There are over thousands of those POS.TMP files in my document folder and my C: drive! And also those two icons on my desktop that I can't delete (Help & Support and Windows Update). StorageProtector keeps on popping up and some Windows warning messages. Please help !

Go to the this link: Disable Realtime Protection Follow their directions to disable any realtime protection that you have as it will interfere with the fix by reinstalling the corrupt files. Please download Atribune's VundoFix.exe from the following site to your desktop: Vundofix.exe Double-click VundoFix.exe to run it. Click the Scan for Vundo button. Once it's done scanning, click the Remove Vundo button. You will receive a prompt asking if you want to remove the files, click "yes". Once you click yes, your desktop will go blank as it starts removing Vundo. When completed, it will prompt that it will reboot your computer, click "ok". Please download and install the latest version of HijackThis v2.0.2: Download the "HijackThis" Installer from this link: Hijack This 1. Save " HJTInstall.exe" to your desktop. 2. Double click on HJTInstall.exe to run the program. 3. By default it will install to C:\Program Files\Trend Micro\HijackThis. 4. Accept the license agreement by clicking the "I Accept" button. 5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log. 6. Click "Save log" to save the log file and then the log will open in Notepad. 7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log. 8. Paste the log in your next reply. 9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required. Please download ComboFix to the desktop from one of the following links: Link1 Link 2 Link 3 Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running, it may cause your system to hang.) Please post the log it produces.

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 오전 5:13:57, on 2008-02-20 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0013) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temporary Directory 6 for HiJackThis.zip\HijackThis.exe O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [WiFiCFG.EXE] "C:\Program Files\802.11g USB2.0 adapter\WiFiCFG.exe" O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" /IMEName O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" /SYNC O4 - HKLM\..\Run: [BMa724b0b6] Rundll32.exe "C:\WINDOWS\system32\ynmjexst.dll",s O4 - HKLM\..\Run: [a417832a] rundll32.exe "C:\WINDOWS\system32\yrypsygn.dll",b O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [kxva] C:\WINDOWS\system32\kxvo.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (file missing) O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {04E7BADF-F3B9-420D-B82D-8D8CADEFE4F9} (CyImage2Ctl Class) - http://cyimg4.cyworld.com/ImageUplo... O16 - DPF: {11D327E3-EE49-4205-B986-596D1C96646F} (HanConnectManager Control) - http://www.hangok.com/common/HanCon... O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin... O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls... O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls... O16 - DPF: {7A9935D3-9B3C-4382-B62A-45CF92B18D74} (Uploader Class) - http://cyimg7.cyworld.com/storyRoom... O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binar... O16 - DPF: {EDEB4C33-5320-42B3-838C-ADF6A0D2055B} (XA3boxUpDown Control) - http://www.a3box.co.kr/ActiveX/XA3b... O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NetDrive Service (ndsvc) - 솔루션박스 - C:\Program Files\Netomi\Netdrive Service\ndsvc.exe -- End of file - 3884 bytes ------- ComboFix 08-02-21 - Administrator 2008-02-20 5:15:34.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.949.1.1033.18.186 [GMT 9:00] Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\ComPlus Applications\hokeroxo4444.dll C:\Program Files\ComPlus Applications\hokeroxo83122.dll C:\Program Files\outlook C:\Program Files\outlook\outlook.exe C:\Program Files\outlook\p.zip C:\Program Files\outlook\v.tmp C:\Program Files\WinBudget C:\Program Files\WinBudget\bin\crap.1199079160.old C:\Program Files\WinBudget\bin\crap.1199729953.old C:\Program Files\WinBudget\bin\crap.1200335914.old C:\Program Files\WinBudget\bin\matrix.dat C:\Program Files\WinBudget\bin\matrix.dll C:\Program Files\WinBudget\bin\matrix.dll.1199729951.old C:\Program Files\WinBudget\bin\matrix.dll.1200335913.old C:\Program Files\WinBudget\bin\tempzor C:\Program Files\Windows NT\lavu.dll C:\Program Files\Windows NT\lavu12.dll C:\Program Files\Windows NT\lavu120.dll C:\Program