Solved Dangerous trojan horse detected

[Resolved]Dangerous trojan horse detected

Please help
I have recently been recieving a Sysytem error prompt apon accessing any web site or "my computer ". The pop-up reads as follows:

Sytem error
Attention (my name). Some dangerous trojan horse detected in your system. Microsoft XP files corrupted. Click ok to download antispyware.

I have ran my anti spy and virus with no luck. I also tried spyware doctor, XoftSpySE,with no luck. Here is my main.txt. Any info would be helpful.

Deckard's System Scanner v20071014.68
Run by Ibrahim on 2008-06-17 10:37:52
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
56: 2008-06-17 17:38:06 UTC - RP56 - Deckard's System Scanner Restore Point
55: 2008-06-12 16:22:21 UTC - RP55 - System Checkpoint
54: 2008-06-10 15:37:51 UTC - RP54 - System Checkpoint
53: 2008-06-07 14:03:12 UTC - RP53 - Installed Adobe Photoshop CS2
52: 2008-06-04 19:55:58 UTC - RP52 - System Checkpoint


-- First Restore Point --
1: 2008-04-14 00:57:20 UTC - RP1 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 480 MiB (512 MiB recommended).


-- HijackThis (run as Ibrahim.exe) ---------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:39:37 AM, on 6/17/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\htpatch.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\DAP\DAP.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Ibrahim\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Ibrahim.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Sigma plugin - {7DBF8390-552B-4D55-9F62-00D032032691} - C:\WINDOWS\posant16a.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! ¤u¨Ã£¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Program Files\DAP\DAPIEBar.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe "
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe "
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll "
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe "
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [DownloadAccelerator] C:\PROGRA~1\DAP\DAP.EXE /STARTUP
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE "
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://global.acer.com/
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1208096476450
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=19588
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

--
End of file - 9588 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R2 SVKP - c:\windows\system32\svkp.sys <Not Verified; AntiCracking; SVKP driver for NT>
R3 NTIDrvr (Upper Class Filter Driver) - c:\windows\system32\drivers\ntidrvr.sys <Not Verified; NewTech Infosystems, Inc.; >


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

S3 AresChatServer (Ares Chatroom server) - c:\program files\ares\chatserver.exe <Not Verified; Ares Development Group; Ares Chat Server>


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Scheduled Tasks -------------------------------------------------------------

2008-04-13 18:08:14 534 --a------ C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Ibrahim.job


-- Files created between 2008-05-17 and 2008-06-17 -----------------------------

2008-06-17 10:20:21 0 d-------- C:\Program Files\Trend Micro
2008-06-17 09:32:10 274432 --a------ C:\WINDOWS\posant16a.dll
2008-06-17 09:32:09 53 --a------ C:\smp.bat
2008-06-17 08:51:40 0 d-------- C:\WINDOWS\LastGood
2008-06-07 07:06:46 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-06-07 07:05:31 0 d-------- C:\Program Files\Common Files\Adobe Systems Shared
2008-06-07 07:03:17 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe
2008-06-04 12:25:12 0 d--hs---- C:\FOUND.008
2008-06-02 20:59:08 0 d--hs---- C:\FOUND.007
2008-06-02 12:56:38 0 d-------- C:\Program Files\Common Files\xing shared
2008-05-31 09:02:14 0 d-------- C:\Program Files\mkvtoavis
2008-05-31 09:00:24 0 d-------- C:\Program Files\MKVTOAVI
2008-05-31 04:30:27 0 d-------- C:\Program Files\Total Video Player
2008-05-25 08:29:34 0 d-------- C:\Program Files\Combined Community Codec Pack
2008-05-25 08:19:21 0 d-------- C:\Program Files\FLV Player
2008-05-21 04:49:20 0 d--hs---- C:\FOUND.006
2008-05-21 04:44:24 0 d--hs---- C:\FOUND.005
2008-05-20 23:37:54 0 d--hs---- C:\FOUND.004
2008-05-20 04:23:44 0 d--hs---- C:\FOUND.003


