I have read some similar posts about the Klone trojan (or virus as avg calls it) but they dont seem to co-relate with my experiences A routine scan with avg detected a single instance of Klone virus within the file bit_che.exe, a bittorrent search engine I have installed (yes I know downloading stuff is probably how I got it, lesson learnt). Avg has deleted the file and I have removed any system restore points. further avg, trend micro (online scan) and vundofix scans have been clear. My concern is that 2 days before I found this infection my girlfriends creditcard info was stolen. She had used a possibly non secure payment site but I am concerned about the coincidence of then finding a trojan that is possibly capable of lifting card numbers. From the above info and my hijack this log (available if req.) can anyone either reassure me that I am clean or suggest what else I can do to be certain

Let me to have a look. Download the "HijackThis" Installer from this link: http://www.trendsecure.com/portal/e... 1. Save " HJTInstall.exe" to your desktop. 2. Double click on HJTInstall.exe to run the program. 3. By default it will install to C:\Program Files\Trend Micro\HijackThis. 4. Accept the license agreement by clicking the "I Accept" button. 5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log. 6. Click "Save log" to save the log file and then the log will open in Notepad. 7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log. 8. Paste the log in your next reply. 9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required. Post Hijackthis Log in your next reply. *Do Safe Computing*

Thanks adii Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:20:34, on 24/04/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: E:\WINDOWS\System32\smss.exe E:\WINDOWS\system32\winlogon.exe E:\WINDOWS\system32\services.exe E:\WINDOWS\system32\lsass.exe E:\WINDOWS\system32\Ati2evxx.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\WINDOWS\system32\Ati2evxx.exe E:\WINDOWS\Explorer.exe E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe E:\PROGRA~1\Grisoft\AVG7\avgcc.exe E:\WINDOWS\system32\spoolsv.exe E:\WINDOWS\RTHDCPL.exe E:\Program Files\COMODO\Firewall\cfp.exe E:\Program Files\Windows XP Fun Pack\Winter 2003\WinterPowerToy\WinterWalltoy.exe E:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe E:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe E:\Program Files\COMODO\Firewall\cmdagent.exe E:\WINDOWS\System32\svchost.exe E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe E:\Program Files\UPHClean\uphclean.exe E:\Program Files\Internet Explorer\iexplore.exe E:\PROGRAM FILES\ATI TECHNOLOGIES\ATI.ACE\CORE-STATIC\mom.exe E:\PROGRAM FILES\ATI TECHNOLOGIES\ATI.ACE\CORE-STATIC\ccc.exe E:\Program Files\VideoLAN\VLC\vlc.exe E:\Program Files\Mozilla Firefox\firefox.exe E:\Documents and Settings\Administrator\Desktop\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ig?hl=en R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar5.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar5.dll O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] E:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe O4 - HKLM\..\Run: [AVG7_CC] E:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.exe O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.exe O4 - HKLM\..\Run: [StartCCC] "E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.exe O4 - HKLM\..\Run: [Alcmtr] ALCMTR.exe O4 - HKLM\..\Run: [COMODO Firewall Pro] "E:\Program Files\COMODO\Firewall\cfp.exe" -h O4 - HKCU\..\Run: [StartCCC] E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] E:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] E:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] E:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] E:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Startup: Winter Fun Wallpaper Changer.lnk = ? O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} - O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} - O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} - O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} - O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - O20 - AppInit_DLLs: E:\WINDOWS\system32\guard32.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - E:\Program Files\COMODO\Firewall\cmdagent.exe O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

Please run HijackThis again! and click "Scan." Place checks next to the following entries: O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} - O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} - O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} - O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} - O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - Close all browsers and other windows except for HijackThis!, and click "Fix checked". Please download ATF Cleaner by Atribune. (This program is for XP and Windows 2000 only) Download: http://www.atribune.org/ccount/clic... Double-click ATF-Cleaner.exe to run the program. Under Main "Select Files to Delete" choose: Select All. Click the Empty Selected button. If you use Firefox browser: Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. If you use Opera browser: Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. Click Exit on the Main menu to close the program. Please do an online scan with Kaspersky WebScanner. online scanner: http://www.kaspersky.com/virusscanner 1.Click on "Kaspersky Online Scanner". 2.You will be prompted to install an ActiveX component from Kaspersky, Click Yes. 3.The program will launch and then begin downloading the latest definition files. 4.Once the files have been downloaded click on "NEXT". 5.Now click on "Scan Settings". 6.In the scan settings make that the following are selected: 7.Scan using the following Anti-Virus database: Extended (if available otherwise Standard) 8.Scan Options: Scan Archives Scan Mail Bases 9.Click OK. 10.Under select a target to scan, select "My Computer". This will program will start and scan your system. The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected. Upon completion, click on the "Save as Text" button. Save the file to your desktop. Copy and paste that information in your next reply. Post Hijackthis Log in your next reply. *Do Safe Computing*