Files\Windows NT\lavu127.dll C:\Program Files\Windows NT\lavu144.dll C:\Program Files\Windows NT\lavu193.dll C:\Program Files\Windows NT\lavu201.dll C:\Program Files\Windows NT\lavu248.dll C:\Program Files\Windows NT\lavu262.dll C:\Program Files\Windows NT\lavu294.dll C:\Program Files\Windows NT\lavu313.dll C:\Program Files\Windows NT\lavu319.dll C:\Program Files\Windows NT\lavu320.dll C:\Program Files\Windows NT\lavu341.dll C:\Program Files\Windows NT\lavu41.dll C:\Program Files\Windows NT\lavu448.dll C:\Program Files\Windows NT\lavu45.dll C:\Program Files\Windows NT\lavu453.dll C:\Program Files\Windows NT\lavu480.dll C:\Program Files\Windows NT\lavu510.dll C:\Program Files\Windows NT\lavu546.dll C:\Program Files\Windows NT\lavu552.dll C:\Program Files\Windows NT\lavu575.dll C:\Program Files\Windows NT\lavu578.dll C:\Program Files\Windows NT\lavu601.dll C:\Program Files\Windows NT\lavu620.dll C:\Program Files\Windows NT\lavu646.dll C:\Program Files\Windows NT\lavu673.dll C:\Program Files\Windows NT\lavu683.dll C:\Program Files\Windows NT\lavu704.dll C:\Program Files\Windows NT\lavu71.dll C:\Program Files\Windows NT\lavu720.dll C:\Program Files\Windows NT\lavu721.dll C:\Program Files\Windows NT\lavu774.dll C:\Program Files\Windows NT\lavu778.dll C:\Program Files\Windows NT\lavu831.dll C:\Program Files\Windows NT\lavu84.dll C:\Program Files\Windows NT\lavu847.dll C:\Program Files\Windows NT\lavu854.dll C:\Program Files\Windows NT\lavu862.dll C:\Program Files\Windows NT\lavu876.dll C:\Program Files\Windows NT\lavu88.dll C:\Program Files\Windows NT\lavu900.dll C:\Program Files\Windows NT\lavu937.dll C:\Program Files\Windows NT\lavu950.dll C:\Temp\1cb C:\Temp\1cb\syscheck.log C:\Temp\bkR11 C:\Temp\bkR11\ftCa.log C:\temp\tn3 C:\WINDOWS\cookies.ini C:\WINDOWS\mrofinu1000106.exe C:\WINDOWS\mrofinu572.exe C:\WINDOWS\system32\bbc5 C:\WINDOWS\system32\ddcdebx.dll C:\WINDOWS\system32\ddcyy.dll C:\WINDOWS\system32\doc4 C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\pac.txt C:\WINDOWS\system32\rex2 C:\WINDOWS\system32\wintisv32.exe C:\WINDOWS\system32\yycdd.ini C:\WINDOWS\system32\yycdd.ini2 C:\WINDOWS\tk58.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_CMDSERVICE -------\LEGACY_DOMAINSERVICE -------\LEGACY_NETWORK_MONITOR ((((((((((((((((((((((((( Files Created from 2008-01-20 to 2008-02-20 ))))))))))))))))))))))))))))))) . 2008-02-21 05:21 . 2008-02-21 05:21 51,200 -r-hs---- C:\WINDOWS\system32\fool0.dll 2008-02-20 03:57 . 2008-02-20 03:57 143,449 -r-hs---- C:\WINDOWS\system32\kxvo.exe 2008-02-20 03:57 . 2008-02-20 03:57 51,200 -r-hs---- C:\WINDOWS\system32\fool1.dll 2008-02-19 08:55 . 2008-02-19 08:55 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AdwareAlert 2008-02-19 07:56 . 2008-02-19 09:25 1,237,480 ---hs---- C:\WINDOWS\system32\ngyspyry.ini 2008-02-15 07:17 . 2008-02-17 07:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec 2008-02-15 07:11 . 2008-02-18 01:10 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared 2008-02-14 09:50 . 2008-02-15 06:02 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-02-14 03:15 . 2008-02-15 06:01 <DIR> d-------- C:\Program Files\XoftSpySE 2008-02-14 03:06 . 2008-02-14 09:22 1,216,641 --ahs---- C:\WINDOWS\system32\webkrcgk.ini 2008-01-27 04:11 . 2008-01-27 09:57 <DIR> d-------- C:\Program Files\RogueRemover FREE 2008-01-21 04:18 . 2008-02-14 03:04 1,044,748 --ahs---- C:\WINDOWS\system32\spnrsjtw.ini 2008-01-20 04:16 . 2008-01-21 04:17 1,056,145 --ahs---- C:\WINDOWS\system32\lsnoihsx.ini . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-16 22:38 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-02-16 22:38 --------- d-----w C:\Program Files\A3BOX 2008-02-15 01:28 --------- d-----w C:\Program Files\802.11g USB2.0 adapter 2008-02-14 00:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-02-13 18:48 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-02-13 02:00 --------- d-----w C:\Program Files\Monkey3 2008-02-05 00:44 --------- d-----w C:\Program Files\Cyworld Studio 2007-12-30 02:31 --------- d-----w C:\Program Files\QuickTime 2007-12-30 02:28 --------- d-----w C:\Program Files\Apple Software Update 2007-12-30 02:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple 2007-12-10 18:44 35,840 ----a-w C:\WINDOWS\mrofinu572.exe.tmp 2006-05-03 10:06 163,328 --sha-r C:\WINDOWS\system32\flvDX.dll 2007-02-21 11:47 31,232 --sha-r C:\WINDOWS\system32\msfDX.dll 2005-07-29 07:24 472 --sha-r C:\WINDOWS\TVlDT00\np5GnXX.vbs . ((((((((((((((((((((((((((((((((((((((((((((( AWF )))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{328d1001-1f52-4711-adc8-202880d167b1}] C:\WINDOWS\system32\diweixnr.