I have Virus Alert! in my task bar next to the time, Task Manager is grayed out, and my start menu is very limited and missing all programs, control panel and all other items, only things available are my recent programs, shutdown and Set Program Access. I found another thread on here with the same issue so i followed those instructions and still same issue. this is what i have done so far; Download and ran ATF cleaner, Download and ran SUPERAntispyware, Download and ran Malware Bytes AntiMalware, Downloaded HiJackThis. I had to do this all in safemode because the programs would not update in normal mode. I also removed Total Secure 2009 with steps from http://www.411-spyware.com/remove-t... this was the first thing i did. please help

Download SDFix.exe and save it to your Desktop. Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with SDFix or remove some of its embedded files which may cause "unpredictable results". Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. Remember to re-enable the protection again afterwards before connecting to the Internet. 1.Double click SDFix.exe and choose Install to extract it to its own folder on the Desktop. Please then reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select the first option, to run Windows in Safe Mode, then press "Enter". Choose your usual account. 2. Open the c:\SDFix folder and double click RunThis.cmd to start the script. Type Y to begin the script. It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot. Press any Key and it will restart the PC. 3. Your system will take longer that normal to restart as the fixtool will be running and removing files. When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons. 4. Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt Post a new Malwarebytes log and a new Hijack This log please.

Malwarebytes' Anti-Malware 1.30 Database version: 1345 Windows 5.1.2600 Service Pack 3 11/1/2008 2:07:36 AM mbam-log-2008-11-01 (02-07-32).txt Scan type: Full Scan (C:\|D:\|E:\|) Objects scanned: 513639 Time elapsed: 4 hour(s), 22 minute(s), 15 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 2 Registry Values Infected: 0 Registry Data Items Infected: 8 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a2f253ad-1f23-4d87-a64b-d6987f38d981} (Trojan.FakeAlert) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7fae709c-a4f1-40ad-95e2-d119cfb6b539} (Trojan.FakeAlert) -> No action taken. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.Homepage) -> Bad: (http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2) Good: (http://www.google.com/) -> No action taken. HKEY_CURRENT_USER\Control Panel\International\sTimeFormat (Trojan.FakeAlert) -> Bad: (HH:mm: VIRUS ALERT!) Good: (h:mm:ss tt) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowControlPanel (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowRun (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyDocs (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken. Folders Infected: (No malicious items detected) Files Infected: C:\System Volume Information\_restore{B96628C0-A733-4FEC-8FC5-28A95D1A9D44}\RP38\A0013251.exe (Trojan.FakeAlert) -> No action taken. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:42: VIRUS ALERT!, on 10/31/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\ctfmon.exe D:\Program Files\BitDefender\BitDefender 2008\bdagent.exe C:\WINDOWS\system32\RUNDLL32.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe E:\Program Files\Ideazon\ZEngine\Zboard.exe C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe D:\Program Files\Washer\washer.exe C:\Program Files\Messenger\msmsgs.exe E:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe D:\Program Files\Curse\CurseClient.exe D:\Program Files\PeerGuardian2\pg2.exe D:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\System32\svchost.exe D:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.ph... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin... R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin... R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: (no name) - {36E87AE9-1CBE-4758-B521-EF2890BB42AA} - C:\WINDOWS\system32\fcccaXRK.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar.dll O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - D:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - E:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll O4 - HKLM\..\Run: [BDAgent] "D:\Program Files\BitDefender\BitDefender 2008\bdagent.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.exe C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [LXCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16 O4 - HKLM\..\Run: [Zboard] E:\Program Files\Ideazon\ZEngine\Zboard.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKCU\..\Run: [Washer] D:\Program Files\Washer\washer.exe /0 O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [DAEMON Tools Lite] "E:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [CurseClient] D:\Program Files\Curse\CurseClient.exe -silent O4 - HKCU\..\Run: [PeerGuardian] D:\Program Files\PeerGuardian2\pg2.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] D:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: Azureus.exe O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win... O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic... O20 - Winlogon Notify: !SASWinLogon - D:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe O23 - Service: lxcf_device - - C:\WINDOWS\system32\lxcfcoms.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - D:\Program Files\BitDefender\BitDefender 2008\vsserv.exe O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe -- End of file - 7493 bytes

Please download ComboFix to the desktop from one of the following links: Link1 Link 2 Link 3 Combofix is a powerful tool so follow the instructions exactly or you could damage your computer. Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with Combofix and remove some of its embedded files which may cause "unpredictable results". Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. In your case to run Combofix do the following: 1. Go offline turn off your BitDefender antivirus, and any antispyware that you may have. 2. Run Combofix and save its log. 3. Restart the computer to get the antivirus running again but leave the antispyware programs off until we get the computer cleaned. 4. Post the Combofix log. Remember to re-enable the protection again afterwards before connecting to the Internet. Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running or move the mouse, it will cause your system to hang.) Please post the log it produces.

