Hi, I need some help with getting my computer clean. I have an AMD Athlon 1700 (1.48 Ghz) 512 MB ram with Windows XP Pro SP2. I seem to be infected with the virus that redirects you from a google (or other) search page to go.google.... I have run Malwarebytes and this seem to fix the problem (had to restart due to the need to remove one item in the C:\WINDOWS\system32\ folder). However when I restart again the problem reoccurs! Also I think this (or something else) is stopping some programmes from updating. Can someone please help? Thanks. By the way, I have downloaded Malwarebytes, HiJackThis and ComboFix (only used Malwarebytes becuase of the warnings in other posts about the last 2)

Download SDFix.exe and save it to your Desktop. Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with SDFix or remove some of its embedded files which may cause "unpredictable results". Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. Remember to re-enable the protection again afterwards before connecting to the Internet. 1.Double click SDFix.exe and choose Install to extract it to its own folder on the Desktop. Please then reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select the first option, to run Windows in Safe Mode, then press "Enter". Choose your usual account. 2. Open the c:\SDFix folder and double click RunThis.cmd to start the script. Type Y to begin the script. It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot. Press any Key and it will restart the PC. 3. Your system will take longer that normal to restart as the fixtool will be running and removing files. When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons. 4. Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt Then post a Hijack This log please.

Thanks, Ran SDfix. SDfix log: [b]SDFix: Version 1.237 [/b] Run by Jemma and Matt on Thu 23/10/2008 at 21:11 Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Rootkit Found : C:\WINDOWS\system32\drivers\TDSSpqlt.sys - Rootkit.Win32.Agent.cku [b]Name [/b]: tdssserv [b]Path [/b]: \systemroot\system32\drivers\TDSSpqlt.sys tdssserv - Deleted Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\WINDOWS\system32\TDSSoity.dll - Deleted C:\WINDOWS\system32\TDSSarxx.dll - Deleted C:\WINDOWS\system32\TDSSvoql.dll - Deleted C:\WINDOWS\system32\TDSScfmn.dll - Deleted C:\WINDOWS\system32\TDSSlxcp.dll - Deleted C:\WINDOWS\system32\TDSSxhyf.dll - Deleted C:\DOCUME~1\JEMMAA~1\COOKIES\SOVULE.BIN - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\Binaries1.cab2 - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\Binaries2.cab3 - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\Binaries3.cab4 - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmp30.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmp2E.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmp36.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmp3E.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmp48.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmp82.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmp49.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmp6E.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmp76.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpD0.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpCD.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpCF.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpD2.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpDC.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpDD.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpDE.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpDF.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpE0.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpE1.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpD9.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpDA.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpDB.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpE2.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpE3.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpE4.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpE5.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpE6.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpE7.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpF8.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpF3.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpF4.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpF5.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpF6.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpF7.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpF9.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpFA.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpFB.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpFC.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpFD.