServer = 202.188.0.133,202.188.1.5 O17 - HKLM\System\CCS\Services\Tcpip\..\{A0F2BF8C-A0EF-490C-9EFA-02BC3011312F}: NameServer = 202.188.0.133 202.188.1.5 O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: wampapache - Unknown owner - D:\Program Files\wamp\apache2\bin\Apache.exe" -k runservice (file missing) O23 - Service: wampmysqld - Unknown owner - D:\Program Files\wamp\mysql\bin\mysqld-nt.exe" "--defaults-file=D:\Program Files\wamp\mysql\my.ini" wampmysqld (file missing)

0

Please download ComboFix to the desktop from this link: http://download.bleepingcomputer.com/sUBs/combofix.exe Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running, it may cause your system to hang.) Please post the combofix.txt log.

0

Hi again. This is Combofix log; *When I look at the log, I remembered something. It happens since I install the free version of Myspace Friends Adder. user - 06-12-19 6:02:06.68 Service Pack 2 ComboFix 06.11.27 - Running from: "C:\Documents and Settings\user\Desktop" ((((((((((((((((((((((((((((((( Files Created from 2006-11-19 to 2006-12-19 )))))))))))))))))))))))))))))))))) 2006-12-18 21:25 <DIR> d----c--- C:\!KillBox 2006-12-18 21:16 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2006-12-18 21:16 <DIR> d-------- C:\Program Files\Grisoft 2006-12-18 09:26 90,112 --a------ C:\WINDOWS\system32\RegDACL.exe 2006-12-18 09:26 7,483 --a--c--- C:\clean.bat 2006-12-18 09:26 40,960 --a------ C:\WINDOWS\system32\swsc.exe 2006-12-18 09:26 4,096 --a------ C:\WINDOWS\system32\reboot.exe 2006-12-18 09:26 38,400 --a------ C:\WINDOWS\system32\moveex.exe 2006-12-18 09:26 <DIR> d-------- C:\Program Files\HaxFix 2006-12-18 08:32 2,050 --a------ C:\WINDOWS\system32\tmp.reg 2006-12-18 08:28 <DIR> d-------- C:\Program Files\Hijackthis 2006-12-18 05:50 <DIR> d----c--- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2006-12-18 05:50 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2006-12-17 01:29 <DIR> d----c--- C:\Documents and Settings\user\ZDE 2006-12-16 04:06 76,560 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys 2006-12-16 02:54 <DIR> d----c--- C:\Documents and Settings\user\.housecall6.6 2006-12-16 02:44 <DIR> d-------- C:\Program Files\Spyware Doctor 2006-12-16 00:58 <DIR> d-a--c--- C:\Documents and Settings\All Users\Application Data\TEMP 2006-12-12 22:47 <DIR> d----c--- C:\Documents and Settings\user\Application Data\uTorrent 2006-12-12 22:47 <DIR> d-------- C:\Program Files\uTorrent 2006-12-08 10:20 <DIR> d----c--- C:\Documents and Settings\user\.xngr 2006-11-26 19:13 <DIR> d----c--- C:\Documents and Settings\user\Application Data\PSpad 2006-11-26 19:12 <DIR> d-------- C:\Program Files\PSPad editor 2006-11-24 06:10 <DIR> d----c--- C:\Documents and Settings\user\.thumbnails 2006-11-24 06:05 <DIR> d----c--- C:\Documents and Settings\user\.gimp-2.2 2006-11-24 06:04 <DIR> d-------- C:\Program Files\GIMP-2.0 2006-11-24 06:02 <DIR> d-------- C:\Program Files\Common Files\GTK 2006-11-22 08:51 <DIR> d----c--- C:\Config.Msi 2006-11-22 06:51 <DIR> d----c--- C:\Documents and Settings\user\Application Data\PC Tools 2006-11-21 21:02 <DIR> d----c--- C:\Sun (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-12-18 22:43 -------- d-------- C:\Program Files\Mozilla Firefox 2006-12-17 20:36 -------- d-------- C:\Program Files\Ares 2006-12-16 19:15 -------- d----c--- C:\Documents and Settings\user\Application Data\AdobeUM 2006-12-16 04:06 -------- d-------- C:\Program Files\Internet Explorer 2006-12-16 00:51 -------- d-------- C:\Program Files\mIRC 2006-12-16 00:48 -------- d-------- C:\Program Files\MP3 CD Converter Professional 2006-12-15 22:26 205 --a------ C:\WINDOWS\windows.exe 2006-12-02 21:29 -------- d-------- C:\Program Files\Evrsoft First Page 2006 2006-12-02 21:28 -------- d-------- C:\Program Files\Java 2006-12-02 21:26 -------- d--h----- C:\Program Files\InstallShield Installation Information 2006-12-02 21:24 -------- d----c--- C:\Documents and Settings\user\Application Data\Lavasoft 2006-11-24 06:02 -------- d-------- C:\Program Files\Common Files 2006-11-09 23:51 -------- d-------- C:\Program Files\Myspace Friends Adder 2006-11-04 22:52 -------- d-------- C:\Program Files\Google 2006-11-04 22:52 -------- d-------- C:\Program Files\GlobalSCAPE 2006-10-22 22:33 -------- dr-h-c--- C:\Documents and Settings\user\Application Data\yahoo! (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background" "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "Yahoo! Pager"="\"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YAHOOM~1.EXE\" -quiet" "EPSON Stylus C45 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S4I3T1.exe /P23 \"EPSON Stylus C45 Series\" /M \"Stylus C45\" /EF \"HKCU\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\"" "EPSON Stylus C45 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S4I3T1.exe /P23 \"EPSON Stylus C45 Series\" /O6 \"USB001\" /M \"Stylus C45\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "USB Manager"="C:\\Program Files\\USB Manager\\Manager.exe" "Remote Control Server"="" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_03\\bin\\jusched.exe" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000005 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,e4,03,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,\ 00,00,04,00,00,40 "RestoredStateInfo"=hex:18,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,\ 00,00,01,00,00,00 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" "UPnPMonitor"="{e57ce738-33e8-4c51-8354-bb4de9d215d1}" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Completion time: 06-12-19 6:03:56.46 C:\ComboFix.txt ... 06-12-19 06:03

