i have a virus/trojan called downloader.agent can someone please help me fix~ acer

Download the "HijackThis" Installer from this link: http://www.trendsecure.com/portal/e... 1. Save " HJTInstall.exe" to your desktop. 2. Double click on HJTInstall.exe to run the program. 3. By default it will install to C:\Program Files\Trend Micro\HijackThis. 4. Accept the license agreement by clicking the "I Accept" button. 5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log. 6. Click "Save log" to save the log file and then the log will open in Notepad. 7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log. 8. Paste the log in your next reply. 9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required. Post Hijackthis Log in your next reply. *Do Safe Computing*

Ok here is the log i got from it. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:32:32 AM, on 5/12/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\PROGRA~1\AVG\AVG8\avgfws8.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\AVG\AVG8\avgam.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\SOUNDMAN.exe C:\WINDOWS\System32\igfxtray.exe C:\WINDOWS\System32\hkcmd.exe C:\Program Files\Razer\razerhid.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\Razer\Tarantula\razerhid.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Razer\razerofa.exe C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\AIM\aim.exe C:\Program Files\Messenger\MSMSGS.exe C:\Utopia\Angel\Angel.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Razer\Tarantula\razertra.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll O3 - Toolbar: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Tarantula] C:\Program Files\Razer\Tarantula\razerhid.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [ctfmona] C:\WINDOWS\system32\ctfmona.exe O4 - HKLM\..\Run: [WinIFixer] C:\Program Files\WinIFixer\WinIFixer.exe O4 - HKLM\..\Run: [7c76b03f] rundll32.exe "C:\WINDOWS\system32\qdquorij.dll",b O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.exe" /background O4 - HKCU\..\Run: [Utopia Angel] "C:\Utopia\Angel\Angel.exe" O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin... O16 - DPF: {BBFD2D10-EC6E-4259-91D1-1E38C826E5E2} (Launcher Class) - http://app.gomtv.com/gomtv/gomtvx.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe -- End of file - 5165 bytes I have work in an hour but as soon as i get back i will be here to try and fix my comp. thank you for your help. acer

Disable Real Time Monitoring Programs, click here to see: http://spywaredetail.com/forum/show... Please run HijackThis again! and click "Scan." Place checks next to the following entries: O4 - HKLM\..\Run: [ctfmona] C:\WINDOWS\system32\ctfmona.exe O4 - HKLM\..\Run: [WinIFixer] C:\Program Files\WinIFixer\WinIFixer.exe O4 - HKLM\..\Run: [7c76b03f] rundll32.exe "C:\WINDOWS\system32\qdquorij.dll",b Close all browsers and other windows except for HijackThis!, and click "Fix checked". Remove these files: C:\WINDOWS\system32\ctfmona.exe Remove these folders: C:\Program Files\WinIFixer ---- Download SmitfraudFix.exe from here and save it to your desktop: Download link: http://siri.urz.free.fr/Fix/Smitfra... You can also read this for its Tutorial how to us SmitraudFix: http://siri.geekstogo.com/Smitfraud... >Restart your computer. Before the Windows loading screen appears, keep pressing F8 until you see the boot menu. Select Safe Mode. >Double-click SmitfraudFix.exe >Select 2 and press Enter to clean your system by deleting infected files. >You will be prompted: Do you want to clean the registry ? Answer Y (yes) and press Enter in order to remove the hijacked Desktop background and clean registry keys associated with the infection. >SmitFraudFix will then check if wininet.dll is infected. You may be prompted to replace the infected file (if found): Replace infected file ? Answer Y (yes) and press Enter to restore a clean file. >You may have to restart your computer in order to finish the spyware removal process. You can find a