-- Find3M Report ---------------------------------------------------------------

2008-05-14 00:09:08 0 d-------- C:\Documents and Settings\Ibrahim\Application Data\Real
2008-05-10 06:44:54 0 d-------- C:\Program Files\AvantGo Connect
2008-05-10 06:43:52 0 d-------- C:\Program Files\Microsoft ActiveSync
2008-05-06 09:44:02 2368 --a------ C:\WINDOWS\system32\SVKP.sys <Not Verified; AntiCracking; SVKP driver for NT>
2008-05-06 09:43:36 50688 --a------ C:\WINDOWS\system32\wbhelp2.dll <Not Verified; Stardock.Net, Inc; WindowBlinds for Win32 x86 machines>
2008-05-06 09:43:34 0 d-------- C:\Program Files\DAP
2008-05-01 00:09:54 0 d-------- C:\Program Files\Common Files\Real
2008-04-29 03:52:36 0 d-------- C:\Documents and Settings\Ibrahim\Application Data\vlc
2008-04-29 03:48:26 0 d-------- C:\Program Files\VideoLAN
2008-04-18 09:06:12 0 d-------- C:\Documents and Settings\Ibrahim\Application Data\Astro Gemini Software
2008-04-18 09:06:10 0 d-------- C:\Program Files\Astro Gemini Software
2008-04-16 23:03:16 1160 --a------ C:\WINDOWS\mozver.dat
2008-04-16 22:58:02 0 --a------ C:\WINDOWS\nsreg.dat
2008-04-13 17:49:28 12288 --a------ C:\WINDOWS\impborl.dll
2008-04-13 17:49:28 634880 --a------ C:\WINDOWS\Aspire.scr <Not Verified; ScreenTime Media; ScreenTime For Flash>
2008-04-13 17:47:20 1024 -r-h----- C:\WINDOWS\system32\NTICDMK32.dll
2008-04-13 17:39:54 0 -rahs---- C:\MSDOS.SYS
2008-04-13 17:39:54 0 -rahs---- C:\IO.SYS
2008-04-13 17:39:54 0 --a------ C:\CONFIG.SYS
2008-04-13 17:39:54 0 --a------ C:\AUTOEXEC.BAT
2008-04-13 17:38:16 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat
2008-04-13 17:32:32 62 --ahs---- C:\Documents and Settings\Ibrahim\Application Data\desktop.ini
2008-03-31 14:25:48 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®>
2008-03-31 14:25:48 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®>
2008-03-31 14:25:46 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?>
2008-03-31 14:25:46 831488 --a------ C:\WINDOWS\system32\divx_xx0a.dll
2008-03-31 14:25:46 682496 --a------ C:\WINDOWS\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®>
2008-03-21 13:30:08 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2008-03-21 13:28:54 196608 --a------ C:\WINDOWS\system32\dtu100.dll <Not Verified; DivX, Inc.; DivX, Inc. dtu100>
2008-03-21 13:28:54 81920 --a------ C:\WINDOWS\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100>
2008-03-21 13:28:20 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7DBF8390-552B-4D55-9F62-00D032032691}]
06/17/2008 09:32 AM 274432 --a------ C:\WINDOWS\posant16a.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio "= "cmicnfg.cpl" []
"HTpatch "= "C:\WINDOWS\htpatch.exe" [10/30/2002 05:40 PM]
"CHotkey "= "mHotkey.exe" [03/28/2003 05:24 PM C:\WINDOWS\mHotkey.exe]
"ccApp "= "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [09/02/2006 07:04 PM]
"osCheck "= "C:\Program Files\Norton AntiVirus\osCheck.exe" [09/05/2006 01:22 PM]
"SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM]
"Symantec PIF AlertEng "= "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [01/29/2008 05:38 PM]
"HP Component Manager "= "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [12/22/2003 08:38 AM]
"HPDJ Taskbar Utility "= "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe" [03/04/2004 08:46 AM]
"HP Software Update "= "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [02/18/2004 10:55 AM]
"googletalk "= "C:\Program Files\Google\Google Talk\googletalk.exe" [01/01/2007 02:22 PM]
"DownloadAccelerator "= "C:\PROGRA~1\DAP\DAP.exe" [01/02/2000 06:06 AM]
"TkBellExe "= "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [06/02/2008 12:55 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager "= "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [08/30/2007 05:43 PM]
"MsnMsgr "= "C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [10/18/2007 11:34 AM]
"ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 12:56 AM]
"ares "= "C:\Program Files\Ares\Ares.exe" [02/20/2008 07:33 AM]
"MSMSGS "= "C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 09:24 AM]
"H/PC Connection Agent "= "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" [02/02/2004 10:42 PM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1/21/2000 1:15:54 AM]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@= "Service "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@= "Volume shadow copy "