0

The combofix scan located it. lets make sure it is a virus. Go to this link, http://virusscan.jotti.org/ use the browse button to locate this file: C:\WINDOWS\windows.exe Click so that it is in the "file to upload and scan window" then click submit then post the results. May take a few minutes for the results.

0

here's the scan result. AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Fortinet Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing VirusBuster Found nothing VBA32 Found nothing

0

Try uninstalling "Myspace Friends Adder". See if Dr. Web Cureit finds anything. Please download Dr Web CureIt to your desktop from this link ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe Doubleclick the drweb-cureit.exe file and Allow to run the express scan. This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan. Once the short scan has finished, mark the drives that you want to scan. Select all drives. A red dot shows which drives have been chosen. Click the green arrow at the right, and the scan will start. Click 'Yes to all' if it asks if you want to cure/move the file. When the scan has finished, look if you can click next icon next to the files found: If so, click it and then click the next icon right below and select Move incurable. This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples) After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list Save the report to your desktop. The report will be called DrWeb.csv Close Dr.Web Cureit. Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot. After reboot, post the contents of the log on your desktop.

0

Hi again. I have uninstall Myspace Friends Adder. After running Dr.Web CureIt, it still prompt windows.exe. Here is DrWeb.csv: Process.exe;C:\Documents and Settings\user\Desktop\SmitfraudFix\SmitfraudFix;Tool.Prockill;Moved.; restart.exe;C:\Documents and Settings\user\Desktop\SmitfraudFix\SmitfraudFix;Tool.ShutDown.11;Moved.; A0092053.exe;C:\System Volume Information\_restore{91A6F704-4520-4CB9-BD74-1E1CC2B5FC94}\RP193;BackDoor.Haxdoor.309;Deleted.; A0092054.exe;C:\System Volume Information\_restore{91A6F704-4520-4CB9-BD74-1E1CC2B5FC94}\RP193;Trojan.DownLoader.12166;Deleted.;

0

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Reboot into safe mode. Run Killbox from safe mode. Please double-click Killbox.exe to run it. Select: Delete on Reboot then Click on the All Files button. Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy): C:\WINDOWS\windows.exe Return to Killbox, go to the File menu, and choose Paste from Clipboard. Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let us know if you receive this message!). If your computer does not restart automatically, please restart it manually.

0

There is no more prompt after restart. The only thing is pop-up(with OK button), it says: Error ----- Couldn't find windows.exe

0

Looks like it slipped by me. Reboot into safe mode. Run Hijack This and remove this item: O4 - Global Startup: Shortcut to WINDOWXP.exe.LNK = C:\WINDOWS\WINDOWXP.exe Next delete this file with Killbox using the same procedure you have been using: C:\WINDOWS\WINDOWXP.exe Empty the restore folder again and run ATF Cleaner. Post a new Hijack This log if you still have the problem.

0

There is no more prompt after restart. Am I safe now?

0

Many thanks jabuck.

0

Your computer is clean. Download the latest version of http://java.sun.com/javase/downloads/index.jsp Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications". Click the "Download" button to the right. Check the box that says: "Accept License Agreement". The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed . Then from your desktop double-click on jre-1_5_0_09-windowsi586-p.exe to install the newest version. You should consider adding "Spywareblaster" to your arsenol of antispyware tools, just do a google search for spywareblaster, download it,install it, and update it. Its free and runs in the background, so you don't actually run it, and re-writes malicious script before it can install on your computer. Look for updates weekly as there is no auto-update on the free version. Glad we could help.

0