ComboFix 08-10-31.02 - Owner 2008-11-01 10:24:20.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.480 [GMT -4:00] Running from: E:\mozilla downloads\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\_003469_.tmp.dll C:\WINDOWS\system32\KRXacccf.ini C:\WINDOWS\system32\KRXacccf.ini2 . ((((((((((((((((((((((((( Files Created from 2008-10-01 to 2008-11-01 ))))))))))))))))))))))))))))))) . 2008-11-01 03:38 . 2008-11-01 03:38 5,980 --a------ C:\StarCodec_ver1.5897.0.exe 2008-11-01 03:37 . 2008-11-01 03:37 7,273 --a------ C:\MediaTube_ver1.1573.0.exe 2008-11-01 03:36 . 2008-11-01 03:36 32,256 --a------ C:\WINDOWS\system32\winrzf32.dll 2008-11-01 03:36 . 2008-11-01 03:36 7,238 --a------ C:\wmcodec_update.exe 2008-10-31 21:08 . 2008-10-31 21:08 578,560 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll 2008-10-31 21:06 . 2008-10-31 21:07 <DIR> d-------- C:\WINDOWS\ERUNT 2008-10-31 21:00 . 2008-10-31 21:20 <DIR> d-------- C:\SDFix 2008-10-31 16:45 . 2008-10-31 16:45 <DIR> d-------- C:\Program Files\Trend Micro 2008-10-31 14:07 . 2008-10-31 14:07 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes 2008-10-31 14:01 . 2008-10-31 14:01 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Malwarebytes 2008-10-31 14:01 . 2008-10-31 14:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-10-31 14:01 . 2008-10-22 16:10 38,496 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-10-31 14:01 . 2008-10-22 16:10 15,504 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-10-31 13:51 . 2008-10-31 13:51 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Talkback 2008-10-31 12:28 . 2008-10-31 12:28 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\DivX 2008-10-31 11:43 . 2008-10-31 11:43 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com 2008-10-31 00:12 . 2008-10-31 00:12 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\SUPERAntiSpyware.com 2008-10-31 00:12 . 2008-10-31 00:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-10-31 00:11 . 2008-10-31 00:11 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-10-30 11:38 . 2008-10-30 11:38 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Talkback 2008-10-30 03:25 . 2008-10-30 03:25 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\BitDefender 2008-10-30 03:24 . 2008-10-30 03:24 <DIR> d-------- C:\Documents and Settings\Administrator 2008-10-29 23:04 . 2008-10-29 23:04 235,008 --a------ C:\WINDOWS\system32\sysdump.tar 2008-10-29 15:53 . 2008-10-29 15:53 <DIR> d-------- C:\Program Files\TryMedia 2008-10-28 21:25 . 2008-10-28 21:25 4,096 --a------ C:\WINDOWS\d3dx.dat 2008-10-23 19:47 . 2008-10-15 12:34 337,408 -----c--- C:\WINDOWS\system32\dllcache\netapi32.dll 2008-10-23 01:18 . 2008-10-23 01:18 588 --a------ C:\WINDOWS\system32\settingsbkup.sfm 2008-10-23 01:18 . 2008-10-23 01:18 588 --a------ C:\WINDOWS\system32\settings.sfm 2008-10-21 15:26 . 2008-10-21 15:32 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Winamp 2008-10-21 11:49 . 1999-12-17 10:13 86,016 --a------ C:\WINDOWS\unvise32.exe 2008-10-20 09:55 . 2008-10-20 09:55 <DIR> d-------- C:\WINDOWS\system32\scripting 2008-10-20 09:55 . 2008-10-20 09:55 <DIR> d-------- C:\WINDOWS\system32\en 2008-10-20 09:55 . 2008-10-20 09:55 <DIR> d-------- C:\WINDOWS\l2schemas 2008-10-19 19:40 . 2008-10-30 02:36 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\ImgBurn 2008-10-19 18:18 . 2008-10-19 18:19 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Ahead 2008-10-19 17:05 . 2004-08-04 01:31 20,992 --a------ C:\WINDOWS\system32\drivers\RTL8139.sys 2008-10-19 17:05 . 2004-08-04 01:31 20,992 --a--c--- C:\WINDOWS\system32\dllcache\rtl8139.sys 2008-10-19 13:24 . 2003-02-28 18:26 139,536 --a------ C:\WINDOWS\system32\javaee.dll 2008-10-19 13:24 . 2003-02-28 18:26 46,352 --a------ C:\WINDOWS\setdebug.exe 2008-10-19 13:24 . 2003-02-28 16:54 7,315 --a------ C:\WINDOWS\system32\javasup.vxd 2008-10-19 13:24 . 2003-02-28 16:35 6,550 --a------ C:\WINDOWS\jautoexp.dat 2008-10-19 13:24 . 