Here goes. About 3 weeks ago my computer froze up and so I turned it off using the power button. When I turned it back on it did a disk check as I expected but it took about 3hours! When I finally got back on my computer everything seemed really slow, like opening programs etc. Next time I went to start up my computer it did a disk check again, this time it took almost 8hours!! I deleted my virus protection program –wasn’t sure if it was doing it’s job- and installed a friend’s McAfee protection program and ran a scan. Ended up deleting about 20 files in total, mostly adware stuff I think. Still my computer is slow and wants to do a disk check each time I turn it on, but now I just skip it. I tried a system restore but it would not work. Also my sound is really crackly now like when I try playing music either using iTunes or RealPlayer-same result. I only just realised last night that my windows firewall was turned off, not sure long it has been like that, but the McAfee one has been on the past week anyway. I think that’s all, haven’t really got any idea how to sort this. Any help would be greatly appreciated. Thanks

Please post a Hijack This log so that the files associated with the virus/spyware/hijacker can be identified.

Please download HJTsetup.exe from this link http://www.thespykiller.co.uk/files/HJTsetup.exe to your desktop.
Doubleclick on the HJTsetup.exe icon on your desktop.
By default it will install to C:\Program Files\Hijack This.
Continue to click "next" in the setup dialogue boxes until you get to the "Select Addition Tasks" dialogue.
Put a check by "Create a desktop icon" then click "Next" again.
Continue to follow the rest of the prompts from there.
At the final dialogue box click "Finish" and it will launch Hijack This.
Click on the "Do a system scan and save a logfile" button. It will scan and the log should open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log and post it in this thread.

Do not fix anything yet unless you know what you are doing. This is a powerful tool that can crash the computer if used improperly.

Please download SmitRemFix from this link http://siri.urz.free.fr/Fix/Smitfra... Then extract the contents to your desktop.
!!!! Only run option #1 as runing the other options on an uninfected computer will damage the desktop.!!!!
Open the "SmitfraudFix" folder and double-click "smitfraudfix.cmd"
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.
Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

Logfile of HijackThis v1.99.1
Scan saved at 21:22:33, on 13/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Arcade\PCMService.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\mcafee.com\mps\mscifapp.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\acer\eRecovery\Monitor.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.imesh.com/search/inde...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.myed.ed.ac.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.myed.ed.ac.uk/
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\PROGRA~1\mcafee.com\mps\mcbrhlpr.dll
O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [EPSON Stylus C42 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C42 Series" /O6 "USB001" /M "Stylus C42"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [McafWelcome] C:\Program Files\McAfee.com\Agent\mcwelcom.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binar...
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binar...
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin...
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binar...
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.c...
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.c...
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/M...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binar...
O16 - DPF: {BF985246-09BF-11D2-BE62-006097DF57F6} (SimCityX Control) - http://simcity.ea.com/play/classic/...
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

SmitFraudFix v2.120

Scan done at 21:36:40.12, 13/11/2006
Run from C:\Documents and Settings\David\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\ncompat.tlb FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\David

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\David\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\DAVID\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32

»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

Please download ATF-Cleaner to your desktop from this link
http://www.atribune.org/content/view/19/2/ We will need it later in safe mode

Download and install AVG Anti-Spyware We will need this later in safe mode

Be sure to update AVG Anti- Spyware

Turn off Windows Defender Realtime protection untill we get you clean:

Open Windows Defender
Click on "Tools"
Click on "General Settings"
Scroll down to "Real-time protection options"
Uncheck "Turn on Real-time protection (recommended)"
Click "Save"

Go to start> control panel> add/remove prgrams> uninstall these programs if found:

MyWebSearch (or anything with myweb or mywebsearch in it)

SaveNow

WhenU

Webhancer

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.

Next, please reboot your computer in Safe Mode by doing the following :

Restart your computer

After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;

Instead of Windows loading as normal, a menu with options should appear;

Select the first option, to run Windows in Safe Mode, then press "Enter".

