i finally did the wrong thing and got these two viruses. i used avg7.5, greatis.com's regrun suite and spybot s&d to get the computer running a little better, but still get all kinds of pop-up about security and disinfection from windows security alert and protection-wizard.com, and attempts to install M$ office from disc 2... i have done a hijackthis scan. i renamed b.exe to bbbb.exe, and no longer find sav.exe except in the recycle bin. any suggestions?

Please run these scans and post there logs. Please download Malwarebytes' Anti-Malware from one of these sites: MalwareBytes1 MalwareBytes2 1. Double Click mbam-setup.exe to install the application. 2. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. 3. If an update is found, it will download and install the latest version. 4. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. 5. When the scan is complete, click OK, then Show Results to view the results. 6. Make sure that everything found is checked, and click Remove Selected. 7. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately. 8. The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. 9. Copy&Paste the entire report in your next reply. Please download and install the latest version of HijackThis v2.0.2: Download the "HijackThis" Installer from this link: Hijack This 1. Save " HJTInstall.exe" to your desktop. 2. Double click on HJTInstall.exe to run the program. 3. By default it will install to C:\Program Files\Trend Micro\HijackThis. 4. Accept the license agreement by clicking the "I Accept" button. 5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log. 6. Click "Save log" to save the log file and then the log will open in Notepad. 7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log. 8. Paste the log in your next reply. 9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.

hello. since i first wrote (last night) with my problem, i've nearly gotten rid of it on my own. i went to bed with no problems on the computer, but today, after going to a few of the websites you suggested i stated getting another, infrequent, pop-up which looks like the windows security alert' boxs, but with some garbled copy in it which is from my isp (tds.net) it says it "cannot find www.antispyware-review.info/a/b4.html?wmid=4663&pwebmid=911cj4&a=:". it has the 'windows security alert' border, and goes away and stays gone until i click an antimalware type link. i have a screenshot if you want it. here's what i've done to get back to an almost pristine state. LAST NIGHT 1. AVG 7.5 -- scan and fix 2. Spybot S & D -- scan and fix 3 install and run RegRun from greatis.com. things much better, but different, regrun, pop ups started. 4. uninstall regrun. TODAY 5. ran atf cleaner 6. ran drweb cureit 7. ran HJT (log below) 8. ran MBAM (log below and remove selected) 9. restart due to several files unable to be removed. ============================================ ============================================ HJT LOG unique message:23380 @computing.net forum Logfile of HijackThis v1.99.1 Scan saved at 6:47:35 PM, on 9/8/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\McAfee\SiteAdvisor\McSACore.exe C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS C:\Documents and Settings\All Users\Application Data\tofkdyzo\zctwvudo.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Picasa2\PicasaMediaDetector.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7E7.tmp.exe C:\WINDOWS\system32\xmtcdgjw.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Logitech\SetPoint\KEM.exe C:\Program Files\Logitech\SetPoint\KHALMNPR.exe C:\WINDOWS\explorer.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Outlook Express\msimn.exe C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\b.exe C:\Program Files\Opera\opera.exe C:\Program Files\Hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://tvlistings.zap2it.com/tvlist... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin... R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin... R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.6.26.dll O2 - BHO: XML module - {500BCA15-57A7-4eaf-8143-8C619470B13D} - C:\WINDOWS\system32\msxml71.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [RegRun WinBait] C:\WINDOWS\winbait.exe O4 - HKLM\..\Run: [@RegRunOnSecure] C:\PROGRA~1\Greatis\REGRUN~1\OnSecure.exe O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe O4 - HKCU\..\Run: [Somefox] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7E7.tmp.exe O4 - HKCU\..\Run: [webmsgcmd] C:\WINDOWS\system32\xmtcdgjw.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [infocmd] C:\WINDOWS\system32\wdglkpan.exe O4 - HKCU\..\Run: [Regrun2] C:\PROGRA~1\Greatis\REGRUN~1\WatchDog.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.6.26.dll/206 (file missing) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic... O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/pl... O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing) O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS =========================================== =========================================== MBAM LOG Malwarebytes' Anti-Malware 1.27 Database version: 1133 Windows 5.1.2600 Service Pack 3 9/9/2008 7:05:11 PM mbam-log-2008-09-09 (19-05-04).txt Scan type: Quick Scan Objects scanned: 61274 Time elapsed: 10 minute(s), 40 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 13 Registry Values Infected: 4 Registry Data Items Infected: 0 Folders Infected: 4 Files Infected: 48 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\toolbar.tb (Trojan.BHO) -> No action taken. HKEY_CLASSES_ROOT\toolbar.tb.1 (Trojan.BHO) -> No action taken. HKEY_CLASSES_ROOT\xml.xml (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\TypeLib\{9233c3c0-1472-4091-a505-5580a23bb4ac} (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\xml.xml.1 (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\AppID\{b0e43034-50f5-1f84-8098-824b44f2dbc3} (Adware.AdMedia) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> No action taken. HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> No action taken. HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> No action taken. HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\rdriv (Fake.Dropped.Malware) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> No action taken. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\webmsgcmd (Trojan.FakeAlert.H) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\infocmd (Trojan.FakeAlert.H) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\am5xlv2yqt (Trojan.FakeAlert.H) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SystemCheck2 (Trojan.Agent) -> No action taken. Registry Data Items Infected: (No malicious items detected) Folders Infected: C:\Documents and Settings\All Users\Application Data\tofkdyzo (Trojan.FakeAlert.H) -> No action taken. C:\Program Files\WinBudget (Adware.AdMedia) -> No action taken. C:\Program Files\WinBudget\bin (Adware.AdMedia) -> No action taken. C:\WINDOWS\system32\smp (Fake.Dropped.Malware) -> No action taken. Files Infected: C:\WINDOWS\system32\xmtcdgjw.exe (Trojan.FakeAlert.H) -> No action taken. C:\WINDOWS\system32\wdglkpan.exe (Trojan.FakeAlert.H) -> No action taken. C:\Documents and Settings\All Users\Application Data\tofkdyzo\zctwvudo.exe (Trojan.FakeAlert.H) -> No action taken. C:\WINDOWS\system32\msxml71.dll (Trojan.FakeAlert) -> No action taken. C:\Documents and Settings\Administrator\Local Settings\Temp\b.exe (Trojan.FakeAlert) -> No action taken. C:\Program Files\WinBudget\bin\matrix.dat (Adware.AdMedia) -> No action taken. C:\WINDOWS\system32\smp\msrc.exe (Fake.Dropped.Malware) -> No action taken. C:\WINDOWS\system32\akttzn.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\anticipator.dll (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\awtoolb.dll (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\bdn.com (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\bsva-egihsg52.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\dpcproxy.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\emesx.dll (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\hoproxy.dll (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\hxiwlgpm.dat (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\hxiwlgpm.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\medup012.dll (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\msgp.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\msnbho.dll (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\mssecu.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\msvchost.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\mtr2.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\mwin32.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\netode.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\newsd32.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\ps1.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\psof1.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\psoft1.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\regc64.dll (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\regm64.dll (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\Rundl1.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\sncntr.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\ssurf022.dll (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\ssvchost.com (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\ssvchost.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\sysreq.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\taack.dat (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\taack.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\temp#01.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\thun.dll (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\thun32.dll (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\VBIEWER.OCX (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\vcatchpi.dll (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\winlogonpc.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\winsystem.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\WINWGPX.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\system32\vbsys2.dll (Trojan.Clicker) -> No action taken. phew! haven't downloaded this much this fast in a long time! kinda proud i'm following your directions -- and they're written in a very understandable manner. thanks very much. my computer is very usable... i await further instructions. rich m. corinna, maine

