I've got a lot of problems...need some help please!

[BAW01]

I've followed the preliminary steps from thread 288. Here is the hijackthis log and the online scan report(PandaActiveScan). I've been running Norton, Spybot, Ad-Aware, and Super Antivirus. Yet everytime I bootup the computer I'm flooded with popups and virus warnings. Many of them are the same ones all those programs stated they resolved prior to rebooting. Any help would be very appreciated...thx

Logfile of HijackThis v1.99.1
Scan saved at 12:02:43 AM, on 12/20/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr__.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
C:\PROGRA~1\LEXMAR~1\ACMonitor_X84-X85.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X84-X85.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\ATI Multimedia\main\launchpd.exe
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\WINDOWS\system32\wwb.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\msasvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\NORTON~1\navw32.exe
C:\hijackthis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.eyeseek.com/firstsite.asp?b=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
F3 - REG:win.ini: run=C:\WINDOWS\inet20111\services.exe
O2 - BHO: C:\WINDOWS\system32\zkPeCrypt.dll - {8A5849C4-93F3-429D-FF34-660A2068897C} - C:\WINDOWS\system32\zkPeCrypt.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr__.exe
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] "C:\Program Files\Norton AntiVirus\CfgWiz.exe" /GUID {0D7956A2-5A08-4ec2-A72C-DF8495A66016} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [zhypzutA] C:\WINDOWS\zhypzutA1.exe
O4 - HKLM\..\Run: [sys0264324371] C:\WINDOWS\sys0264324371.exe
O4 - HKLM\..\Run: [SvcManager] lsass0.exe
O4 - HKLM\..\Run: [pVRV3eP] C:\WINDOWS\system32\ujtnzbw.exe
O4 - HKLM\..\Run: [sfpJk] "C:\WINDOWS\system32\ovauma1ep.exe"
O4 - HKLM\..\Run: [Microsoft sheduler] C:\WINDOWS\inet20111\schedule.exe
O4 - HKLM\..\Run: [whdi] C:\DOCUME~1\Brent\LOCALS~1\Temp\30658\whydie.exe
O4 - HKLM\..\Run: [Nord] C:\WINDOWS\system32\nordsys.exe
O4 - HKLM\..\Run: [Lexmark X84-X85 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X84-X85.exe
O4 - HKLM\..\Run: [Lexmark X84-X85 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X84-X85.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\launchpd.exe"
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [explorer] C:\WINDOWS\explorer.exe
O4 - HKCU\..\Run: [iexplore] C:\Program Files\Internet Explorer\iexplore.exe
O4 - HKCU\..\Run: [PSCastor] "C:\Program Files\PSCastor\PSCastor.exe"
O4 - HKCU\..\Run: [Nord] C:\WINDOWS\system32\nordsys.exe
O4 - HKCU\..\Run: [keymgr] C:\WINDOWS\system32\keymgr.exe
O4 - HKCU\..\Run: [mciqtz32] C:\WINDOWS\system32\mciqtz32.exe
O4 - HKCU\..\Run: [mcd32] C:\WINDOWS\system32\mcd32.exe
O4 - HKCU\..\Run: [SvcManager] lsass0.exe
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [1] "C:\WINDOWS\system32\1.exe"
O4 - HKCU\..\Run: [wlyigm] "C:\WINDOWS\system32\wlyigm.exe"
O4 - HKCU\..\Run: [wvxwyhe] "C:\WINDOWS\system32\wvxwyhe.exe"
O4 - HKCU\..\Run: [wwb] "C:\WINDOWS\system32\wwb.exe"
O4 - HKCU\..\Run: [wjjtcjcf] "C:\WINDOWS\system32\wjjtcjcf.exe"
O4 - HKCU\..\Run: [whaudhu] "C:\WINDOWS\system32\whaudhu.exe"
O4 - HKCU\..\Run: [wtqiqa] "C:\WINDOWS\system32\wtqiqa.exe"
O4 - HKCU\..\Run: [wmjvtat] "C:\WINDOWS\system32\wmjvtat.exe"
O4 - HKCU\..\Run: [wephvq] "C:\WINDOWS\system32\wephvq.exe"
O4 - HKCU\..\Run: [wdplxv] "C:\WINDOWS\system32\wdplxv.exe"
O4 - HKCU\..\Run: [wgyjyiu] "C:\WINDOWS\system32\wgyjyiu.exe"