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{56ac71d7-09bd-11dd-9fb2-806d6172696f}]
Auto\command- setup.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c20445cc-371b-11dd-a01c-000d87130ae7}]
AutoRun\command- F:\tgtighg.cmd
explore\Command- F:\tgtighg.cmd
open\Command- F:\tgtighg.cmd




-- End of Deckard's System Scanner: finished at 2008-06-17 10:41:13 ------------

 

Hi hashim101
Welcome to Windowsbbs.

I see you have P2P software ( Limewire, BitTorrent uTorrent, Ares etc… ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections.

References for the risk of these programs are here,
here and here.

I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

Note: Please be advised that continued use of these programs after being warned of the danger of infections from them, may result in the discontinued help of future cleaning of your system here at Windowsbbs Virus and Spyware removal.

Lets see if MBAM will kill this.

Download Malwarebytes' Anti-Malware (MBAM) from here or here and save the file to your desktop.

Double click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select 'Perform Quick Scan', then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note below)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Post the entire report in your next reply along with a fresh HijackThis log.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Now do this.

Please download Flash_Disinfector.exe by sUBs and save it to your desktop:

http://www.techsupportforum.com/sectools/sUBs/Flash_Disinfector.exe

NOTE: In the event you already have Flash_Disinfector, this is a new version that I need you to download.

If you have any Flash drives (USB thumb drives) plug them in before doing this.

• Double-click Flash_Disinfector.exe to run it.
  Follow any prompts that may appear.
  Your desktop will vanish for a while, and then reappear. This is normal.
  Wait until the program has finished scanning, then please exit the program.

Empty this folder:

C:\WINDOWS\temp


Please post the MBAM log and a new dss log.

Thanks
Geri

 

Thanx A Mill

HEY THANX FOR THE HELP IT WORKED!! HERES THE NEW MBAM AND DSS LOG THANX A MILL.

Malwarebytes' Anti-Malware 1.17
Database version: 850

11:47:02 AM 6/17/2008
mbam-log-6-17-2008 (11-47-02).txt

Scan type: Quick Scan
Objects scanned: 36461
Time elapsed: 4 minute(s), 47 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 6
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\posant16a.dll (Trojan.FakeAlert) -> Unloaded module successfully.

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{5fd23a1e-7be2-468e-bbfc-a35447122211} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{5fd23a1e-7be2-468e-bbfc-a35447122210} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ie.ieplugin (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7dbf8390-552b-4d55-9f62-00d032032691} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{7dbf8390-552b-4d55-9f62-00d032032691} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7dbf8390-552b-4d55-9f62-00d032032691} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\posant16a.dll (Trojan.FakeAlert) -> Delete on reboot.

HERES THE DSS

Deckard's System Scanner v20071014.68
Run by Ibrahim on 2008-06-17 11:56:52
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Total Physical Memory: 480 MiB (512 MiB recommended).