report on spyware removal at the root of the system drive. Usually it will be located at C:\rapport.txt. After runing above tools, Scan your pc with Hijackthis and Post Fresh Hijackthis Log along with SmitfraudFix Log in your next reply. --- Download Combofix by sUBs and save to your desktop. (If you have previously downloaded ComboFix,please delete that version now.) download link HERE: http://download.bleepingcomputer.co... http://www.forospyware.com/sUBs/Com... Note It is important that it is saved directly to your desktop Close any open browsers. Double click on combofix.exe and follow the prompts. When it's finished it will produce a log. Post the entire contents of C:\ComboFix.txt into your next reply. Note Do not mouseclick combofix's window while it's running. That may cause the program to freeze/hang. Note In case your Antivirus or any other realtime scanner is displaying an alert after you downloaded Combofix or while you use Combofix,please disable your scanner and redownload Combofix again. Some scanners may see some combofix related components as suspicious and block or delete them while there's nothing wrong with them. -- *Do Safe Computing*

this is the hijackthis! report Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:35:00 AM, on 5/13/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\PROGRA~1\AVG\AVG8\avgfws8.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\AVG\AVG8\avgam.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\SOUNDMAN.exe C:\WINDOWS\System32\igfxtray.exe C:\WINDOWS\System32\hkcmd.exe C:\Program Files\Razer\razerhid.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\Razer\razerofa.exe C:\Program Files\Razer\Tarantula\razerhid.exe C:\Program Files\iTunes\iTunesHelper.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\AIM\aim.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Messenger\MSMSGS.exe C:\Program Files\Razer\Tarantula\razertra.exe C:\Program Files\Internet Explorer\iexplore.exe C:\PROGRA~1\AVG\AVG8\aAvgApi.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll O3 - Toolbar: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Tarantula] C:\Program Files\Razer\Tarantula\razerhid.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.exe" /background O4 - HKCU\..\Run: [Utopia Angel] "C:\Utopia\Angel\Angel.exe" O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin... O16 - DPF: {BBFD2D10-EC6E-4259-91D1-1E38C826E5E2} (Launcher Class) - http://app.gomtv.com/gomtv/gomtvx.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe -- End of file - 4922 bytes and this is combofix ComboFix 08-05-12.1 - Josh 2008-05-13 11:37:43.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.604 [GMT -4:00] Running from: C:\Documents and Settings\Josh\Desktop\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Josh\Application Data\WinIFixer.com C:\Documents and Settings\Josh\Local Settings\Temporary Internet Files\ijjistarter_verinfo.dat C:\Documents and Settings\Josh\Local Settings\Temporary Internet Files\ijjistarter2FxB.exe C:\WINDOWS\cookies.ini C:\WINDOWS\system32\jirouqdq.ini C:\WINDOWS\system32\ljwhajbd.ini C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\mrknikhp.ini C:\WINDOWS\system32\oerwbwyy.ini C:\WINDOWS\system32\yFfOrtwa.ini C:\WINDOWS\system32\yFfOrtwa.ini2 D:\Autorun.inf . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_SZKG5 ((((((((((((((((((((((((( Files Created from 2008-04-13 to 2008-05-13 ))))))))))))))))))))))))))))))) . 2008-05-13 11:15 . 2008-04-28 08:03 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-05-13 11:15 . 2008-04-28 08:03 82,944 --a------ C:\WINDOWS\system32\404Fix.exe 2008-05-12 01:33 . 2008-05-12 01:33 91,776 --a------ C:\WINDOWS\system32\yywbwreo.dll 2008-05-10 21:50 . 2008-05-10 21:50 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-05-10 21:41 . 2008-05-10 21:41 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys 2008-05-10 21:41 . 2008-05-10 21:41 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys 2008-05-10 21:41 . 