O4 - HKCU\..\Run: [wbuqvua] "C:\WINDOWS\system32\wbuqvua.exe"
O4 - HKCU\..\Run: [wobckwtg] "C:\WINDOWS\system32\wobckwtg.exe"
O4 - HKCU\..\Run: [wcnlepm] "C:\WINDOWS\system32\wcnlepm.exe"
O4 - HKCU\..\Run: [wcamnobn] "C:\WINDOWS\system32\wcamnobn.exe"
O4 - HKCU\..\Run: [Recoveru systems] C:\DOCUME~1\Brent\LOCALS~1\Temp\svchost.exe
O4 - HKCU\..\Run: [wjibm] "C:\WINDOWS\system32\wjibm.exe"
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O16 - DPF: LEGO Stormrunner - http://mindstorms.lego.com/stormrunner/stormrunner1-1-0.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {23508E60-6B77-4424-8154-8EDE5B2460B0} (ImportOLContacts.ucOutlookToDC) - http://www33.verizon.com/VOlDC/UIActiveX/ImportOutlookContacts.CAB
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://download.weatherbug.com/minibug/tricklers/AWS/MiniBugTransporter.cab?
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - https://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {52814E87-412B-4ACB-925E-DA3E23877786} (prjOutlookContacts.ucOutlookContacts) - http://www33.verizon.com/VOlDC/UIActiveX/prjOutlookContacts.CAB
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {90918C20-FB99-495A-BD79-CB91ACF44887} - http://www.typingmaster.com/contents/tm2002/oneclick/TMSetup.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - https://a248.e.akamai.net/f/248/5462/2h/www.symantecstore.com/v2.0-img/operations/symbizpr/xcontrol/SymDlBrg.cab
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
O16 - DPF: {D06A22B4-6087-4D3D-B7AF-82B113E9ABD4} (CPostLaunch Object) - http://www2.verizon.net/update/msnwebinstall/includes/vzWebIns.CAB
O18 - Filter: text/html - {8660A526-27A4-4FBD-85B2-857E82A25971} - (no file)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: msvcrt64.dll - {A44F7972-7C16-4EC3-9365-CB6FD615AFC2} - msvcrt64.dll (file missing)
O21 - SSODL: nDIov - {0445306C-AEEF-9AC6-366A-90984BB89B08} - C:\WINDOWS\system32\mv.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: browser.exe - Unknown owner - C:\WINDOWS\system32\browser.exe (file missing)
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: cdosys.exe - Unknown owner - C:\WINDOWS\system32\cdosys.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: hlink.exe - Unknown owner - C:\WINDOWS\system32\hlink.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: kbdcr.exe - Unknown owner - C:\WINDOWS\system32\kbdcr.exe
O23 - Service: ldeei.exe - Unknown owner - C:\WINDOWS\system32\ldeei.exe (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe
O23 - Service: msxml3r.exe - Unknown owner - C:\WINDOWS\system32\msxml3r.exe (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: p2pgraph.exe - Unknown owner - C:\WINDOWS\system32\p2pgraph.exe (file missing)
O23 - Service: roboex32.exe - Unknown owner - C:\WINDOWS\system32\roboex32.exe (file missing)
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: security.exe - Unknown owner - C:\WINDOWS\system32\security.exe (file missing)
O23 - Service: sendcmsg.exe - Unknown owner - C:\WINDOWS\system32\sendcmsg.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe (file missing)
O23 - Service: vzguninstall.exe - Unknown owner - C:\WINDOWS\system32\vzguninstall.exe (file missing)
O23 - Service: wdigest.exe - Unknown owner - C:\WINDOWS\system32\wdigest.exe (file missing)
O23 - Service: wmerrenu.exe - Unknown owner - C:\WINDOWS\system32\wmerrenu.exe (file missing)
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)
O23 - Service: xmlprov.exe - Unknown owner - C:\WINDOWS\system32\xmlprov.exe (file missing)