-- HijackThis (run as Ibrahim.exe) ---------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:57:01 AM, on 6/17/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\htpatch.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\DAP\DAP.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Ibrahim\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Ibrahim.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! ¤u¨Ã£¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Program Files\DAP\DAPIEBar.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe "
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe "
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll "
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe "
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe "
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [DownloadAccelerator] C:\PROGRA~1\DAP\DAP.EXE /STARTUP
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE "
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://global.acer.com/
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1208096476450
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=19588
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

--
End of file - 9403 bytes

-- Files created between 2008-05-17 and 2008-06-17 -----------------------------

2008-06-17 11:54:00 0 drahs---- C:\autorun.inf
2008-06-17 11:40:47 0 d-------- C:\Documents and Settings\Ibrahim\Application Data\Malwarebytes
2008-06-17 11:40:45 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-17 11:40:43 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-17 10:20:21 0 d-------- C:\Program Files\Trend Micro
2008-06-17 09:32:09 53 --a------ C:\smp.bat
2008-06-07 07:06:46 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-06-07 07:05:31 0 d-------- C:\Program Files\Common Files\Adobe Systems Shared
2008-06-07 07:03:17 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe
2008-06-04 12:25:12 0 d--hs---- C:\FOUND.008
2008-06-02 20:59:08 0 d--hs---- C:\FOUND.007
2008-06-02 12:56:38 0 d-------- C:\Program Files\Common Files\xing shared
2008-05-31 09:02:14 0 d-------- C:\Program Files\mkvtoavis
2008-05-31 09:00:24 0 d-------- C:\Program Files\MKVTOAVI
2008-05-31 04:30:27 0 d-------- C:\Program Files\Total Video Player
2008-05-25 08:29:34 0 d-------- C:\Program Files\Combined Community Codec Pack
2008-05-25 08:19:21 0 d-------- C:\Program Files\FLV Player
2008-05-21 04:49:20 0 d--hs---- C:\FOUND.006
2008-05-21 04:44:24 0 d--hs---- C:\FOUND.005
2008-05-20 23:37:54 0 d--hs---- C:\FOUND.004
2008-05-20 04:23:44 0 d--hs---- C:\FOUND.003