2003-02-28 16:38 113 --a------ C:\WINDOWS\system32\zonedon.reg 2008-10-19 13:24 . 2003-02-28 16:38 113 --a------ C:\WINDOWS\system32\zonedoff.reg 2008-10-18 15:44 . 2008-10-18 15:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Last.fm 2008-10-18 15:02 . 2008-10-19 09:01 <DIR> d-------- C:\Program Files\NOS 2008-10-18 15:02 . 2008-10-19 09:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\NOS 2008-10-18 14:58 . 2008-10-18 15:09 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-10-17 23:00 . 2008-10-17 23:00 7,168 --ahs---- C:\WINDOWS\system32\Thumbs.db 2008-10-17 18:27 . 2008-10-17 18:27 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Ideazon 2008-10-16 11:05 . 2008-11-01 03:38 116 --a------ C:\WINDOWS\NeroDigital.ini 2008-10-16 10:59 . 2008-10-16 11:02 <DIR> d-------- C:\Program Files\Common Files\Ahead 2008-10-16 10:23 . 2008-10-16 10:23 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-10-16 09:20 . 2008-10-16 09:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\HipSoft 2008-10-16 01:29 . 2008-10-16 01:29 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\funkitron 2008-10-16 00:22 . 2008-10-16 00:23 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\DAEMON Tools 2008-10-15 21:08 . 2008-10-15 21:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9 2008-10-15 16:55 . 2008-10-15 16:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Blizzard 2008-10-15 14:18 . 2008-10-15 14:18 376 --a------ C:\WINDOWS\ODBC.INI 2008-10-15 14:14 . 2008-10-15 14:14 <DIR> d-------- C:\Program Files\Microsoft ActiveSync 2008-10-15 14:11 . 2008-10-17 23:00 <DIR> d-------- C:\WINDOWS\ShellNew 2008-10-15 14:10 . 2008-10-15 14:10 <DIR> d-------- C:\Program Files\Common Files\L&H 2008-10-15 13:56 . 2008-10-16 17:55 <DIR> d-------- C:\Program Files\Common Files\Blizzard Entertainment 2008-10-15 11:17 . 2008-10-15 11:17 12,670 --a------ C:\WINDOWS\system32\LexFiles.ulf 2008-10-15 11:14 . 2008-10-31 20:46 <DIR> d-------- C:\Program Files\Lx_cats 2008-10-15 11:14 . 2008-10-15 11:17 <DIR> d-------- C:\Program Files\Lexmark 730 Series 2008-10-15 11:05 . 2005-08-03 05:52 65,536 -ra------ C:\WINDOWS\system32\lxcfcfg.dll 2008-10-15 11:05 . 2006-05-03 10:15 1,158 -ra------ C:\WINDOWS\system32\lxcf.loc 2008-10-15 02:10 . 2008-10-15 02:10 <DIR> d-------- C:\Program Files\Common Files\Adobe AIR 2008-10-15 02:06 . 2008-10-15 02:06 <DIR> d-------- C:\Program Files\InstallShield Installation Information 2008-10-15 02:04 . 2008-10-15 02:04 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2008-10-15 01:07 . 2001-09-05 16:24 476,672 --a------ C:\WINDOWS\unwash.exe 2008-10-14 17:37 . 2008-10-30 17:12 <DIR> d-------- C:\Program Files\Google 2008-10-14 17:37 . 2008-10-16 01:28 <DIR> d-------- C:\Program Files\GameHouse 2008-10-14 14:45 . 2008-10-15 21:08 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\GameHouse 2008-10-14 14:19 . 2008-08-14 06:11 2,189,184 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2008-10-14 14:19 . 2008-08-14 06:09 2,145,280 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe 2008-10-14 14:19 . 2008-08-14 05:33 2,066,048 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe 2008-10-14 14:19 . 2008-08-14 05:33 2,023,936 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe 2008-10-14 14:19 . 2008-09-15 08:12 1,846,400 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys 2008-10-14 14:19 . 2008-09-08 06:41 333,824 -----c--- C:\WINDOWS\system32\dllcache\srv.sys 2008-10-14 12:04 . 2008-10-14 12:04 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Bitdefender 2008-10-14 12:04 . 2008-10-14 12:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\BitDefender 2008-10-14 11:50 . 2008-10-14 11:59 <DIR> d-------- C:\WINDOWS\SxsCaPendDel 2008-10-14 07:27 . 2008-10-14 07:27 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\DivX 2008-10-14 07:23 . 2008-10-31 12:22 75 --a------ C:\WINDOWS\cdplayer.ini 2008-10-14 07:22 . 2008-10-14 07:22 <DIR> d-------- C:\Program Files\Real 2008-10-14 07:22 . 