Pressing "a" Button Acts As Back & ....

check1324 · 12th June 2008

Hi,
I have got strange problem in my PC. When I press "A" button from the keyboard it acts as a back button, and takes the window back from whatever screen Am present. This happens for both windows explorer as well as for my web browser.. And Next thing is when I press "1" button it randomly types "0001" or "100" or some other similar digits.

I had scanned with AVG antispyware then it detected some problem and fixed it, But the same problem started again after a week. and Now including AVG no antispware is detected any such problem.

Please help me rectifying this problem.

I am posting the Deckard's System Scanner here:
Deckard's System Scanner v20071014.68
Run by Admin on 2008-06-12 16:18:36
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.

-- Last 5 Restore Point(s) --
34: 2008-06-12 10:48:49 UTC - RP128 - Deckard's System Scanner Restore Point
33: 2008-06-12 10:25:45 UTC - RP127 - Made by Registry Mechanic O
32: 2008-06-12 10:17:03 UTC - RP126 - Perfect goin
31: 2008-06-12 08:58:45 UTC - RP125 - Removed McAfee VirusScan Enterprise
30: 2008-06-12 08:07:59 UTC - RP124 - Installed McAfee VirusScan Enterprise

-- First Restore Point --
1: 2008-05-21 02:15:14 UTC - RP95 - System Checkpoint

Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 376 MiB (512 MiB recommended).

-- HijackThis (run as Admin.exe) -----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:20:37 PM, on 6/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\DAP\DAP.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\T-Media\RMTSTOCK.EXE
C:\PROGRA~1\T-Media\MIXERCTL.EXE
C:\PROGRA~1\T-Media\KBOSDCTL.EXE
C:\PROGRA~1\T-Media\KBRmt32.Exe
C:\PROGRA~1\T-Media\CDMng32.EXE
C:\PROGRA~1\T-Media\RmtConvt.EXE
C:\PROGRA~1\T-Media\BKGRD32.EXE
C:\PROGRA~1\T-Media\WheelMng.EXE
C:\PROGRA~1\T-Media\RMTSPECL.EXE
C:\PROGRA~1\T-Media\CALCMNG.EXE
C:\PROGRA~1\T-Media\RECMNG.EXE
C:\PROGRA~1\T-Media\MxrCtl32.EXE
C:\PROGRA~1\T-Media\DKeyBEx.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sify Broadband\BBClient.exe
C:\Program Files\Sify Broadband\BBImpSec.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Documents and Settings\Admin\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Admin.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://sify.com/finance/budget/?user...79c5a1865355b1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: BHOManager Class - {474264BC-9571-47C1-85B9-780F756DC9CE} - C:\WINDOWS\system32\BHOManager.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [KMEKE9801] C:\PROGRA~1\T-Media\DriBat32.EXE DKBoot.INI
O4 - HKCU\..\Run: [SifyBB] C:\Program Files\Sify Broadband\BBImpSec.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1211653820640
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - https://sslvpnpl.eds.com/ICSScanner.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8C63ABFA-0F40-484A-80B7-80089B1995EB}: NameServer = 202.144.95.4,202.144.66.6
O17 - HKLM\System\CS1\Services\Tcpip\..\{8C63ABFA-0F40-484A-80B7-80089B1995EB}: NameServer = 202.144.95.4,202.144.66.6
O17 - HKLM\System\CS2\Services\Tcpip\..\{8C63ABFA-0F40-484A-80B7-80089B1995EB}: NameServer = 202.144.95.4,202.144.66.6
O17 - HKLM\System\CS3\Services\Tcpip\..\{8C63ABFA-0F40-484A-80B7-80089B1995EB}: NameServer = 202.144.95.4,202.144.66.6
O18 - Protocol: HTLFP - {03B7A5D4-96B0-4316-95F8-072D326A58F1} - ielpview.dll (file missing)
O18 - Protocol: vfsp - {E4CB5121-E242-11D4-8ED6-00010219EB22} - VFSProtocol.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe (file missing)

--
End of file - 6018 bytes

-- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) -----------

backup-20080612-113458-145 O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

-- File Associations -----------------------------------------------------------

.reg - regfile - shell\open\command - regedit.exe "%1" %*
.scr - scrfile - shell\open\command - "%1" %*

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R2 paldrv - c:\windows\system32\pal_drv.sys <Not Verified; Mercury Interactive Corp.; Astra>
R3 ialm - c:\windows\system32\drivers\ialmnt5.sys <Not Verified; Intel Corporation; Intel Graphics Accelerator Drivers for Windows NT(R)>
R3 slnt (RTL8139D PCI Fast Ethernet Adapter) - c:\windows\system32\drivers\slnt.sys <Not Verified; Silan Micro-Electronics Inc.; Silan Micro-Electronics Inc.>
R3 STAC97 (Audio Driver (WDM) - SigmaTel CODEC) - c:\windows\system32\drivers\stac97.sys <Not Verified; SigmaTel, Inc.; VIA Audio Controller with SigmaTel CODEC device driver.>

S3 KBFiltr (Dritek HotKey Keyboard Filter Driver) - c:\windows\system32\drivers\kbfiltr.sys (file missing)

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

S3 WLSetupSvc (Windows Live Setup Service) - "c:\program files\windows live\installer\wlsetupsvc.exe" (file missing)

-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.