Choose your usual account.

Run Hijack This from safe mode, close all windows except Hijack This, place a check to the left of the following items and press "fix checked":

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.imesh.com/search/inde...

O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL

O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)

Exit Hijack This but remain in safe mode.

Navigate to and delete this folder:

C:\Program Files\MyWay

Next, from safe mode, open the "SmitfraudFix" folder again and double-click "smitfraudfix.cmd"
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing " Y " and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if "wininet.dll " is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing "Y" and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.

A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Please download ComboFix to the desktop from this link:

http://download.bleepingcomputer.com/sUBs/combofix.exe

Double-click combofix.exe
Follow the prompts.
(Don't click on the window while the program is running, it may cause your system to hang.)

Please post the combofix.txt log and a new Hijack This log please.

Ok, I have followed the steps so far but when it came to rebooting my computer and running it in safe mode it didn't work. I got the screen up and selected 'safe mode' and then the os but then the screen went black and some text appeared. I left it each time -tried it twice- for about 1hour and it didnt change so I just restarted. Unsure of the steps to take now. Will try the same method next time I power up but any further input as to why it may not have worked would be very helpful. Thanks

Run through the steps in normal mode, including smitrem, then post the combofix log please.

SmitFraudFix v2.120

Scan done at 3:11:36.03, 14/11/2006
Run from C:\Documents and Settings\David\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

David - 06-11-14 3:28:17.59 Service Pack 2
ComboFix 06.11.9 - Running from: "C:\Documents and Settings\David\Desktop"

((((((((((((((((((((((((((((((( Files Created from 2006-10-14 to 2006-11-14 ))))))))))))))))))))))))))))))))))


2006-11-13 23:25 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-11-13 21:36 5,778 --a------ C:\WINDOWS\system32\tmp.reg
2006-11-13 21:35 53,248 --a------ C:\WINDOWS\system32\Process.exe
2006-11-13 21:35 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2006-11-13 21:35 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2006-11-13 21:35 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2006-11-05 18:18 90,112 --a------ C:\WINDOWS\system32\McRtl32.dll
2006-11-05 18:18 9,216 --a------ C:\WINDOWS\system32\MpfApi.dll
2006-11-05 18:18 80,640 --a------ C:\WINDOWS\system32\drivers\MpFirewall.sys
2006-11-05 18:18 32,768 --a------ C:\WINDOWS\system32\instlsp.exe
2006-11-05 18:18 131,072 --a------ C:\WINDOWS\system32\mclsp.dll
2006-11-05 18:16 114,464 --a------ C:\WINDOWS\system32\drivers\naiavf5x.sys
2006-11-05 18:14 349,760 --a------ C:\WINDOWS\system32\mcinsctl.dll
2006-11-05 18:14 288,320 -ra------ C:\WINDOWS\system32\mcgdmgr.dll
2006-10-27 15:57 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys
2006-10-27 15:57 15,360 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys
2006-10-27 15:57 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys
2006-10-27 15:56 85,376 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys
2006-10-27 15:56 44,544 --a------ C:\WINDOWS\system32\OVUI2.dll
2006-10-27 15:56 41,984 --a------ C:\WINDOWS\system32\OVUI2RC.dll
2006-10-27 15:56 39,424 --a------ C:\WINDOWS\system32\OVComS.exe
2006-10-27 15:56 351,616 --a------ C:\WINDOWS\system32\drivers\OVCodek2.sys
2006-10-27 15:56 28,032 --a------ C:\WINDOWS\system32\drivers\OVCD.sys
2006-10-27 15:56 20,480 --a------ C:\WINDOWS\system32\OVComC.dll
2006-10-27 15:56 19,328 --a------ C:\WINDOWS\system32\drivers\WSTCODEC.SYS
2006-10-27 15:56 17,024 --a------ C:\WINDOWS\system32\drivers\CCDECODE.sys
2006-10-27 15:56 116,736 --a------ C:\WINDOWS\system32\OVCodec2.dll
2006-10-27 15:56 11,136 --a------ C:\WINDOWS\system32\drivers\SLIP.sys
2006-10-27 15:55 53,760 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2006-10-27 15:55 48,000 --a------ C:\WINDOWS\system32\drivers\OVCam2.sys