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EF5E61A7-3803-490F-A347-27C76EB9462E}] C:\WINDOWS\system32\gebyw.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PopUpStopperFreeEdition"="C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe" [2005-03-17 11:10 536576] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360] "kxva"="C:\WINDOWS\system32\kxvo.exe" [2008-02-20 03:57 143449] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AAWTray"="C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [ ] "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.exe" [ ] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "WiFiCFG.EXE"="C:\Program Files\802.11g USB2.0 adapter\WiFiCFG.exe" [ ] "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 22:32 455168] "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 22:32 455168] "BMa724b0b6"="C:\WINDOWS\system32\ynmjexst.dll" [ ] "a417832a"="C:\WINDOWS\system32\yrypsygn.dll" [ ] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoDesktopCleanupWizard"= 1 (0x1) "ForceClassicControlPanel"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoResolveTrack"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoResolveTrack"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{88485281-8b4b-4f8d-9ede-82e29a064277}"= C:\PROGRA~1\MarkAny\CONTEN~1\MACSMA~1.DLL [2004-11-23 16:51 192512] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Post-it® Software Notes Lite.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Post-it® Software Notes Lite.lnk backup=C:\WINDOWS\pss\Post-it® Software Notes Lite.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\a417832a] C:\WINDOWS\system32\kgcrkbew.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2007-10-10 19:51 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent] C:\Program Files\BitTorrent\bittorrent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BMa724b0b6] C:\WINDOWS\system32\ynmjexst.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ClubBox] C:\WINDOWS\system32\clubbox.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DNA] C:\Program Files\BitTorrent_DNA\dna.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1] --a--c--- 2004-08-04 07:32 208952 C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kxva] -r-hs---- 2008-02-20 03:57 143449 C:\WINDOWS\system32\kxvo.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate] --a------ 2005-06-08 14:44 196608 C:\Program Files\Logitech\Video\ManifestEngine.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray] --a--c--- 2005-06-08 15:14 217088 C:\Program Files\Logitech\Video\LogiTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\m2HostHelp] C:\PROGRA~1\CNSoft\MR613C~1.ONC\m2HostHelp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MAAgent] C:\Program Files\MarkAny\ContentSafer\MAAgent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr] C:\Program Files\MSN Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NI.UGA6P_0001_N122M2210] --a------ 2007-12-11 03:40 302624 C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winvsnet.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck] C:\Program Files\Norton AntiVirus\osCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\outlook] C:\Program Files\outlook\outlook.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2007-12-11 10:56 286720 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\runner1] C:\WINDOWS\mrofinu572.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSTray] --a--c--- 2007-02-23 16:32 126976 C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] -rahs---- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyDefender Shield] C:\Program Files\SpyDefender Pro\SpyDefender.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] --a------ 2007-10-02 06:05 27664 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh] --a------ 2007-11-13 15:48 3411968 C:\Program Files\Veoh Networks\Veoh\VeohClient.