-- Scheduled Tasks -------------------------------------------------------------

2008-05-27 01:07:11 300 --ah----- C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IType_exe.job

-- Files created between 2008-05-12 and 2008-06-12 -----------------------------

2008-06-12 15:42:21 0 dr-h----- C:\Documents and Settings\Admin\Recent
2008-06-12 14:31:38 0 d-------- C:\Program Files\Enigma Software Group
2008-06-12 13:38:49 0 d-------- C:\Program Files\Common Files\Cisco Systems
2008-06-12 00:57:23 0 d-------- C:\Documents and Settings\Admin\Application Data\Malwarebytes
2008-06-12 00:57:09 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-12 00:57:06 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-12 00:27:18 0 d-------- C:\Program Files\Trend Micro
2008-06-12 00:12:20 51 --a------ C:\smp.bat
2008-06-09 00:18:41 0 d-------- C:\Program Files\PFConfig
2008-06-08 23:40:07 0 d--h----- C:\WINDOWS\system32\GroupPolicy
2008-06-08 17:49:06 0 d-------- C:\Program Files\Lavasoft
2008-06-08 17:49:01 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-06-07 22:48:49 717296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-06-07 22:48:34 0 d-------- C:\Documents and Settings\Admin\Application Data\DAEMON Tools
2008-06-06 12:40:47 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-06 02:00:18 0 d-------- C:\Program Files\T-Media
2008-06-06 01:49:10 303616 --a------ C:\WINDOWS\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
2008-06-06 01:49:08 0 d-------- C:\Documents and Settings\Admin\WINDOWS
2008-06-01 20:19:21 0 d-------- C:\Program Files\SopCast
2008-06-01 16:36:36 164352 --a------ C:\WINDOWS\system32\unrar.dll
2008-06-01 16:36:32 217088 --a------ C:\WINDOWS\system32\yv12vfw.dll <Not Verified; www.helixcommunity.org; Helix YV12 YUV Codec>
2008-06-01 16:36:32 282624 --a------ C:\WINDOWS\system32\xvidvfw.dll
2008-06-01 16:36:32 1559040 --a------ C:\WINDOWS\system32\xvidcore.dll
2008-06-01 16:36:30 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2008-06-01 16:36:30 81920 --a------ C:\WINDOWS\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100>
2008-06-01 16:36:29 739840 --a------ C:\WINDOWS\system32\divx.dll <Not Verified; DivX, Inc.; DivX®>
2008-06-01 16:36:28 7680 --a------ C:\WINDOWS\system32\ff_vfw.dll
2008-06-01 16:36:24 0 d-------- C:\Program Files\K-Lite Codec Pack
2008-05-28 12:47:19 0 d-------- C:\Program Files\Smart Projects
2008-05-28 01:00:08 0 d-------- C:\Documents and Settings\Admin\Application Data\Grisoft
2008-05-28 00:59:44 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-05-25 21:02:12 0 d-------- C:\Documents and Settings\Administrator\Application Data\Real
2008-05-25 20:57:49 61440 --a------ C:\WINDOWS\UnInst32.EXE <Not Verified; Dritek System Inc.; Dritek System Inc. UnInst32 12.21.1999 ( VC60 )>
2008-05-25 20:25:11 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-05-25 20:24:53 0 d-------- C:\Documents and Settings\Admin\Application Data\SUPERAntiSpyware.com