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpFE.tmp - Deleted C:\DOCUME~1\JEMMAA~1\LOCALS~1\Temp\tmpFF.tmp - Deleted C:\WINDOWS\system32\TFTP3612 - Deleted C:\WINDOWS\system32\2pac.txt - Deleted Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-23 21:17:54 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"="C:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe:*:Enabled:Malwarebytes' Anti-Malware" "C:\\Program Files\\Frogprints NZ\\Editor.exe"="C:\\Program Files\\Frogprints NZ\\Editor.exe:*:Enabled:Editor" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Tue 9 May 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users.WINDOWS\DRM\DRMv1.bak" Thu 19 Jun 2008 42,062,848 ...H. --- "C:\Documents and Settings\Jemma and Matt\My Documents\~WRL0003.tmp" Fri 20 Jun 2008 42,063,872 ...H. --- "C:\Documents and Settings\Jemma and Matt\My Documents\~WRL0005.tmp" Fri 20 Jun 2008 42,063,360 ...H. --- "C:\Documents and Settings\Jemma and Matt\My Documents\~WRL2262.tmp" Fri 20 Jun 2008 42,064,384 ...H. --- "C:\Documents and Settings\Jemma and Matt\My Documents\~WRL0099.tmp" Fri 20 Jun 2008 44,060,160 ...H. --- "C:\Documents and Settings\Jemma and Matt\My Documents\~WRL3799.tmp" Fri 20 Jun 2008 44,060,672 ...H. --- "C:\Documents and Settings\Jemma and Matt\My Documents\~WRL3177.tmp" Fri 20 Jun 2008 44,059,648 ...H. --- "C:\Documents and Settings\Jemma and Matt\My Documents\~WRL3705.tmp" Fri 20 Jun 2008 44,061,184 ...H. --- "C:\Documents and Settings\Jemma and Matt\My Documents\~WRL0110.tmp" Fri 20 Jun 2008 44,060,160 ...H. --- "C:\Documents and Settings\Jemma and Matt\My Documents\~WRL2799.tmp" Wed 2 Aug 2006 9,901,568 A..H. --- "C:\USB Stick\Hirepool\hirepool\~WRL0003.tmp" Wed 2 Aug 2006 9,901,568 A..H. --- "C:\Usb Stick 4-11-06\Hirepool\hirepool\~WRL0003.tmp" Tue 9 Sep 2008 0 A.SH. --- "C:\Documents and Settings\All Users.WINDOWS\DRM\Cache\Indiv01.tmp" Fri 17 Mar 2006 1,495,040 A.SH. --- "C:\USB Stick\new\my doc\OLD STUFF\SIV92.tmp" Fri 17 Mar 2006 2,011,136 A.SH. --- "C:\USB Stick\new\my doc\OLD STUFF\SIV99.tmp" Fri 29 Sep 2006 20,992 ...H. --- "C:\Documents and Settings\Jemma and Matt\Application Data\Microsoft\Word\~WRL0316.tmp" Fri 29 Sep 2006 21,504 ...H. --- "C:\Documents and Settings\Jemma and Matt\Application Data\Microsoft\Word\~WRL3586.tmp" Fri 29 Sep 2006 19,456 ...H. --- "C:\Documents and Settings\Jemma and Matt\Application Data\Microsoft\Word\~WRL0003.tmp" Sat 5 Apr 2008 219,136 ...H. --- "C:\Documents and Settings\Jemma and Matt\Application Data\Microsoft\Word\~WRL0326.tmp" Mon 20 Feb 2006 19,456 ...H. --- "C:\Documents and Settings\Jemma and Matt\Application Data\Microsoft\Word\~WRL1102.tmp" Mon 12 Feb 2007 3,096,576 A..H. --- "C:\Documents and Settings\Jemma and Matt\Application Data\U3\temp\Launchpad Removal.exe" [b]Finished![/b] Hijack This log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:23:01, on 23/10/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\wscntfy.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\SOUNDMAN.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Jemma and Matt\Desktop\Desktop Stuff\System Apps\HiJackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Clear.net O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - F:\Program Files\Adobe\CS\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [Microsoft Updater Winnt32dlls] rundllnt32.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.exe TWEAKUI.CPL,TweakMeUp O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon O4 - HKLM\..\RunServices: [Microsoft Updater Winnt32dlls] rundllnt32.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.exe (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.exe (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [brastk] C:\WINDOWS\system32\brastk.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.exe (User 'Default user') O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: Convert link target to Adobe PDF - res://F:\Program Files\Adobe\CS\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://F:\Program Files\Adobe\CS\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://F:\Program Files\Adobe\CS\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://F:\Program Files\Adobe\CS\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://F:\Program Files\Adobe\CS\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://F:\Program Files\Adobe\CS\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://F:\Program Files\Adobe\CS\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://F:\Program Files\Adobe\CS\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls... O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls... O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.frogprints.co.nz/order/I... O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.tickle.co.nz/uploaders/I... O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} - http://www.tickle.co.nz/uploaders/I... O20 - AppInit_DLLs: karna.dat O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - F:\Program Files\Adobe\CS\Adobe Version Cue CS2\bin\VersionCueCS2.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 8427 bytes

On a side note, I got Avast to update its database which is one of the ones I was having problems with updating. Cheers

Please download ComboFix to the desktop from one of the following links: Link1 Link 2 Link 3 Combofix is a powerful tool so follow the instructions exactly or you could damage your computer. Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with Combofix and remove some of its embedded files which may cause "unpredictable results". Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. In your case to run Combofix do the following: 1. Go offline turn off your Avast antivirus, and any antispyware that you may have. 2. Run Combofix and save its log. 3. Restart the computer to get the antivirus running again but leave the antispyware programs off until we get the computer cleaned. 4. Post the Combofix log. Remember to re-enable the protection again afterwards before connecting to the Internet. Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running or move the mouse, it will cause your system to hang.) Please post the log it produces.