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2006-11-05 18:34 -------- d-------- C:\Documents and Settings\David\Application Data\McAfee.com Personal Firewall
2006-11-05 18:19 -------- d-------- C:\Program Files\McAfee
2006-11-05 18:14 -------- d-------- C:\Program Files\McAfee.com
2006-11-02 11:54 -------- d-------- C:\Program Files\MSN Messenger
2006-10-31 14:38 1749 --a------ C:\Documents and Settings\David\Application Data\AdobeDLM.log
2006-09-13 06:01 1084416 --a------ C:\WINDOWS\system32\msxml3.dll
2006-08-25 16:45 617472 --a------ C:\WINDOWS\system32\comctl32.dll
2006-08-21 13:21 16896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-08-21 10:14 23040 --a------ C:\WINDOWS\system32\fltMc.exe
2006-08-16 12:58 100352 --a------ C:\WINDOWS\system32\6to4svc.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.908.5008\\GoogleToolbarNotifier.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"LaunchApp"="Alaunch"
"IgfxTray"="C:\\WINDOWS\\system32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINDOWS\\system32\\hkcmd.exe"
"SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe"
"SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"
"PCMService"="\"C:\\Program Files\\Arcade\\PCMService.exe\""
"IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32"
"MSPY2002"="C:\\WINDOWS\\system32\\IME\\PINTLGNT\\ImScInst.exe /SYNC"
"PHIME2002ASync"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC"
"PHIME2002A"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName"
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"EPM-DM"="c:\\acer\\epm\\epm-dm.exe"
"ePowerManagement"="C:\\Acer\\ePM\\ePM.exe boot"
"LManager"="C:\\Program Files\\Launch Manager\\QtZgAcer.EXE"
"eRecoveryService"="C:\\Windows\\System32\\Check.exe"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"Adobe Photo Downloader"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\""
"EPSON Stylus C42 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S10IC2.EXE /P23 \"EPSON Stylus C42 Series\" /O6 \"USB001\" /M \"Stylus C42\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"McafWelcome"="C:\\Program Files\\McAfee.com\\Agent\\mcwelcom.exe"
"VSOCheckTask"="\"C:\\PROGRA~1\\McAfee.com\\VSO\\mcmnhdlr.exe\" /checktask"
"VirusScan Online"="C:\\Program Files\\McAfee.com\\VSO\\mcvsshld.exe"
"OASClnt"="C:\\Program Files\\McAfee.com\\VSO\\oasclnt.exe"
"MCAgentExe"="c:\\PROGRA~1\\mcafee.com\\agent\\mcagent.exe"
"MCUpdateExe"="C:\\PROGRA~1\\mcafee.com\\agent\\mcupdate.exe"
"MPFExe"="C:\\PROGRA~1\\McAfee.com\\PERSON~1\\MpfTray.exe"
"MPSExe"="c:\\PROGRA~1\\mcafee.com\\mps\\mscifapp.exe /embedding"
"MSKAGENTEXE"="C:\\PROGRA~1\\McAfee\\SPAMKI~1\\MskAgent.exe"
"MSKDetectorExe"="C:\\PROGRA~1\\McAfee\\SPAMKI~1\\MSKDetct.exe /startup"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="Microsoft AntiMalware ShellExecuteHook"
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\MP Scheduled Scan.job

