Hi guys - i had WinAntiVirus pop-ups a couple of weeks ago + had great help from you - but ever since ive been unable to install any security package - im currently trying Norton but it stops half way through having encountered an error - also the pop-ups are back - could anyone help please?

Post a Hijack This log please. Please download SmitRemFix from this link http://siri.urz.free.fr/Fix/Smitfra... Then extract the contents to your desktop. !!!! Only run option #1 as runing the other options on an uninfected computer will damage the desktop.!!!! Open the "SmitfraudFix" folder and double-click "smitfraudfix.cmd" Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present). Please copy/paste the content of that report into your next reply. Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user. When you run smitfruadfix if anything is "found"don't run combofix we will run it later. Please download ComboFix to the desktop from this link: http://download.bleepingcomputer.com/sUBs/combofix.exe Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running, it may cause your system to hang.) Please post the combofix.txt log.

Hi jabuck here is the info you asked for : Logfile of HijackThis v1.99.1 Scan saved at 00:32:17, on 20/11/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe c:\APPS\Powercinema\Kernel\TV\CLSched.exe C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\system32\UAService7.exe C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe C:\WINDOWS\SOUNDMAN.exe C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe C:\Program Files\QuickTime\qttask.exe C:\Apps\Powercinema\PCMService.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe C:\Program Files\Common Files\AOL\ACS\AOLDial.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\Program Files\VoyagerTest\fts.exe C:\Program Files\cahoot webcard\CahootWebcard.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Common Files\AOL\1137364792\ee\AOLHostManager.exe C:\WINDOWS\system32\sistray.exe C:\Program Files\WinZip\WZQKPICK.exe C:\PROGRA~1\Magentic\bin\MgApp.exe C:\Program Files\Common Files\AOL\1137364792\ee\AOLServiceHost.exe C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe C:\WINDOWS\system32\svchost.exe c:\program files\common files\aol\1137364792\ee\services\antiSpywareApp\ver2_0_12\AOLSP Scheduler.exe C:\Program Files\Common Files\AOL\1137364792\ee\AOLServiceHost.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe C:\Program Files\AOL 9.0a\waol.exe C:\Program Files\AOL 9.0a\shellmon.exe C:\Program Files\Common Files\AOL\aoltpspd.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\Program Files\Grisoft\AVG Free\avgcc.exe C:\Documents and Settings\user\My Documents\Unzipped\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://format.packardbell.com/cgi-b... R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = C:\Program Files\AOL Toolbar\welcome.html R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://format.packardbell.com/cgi-b... R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell O2 - BHO: (no name) - s - (no file) O2 - BHO: (no name) - SlimBho2.dll' - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O2 - BHO: Orbiscom - {D81AB57B-7327-4347-B7C7-9EF7CA87CE09} - C:\WINDOWS\system32\SlimBho2.dll O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file) O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.exe O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [PSDrvCheck] C:\WINDOWS\system32\PSDrvCheck.exe O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe /IMEName O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe" O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1137364792\ee\AOLHostManager.exe O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe" O4 - HKLM\..\Run: [CahootWebcard] C:\Program Files\cahoot webcard\CahootWebcard.exe /dontopenmycards O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Magentic] C:\PROGRA~1\Magentic\bin\Magentic.exe /c O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0a\aoltray.exe O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.exe O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: &eBay Search - res://C:\Program Files\AOL 9.0\eBayTb.dll/RCSearch.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\uk.htm O16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/odc.cab O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} (CPlayFirstDinerDash2Control Object) - http://www.shockwave.com/content/di... O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/... O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microso... O16 - DPF: {7D731A83-6C80-4EA4-9646-5E06A0513274} (Sandlot Loader Control) - http://www.shockwave.com/content/ba... O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/active... O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (Download Helper Class) - http://activex.microgaming.com/dlhe... O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewo... O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://www.shockwave.com/content/ci... O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.shockwave.com/content/bo... O17 - HKLM\System\CCS\Services\Tcpip\..\{E867692C-01D4-4829-B152-D00C010FDB9A}: NameServer = 205.188.146.145 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - (no file) O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing) O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe SmitFraudFix v2.123 Scan done at 0:35:29.39, 20/11/2006 Run from C:\Documents and Settings\user\My Documents\Unzipped\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\user »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\user\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\user\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32 »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Set up the computer to view hidden files by going to start>control panel>folder options>view tab>tick the circle beside "show hidden files and folders" and untick the box beside "hide extensions of known file types" and "hide protected system operating files">apply>ok. Boot into safe mode. Run Hijack This and remove these items: O2 - BHO: (no name) - s - (no file) O2 - BHO: (no name) - SlimBho2.dll' - (no file) O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - (no file) Exit Hijack This but remain in safe mode. Navigate to and delete this files if found: C:\Windows\System32\SlimBho2.dll Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. Post the Combofix log. Please download Dr Web CureIt to your desktop from this link ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe Doubleclick the drweb-cureit.exe file and Allow to run the express scan. This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan. Once the short scan has finished, mark the drives that you want to scan. Select all drives. A red dot shows which drives have been chosen. Click the green arrow at the right, and the scan will start. Click 'Yes to all' if it asks if you want to cure/move the file. When the scan has finished, look if you can click next icon next to the files found: If so, click it and then click the next icon right below and select Move incurable. This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples) After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list Save the report to your desktop. The report will be called DrWeb.csv Close Dr.Web Cureit. Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot. After reboot, post the contents of the log on your desktop.