2008-10-14 07:22 <DIR> d-------- C:\Program Files\Common Files\xing shared 2008-10-14 07:22 . 2008-10-14 07:22 <DIR> d-------- C:\Program Files\Common Files\Real 2008-10-14 05:11 . 2008-11-01 10:21 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Azureus 2008-10-14 05:11 . 2008-10-14 05:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Azureus 2008-10-14 05:10 . 2000-06-23 14:05 136,704 --a------ C:\WINDOWS\system32\iacenc.dll 2008-10-14 05:10 . 2000-06-22 13:09 56,320 --------- C:\WINDOWS\system32\iyvu9_32.dll 2008-10-14 05:05 . 1998-10-29 19:45 306,688 --a------ C:\WINDOWS\IsUninst.exe 2008-10-14 05:03 . 2008-10-14 05:03 <DIR> d-------- C:\Program Files\Sun 2008-10-14 05:03 . 2004-08-04 03:56 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2008-10-14 05:03 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-10-14 05:01 . 2008-10-14 05:03 <DIR> d-------- C:\Program Files\Java 2008-10-14 05:01 . 2008-10-14 05:01 <DIR> d-------- C:\Program Files\Common Files\Java 2008-10-13 18:50 . 2008-10-13 18:50 <DIR> d-------- C:\Program Files\ReflexiveArcade 2008-10-10 12:15 . 2008-04-13 20:12 712,704 --------- C:\WINDOWS\system32\windowscodecs.dll 2008-10-10 12:15 . 2008-04-13 20:12 346,112 --------- C:\WINDOWS\system32\windowscodecsext.dll 2008-10-10 12:15 . 2008-04-13 20:12 290,304 --------- C:\WINDOWS\system32\rhttpaa.dll 2008-10-10 12:15 . 2008-04-13 20:12 276,992 --------- C:\WINDOWS\system32\wmphoto.dll 2008-10-10 12:15 . 2008-04-13 20:12 76,800 --------- C:\WINDOWS\system32\qutil.dll 2008-10-10 12:15 . 2008-04-13 20:12 69,120 --------- C:\WINDOWS\system32\wlanapi.dll 2008-10-10 12:15 . 2008-04-13 20:12 61,952 --------- C:\WINDOWS\system32\rasqec.dll 2008-10-10 12:15 . 2008-04-13 20:12 53,248 --------- C:\WINDOWS\system32\tsgqec.dll 2008-10-10 12:15 . 2008-04-13 20:12 50,688 --------- C:\WINDOWS\system32\tspkg.dll 2008-10-10 12:15 . 2008-04-13 20:12 32,768 --------- C:\WINDOWS\system32\setupn.exe 2008-10-10 12:15 . 2008-04-13 20:12 28,672 --------- C:\WINDOWS\system32\verclsid.exe 2008-10-10 12:15 . 2008-04-13 14:40 10,240 --------- C:\WINDOWS\system32\drivers\sffp_mmc.sys 2008-10-10 12:13 . 2008-04-13 20:11 650,752 --------- C:\WINDOWS\system32\dot3ui.dll 2008-10-10 12:12 . 2008-04-13 20:11 136,192 --------- C:\WINDOWS\system32\aaclient.dll 2008-10-10 07:19 . 2008-05-01 10:33 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll 2008-10-10 07:19 . 2008-06-13 07:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-10-10 07:18 . 2008-04-11 15:04 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll 2008-10-10 07:18 . 2008-05-08 10:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys 2008-10-10 05:05 . 2008-10-10 07:17 4,958,588 --a------ C:\WINDOWS\{00000000-00000000-0000000D-00001102-00000008-10211102}.BAK 2008-10-10 05:05 . 2008-11-01 10:26 30,600 --a------ C:\WINDOWS\system32\BMXStateBkp-{00000000-00000000-0000000D-00001102-00000008-10211102}.rfx 2008-10-10 05:05 . 2008-11-01 10:26 30,600 --a------ C:\WINDOWS\system32\BMXState-{00000000-00000000-0000000D-00001102-00000008-10211102}.rfx 2008-10-10 05:05 . 2008-11-01 10:26 29,604 --a------ C:\WINDOWS\system32\BMXCtrlState-{00000000-00000000-0000000D-00001102-00000008-10211102}.rfx 2008-10-10 05:05 . 2008-11-01 10:26 29,604 --a------ C:\WINDOWS\system32\BMXBkpCtrlState-{00000000-00000000-0000000D-00001102-00000008-10211102}.rfx 2008-10-10 05:05 . 2008-11-01 10:26 11,564 --a------ C:\WINDOWS\system32\DVCState-{00000000-00000000-0000000D-00001102-00000008-10211102}.rfx 2008-10-10 03:42 . 2008-10-10 03:42 <DIR> d-------- C:\Program Files\Windows Media Connect 2 2008-10-10 03:39 . 