Completion time: 06-11-14 3:29:03.84
C:\ComboFix.txt ... 06-11-14 03:29

Logfile of HijackThis v1.99.1
Scan saved at 03:30:36, on 14/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Acer\eManager\anbmServ.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Arcade\PCMService.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
c:\program files\mcafee.com\agent\mcdetect.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
c:\program files\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\mcafee.com\mps\mscifapp.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\acer\eRecovery\Monitor.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Hijackthis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\PROGRA~1\mcafee.com\mps\mcbrhlpr.dll
O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [EPSON Stylus C42 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C42 Series" /O6 "USB001" /M "Stylus C42"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [McafWelcome] C:\Program Files\McAfee.com\Agent\mcwelcom.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binar...
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binar...
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin...
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binar...
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.c...
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.c...
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/M...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binar...
O16 - DPF: {BF985246-09BF-11D2-BE62-006097DF57F6} (SimCityX Control) - http://simcity.ea.com/play/classic/...
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

Please download Dr Web CureIt to your desktop from this link ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
Doubleclick the drweb-cureit.exe file and Allow to run the express scan.
This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it.
This is only a short scan.
Once the short scan has finished, mark the drives that you want to scan.
Select all drives.
A red dot shows which drives have been chosen.
Click the green arrow at the right, and the scan will start.
Click 'Yes to all' if it asks if you want to cure/move the file.
When the scan has finished, look if you can click next icon next to the files found:
If so, click it and then click the next icon right below and select Move incurable.
This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
Save the report to your desktop. The report will be called DrWeb.csv
Close Dr.Web Cureit.
Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
After reboot, post the contents of the log on your desktop.

actskn45.ocx;C:\WINDOWS\system32;Trojan.Isbar.439;Deleted.;
Process.exe;C:\WINDOWS\system32;Tool.Prockill;Incurable.Moved.;
Process.exe;C:\Documents and Settings\David\Desktop\SmitfraudFix;Tool.Prockill;Incurable.Moved.;
restart.exe;C:\Documents and Settings\David\Desktop\SmitfraudFix;Tool.ShutDown.11;Incurable.Moved.;
backup-20061114-030244-277.dll;C:\Program Files\Hijackthis\backups;Adware.MyWay;Incurable.Moved.;
A0035927.EXE;C:\System Volume Information\_restore{203A9C89-7A2C-419F-A40E-8C82E0800C2E}\RP470;Adware.MyWay;Incurable.Moved.;
A0035928.DLL;C:\System Volume Information\_restore{203A9C89-7A2C-419F-A40E-8C82E0800C2E}\RP470;Adware.MyWay;Incurable.Moved.;
A0035929.DLL;C:\System Volume Information\_restore{203A9C89-7A2C-419F-A40E-8C82E0800C2E}\RP470;Adware.MyWay;Incurable.Moved.;
A0035958.ocx;C:\System Volume Information\_restore{203A9C89-7A2C-419F-A40E-8C82E0800C2E}\RP470;Trojan.Isbar.439;Deleted.;

Don't mean to butt in, but it also seems wise to have this user run diagnostics from the Harddrive mfg to check for problems with the drive not related to spyware and viruses.

One more cleanup proceedure.

Please download ATF-Cleaner to your desktop from this link
http://www.atribune.org/content/view/19/2/ We will need it later in safe mode

Download and install AVG Anti-Spyware We will need this later in safe mode

Be sure to update AVG Anti- Spyware

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.

Run AVG Anti-spyware from normal mode and click on the Scanner tab at the top. Click the "Settings" tab and then change the recommended action to Quarantine and click Automatically generate report after every scan. Click back to the "Scan" tab and then click on Complete System Scan. This scan can take quite a while to run, so be prepared.

AVG Anti-Spyware will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. AVG Anti-Spyware will display "All actions have been applied" on the right hand side.

Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop).

Post the results of the AVG-Antispyware scan.

Then try to boot into safe mode and let me know what happens.