Ok all done here is the combofix log : user - 06-11-20 23:44:56.53 Service Pack 2 ComboFix 06.11.19 - Running from: "C:\Program Files\AOL 9.0a\download" ((((((((((((((((((((((((((((((( Files Created from 2006-10-20 to 2006-11-20 )))))))))))))))))))))))))))))))))) 2006-11-20 00:51 <DIR> d-------- C:\Program Files\Shockwave.com 2006-11-20 00:34 53,248 --a------ C:\WINDOWS\system32\Process.exe 2006-11-19 23:21 816,672 --a------ C:\WINDOWS\system32\drivers\avg7core.sys 2006-11-19 23:21 4,960 --a------ C:\WINDOWS\system32\drivers\avgtdi.sys 2006-11-19 23:21 4,224 --a------ C:\WINDOWS\system32\drivers\avg7rsw.sys 2006-11-19 23:21 3,968 --a------ C:\WINDOWS\system32\drivers\avgclean.sys 2006-11-19 23:21 28,416 --a------ C:\WINDOWS\system32\drivers\avg7rsxp.sys 2006-11-19 23:21 <DIR> d-------- C:\Program Files\Grisoft 2006-11-19 23:21 <DIR> d-------- C:\Documents and Settings\user\Application Data\AVG7 2006-11-19 23:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2006-11-19 23:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7 2006-11-19 18:26 <DIR> d-------- C:\WINDOWS\UbiSoft 2006-11-19 18:26 <DIR> d-------- C:\UbiSoft 2006-11-19 15:31 <DIR> d-------- C:\Program Files\IObit 2006-11-18 16:55 <DIR> d-------- C:\891431f1605148ee76fa 2006-11-17 16:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec 2006-11-16 14:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PlayFirst 2006-11-16 14:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PopCap 2006-11-14 12:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee 2006-11-13 10:44 <DIR> d-------- C:\Program Files\cahoot webcard 2006-11-12 10:08 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2006-11-09 13:47 3,846 --a------ C:\WINDOWS\system32\tmp.reg 2006-11-09 13:46 40,960 --a------ C:\WINDOWS\system32\swsc.exe 2006-11-09 13:46 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2006-11-09 13:46 135,168 --a------ C:\WINDOWS\system32\swreg.exe 2006-11-09 13:36 <DIR> d-------- C:\Program Files\Hijackthis 2006-11-08 09:51 <DIR> d-------- C:\WINDOWS\system32\ODCTOOLS 2006-11-07 14:47 127,208 --a------ C:\WINDOWS\system32\mucltui.dll 2006-11-07 13:58 <DIR> d--h-c--- C:\WINDOWS\ie7 2006-11-07 13:58 <DIR> d-------- C:\WINDOWS\WBEM 2006-11-07 13:58 <DIR> d-------- C:\WINDOWS\system32\en-US 2006-11-07 13:56 121,856 --------- C:\WINDOWS\system32\xmllite.dll 2006-11-07 13:56 <DIR> d-------- C:\WINDOWS\network diagnostic 2006-11-07 13:21 <DIR> d-------- C:\WINDOWS\system32\NtmsData 2006-11-07 12:21 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2006-11-07 12:21 <DIR> d-------- C:\Program Files\MSXML 4.0 2006-11-07 10:18 <DIR> d-------- C:\WINDOWS\Minidump 2006-11-04 14:14 1,245,696 --a------ C:\WINDOWS\system32\msxml4.dll 2006-10-30 13:59 <DIR> d-------- C:\Program Files\Java 2006-10-30 13:57 <DIR> d-------- C:\Program Files\Common Files\Java 2006-10-27 15:09 6,049,280 --------- C:\WINDOWS\system32\ieframe.dll 2006-10-27 15:09 50,688 --------- C:\WINDOWS\system32\msfeedsbs.dll 2006-10-27 15:09 458,752 --------- C:\WINDOWS\system32\msfeeds.dll 2006-10-27 15:09 180,736 --------- C:\WINDOWS\system32\ieui.dll 2006-10-27 02:44 13,312 --a------ C:\WINDOWS\system32\ieudinit.exe 2006-10-24 10:05 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-11-19 23:21 -------- d---s---- C:\Documents and Settings\user\Application Data\Microsoft 2006-11-19 23:11 -------- d-------- C:\Program Files\Common Files\Symantec Shared 2006-11-19 23:10 44288 --a------ C:\WINDOWS\system32\drivers\cdr4_xp.sys 2006-11-19 16:09 -------- d-------- C:\Program Files\Common Files 2006-11-15 18:15 -------- d-------- C:\Program Files\CardPlayer Poker 2006-11-11 19:49 -------- d-------- C:\Program Files\Common Files\FTL Shared 2006-11-07 18:37 -------- d-------- C:\Program Files\AOL 9.0a 2006-11-07 14:00 -------- d-------- C:\Program Files\Internet Explorer 2006-11-07 12:11 -------- d-------- C:\Program Files\Common Files\Microsoft Shared 2006-11-05 20:34 -------- d-------- C:\Documents and Settings\user\Application Data\Macromedia 2006-10-27 15:09 413696 --a------ C:\WINDOWS\system32\vbscript.dll 2006-10-27 15:09 231424 --a------ C:\WINDOWS\system32\webcheck.dll 2006-10-27 15:09 156160 --a------ C:\WINDOWS\system32\msls31.dll 2006-10-27 02:44 71680 --a------ C:\WINDOWS\system32\admparse.dll 2006-10-27 02:44 55296 --a------ C:\WINDOWS\system32\iesetup.dll 2006-10-27 02:44 54784 --a------ C:\WINDOWS\system32\ie4uinit.exe 2006-10-27 02:44 43008 --a------ C:\WINDOWS\system32\iernonce.dll 2006-10-27 02:44 382976 --a------ C:\WINDOWS\system32\iedkcs32.dll 2006-10-27 02:44 229376 --a------ C:\WINDOWS\system32\ieaksie.dll 2006-10-27 02:44 152064 --a------ C:\WINDOWS\system32\ieakeng.dll 2006-10-27 02:44 123904 --a------ C:\WINDOWS\system32\advpack.dll 2006-10-27 02:42 161792 --a------ C:\WINDOWS\system32\ieakui.dll 2006-10-24 12:10 -------- d-------- C:\Program Files\WinRAR 2006-10-24 11:10 -------- d-------- C:\Program Files\Zylom Games 2006-10-24 10:45 -------- d-------- C:\Documents and Settings\user\Application Data\Zylom 2006-10-24 10:45 -------- d-------- C:\Documents and Settings\user\Application Data\Identities 2006-10-17 13:06 78336 --a------ C:\WINDOWS\system32\ieencode.dll 2006-10-17 13:05 40960 --a------ C:\WINDOWS\system32\licmgr10.dll 2006-10-17 13:05 206336 --------- C:\WINDOWS\system32\WinFXDocObj.exe 2006-10-17 13:05 105984 --a------ C:\WINDOWS\system32\url.dll 2006-10-17 13:04 101376 --a------ C:\WINDOWS\system32\occache.dll 2006-10-17 13:03 17408 --a------ C:\WINDOWS\system32\corpol.dll 2006-10-17 12:58 61952 --------- C:\WINDOWS\system32\icardie.dll 2006-10-17 12:58 12288 --------- C:\WINDOWS\system32\msfeedssync.exe 2006-10-17 12:57 36352 --a------ C:\WINDOWS\system32\imgutil.dll 2006-10-17 12:57 266752 --------- C:\WINDOWS\system32\iertutil.dll 2006-10-17 12:56 45568 --a------ C:\WINDOWS\system32\mshta.exe 2006-10-17 12:28 48128 --a------ C:\WINDOWS\system32\mshtmler.dll 2006-10-17 12:27 380928 --------- C:\WINDOWS\system32\ieapfltr.dll 2006-10-13 12:35 142336 --a------ C:\WINDOWS\system32\nwprovau.dll 2006-10-11 13:07 252752 --a------ C:\WINDOWS\system32\odc.dll 2006-10-04 14:23 -------- d-------- C:\Program Files\BFG 2006-10-04 13:01 -------- d-------- C:\Program Files\Oberon Media 2006-10-04 13:00 -------- d-------- C:\Program Files\ReflexiveArcade 2006-09-22 11:18 -------- d-------- C:\Program Files\Real 2006-09-22 11:06 774144 --a------ C:\Program Files\RngInterstitial.dll 2006-09-22 10:27 -------- d-------- C:\Program Files\Yahoo! 2006-09-20 16:03 -------- d-------- C:\Program Files\Dynamic Toolbar 2006-09-20 13:15 -------- d-------- C:\Program Files\Magentic 2006-09-13 05:01 1084416 --a------ C:\WINDOWS\system32\msxml3.dll 2006-09-06 17:43 22752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2006-09-04 14:39 194560 --a------ C:\WINDOWS\system32\Sharpest_Pictures_Waterfalls.scr 2006-09-02 23:24 606848 --a------ C:\WINDOWS\flashax.exe 2006-09-02 23:24 503808 --a------ C:\WINDOWS\Tranquil - Waterfalls.scr 2006-09-02 23:24 12288 --a------ C:\WINDOWS\impborl.dll 2006-08-25 15:45 617472 --a------ C:\WINDOWS\system32\comctl32.dll 2006-08-21 12:21 16896 --a------ C:\WINDOWS\system32\fltlib.dll 2006-08-21 09:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "Magentic"="C:\\PROGRA~1\\Magentic\\bin\\Magentic.exe /c" "Google Desktop Search"="\"C:\\Program Files\\Google\\Google Desktop Search\\GoogleDesktop.exe\" /startup" "BitTorrent"="\"C:\\Program Files\\BitTorrent\\bittorrent.exe\" --force_start_minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\"" "SoundMan"="SOUNDMAN.EXE" "SiSPower"="Rundll32.exe SiSPower.dll,ModeAgent" "RoxioDragToDisc"="\"C:\\Program Files\\Roxio\\Easy Media Creator 7\\Drag to Disc\\DrgToDsc.