updated hijack this file... Running processes: E:\WINDOWS\System32\smss.exe E:\WINDOWS\system32\winlogon.exe E:\WINDOWS\system32\services.exe E:\WINDOWS\system32\lsass.exe E:\WINDOWS\system32\Ati2evxx.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\WINDOWS\system32\Ati2evxx.exe E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe E:\WINDOWS\Explorer.exe E:\WINDOWS\system32\spoolsv.exe E:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe E:\PROGRA~1\Grisoft\AVG7\avgcc.exe E:\WINDOWS\RTHDCPL.exe E:\Program Files\COMODO\Firewall\cfp.exe E:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe E:\Program Files\Windows XP Fun Pack\Winter 2003\WinterPowerToy\WinterWalltoy.exe E:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe E:\Program Files\COMODO\Firewall\cmdagent.exe E:\WINDOWS\System32\svchost.exe E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe E:\Program Files\UPHClean\uphclean.exe E:\WINDOWS\system32\wuauclt.exe E:\Documents and Settings\Administrator\Desktop\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ig?hl=en R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar5.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar5.dll O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] E:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe O4 - HKLM\..\Run: [AVG7_CC] E:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.exe O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.exe O4 - HKLM\..\Run: [StartCCC] "E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.exe O4 - HKLM\..\Run: [Alcmtr] ALCMTR.exe O4 - HKLM\..\Run: [COMODO Firewall Pro] "E:\Program Files\COMODO\Firewall\cfp.exe" -h O4 - HKCU\..\Run: [StartCCC] E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] E:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] E:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] E:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] E:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Startup: Winter Fun Wallpaper Changer.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/pa... O20 - AppInit_DLLs: E:\WINDOWS\system32\guard32.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - E:\Program Files\COMODO\Firewall\cmdagent.exe O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe Kaspersky WebScanner log... Scan Statistics Total number of scanned objects 99504 Number of viruses found 0 Number of infected objects 0 Number of suspicious objects 0 Duration of the scan process 01:08:04 Infected Object Name Virus Name Last Action E:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped E:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped E:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012008042420080425\index.dat Object is locked skipped E:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012008042520080426\index.dat Object is locked skipped E:\Documents and Settings\Administrator\Local Settings\Temp\~DFBE1D.tmp Object is locked skipped E:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped E:\Documents and Settings\Administrator\ntuser.dat Object is locked skipped E:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped E:\Documents and Settings\All Users\Application Data\comodo\Firewall Pro\cfplogdb.sdb Object is locked skipped E:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped E:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped E:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped E:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped E:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped E:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped E:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped E:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped E:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped E:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped E:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped E:\WINDOWS\CSC\00000001 Object is locked skipped E:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped E:\WINDOWS\SchedLgU.Txt Object is locked skipped E:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped E:\WINDOWS\Sti_Trace.log Object is locked skipped E:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped E:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped E:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped E:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped E:\WINDOWS\system32\config\default Object is locked skipped E:\WINDOWS\system32\config\default.LOG Object is locked skipped E:\WINDOWS\system32\config\SAM Object is locked skipped E:\WINDOWS\system32\config\SAM.LOG Object is locked skipped E:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped E:\WINDOWS\system32\config\SECURITY Object is locked skipped E:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped E:\WINDOWS\system32\config\software Object is locked skipped E:\WINDOWS\system32\config\software.LOG Object is locked skipped E:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped E:\WINDOWS\system32\config\system Object is locked skipped E:\WINDOWS\system32\config\system.LOG Object is locked skipped E:\WINDOWS\system32\drivers\atapi.sys Object is locked skipped E:\WINDOWS\system32\h323log.txt Object is locked skipped E:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped E:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped E:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped E:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped E:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped E:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped E:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped E:\WINDOWS\Temp\Perflib_Perfdata_63c.dat Object is locked skipped E:\WINDOWS\wiadebug.log Object is locked skipped E:\WINDOWS\wiaservc.log Object is locked skipped E:\WINDOWS\WindowsUpdate.log Object is locked skipped

All scans I have done up to this point have been clear. I frequenty also use spybot s+d, adaware and spywareblaster. Just updated to avg version 8 and ran a scan. It just found 239 "warning infections" all activex based. None of these were detected by any other scanner which seems odd. I have listed one below as an example. there was a mix of about 6 different trojans and loads listed as adware. Does it seem odd that no other scanner detected any of these??? HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{8E13DDE1-E013-47ec-9C4C-27C2F78BDD26};"Found Trojan.Conhook.c";"Potentially dangerous object"

Oh and a fair few of the infections found by avg were "vundo" which is particularly odd as I had already run vundofix.exe (recommended to another user on this forum). I'm confused and a little concerned about entering any important info on any website now. UPDATE: It seems the original "threat" in bit_che.exe was a false positive from avg. see here... http://convivea.com/forums/index.ph... This is making me think all these new registry entries that the new avg has found are in some way also false positives ?something related to spyware blasters protection. Anyone any ideas UPDATE2: After fixing all the activex "warnings" avg found I ran a second scan which was clear. I then ran spyware blaster again and found that loads of entries were not protected. After enabling all protection on spywareblaster I re-ran avg and low and behold all the warnings came back so it seems that avg8 and spywareblaster just don't get along