2008-05-10 21:41 12,424 --a------ C:\WINDOWS\system32\drivers\avgrkx86.sys 2008-05-10 21:41 . 2008-05-10 21:41 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll 2008-05-10 21:40 . 2008-05-13 06:29 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg 2008-05-10 21:40 . 2008-05-11 18:41 <DIR> d-------- C:\Documents and Settings\Josh\Application Data\AVGTOOLBAR 2008-05-10 21:39 . 2008-05-10 21:39 <DIR> d-------- C:\Program Files\AVG 2008-05-10 21:39 . 2008-05-10 21:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8 2008-05-10 21:39 . 2008-05-10 21:39 45,568 --a------ C:\WINDOWS\system32\avgfwdx.dll 2008-05-10 21:39 . 2008-05-10 21:39 22,528 --a------ C:\WINDOWS\system32\drivers\avgfwdx.sys 2008-05-10 21:09 . 2008-05-13 11:27 2,374 --a------ C:\WINDOWS\system32\tmp.reg 2008-05-10 21:07 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-05-10 21:07 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-05-10 21:07 . 2008-04-24 08:10 86,528 --a------ C:\WINDOWS\system32\VACFix.exe 2008-05-10 21:07 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-05-10 21:07 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-05-10 21:07 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-05-10 21:00 . 2008-05-10 21:00 <DIR> d-------- C:\Program Files\Trend Micro 2008-05-10 02:49 . 2008-05-10 02:49 62,910 --a------ C:\Program Files\Uninstall.exe 2008-05-10 02:49 . 2008-05-10 02:49 0 --a------ C:\Program Files\uninstall.dat 2008-05-10 01:00 . 2008-05-10 01:51 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SITEguard 2008-05-10 00:54 . 2008-05-10 00:54 <DIR> d-------- C:\Program Files\Common Files\iS3 2008-05-10 00:54 . 2008-05-10 10:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla! 2008-05-10 00:36 . 2008-05-10 00:36 321,152 --a------ C:\WINDOWS\system32\awtrOfFy.dll 2008-05-10 00:29 . 2008-05-10 00:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Adsl Software Limited 2008-05-10 00:29 . 2008-05-10 00:31 269,334 --a------ C:\WINDOWS\system32\ctfmonb.bmp 2008-05-10 00:29 . 2008-05-10 00:31 160,256 --a------ C:\WINDOWS\system32\blackster.scr 2008-05-10 00:29 . 2008-05-10 00:29 29,824 --a------ C:\WINDOWS\system32\pmnomJyW.dll 2008-04-27 22:10 . 2008-04-27 22:10 <DIR> d-------- C:\Program Files\Microsoft ActiveSync 2008-04-27 22:10 . 2008-04-27 22:10 376 --a------ C:\WINDOWS\ODBC.INI 2008-04-27 22:09 . 2008-04-27 22:10 <DIR> d-------- C:\WINDOWS\ShellNew 2008-04-24 09:34 . 2008-04-30 20:06 <DIR> d-------- C:\Documents and Settings\Josh\Application Data\OpenOffice.org2 2008-04-24 09:33 . 2008-05-05 19:22 <DIR> d-------- C:\Program Files\OpenOffice.org 2.4 2008-04-13 17:45 . 2008-04-13 17:45 <DIR> d-------- C:\WINDOWS\.jagex_cache_32 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-13 07:42 --------- d-----w C:\Program Files\Full Tilt Poker 2008-05-13 05:07 --------- d-----w C:\Program Files\Warcraft III 2008-05-11 20:21 --------- d-----w C:\Documents and Settings\Josh\Application Data\mIRC 2008-05-11 18:04 --------- d-----w C:\Program Files\mIRC 2008-05-07 21:29 --------- d-----w C:\Program Files\World of Warcraft 2008-05-06 03:47 --------- d-----w C:\Program Files\Starcraft 2008-05-05 23:19 --------- d-----w C:\Program Files\WC3Banlist 2008-05-05 23:19 --------- d-----w C:\Program Files\Warkeys 2008-05-05 23:19 --------- d-----w C:\Program Files\Viewpoint 2008-05-05 23:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2008-05-05 23:18 --------- d-----w C:\Program Files\IGN 2008-05-05 23:18 --------- d-----w C:\Documents and Settings\Josh\Application Data\IGN_DLM 2008-05-05 23:11 --------- d-----w C:\Program Files\Common Files\Adobe 2008-04-24 13:32 --------- d-----w C:\Program Files\Java 2008-04-19 23:46 --------- d-----w C:\Program Files\Incomplete 2008-04-19 23:44 --------- d-----w C:\Program Files\LimeWire 2008-04-09 22:07 --------- d-----w C:\Program Files\PokerStars 2008-03-20 17:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-13 16:43 --------- d-----w C:\Program Files\QuickTime 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll 2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll 2008-02-16 08:59 659,456 ----a-w C:\WINDOWS\system32\wininet.