2008-10-18 15:43 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-19 21:05 0 ----a-w C:\WINDOWS\system32\drivers\logiflt.iad 2008-10-14 16:13 86,792 ----a-w C:\WINDOWS\system32\drivers\bdfndisf.sys 2008-10-09 22:44 558,142 ----a-w C:\WINDOWS\java\Packages\ASZTJ1VV.ZIP 2008-10-09 22:44 155,995 ----a-w C:\WINDOWS\java\Packages\ZN7BDFBJ.ZIP 2008-10-09 22:44 --------- d-----w C:\Program Files\microsoft frontpage 2008-09-18 03:55 6,132,576 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys 2008-09-16 00:14 9,464 ------w C:\WINDOWS\system32\drivers\cdralw2k.sys 2008-09-16 00:14 9,336 ------w C:\WINDOWS\system32\drivers\cdr4_xp.sys 2008-09-16 00:14 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys 2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Washer"="D:\Program Files\Washer\washer.exe" [2001-09-05 2753536] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-13 1695232] "DAEMON Tools Lite"="E:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2006-03-01 90112] "CurseClient"="D:\Program Files\Curse\CurseClient.exe" [2008-10-10 4789760] "PeerGuardian"="D:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 1421824] "SUPERAntiSpyware"="D:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-09-03 1576176] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BDAgent"="D:\Program Files\BitDefender\BitDefender 2008\bdagent.exe" [2008-10-14 368640] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-09-17 13574144] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-09-17 86016] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-10-14 185872] "LXCFCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll" [2005-07-20 73728] "Zboard"="E:\Program Files\Ideazon\ZEngine\Zboard.exe" [2008-06-27 53248] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "nwiz"="nwiz.exe" [2008-09-17 C:\WINDOWS\system32\nwiz.exe] C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ Azureus.exe [2008-10-10 199608] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - D:\Program Files\Microsoft Office\Office10\OSA.exe [2001-02-13 83360] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "D:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-07-23 16:28 352256 D:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winrzf32] 2008-11-01 03:36 32256 C:\WINDOWS\system32\winrzf32.dll [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Adobe Media Player.lnk] path=C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Adobe Media Player.lnk backup=C:\WINDOWS\pss\Adobe Media Player.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2008-04-13 20:12 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2006-01-12 15:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-06-10 04:27 144784 C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh] --a------ 2008-09-26 19:14 3660848 E:\Program Files\Veoh Networks\Veoh\VeohClient.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-04-01 14:49 36352 D:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "WMPNetworkSvc"=3 (0x3) "GoogleDesktopManager-061008-081103"=3 (0x3) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001 "Firewalboverride"=dword:00000004 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\WINDOWS\\system32\\lxcfcoms.exe"= "C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxcfpswx.exe"= "D:\\Program Files\\Curse\\CurseClient.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "135:TCP"= 135:TCP:TCP Port 135 R3 Alpham1;Ideazon ZBoard USB Human Interface Device;C:\WINDOWS\system32\DRIVERS\Alpham1.sys [2007-07-23 42624] R3 Alpham2;Ideazon ZBoard MM USB Human Interface Device;C:\WINDOWS\system32\DRIVERS\Alpham2.sys [2007-03-20 18432] R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;C:\WINDOWS\system32\DRIVERS\bdfndisf.sys [2008-10-14 86792] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bdx REG_MULTI_SZ scan *Newly Created Service* - PGFILTER . - - - - ORPHANS REMOVED - - - - BHO-{36E87AE9-1CBE-4758-B521-EF2890BB42AA} - C:\WINDOWS\system32\fcccaXRK.dll WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - (no file) MSConfigStartUp-Google Desktop Search - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\vda3h4h9.default\ FF -: plugin - D:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll FF -: plugin - D:\Program Files\DivX\DivX Web Player\npdivx32.dll FF -: plugin - D:\Program Files\Mozilla Firefox\plugins\np32dsw.dll