-- Find3M Report ---------------------------------------------------------------

2008-06-12 16:21:02 0 d-------- C:\Documents and Settings\Admin\Application Data\uTorrent
2008-06-12 15:48:39 0 d-------- C:\Documents and Settings\Admin\Application Data\Broadband
2008-06-12 14:30:37 0 d-------- C:\Program Files\Common Files
2008-06-09 21:04:54 0 d-------- C:\Documents and Settings\Admin\Application Data\dvdcss
2008-06-08 12:43:08 59 --a------ C:\Documents and Settings\Admin\Application Data\GoodnightTimer.ini
2008-06-08 11:56:07 0 d-------- C:\Documents and Settings\Admin\Application Data\AdobeUM
2008-06-01 20:23:33 0 d-------- C:\Documents and Settings\Admin\Application Data\SopCast
2008-06-01 11:03:13 0 d-------- C:\Documents and Settings\Admin\Application Data\U3
2008-05-27 01:08:39 0 d-------- C:\Program Files\Google
2008-05-27 01:08:05 0 d-------- C:\Documents and Settings\Admin\Application Data\Yahoo!
2008-05-27 00:28:54 0 d-------- C:\Documents and Settings\Admin\Application Data\Help
2008-05-25 20:54:02 0 --a------ C:\autoexec.bat
2008-05-25 20:46:15 0 d-------- C:\Documents and Settings\Admin\Application Data\Uniblue
2008-05-24 16:23:31 0 d-------- C:\Program Files\Movie Maker
2008-05-07 15:25:48 0 d-------- C:\Documents and Settings\Admin\Application Data\Skype
2008-05-03 10:42:34 101 --a------ C:\WINDOWS\system32\prsgrc.dll
2008-05-03 10:42:33 205 --a------ C:\WINDOWS\system32\toklwxy.dll
2008-05-01 13:26:24 0 d-------- C:\Program Files\Sahaj
2008-04-30 12:40:11 1025 --a------ C:\WINDOWS\system32\p6baynn.dll
2008-04-30 12:35:11 0 d-------- C:\Program Files\Common Files\Bcgsoft
2008-04-30 12:28:12 1024 --a------ C:\WINDOWS\system32\grcauth2.dll
2008-04-30 12:28:12 1024 --a------ C:\WINDOWS\system32\grcauth1.dll
2008-04-30 12:27:57 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-04-30 10:41:33 1025 --a------ C:\WINDOWS\system32\sysprs7.dll
2008-04-30 10:41:33 73 --a------ C:\WINDOWS\system32\ssprs.dll
2008-04-30 10:41:33 205 --a------ C:\WINDOWS\system32\lsprst7.dll
2008-04-30 10:41:33 1025 --a------ C:\WINDOWS\system32\clauth2.dll
2008-04-30 10:41:33 1025 --a------ C:\WINDOWS\system32\clauth1.dll
2008-04-30 10:30:52 0 d-------- C:\Program Files\Common Files\Mercury Interactive
2008-04-30 10:28:01 0 d-------- C:\Program Files\Common Files\InstallShield
2008-04-30 10:23:53 0 d-------- C:\Program Files\Microsoft Script Debugger
2008-04-24 00:00:46 0 d-------- C:\Documents and Settings\Admin\Application Data\Real
2008-04-21 04:37:57 0 d-------- C:\Documents and Settings\Admin\Application Data\TeamViewer
2008-04-19 23:39:40 0 d-------- C:\Program Files\Nokia
2008-04-19 08:12:56 0 d-------- C:\Program Files\Java
2008-04-19 08:03:03 0 d-------- C:\Program Files\Common Files\Java
2008-04-17 00:35:03 0 d-------- C:\Program Files\uTorrent
2008-04-07 19:39:42 31304 --a------ C:\Documents and Settings\Admin\Application Data\GDIPFONTCACHEV1.DAT
2008-03-23 21:46:49 2516 --a------ C:\Documents and Settings\Admin\Application Data\NMM-MetaData.db

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [11/02/2004 09:03 AM]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [11/02/2004 08:59 AM]
"DownloadAccelerator"="C:\Program Files\DAP\DAP.exe" [03/05/2008 01:35 PM]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [05/16/2008 04:49 AM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [06/11/2007 02:55 PM]
"KMEKE9801"="C:\PROGRA~1\T-Media\DriBat32.exe" [04/08/1998 05:46 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SifyBB"="C:\Program Files\Sify Broadband\BBImpSec.exe" [04/21/2006 08:04 PM]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [08/30/2007 05:43 PM]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
"DisableTaskMgr"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explo rer]
"EnableShellExecuteHooks"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explor er]
"ClearRecentDocsOnExit"=1 (0x1)
"NoRecentDocsMenu"=1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell ExecuteHooks]
"{A5949E07-8536-4625-A3D0-2DD83F559990}"= C:\WINDOWS\system32\ShellHook.dll [02/11/2007 11:19 PM 46080]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

-- End of Deckard's System Scanner: finished at 2008-06-12 16:22:37 ------------

**Geri** · 12th June 2008

Hi check1324
Welcome to windowsbbs.

I see you have P2P software ( Limewire, BitTorrent uTorrent etc… ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections.

References for the risk of these programs are here,
here and here.

I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

Note: Please be advised that continued use of these programs after being warned of the danger of infections from them, may result in the discontinued help of future cleaning of your system here at Windowsbbs Virus and Spyware removal.

Please do the following in the order given.

** dss.exe must be on the desktop for the following command to work. **

Highlight and copy the bolded command below.

"%userprofile%\desktop\dss.exe" /daft

Click Start>Run and paste the command in the run box, then hit enter.
An interface of Deckards file association fix will open.
Click Scan.
Check the box next to the following, then click Fix.
- .reg
- .scr
Exit when complete.

Now do this.

Download ComboFix from Here to your Desktop.

It's best to disable realtime protection applications as they sometimes interfere with the tool.
Check this link for any applicable programs you may have.

Close all open programs and windows
Double click combofix.exe and follow the prompts.
Vista users right click Combofix.exe and select Run As Administrator.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Note - ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.

Note - Combofix makes some changes when run to prevent autorun/autoplay of ALL CDs, floppies and USB devices, to assist with malware removal & increase security. If this is an issue or makes it difficult for you to use those devices, please ask how to reset it.

Thanks
Geri

check1324 · 6th July 2008

Thanks......... My problem solved........

**Geri** · 8th July 2008

Hi check1324
Could you lets us know what you did to resolve the problem.

You may help someone else with the same problem.

Thanks
Geri