-- Find3M Report ---------------------------------------------------------------

2008-05-14 00:09:08 0 d-------- C:\Documents and Settings\Ibrahim\Application Data\Real
2008-05-10 06:44:54 0 d-------- C:\Program Files\AvantGo Connect
2008-05-10 06:43:52 0 d-------- C:\Program Files\Microsoft ActiveSync
2008-05-06 09:44:02 2368 --a------ C:\WINDOWS\system32\SVKP.sys <Not Verified; AntiCracking; SVKP driver for NT>
2008-05-06 09:43:36 50688 --a------ C:\WINDOWS\system32\wbhelp2.dll <Not Verified; Stardock.Net, Inc; WindowBlinds for Win32 x86 machines>
2008-05-06 09:43:34 0 d-------- C:\Program Files\DAP
2008-05-01 00:09:54 0 d-------- C:\Program Files\Common Files\Real
2008-04-29 03:52:36 0 d-------- C:\Documents and Settings\Ibrahim\Application Data\vlc
2008-04-29 03:48:26 0 d-------- C:\Program Files\VideoLAN
2008-04-18 09:06:12 0 d-------- C:\Documents and Settings\Ibrahim\Application Data\Astro Gemini Software
2008-04-18 09:06:10 0 d-------- C:\Program Files\Astro Gemini Software
2008-04-16 23:03:16 1160 --a------ C:\WINDOWS\mozver.dat
2008-04-16 22:58:02 0 --a------ C:\WINDOWS\nsreg.dat
2008-04-13 17:49:28 12288 --a------ C:\WINDOWS\impborl.dll
2008-04-13 17:49:28 634880 --a------ C:\WINDOWS\Aspire.scr <Not Verified; ScreenTime Media; ScreenTime For Flash>
2008-04-13 17:47:20 1024 -r-h----- C:\WINDOWS\system32\NTICDMK32.dll
2008-04-13 17:39:54 0 -rahs---- C:\MSDOS.SYS
2008-04-13 17:39:54 0 -rahs---- C:\IO.SYS
2008-04-13 17:39:54 0 --a------ C:\CONFIG.SYS
2008-04-13 17:39:54 0 --a------ C:\AUTOEXEC.BAT
2008-04-13 17:38:16 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat
2008-04-13 17:32:32 62 --ahs---- C:\Documents and Settings\Ibrahim\Application Data\desktop.ini
2008-03-31 14:25:48 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®>
2008-03-31 14:25:48 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®>
2008-03-31 14:25:46 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?>
2008-03-31 14:25:46 831488 --a------ C:\WINDOWS\system32\divx_xx0a.dll
2008-03-31 14:25:46 682496 --a------ C:\WINDOWS\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®>
2008-03-21 13:30:08 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2008-03-21 13:28:54 196608 --a------ C:\WINDOWS\system32\dtu100.dll <Not Verified; DivX, Inc.; DivX, Inc. dtu100>
2008-03-21 13:28:54 81920 --a------ C:\WINDOWS\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100>
2008-03-21 13:28:20 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio "= "cmicnfg.cpl" []
"HTpatch "= "C:\WINDOWS\htpatch.exe" [10/30/2002 05:40 PM]
"CHotkey "= "mHotkey.exe" [03/28/2003 05:24 PM C:\WINDOWS\mHotkey.exe]
"ccApp "= "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [09/02/2006 07:04 PM]
"osCheck "= "C:\Program Files\Norton AntiVirus\osCheck.exe" [09/05/2006 01:22 PM]
"SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM]
"Symantec PIF AlertEng "= "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [01/29/2008 05:38 PM]
"HP Component Manager "= "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [12/22/2003 08:38 AM]
"HPDJ Taskbar Utility "= "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe" [03/04/2004 08:46 AM]
"HP Software Update "= "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [02/18/2004 10:55 AM]
"googletalk "= "C:\Program Files\Google\Google Talk\googletalk.exe" [01/01/2007 02:22 PM]
"DownloadAccelerator "= "C:\PROGRA~1\DAP\DAP.exe" [01/02/2000 06:06 AM]
"TkBellExe "= "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [06/02/2008 12:55 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager "= "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [08/30/2007 05:43 PM]
"MsnMsgr "= "C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [10/18/2007 11:34 AM]
"ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 12:56 AM]
"ares "= "C:\Program Files\Ares\Ares.exe" []
"MSMSGS "= "C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 09:24 AM]
"H/PC Connection Agent "= "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" [02/02/2004 10:42 PM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1/21/2000 1:15:54 AM]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@= "Service "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@= "Volume shadow copy "


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c20445cc-371b-11dd-a01c-000d87130ae7}]
AutoRun\command- F:\tgtighg.cmd
explore\Command- F:\tgtighg.cmd
open\Command- F:\tgtighg.cmd




-- End of Deckard's System Scanner: finished at 2008-06-17 11:57:36 ------------

 

Hi
OK Good.

Did you run Flash Disinfector?

Please do this.

Open "Notepad†Copy the contents of the code box below to the blank Notepad.
Click "File" > "Save as "
In the "Save In" box at the top click the down arrow and select DeskTop

In the "File name" type in: fix.reg
In the "Save As Type" select: All Files
Once saved, Go to your desktop double click "fix.reg file" and let it merge with the registry.

Code:

REGEDIT4

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c20445cc-371b-11dd-a01c-000d87130ae7}] 

Now this.

Download ATF Cleaner by Atribune and save it to your Desktop.
This is a good tool to get rid of the temporary garbage you pick up while surfing the net.
Double click ATF-Cleaner.exe to run the program.
Check the boxes to the left of:

Windows Temp
Current User Temp
All Users Temp
Temporary Internet Files
Prefetch
Java Cache
Recycle bin

The rest are optional - if you want it to remove everything check "Select All ".
Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK.

Now lets make sure there is nothing lurking.

Please do an online scan with Kaspersky WebScanner

Click on "Accept" If your pop "“up blocker blocks any windows from opening.

Click Run on the window that opens.
Windows Vista users you must open the web browser using the Run as Administrator command.