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22128E83-9452-49E9-A972-8C0793353CEA}] 2008-05-10 00:36 321152 --a------ C:\WINDOWS\system32\awtrOfFy.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{84FEBFF8-945B-4F9A-B9B8-B68EC5020770}] 2008-05-10 00:29 29824 --a------ C:\WINDOWS\system32\pmnomJyW.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}] 2008-05-10 21:40 2051328 --a------ C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{A057A204-BACC-4D26-9990-79A187E2698E}"= "C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL" [2008-05-10 21:40 2051328] [HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-9990-79a187e2698e}] [HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{A057A204-BACC-4D26-9990-79A187E2698E}"= C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2008-05-10 21:40 2051328] [HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-9990-79a187e2698e}] [HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AIM"="C:\Program Files\AIM\aim.exe" [2006-08-01 16:35 67112] "MSMSGS"="C:\Program Files\Messenger\MSMSGS.exe" [2004-10-13 12:24 1694208] "Utopia Angel"="C:\Utopia\Angel\Angel.exe" [2008-04-29 12:50 3553280] "AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-02-28 23:06 2321600] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2005-04-14 23:01 77824 C:\WINDOWS\SOUNDMAN.EXE] "IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2005-04-20 03:36 155648] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2005-04-20 02:56 126976] "razer"="C:\Program Files\Razer\razerhid.exe" [2005-05-17 19:21 147456] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 21:51 39792] "Tarantula"="C:\Program Files\Razer\Tarantula\razerhid.exe" [2006-09-30 17:48 176128] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 15:10 267048] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-01-31 23:13 385024] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-05-10 21:40 1177368] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.exe [2001-02-13 01:01:04 83360] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{84FEBFF8-945B-4F9A-B9B8-B68EC5020770}"= C:\WINDOWS\system32\pmnomJyW.dll [2008-05-10 00:29 29824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnomJyW] pmnomJyW.dll 2008-05-10 00:29 29824 C:\WINDOWS\system32\pmnomJyW.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.divxa32"= msaud32_divx.acm [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\AIM\\aim.exe"= "C:\\Program Files\\Warcraft III\\Frozen Throne.exe"= "C:\\Program Files\\World of Warcraft\\WoW-2.0.10.6448-to-2.0.12.6546-enUS-downloader.exe"= "C:\\StubInstaller.exe"= "C:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\Starcraft\\StarCraft.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\mIRC\\mirc.exe"= "C:\\Program Files\\Warcraft III\\Warcraft III.exe"= "C:\\Program Files\\World of Warcraft\\WoW-2.2.3.7359-to-2.3.0.7561-enUS-downloader.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6112:TCP"= 6112:TCP:tft "6113:TCP"= 6113:TCP:tft "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724 R0 AvgRkx86;avgrkx86.sys;C:\WINDOWS\system32\Drivers\avgrkx86.sys [2008-05-10 21:41] R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-05-10 21:41] R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-05-10 21:40] R2 avgfws8;AVG8 Firewall;C:\PROGRA~1\AVG\AVG8\avgfws8.exe [2008-05-10 21:40] R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-05-10 21:41] R3 Avgfwdx;Avgfwdx;C:\WINDOWS\system32\DRIVERS\avgfwdx.sys [2008-05-10 21:39] R3 TarFltr;Razer Tarantula USB Keyboard;C:\WINDOWS\system32\Drivers\UsbFltr.sys [2006-09-27 16:48] S3 Avgfwfd;AVG network filter service;C:\WINDOWS\system32\DRIVERS\avgfwdx.sys [2008-05-10 21:39] S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 17:10] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{59832a16-a447-11dc-b9a5-00148545c8e8}] \Shell\AutoRun\command - F:\LaunchU3.exe -a . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-13 11:42:27 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\pmnomJyW.dll . r Running Proce . C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\wdfmgr.exe C:\PROGRA~1\AVG\AVG8\avgam.exe C:\Program Files\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Program Files\Razer\razerofa.exe C:\Program Files\Razer\Tarantula\razertra.exe C:\Program Files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2008-05-13 11:45:53 - machine was rebooted ComboFix-quarantined-files.txt 2008-05-13 15:45:45 Pre-Run: 7,038,459,904 bytes free Post-Run: 8,094,019,584 bytes free 204 --- E O F --- 2008-04-28 20:36:47 acer

You did not post Smitfraud report? please if you did scan with it then post its report, sually it will be located at C:\rapport.txt. Please go through properly with fixing process and follow all the instructions to clean your system properly, because in this way i could find molicious things on your system.Thx -- Open notepad, Don't use any other texteditor than notepad or the script will fail. Copy/paste the bold text below into notepad: File:: C:\WINDOWS\system32\awtrOfFy.dll C:\WINDOWS\system32\pmnomJyW.dll C:\WINDOWS\system32\ctfmona.exe C:\WINDOWS\system32\qdquorij.dll C:\Program Files\uninstall.dat C:\Program Files\Uninstall.exe E:\Autorun.inf F:\Autorun.inf Registry:: [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22128E83-9452-49E9-A972-8C0793353CEA}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{84FEBFF8-945B-4F9A-B9B8-B68EC5020770}] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnomJyW] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "7c76b03f"=- Save this as text file with name of CFScript. Select "All files" from Save as Type. Then drag the CFScript file into ComboFix.exe icon. This will start ComboFix again. ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal. When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply. ------ Please download Malwarebytes' Anti-Malware to your desktop. This is an Free Antimalware Application tool. Download link: http://www.malwarebytes.org/mbam/pr... >DoubleClick mbam-setup.exe and follow the prompts to install MBA-M. >Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. >If an update is found, it will download and install the latest database updates. >Once the program has loaded, select Perform full scan, then click Scan. >When the scan is complete, click OK, then Show Results to view the results. >Be sure that everything is checked, and click Remove Selected. >When MBAM finishes, Notepad will open with the log. Please save it where you can find it easily. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt Post its Log in your next reply along with fresh Hijackthis log. *Do Safe Computing*

Here is what i got from going to the rapport txt from going to the run command. SmitFraudFix v2.320 Scan done at 11:27:21.92, Tue 05/13/2008 Run from C:\Documents and Settings\Josh\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» VACFix VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix S!Ri's WS2Fix: LSP not Found. »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files »»»»»»»»»»»»»»»»»»»»»»»» IEDFix IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» 404Fix 404Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» DNS HKLM\SYSTEM\CCS\Services\Tcpip\..\{ACBFF21B-1480-4792-8C38-45B7AA2A521E}: DhcpNameServer=68.87.75.194 68.87.64.146 HKLM\SYSTEM\CS1\Services\Tcpip\..\{ACBFF21B-1480-4792-8C38-45B7AA2A521E}: DhcpNameServer=68.87.75.194 68.87.64.146 HKLM\SYSTEM\CS3\Services\Tcpip\..\{ACBFF21B-1480-4792-8C38-45B7AA2A521E}: DhcpNameServer=68.87.75.194 68.87.64.146 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=68.87.75.194 68.87.64.146 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=68.87.75.194 68.87.64.146 HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=68.87.75.194 68.87.64.146 »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End acer