Thanks, I ran combofix this morning and the log is below. When I restarted the computer the avast system tray icon was missing, I have not connected to the internet because of this. I have downloaded the latest version of avast at work and will install it when I get home. Also Combofix asked if I wanted to install the recovery console, but needed a internet connection to do so, therefore I clicked "no". Combofix log: ComboFix 08-10-19.01 - Jemma and Matt 2008-10-24 7:14:46.1 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.240 [GMT 13:00] Running from: C:\Documents and Settings\Jemma and Matt\Desktop\Desktop Stuff\System Apps\ComboFix.exe [COLOR=RED][B]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Jemma and Matt\Cookies\finu.dat C:\WINDOWS\system32\dbxDgrevCheck.dll . ((((((((((((((((((((((((( Files Created from 2008-09-23 to 2008-10-23 ))))))))))))))))))))))))))))))) . 2008-10-23 21:08 . 2008-10-23 21:08 <DIR> d-------- C:\WINDOWS\ERUNT 2008-10-23 21:03 . 2008-10-22 02:19 <DIR> d-------- C:\SDFix 2008-10-22 22:54 . 2008-10-22 22:54 35,328 --a------ C:\WINDOWS\system32\TDSSoiqh.dll 2008-10-22 22:31 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-10-22 19:08 . 2008-10-22 19:08 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak 2008-10-20 22:55 . 2008-10-20 22:55 <DIR> d-------- C:\Program Files\PokerStars 2008-10-20 17:19 . 2008-10-20 17:19 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-10-20 17:19 . 2008-10-20 17:19 <DIR> d-------- C:\Documents and Settings\Jemma and Matt\Application Data\Malwarebytes 2008-10-20 17:19 . 2008-10-20 17:19 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes 2008-10-20 17:19 . 2008-10-16 20:25 38,496 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-10-20 17:19 . 2008-10-16 20:25 15,504 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-10-19 23:21 . 2008-10-19 23:21 <DIR> d-------- C:\Program Files\XoftSpySE 2008-10-19 23:13 . 2008-10-19 23:13 <DIR> d-------- C:\Program Files\RogueRemover FREE 2008-10-19 21:19 . 2001-08-28 14:00 4,224 --a------ C:\WINDOWS\system32\drivers\beep.sys 2008-10-19 21:19 . 2001-08-28 14:00 4,224 --a------ C:\WINDOWS\system32\dllcache\beep.sys 2008-10-19 19:40 . 2008-10-19 19:40 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft 2008-10-19 17:48 . 2008-10-19 17:48 <DIR> d-------- C:\Program Files\SUPERAntiSpyware 2008-10-19 17:48 . 2008-10-19 17:48 <DIR> d-------- C:\Documents and Settings\Jemma and Matt\Application Data\SUPERAntiSpyware.com 2008-10-19 17:48 . 2008-10-19 17:48 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com 2008-10-19 16:21 . 2008-10-19 16:22 23,600 --a------ C:\WINDOWS\system32\drivers\TVICHW32.SYS 2008-10-19 14:38 . 2008-10-19 14:38 18,302 --a------ C:\Documents and Settings\All Users.WINDOWS\Application Data\epoxuso.reg 2008-10-19 14:38 . 2008-10-19 14:38 17,517 --a------ C:\Program Files\Common Files\bepylu.dat 2008-10-19 14:38 . 2008-10-19 14:38 17,206 --a------ C:\Documents and Settings\Jemma and Matt\Application Data\ezoxeset.exe 2008-10-19 14:38 . 2008-10-19 14:38 14,350 --a------ C:\Documents and Settings\Jemma and Matt\Application Data\fogulomy.com 2008-10-19 14:38 . 2008-10-19 14:38 13,062 --a------ C:\WINDOWS\system32\adubakohe.dat 2008-10-19 14:38 . 2008-10-19 14:38 12,782 --a------ C:\WINDOWS\cepizyhan.vbs 2008-10-19 14:38 . 2008-10-19 14:38 11,152 --a------ C:\WINDOWS\fyjadute.scr 2008-10-19 14:38 . 2008-10-19 14:38 11,075 --a------ C:\WINDOWS\system32\cixyli.scr 2008-10-19 14:38 . 2008-10-19 14:38 10,709 --a------ C:\Documents and Settings\All Users.WINDOWS\Application Data\amopabi.exe 2008-10-19 14:38 . 2008-10-19 14:38 10,426 --a------ C:\Documents and Settings\All Users.WINDOWS\Application Data\gypew.dll 2008-10-19 14:38 . 