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinAble] C:\Program Files\WinAble\winable.exe S1 m2mirror;m2mirror;C:\WINDOWS\system32\DRIVERS\m2mirror.sys [2007-06-20 19:05] S3 ndsvc;NetDrive Service;"C:\Program Files\Netomi\Netdrive Service\ndsvc.exe" [2006-11-17 13:50] S3 SymIM;Symantec Network Security Intermediate Filter Service;C:\WINDOWS\system32\DRIVERS\SymIM.sys [] S3 SymIMMP;SymIMMP;C:\WINDOWS\system32\DRIVERS\SymIM.sys [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{03d9e661-e24e-11db-be42-0019660fdfcd}] \Shell\AutoRun\command - F:\evkq381.com \Shell\explore\Command - F:\evkq381.com \Shell\open\Command - F:\evkq381.com *Newly Created Service* - ZSDERF . Contents of the 'Scheduled Tasks' folder "2008-02-18 23:56:58 C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job" - C:\Program Files\AdwareAlert\AdwareAlert.ex - C:\Program Files\AdwareAlert "2008-02-14 22:51:27 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-21 05:21:48 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . r Running Proce . C:\WINDOWS\system32\conime.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\MsPMSPSv.exe . ************************************************************************** . Completion time: 2008-02-21 5:27:39 - machine was rebooted ComboFix-quarantined-files.txt 2008-02-20 20:27:36 ComboFix2.txt 2007-09-10 23:48:38

Open Notepad and copy/paste everything between the X"s into it and make sure "File::" is at the very top of the page. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX File:: C:\WINDOWS\system32\fool0.dll C:\WINDOWS\system32\kxvo.exe C:\WINDOWS\system32\fool1.dll C:\WINDOWS\system32\ngyspyry.ini C:\WINDOWS\system32\webkrcgk.ini C:\WINDOWS\system32\spnrsjtw.ini C:\WINDOWS\system32\lsnoihsx.ini C:\WINDOWS\mrofinu572.exe.tmp C:\WINDOWS\TVlDT00\np5GnXX.vbs C:\WINDOWS\system32\diweixnr.dll C:\WINDOWS\system32\gebyw.dll C:\WINDOWS\system32\ynmjexst.dll C:\WINDOWS\system32\yrypsygn.dll C:\WINDOWS\system32\clubbox.exe C:\Program Files\WinAble\winable.exe F:\evkq381.com Driver:: kxva BMa724b0b6 a417832a Folder:: C:\Documents and Settings\Administrator\Application Data\AdwareAlert C:\WINDOWS\TVlDT00 C:\Program Files\WinAble Registry:: [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{328d1001-1f52-4711-adc8-202880d167b1}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EF5E61A7-3803-490F-A347-27C76EB9462E}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "kxva"=- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BMa724b0b6"=- "a417832a"=- [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\a417832a] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BMa724b0b6] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ClubBox] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kxva] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\outlook] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\runner1] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinAble] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{03d9e661-e24e-11db-be42-0019660fdfcd}] XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop. Then drag/drop the CFScript.txt onto ComboFix.exe (the red X on your desktop) if combofix does not auto start click "run". Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Download ATF Cleaner from this link: ATF Cleaner Run ATF-Cleaner Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. Run an online scan with Kaspersky from the following link: Kaspersky Online Scanner Note: If you have used this particular scanner before, you MAY HAVE YO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component Click Yes, when prompted to install its ActiveX component. (Note.. for Internet Explorer 7 users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.) The program launches and downloads the latest definition files. Once the files are downloaded click on Next Click on Scan Settings and configure as follows: Scan using the following Anti-Virus database: Extended Scan Options: Scan Archives Scan Mail Base Click OK and, under select a target to scan, select My Computer When the scan is done, in the Scan is completed window (below), any infection is displayed. There is no option to clean/disinfect, however, we need to analyze the information on the report. To obtain the report: Click on: Save Report As (above - red blinking arrow) Next, in the Save as prompt, Save in area, select: Desktop In the File name area, use KScan, or something similar In Save as type, click the drop arrow and select: Text file [*.txt] Then, click: Save Please post the Kaspersky Online Scanner Report in your reply. Post a new Combofix log.

i have the same problem with POS.TMP, i already used vundofix and dowloaded combofix and hijack, can i post the result as well to get some help? pleease?:)

silvio, we would be happy to help. Just start you own thread(post) and state the problem, no logs until requested by a helper.