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "PSDrvCheck"="C:\\WINDOWS\\system32\\PSDrvCheck.exe" "PinnacleDriverCheck"="C:\\WINDOWS\\system32\\PSDrvCheck.exe -CheckReg" "PHIME2002ASync"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.exe /SYNC" "PHIME2002A"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.exe /IMEName" "PCMService"="\"c:\\Apps\\Powercinema\\PCMService.exe\"" "IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32" "HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe" "HP Component Manager"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\"" "HostManager"="C:\\Program Files\\Common Files\\AOL\\1137364792\\ee\\AOLHostManager.exe" "DSLSTATEXE"="C:\\Program Files\\BT Voyager 105 ADSL Modem\\dslstat.exe icon" "DSLAGENTEXE"="C:\\Program Files\\BT Voyager 105 ADSL Modem\\dslagent.exe" "ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "AOLDialer"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe" "Adobe Photo Downloader"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\"" "%FP%Friendly fts.exe"="\"C:\\Program Files\\VoyagerTest\\fts.exe\"" "CahootWebcard"="C:\\Program Files\\cahoot webcard\\CahootWebcard.exe /dontopenmycards" "AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP" "AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce\Setup] "Registrando Panda ActiveX"="C:\\WINDOWS\\system32\\regsvr32.exe /s C:\\WINDOWS\\system32\\ActiveScan\\as.dll" "Registrando Panda Almacen"="C:\\WINDOWS\\system32\\regsvr32.exe /s C:\\WINDOWS\\system32\\ActiveScan\\pavpz.dll" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000005 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,de,03,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,12,03,00,00,23,00,00,00,dc,00,00,00,d2,00,\ 00,00,01,00,00,00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.exe" "DWQueuedReporting"="\"C:\\PROGRA~1\\COMMON~1\\MICROS~1\\DW\\dwtrig20.exe\" -t" "AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.exe" "DWQueuedReporting"="\"C:\\PROGRA~1\\COMMON~1\\MICROS~1\\DW\\dwtrig20.exe\" -t" "AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=hex:91,00,00,00 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 "EnableLUA"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" "WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Completion time: 06-11-20 23:45:51.53 C:\ComboFix.txt ... 06-11-20 23:45 Also do you want me to post the Dr.Web log?

Sorry jabuck i misread your last post here is the Dr.Web log: restart.exe;C:\Documents and Settings\user\My Documents\Unzipped\SmitfraudFix\SmitfraudFix;Tool.ShutDown.11;Moved.; Process.exe;C:\Documents and Settings\user\My Documents\Unzipped\SmitfraudFix\SmitfraudFix;Tool.Prockill;Incurable.Moved.; Process.exe;C:\WINDOWS\system32;Tool.Prockill;Incurable.Moved.;

Set up the computer to view hidden files by going to start>control panel>folder options>view tab>tick the circle beside "show hidden files and folders" and untick the box beside "hide extensions of known file types" and "hide protected system operating files">apply>ok. Navigate to the following folder, open it, write down the filenames such as (tom.exe, sue.dll) and post the filenames please: C:\891431f1605148ee76fa Everything else looks clean for the most part.