AVG Anti-Spyware - Scan Report

+ Created at: 12:41:23 15/11/2006

+ Scan result:

HKLM\SOFTWARE\Classes\LBBHO.LBBHO -> Adware.RelatedLinks : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\LBBHO.LBBHO.1 -> Adware.RelatedLinks : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\LBBHO.LBBHO\CLSID -> Adware.RelatedLinks : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\LBBHO.LBBHO\CurVer -> Adware.RelatedLinks : Cleaned with backup (quarantined).
C:\Documents and Settings\David\Cookies\david@247realmedia[1].txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.109:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.110:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.111:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.112:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.113:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.114:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.115:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.116:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.117:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.118:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.119:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.120:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.360:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\David\Cookies\david@122.2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\David\Cookies\david@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\David\Cookies\david@cbs.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\David\Cookies\david@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\David\Cookies\david@msnportal.112.2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\David\Cookies\david@nike.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\David\Cookies\david@opodo.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\David\Cookies\david@paypal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.159:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.160:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\David\Cookies\david@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\David\Cookies\david@adbrite[3].txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.245:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.246:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
:mozilla.247:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\David\Cookies\david@rotator.adjuggler[1].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\David\Cookies\david@rotator.adjuggler[2].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\David\Cookies\david@adrevolver[4].txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Documents and Settings\David\Cookies\david@netli.media.adrevolver[1].txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Documents and Settings\David\Cookies\david@z1.adserver[1].txt -> TrackingCookie.Adserver : Cleaned.
:mozilla.56:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.57:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
C:\Documents and Settings\David\Cookies\david@adtech[1].txt -> TrackingCookie.Adtech : Cleaned.
C:\Documents and Settings\David\Cookies\david@adtech[3].txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.126:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.127:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.128:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.129:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\David\Cookies\david@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.143:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Adviva : Cleaned.
C:\Documents and Settings\David\Cookies\david@adviva[1].txt -> TrackingCookie.Adviva : Cleaned.
C:\Documents and Settings\David\Cookies\david@adviva[2].txt -> TrackingCookie.Adviva : Cleaned.
:mozilla.23:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\David\Cookies\david@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.371:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Bfast : Cleaned.
:mozilla.348:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Documents and Settings\David\Cookies\david@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Documents and Settings\David\Cookies\david@bluestreak[3].txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Documents and Settings\David\Cookies\david@www.burstbeacon[2].txt -> TrackingCookie.Burstbeacon : Cleaned.
:mozilla.226:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.227:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.228:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\David\Cookies\david@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\David\Cookies\david@www.burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.79:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.81:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.84:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.86:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.87:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.88:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.89:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.90:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.91:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.92:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\David\Cookies\david@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\David\Cookies\david@ad1.clickhype[1].txt -> TrackingCookie.Clickhype : Cleaned.
C:\Documents and Settings\David\Cookies\david@com[2].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\David\Cookies\david@news.com[1].txt -> TrackingCookie.Com : Cleaned.
:mozilla.236:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Coremetrics : Cleaned.
:mozilla.15:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\David\Cookies\david@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.326:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.327:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.328:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.365:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.388:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.403:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.406:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.409:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.410:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.411:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
:mozilla.415:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\David\Cookies\david@e-2dj6wfkyanazcep.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\David\Cookies\david@e-2dj6wfkyuoc5cdp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\David\Cookies\david@e-2dj6wfmisgdzkaq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\David\Cookies\david@e-2dj6whkowgczeeo.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\David\Cookies\david@e-2dj6wjliqpajseo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\David\Cookies\david@estat[1].txt -> TrackingCookie.Estat : Cleaned.
:mozilla.155:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.156:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.157:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.158:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
C:\Documents and Settings\David\Cookies\david@adopt.euroclick[2].txt -> TrackingCookie.Euroclick : Cleaned.