2008-10-19 14:38 10,323 --a------ C:\WINDOWS\peryzah.sys 2008-10-19 14:38 . 2008-10-19 14:38 10,294 --a------ C:\WINDOWS\system32\xikyja.dll 2008-10-19 14:27 . 2008-10-19 14:27 45,056 --a------ C:\WINDOWS\system32\av.dat 2008-10-19 14:26 . 2008-10-22 21:12 164 --a------ C:\WINDOWS\system32\TDSSmtve.dat 2008-10-09 20:33 . 2008-10-09 20:33 78 --a------ C:\WINDOWS\system\WIN32S.INI 2008-10-09 20:32 . 2008-10-09 20:32 <DIR> d-------- C:\WESTWOOD 2008-10-09 20:32 . 1994-08-24 00:00 188,960 --a------ C:\WINDOWS\system\WINGDE.DLL 2008-10-09 20:32 . 1994-09-21 00:00 92,208 --a------ C:\WINDOWS\system\WING.DLL 2008-10-09 20:32 . 1994-09-21 00:00 12,800 --a------ C:\WINDOWS\system\WING32.DLL 2008-10-09 20:32 . 1994-09-21 00:00 6,736 --a------ C:\WINDOWS\system\WINGDIB.DRV 2008-10-09 20:32 . 1994-09-21 00:00 5,024 --a------ C:\WINDOWS\system\WINGPAL.WND 2008-10-09 20:32 . 1994-06-27 00:00 1,966 --a------ C:\WINDOWS\system\DVA.386 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-19 01:38 16,550 ----a-w C:\Program Files\Common Files\jovusimy.db 2008-10-19 01:38 16,370 ----a-w C:\Program Files\Common Files\dijevanucy._sy 2008-10-03 17:41 6,066,176 ------w C:\WINDOWS\system32\dllcache\ieframe.dll 2008-09-15 11:57 1,846,016 ----a-w C:\WINDOWS\system32\win32k.sys 2008-09-15 11:57 1,846,016 ------w C:\WINDOWS\system32\dllcache\win32k.sys 2008-09-09 07:29 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-09-06 22:34 --------- d-----w C:\Program Files\Frogprints NZ 2008-08-29 22:24 --------- d-----w C:\Program Files\NetDog 2008-08-28 10:04 333,056 ----a-w C:\WINDOWS\system32\drivers\srv.sys 2008-08-28 10:04 333,056 ------w C:\WINDOWS\system32\dllcache\srv.sys 2008-08-27 08:24 3,593,216 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-08-25 08:38 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-08-25 08:38 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-08-23 05:56 635,848 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-08-23 05:54 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll 2008-08-14 10:00 2,180,352 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-08-14 10:00 2,180,352 ------w C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2008-08-14 09:58 2,136,064 ------w C:\WINDOWS\system32\dllcache\ntkrnlmp.exe 2008-08-14 09:51 138,368 ------w C:\WINDOWS\system32\dllcache\afd.sys 2008-08-14 09:22 2,057,728 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2008-08-14 09:22 2,057,728 ------w C:\WINDOWS\system32\dllcache\ntkrnlpa.exe 2008-08-14 09:22 2,015,744 ------w C:\WINDOWS\system32\dllcache\ntkrpamp.exe 2008-08-11 08:11 241,704 ------w C:\WINDOWS\system32\dllcache\wgaLogon.dll 2008-08-11 08:10 917,032 ------w C:\WINDOWS\system32\dllcache\WgaTray.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-12-07 30208] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-25 155648] "LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-05-18 49152] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-04 143360] "Tweak UI"="TWEAKUI.CPL" [2003-03-25 C:\WINDOWS\system32\tweakui.cpl] "SoundMan"="SOUNDMAN.EXE" [2002-08-15 C:\WINDOWS\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.exe" [2004-08-04 15360] C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\ HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 53248] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 258048] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm "msacm.mpegacm"= mpegacm.acm "msacm.ulmp3acm"= ulmp3acm.acm "msacm.sl_anet"= C:\PROGRA~1\ACEMEG~1\SystemS\sl_anet.acm "vidc.iyuv"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\iyuv_32.dll "vidc.yvu9"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\Iyvu9_32.dll "vidc.uyvy"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll "vidc.yuy2"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll "vidc.yvyu"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll "msacm.msaudio1"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msaud32.acm "msacm.iac2"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\iac25_32.ax [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"= "C:\\Program Files\\Frogprints NZ\\Editor.