• The program will launch and then begin downloading the latest definition files:
• Under Scan on the left side.Click on My Computer
• This will start the program and scan your system.
• Click the "Scan Report" On the left side.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  • Click the Save Report As button, and in the Browse dialog box, type a name for the scan report file that you want to create and select its type Text file. Click OK to save the file.:
• Save the text file to your desktop.
• Copy and paste that information in your next post.

Please post the Kaspersky results.

Thanks
Geri

 

yea did the aboive just got 1 prb

hey thanx again for the help.....i did run the flash disenfector as u said that i shud....and then the fix.reg and i ran it too....but when u said
"Now lets make sure there is nothing lurking.

Please do an online scan with Kaspersky WebScanner "

the page opened and i did click on accept but nothing happened is it because i hav norton or wht....but other than that my comp. isnt giving me the error anymore...so wht do u think i sould do??

 

Hi
I would like to see a on-line scan.

Lets try Panda.

Please go HERE to run Panda's ActiveScan

• Once you are on the Panda site click the Scan your PC button
• A new window will open...click the Check Now button
• Enter your Country
• Enter your State/Province
• Enter your e-mail address and click send
• Select either Home User or Company
• Click the big Scan Now button
• If it wants to install an ActiveX component allow it
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
• When download is complete, click on My Computer to start the scan
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report

Thanks
Geri

 