C:\Documents and Settings\David\Cookies\david@as-us.falkag[1].txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.80:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.82:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.83:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.85:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\David\Cookies\david@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\David\Cookies\david@fastclick[3].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\David\Cookies\david@media.fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\David\Cookies\david@ehg-bookpeople.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\David\Cookies\david@ehg-designreactor.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\David\Cookies\david@ehg-iwantoneofthose.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\David\Cookies\david@ehg-rodale.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\David\Cookies\david@ehg-viacom.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\David\Cookies\david@ehg-zazzle.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\David\Cookies\david@hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\David\Cookies\david@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.398:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Hitslink : Cleaned.
:mozilla.399:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Hitslink : Cleaned.
:mozilla.400:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Hitslink : Cleaned.
:mozilla.401:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Hitslink : Cleaned.
C:\Documents and Settings\David\Cookies\david@counter.hitslink[1].txt -> TrackingCookie.Hitslink : Cleaned.
C:\Documents and Settings\David\Cookies\david@hotlog[2].txt -> TrackingCookie.Hotlog : Cleaned.
C:\Documents and Settings\David\Cookies\david@linksynergy[1].txt -> TrackingCookie.Linksynergy : Cleaned.
C:\Documents and Settings\David\Cookies\david@image.masterstats[1].txt -> TrackingCookie.Masterstats : Cleaned.
:mozilla.268:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\David\Cookies\david@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\David\Cookies\david@mediaplex[2].txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.386:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\David\Cookies\david@overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\David\Cookies\david@perf.overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\David\Cookies\david@ads.pointroll[2].txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.373:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Qksrv : Cleaned.
:mozilla.374:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Qksrv : Cleaned.
:mozilla.46:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.47:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.48:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.49:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\David\Cookies\david@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\David\Cookies\david@questionmarket[3].txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\David\Cookies\david@revenue[1].txt -> TrackingCookie.Revenue : Cleaned.
:mozilla.24:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.25:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.26:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.27:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.28:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Documents and Settings\David\Cookies\david@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Documents and Settings\David\Cookies\david@serving-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Documents and Settings\David\Cookies\david@cs.sexcounter[2].txt -> TrackingCookie.Sexcounter : Cleaned.
C:\Documents and Settings\David\Cookies\david@cs.sexcounter[3].txt -> TrackingCookie.Sexcounter : Cleaned.
C:\Documents and Settings\David\Cookies\david@sexlist[2].txt -> TrackingCookie.Sexlist : Cleaned.
C:\Documents and Settings\David\Cookies\david@counter14.sextracker[1].txt -> TrackingCookie.Sextracker : Cleaned.
C:\Documents and Settings\David\Cookies\david@counter15.sextracker[1].txt -> TrackingCookie.Sextracker : Cleaned.
C:\Documents and Settings\David\Cookies\david@counter7.sextracker[1].txt -> TrackingCookie.Sextracker : Cleaned.
C:\Documents and Settings\David\Cookies\david@sextracker[2].txt -> TrackingCookie.Sextracker : Cleaned.
:mozilla.299:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.
:mozilla.300:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.
:mozilla.302:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned.
C:\Documents and Settings\David\Cookies\david@adopt.specificclick[1].txt -> TrackingCookie.Specificclick : Cleaned.
C:\Documents and Settings\David\Cookies\david@spylog[2].txt -> TrackingCookie.Spylog : Cleaned.
:mozilla.69:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.70:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.71:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.72:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.73:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.74:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.75:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.76:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.77:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
C:\Documents and Settings\David\Cookies\david@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned.
C:\Documents and Settings\David\Cookies\david@statcounter[3].txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.39:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.40:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.41:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.42:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\David\Cookies\david@anad.tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\David\Cookies\david@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.224:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Targetnet : Cleaned.
:mozilla.225:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Targetnet : Cleaned.
C:\Documents and Settings\David\Cookies\david@targetnet[1].txt -> TrackingCookie.Targetnet : Cleaned.
:mozilla.279:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
C:\Documents and Settings\David\Cookies\david@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.324:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Trafic : Cleaned.
C:\Documents and Settings\David\Cookies\david@trafic[1].txt -> TrackingCookie.Trafic : Cleaned.
:mozilla.141:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.142:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\David\Cookies\david@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\David\Cookies\david@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\David\Cookies\david@reduxads.valuead[2].txt -> TrackingCookie.Valuead : Cleaned.
:mozilla.363:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned.
:mozilla.96:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
C:\Documents and Settings\David\Cookies\david@statse.webtrendslive[1].txt -> TrackingCookie.Webtrendslive : Cleaned.
C:\Documents and Settings\David\Cookies\david@statse.webtrendslive[3].txt -> TrackingCookie.Webtrendslive : Cleaned.
C:\Documents and Settings\David\Cookies\david@xxxcounter[1].txt -> TrackingCookie.Xxxcounter : Cleaned.
:mozilla.413:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Yadro : Cleaned.
:mozilla.414:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Yadro : Cleaned.
C:\Documents and Settings\David\Cookies\david@yadro[1].txt -> TrackingCookie.Yadro : Cleaned.
:mozilla.10:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.11:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.12:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.13:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.7:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.8:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.9:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\David\Cookies\david@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\David\Cookies\david@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.144:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.145:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.146:C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\3hdy7csx.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
C:\Documents and Settings\David\Cookies\david@zedo[2].txt -> TrackingCookie.Zedo : Cleaned.