FF -: plugin - D:\Program Files\Mozilla Firefox\plugins\npdivx32.dll FF -: plugin - D:\Program Files\Mozilla Firefox\plugins\npLegitCheckPlugin.dll FF -: plugin - D:\Program Files\Mozilla Firefox\plugins\npmozax.dll FF -: plugin - D:\Program Files\Mozilla Firefox\plugins\npnul32.dll FF -: plugin - D:\Program Files\Mozilla Firefox\plugins\nppdf32.dll FF -: plugin - D:\Program Files\Mozilla Firefox\plugins\nppl3260.dll FF -: plugin - D:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll FF -: plugin - D:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll FF -: plugin - D:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll FF -: plugin - D:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll FF -: plugin - D:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll FF -: plugin - D:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll FF -: plugin - D:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll FF -: plugin - D:\Program Files\Mozilla Firefox\plugins\nprjplug.dll FF -: plugin - D:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll FF -: plugin - D:\Program Files\Mozilla Firefox\plugins\NPSWF32.dll FF -: plugin - E:\Program Files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-01 10:29:25 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\bdfsfltr] "ImagePath"=hex:73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,\ [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\bdfsfltr] "ImagePath"=hex:73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,\ . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\winrzf32.dll . r Running Proce . C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe C:\WINDOWS\system32\rundll32.exe C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Azureus.exe C:\WINDOWS\system32\wscntfy.exe . ************************************************************************** . Completion time: 2008-11-01 10:31:56 - machine was rebooted ComboFix-quarantined-files.txt 2008-11-01 14:31:51 Pre-Run: 30,664,830,976 bytes free Post-Run: 30,595,784,704 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn 294 --- E O F --- 2008-10-24 09:01:09

Please download SuperAntiSpyware from the following link to your desktop: SuperAntiSpyware 1. Open SuperAntiSpware from its icon and install and Update it 2. Under Scanner Options make sure the following are checked (leave all others unchecked): 3. Close browsers before scanning. 4. Scan for tracking cookies. 5. Terminate memory threats before quarantining. 6. Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet. Now reboot into Safe Mode: How to enter safe mode(XP) Using the F8 Method Restart your computer. When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu. Select the option for Safe Mode using the arrow keys. Then press enter on your keyboard to boot into Safe Mode. Now Scan with SuperAntiSpyware 1. Open from the desktop icon or the program Files list On the left, make sure you check C:\Fixed Drive. 2. Perform a Complete scan. After scan,Verify they are all checked. 3. Click OK on the summary screen to quarantine all found items. 4. If asked if you want to reboot, click "Yes" and reboot normally. To retrieve the removal information after reboot, launch SUPERAntispyware again. 1. Click Preferences, then click the Statistics/Logs tab. 2. Under Scanner Logs, double-click SuperAntiSpyware Scan Log. 3. If there are several logs, click the current dated log and press View log. 4. A text file will open in your default text editor. 5. Please copy and paste the Scan Log results in your next reply. 6. Click Close to exit the program.

When i do a scan in safemode and attempt to quarantine of all 159 items while program is Terminating the memory threats before quarantining the pc reboots i do another scan in safemode and attempt and the same thing happens. Is there a program that will scan in dos mode? if not then what next should i manually remove the found threats or remove from registry with regedit?