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 78416] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 20560] S3 autorun;autorun;c:\huadio.tmp [ ] S3 NetWlan5;Symbol Based 802.11b Wireless LAN Card Driver;C:\WINDOWS\system32\DRIVERS\NetWlan5.sys [2004-08-03 132695] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] \Shell\AutoRun\command - D:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3111c629-9de4-11dc-a67d-0010dcc11d17}] \Shell\AutoRun\command - G:\LaunchU3.exe -a . Contents of the 'Scheduled Tasks' folder 2008-10-19 C:\WINDOWS\Tasks\XoftSpySE.job - C:\Program Files\XoftSpySE\XoftSpy.exe [2008-10-16 03:21] 2008-10-23 C:\WINDOWS\Tasks\XoftSpySE 2.job - C:\Program Files\XoftSpySE\XoftSpy.exe [2008-10-16 03:21] . - - - - ORPHANS REMOVED - - - - HKLM-Run-Microsoft Updater Winnt32dlls - rundllnt32.exe HKLM-RunServices-Microsoft Updater Winnt32dlls - rundllnt32.exe HKU-Default-Run-brastk - C:\WINDOWS\system32\brastk.exe HKU-Default-Run-Windows Automatical Updater - dcz.exe HKU-Default-Run-Microsoft Updater Winnt32dlls - rundllnt32.exe . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Jemma and Matt\Application Data\Mozilla\Firefox\Profiles\4vyucn21.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.co.nz FF -: plugin - C:\Program Files\ACE Mega CoDecS Pack\SystemS\RealMedia\Browser\plugins\nppl3260.dll FF -: plugin - C:\Program Files\ACE Mega CoDecS Pack\SystemS\RealMedia\Browser\plugins\nprpjplug.dll FF -: plugin - C:\Program Files\Adobe\Acrobat 5.0\Reader\browser\nppdf32.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-24 07:20:21 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\autorun] "ImagePath"="\??\c:\huadio.tmp" [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys)] "imagepath"="\systemroot\system32\drivers\TDSSpqxt.sys" . r Running Proce . C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASWUPDSV.exe C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.exe C:\PROGRAM FILES\COMMON FILES\LIGHTSCRIBE\LSSRVC.exe C:\PROGRAM FILES\CYBERLINK\SHARED FILES\RICHVIDEO.exe C:\PROGRAM FILES\COMMON FILES\ULEAD SYSTEMS\DVD\ULCDRSVR.exe C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHMAISV.exe C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHWEBSV.exe C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NMINDEXSTORESVR.exe C:\PROGRAM FILES\HP\DIGITAL IMAGING\BIN\HPQGALRY.exe . ************************************************************************** . Completion time: 2008-10-24 7:23:13 - machine was rebooted ComboFix-quarantined-files.txt 2008-10-23 18:23:04 Pre-Run: 12,800,557,056 bytes free Post-Run: 13,309,378,560 bytes free 186 --- E O F --- 2008-10-23 08:58:20

Please download Malwarebytes' Anti-Malware from one of these sites: MalwareBytes1 MalwareBytes2 1. Double Click mbam-setup.exe to install the application. 2. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. 3. If an update is found, it will download and install the latest version. 4. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. 5. When the scan is complete, click OK, then Show Results to view the results. 6. Make sure that everything found is checked, and click Remove Selected. 7. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately. 8. The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. 9. Copy&Paste the entire report in your next reply. Then post a new Hijack This log please.