::Report end

Hey, I tried to reboot in safe mode but once again it did not work. Just got a black screen full of text again.

Please download VundoFix.exe to your C:\.

Then try this:

Reboot into safe mode and when the black screen appears and the text "safe mode" is displayed in the corners,open the taskmanager (Ctrl+Alt+Del) and find "explorer.exe . Click on it in the list and click "Terminate". This will probably take at least 3 to 5 minutes.
Once Explorer is terminated you'll be able to navigate with the mouse, but you will have a desktop without icons.

Remember where you installed the "VundoFix" (Desktop hopefully). Open the taskmanager again, and click "file" then click "run" in the toolbar. Type in the filepath to the VundoFix in the scrollbar and hit enter.
The default location of the VundoFix is here :

C:\Documents and Settings\YOUR USERNAME\Desktop\VundoFix.exe

Replace "your username" with "ever what your user name is".
Then click "ok".

Post the log located at Vundofix.txt and try to boot into safe mode again and let me know what happens.

I got to the screen where you choose 'safe mode' and tried task manager there but pressing the buttons just rebooted my computer. Tried it again but on the screen after selecting 'safe mode' where it asks about operating system. Same happened -rebooted. Tried again, 'safe mode' selected operating sytem, then when the screen full of text came i pressed ctrl+alt+del and nothing happened. Can it be done in normal mode after the computer is fully booted up or am have I misunderstood the instructions?

Run Vundofix from normal mode.

Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will shutdown your computer, click OK.
Turn your computer back on.
Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.

Post the log located at C:Vundofix.txt.

If anything was found and fixed then try safe mode again.

Do you happen to have a xp cd?

VundoFix V6.2.8

Checking Java version...

Java version is 1.5.0.4

Java version is 1.5.0.6

Java version is 1.5.0.9

Scan started at 17:42:28 15/11/2006

Listing files found while scanning....

No infected files were found.

Beginning removal...

Beginning removal...

I can lay my hands on an XP disc yeah. Am a student so would have to have it posted from my home. Nothing was fixed so I didn't try 'safe mode' again.

For now do not try any other methods of getting into safe mode or you may end up in a "boot loop" as there are other ways to get in that alter the boot.ini files and cause a continuous boot cycle.

Hey, its been a while since I was on here and I'm still having the same problems although not quite as extreme. I am now able to boot up in safe mode though by using
start
run
"msconfig"
then changing something there. Read something online how to do it. Did a scan using AVG in safe mode and it found no threats but said there was a boot up error in the C drive... I'm not sure what this means. So will I finally be able to fix my problem?
Thanks