Run Malwarebytes again and be sure to follow the directions in step 6 after the scan has run. Then post the new log.

clean bill of health! Thanks. i'm gonna do a deep scan for the hell of it. (too much time on my hands 8>) ) rich MBAM LOG ========================================= ========================================= Malwarebytes' Anti-Malware 1.27 Database version: 1133 Windows 5.1.2600 Service Pack 3 9/10/2008 9:54:48 AM mbam-log-2008-09-10 (09-54-48).txt Scan type: Quick Scan Objects scanned: 61356 Time elapsed: 10 minute(s), 41 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

even a cleaner scan! thanks again. rich m. MBAM FULL SCAN ========================================== ========================================== Malwarebytes' Anti-Malware 1.27 Database version: 1133 Windows 5.1.2600 Service Pack 3 9/10/2008 10:42:41 AM mbam-log-2008-09-10 (10-42-41).txt Scan type: Full Scan (C:\|) Objects scanned: 126783 Time elapsed: 43 minute(s), 55 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

Please download ComboFix to the desktop from one of the following links: Link1 Link 2 Link 3 Combofix is a powerful tool so follow the instructions exactly or you could damage your computer. Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with Combofix and remove some of its embedded files which may cause "unpredictable results". Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. In your case to run Combofix do the following: 1. Go offline turn off your AVG antivirus, Windows Defender, Spybot and any other antispyware that you may have. 2. Run Combofix and save its log. 3. Restart the computer to get the antivirus running again but leave the antispyware programs off until we get the computer cleaned. 4. Post the Combofix log. Remember to re-enable the protection again afterwards before connecting to the Internet. Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running or move the mouse, it will cause your system to hang.) Please post the log it produces.