heres the result

HEY
GOTT THE RESULTS WHT TO DO AFTER THIS ILL BE WAITIN THANX A MILL

;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-06-18 00:41:34
PROTECTIONS: 1
MALWARE: 24
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
Norton AntiVirus 2007 Yes Yes
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00135099 adware/powerstrip Adware No 0 Yes No HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{669695BC-A811-4A9D-8CDF-BA8C795F261C}
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.casalemedia.com/]
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.casalemedia.com/]
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.casalemedia.com/]
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\FOUND.000\FILE0050.CHK[.doubleclick.net/]
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\FOUND.000\FILE0009.CHK[.doubleclick.net/]
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.doubleclick.net/]
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.atdmt.com/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.fastclick.net/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\FOUND.000\FILE0050.CHK[.fastclick.net/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\FOUND.000\FILE0009.CHK[.fastclick.net/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\FOUND.000\FILE0009.CHK[.fastclick.net/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\FOUND.000\FILE0050.CHK[.fastclick.net/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\FOUND.000\FILE0050.CHK[.fastclick.net/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\FOUND.000\FILE0009.CHK[.fastclick.net/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\FOUND.000\FILE0050.CHK[.fastclick.net/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.fastclick.net/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\FOUND.000\FILE0009.CHK[.fastclick.net/]
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.tribalfusion.com/]
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.tribalfusion.com/]
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.tribalfusion.com/]
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.tribalfusion.com/]
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\FOUND.000\FILE0009.CHK[.tribalfusion.com/]
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\FOUND.000\FILE0050.CHK[.tribalfusion.com/]
00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.mediaplex.com/]
00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\FOUND.000\FILE0050.CHK[.com.com/]
00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.com.com/]
00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Cookies\ibrahim@com[1].txt
00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\FOUND.000\FILE0009.CHK[.com.com/]
00167647 Cookie/Yadro TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.yadro.ru/]
00167724 Cookie/HotLog TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.hotlog.ru/]
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.statcounter.com/]
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.statcounter.com/]
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.statcounter.com/]
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.statcounter.com/]
00167795 Cookie/Cd Freaks TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.club.cdfreaks.com/]
00167795 Cookie/Cd Freaks TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.club.cdfreaks.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\FOUND.000\FILE0009.CHK[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\FOUND.000\FILE0050.CHK[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\FOUND.000\FILE0050.CHK[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\FOUND.000\FILE0050.CHK[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\FOUND.000\FILE0050.CHK[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\FOUND.000\FILE0009.CHK[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\FOUND.000\FILE0009.CHK[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\FOUND.000\FILE0009.CHK[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\FOUND.000\FILE0009.CHK[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\FOUND.000\FILE0009.CHK[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\FOUND.000\FILE0009.CHK[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\FOUND.000\FILE0050.CHK[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\FOUND.000\FILE0050.CHK[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\FOUND.000\FILE0050.CHK[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\FOUND.000\FILE0009.CHK[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\FOUND.000\FILE0050.CHK[ad.yieldmanager.com/]
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.apmebf.com/]
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.apmebf.com/]
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.apmebf.com/]
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\FOUND.000\FILE0009.CHK[.apmebf.com/]
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Cookies\ibrahim@apmebf[2].txt
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\FOUND.000\FILE0050.CHK[.apmebf.com/]
00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.burstnet.com/]
00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.burstnet.com/]
00168105 Cookie/Cd Freaks TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.cdfreaks.com/]
00168105 Cookie/Cd Freaks TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.cdfreaks.com/]
00168105 Cookie/Cd Freaks TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.cdfreaks.com/]
00168105 Cookie/Cd Freaks TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.cdfreaks.com/]
00168105 Cookie/Cd Freaks TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.cdfreaks.com/]
00168109 Cookie/Adtech TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.adtech.de/]
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.realmedia.com/]
00170559 Cookie/Com.com TrackingCookie No 0 Yes No C:\FOUND.000\FILE0050.CHK[.uol.com.br/]
00170559 Cookie/Com.com TrackingCookie No 0 Yes No C:\FOUND.000\FILE0009.CHK[.uol.com.br/]
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\FOUND.000\FILE0009.CHK[.questionmarket.com/]
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\FOUND.000\FILE0009.CHK[.questionmarket.com/]
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\FOUND.000\FILE0050.CHK[.questionmarket.com/]
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\FOUND.000\FILE0050.CHK[.questionmarket.com/]
00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.zedo.com/]
00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Cookies\ibrahim@zedo[1].txt
00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.zedo.com/]
00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.zedo.com/]
00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.zedo.com/]
00366244 Application/NirCmd.A HackTools No 0 No No C:\Documents and Settings\Ibrahim\Desktop\Hashims files\Flash_Disinfector.exe[nircmd.exe]
01606636 Cookie/Adserver TrackingCookie No 0 Yes No C:\Documents and Settings\Ibrahim\Application Data\Mozilla\Firefox\Profiles\fgpsa0n7.default\COOKIES.TXT[.adserver.easyad.info/]
02247798 Generic Backdoor Virus/Trojan No 0 Yes No D:\RED ALERT 2 YURIS REVENGE\Ra2.exe
;===================================================================================================================================================================================
SUSPECTS
Sent Location f
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description f
;===================================================================================================================================================================================
170907 HIGH MS07-046 f
170904 HIGH MS07-043 f
133387 MEDIUM MS06-065 f
;===================================================================================================================================================================================

 

been waiting patiently for an answer

i gave the above results there......as requested.....anyone there??

 

Hi hashim101
OK all that Panda is showing is cookies in firefox.

You can delete these with ATF Cleaner using the firefox settings.

If you use Firefox browser
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Now please do this.

Delete these.

dss.exe <<On your Desktop.

This folder.
C:\Deckard

Let me know that everything is running OK.

Thanks
Geri

 

How much more can i thank you

Hey Geri!
How are you.Hope your good

I too noticed the cookies ..... and was waiting to knw if i could delete them... anyyway i did wht u said and everythings running soomtly as possible...thanx again*hashim101 is looking for th donation button* I hope that in future i could help or of even join you..if possible.will keep in touch...well then thats all ...untill another problem comes up..cya

 

Hi hashim101
Good to hear.
Glad I could help out.

If you click on the link in my signature "Help us keep helping you" it will take you to the page.

Please look at this link for some preventive recommendations, It could keep you from ending up back here to the Spyware and Virus Removal Forums.
http://www.windowsbbs.com/showthread.php?t=67958

I'll mark this one resolved.

Surf Safely
Geri

 

Thank you

I have just registered only to thank Geri for the help provided here. I had the same problem and having followed the instructions provided by Geri, everything went back to normal.

Regards