[BAW01]

Incident Status Location

Virus:Trj/Downloader.LOW Disinfected Operating system
Adware:adware/cws.loadadv Not disinfected C:\WINDOWS\system32\loadadv559.exe
Spyware:spyware/whazit Not disinfected c:\windows\system32\kyf.dat
Adware:adware/cashdeluxe Not disinfected c:\windows\system32\loadadv559.exe
Virus:trj/torpig.a Disinfected Operating system
Spyware:spyware/betterinet Not disinfected c:\windows\inf\biini.inf
Adware:adware/ieplugin Not disinfected c:\windows\kwv2.dat
Adware:adware/ncase Not disinfected c:\windows\system32\FLEOK
Adware:adware/sidesearch Not disinfected c:\program files\Lycos
Spyware:spyware/marketscore Not disinfected Windows Registry
Spyware:spyware/clipgenie Not disinfected Windows Registry
Adware:adware/sahagent Not disinfected Windows Registry
Adware:adware/wintools Not disinfected Windows Registry
Virus:trj/spamer.c Disinfected Operating system
Adware:adware/toolbarsimbar Not disinfected Windows Registry
Potentially unwanted tool:application/myway Not disinfected HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{014DA6C9-189F-421A-88CD-07CFE51CFF10}
Spyware:Cookie/Abetterinternet Not disinfected C:\Documents and Settings\Amanda\Cookies\amanda@abetterinternet[1].txt
Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Amanda\Cookies\amanda@cgi-bin[1].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Amanda\Cookies\amanda@com[2].txt
Spyware:Cookie/did-it Not disinfected C:\Documents and Settings\Amanda\Cookies\amanda@did-it[1].txt
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Amanda\Cookies\amanda@go[2].txt
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Amanda\Cookies\amanda@searchportal.information[2].txt
Spyware:Cookie/Santa Monica networks inc Not disinfected C:\Documents and Settings\Amanda\Cookies\amanda@smni[1].txt
Spyware:Cookie/web-stat Not disinfected C:\Documents and Settings\Amanda\Cookies\amanda@www.web-stat[2].txt
Spyware:Cookie/888 Not disinfected C:\Documents and Settings\Benjamin\Cookies\benjamin@888[1].txt
Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Benjamin\Cookies\benjamin@cgi-bin[1].txt
Spyware:Cookie/did-it Not disinfected C:\Documents and Settings\Benjamin\Cookies\benjamin@did-it[1].txt
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Benjamin\Cookies\benjamin@go[2].txt
Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Blake\Cookies\blake@cgi-bin[1].txt
Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Blake\Cookies\blake@cgi-bin[4].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Blake\Cookies\blake@com[2].txt
Spyware:Cookie/Target Not disinfected C:\Documents and Settings\Blake\Cookies\blake@target[2].txt
Spyware:Cookie/web-stat Not disinfected C:\Documents and Settings\Blake\Cookies\blake@www.web-stat[2].txt
Adware:Adware/Mytoolbar Not disinfected C:\Documents and Settings\Brent\AJDE.exe
Possible Virus. Not disinfected C:\Documents and Settings\Brent\ATNH.exe
Possible Virus. Not disinfected C:\Documents and Settings\Brent\BCCQ.exe
Possible Virus. Not disinfected C:\Documents and Settings\Brent\Desktop\cdegfr
Adware:Adware/Mytoolbar Not disinfected C:\Documents and Settings\Brent\DGDO.exe
Adware:Adware/Mytoolbar Not disinfected C:\Documents and Settings\Brent\DKCI.exe
Possible Virus. Not disinfected C:\Documents and Settings\Brent\DOLE.exe
Possible Virus. Not disinfected C:\Documents and Settings\Brent\DRNM.exe
Possible Virus. Not disinfected C:\Documents and Settings\Brent\EHFQ.exe
Adware:Adware/Mytoolbar Not disinfected C:\Documents and Settings\Brent\EJDF.exe
Possible Virus. Not disinfected C:\Documents and Settings\Brent\FHAB.exe
Possible Virus. Not disinfected C:\Documents and Settings\Brent\GALB.exe
Possible Virus. Not disinfected C:\Documents and Settings\Brent\GRHD.exe
Possible Virus. Not disinfected C:\Documents and Settings\Brent\GTSG.exe
Possible Virus. Not disinfected C:\Documents and Settings\Brent\GUCM.exe
Possible Virus. Not disinfected C:\Documents and Settings\Brent\HDQI.exe
Possible Virus. Not disinfected C:\Documents and Settings\Brent\HSTL.exe
Possible Virus. Not disinfected C:\Documents and Settings\Brent\IATE.exe
Possible Virus. Not disinfected C:\Documents and Settings\Brent\LCDP.exe

[BAW01]

Virus:W32/Netsky.B.worm Disinfected Archive Folders\Deleted Items\information\bill.htm.exe
Virus:W32/Netsky.B.worm Disinfected Archive Folders\Deleted Items\hi\dinner.com
Virus:W32/Netsky.B.worm Disinfected Archive Folders\Deleted Items\information\story.scr
Virus:W32/Netsky.B.worm Disinfected Archive Folders\Deleted Items\information\location.exe
Virus:W32/Netsky.B.worm Disinfected Archive Folders\Deleted Items\warning\me.zip[me.htm.com]
Virus:W32/Netsky.B.worm Disinfected Archive Folders\Deleted Items\fake\doc.htm.exe
Virus:W32/Netsky.B.worm Disinfected Archive Folders\Deleted Items\fake\shower.exe
Virus:W32/Netsky.B.worm Disinfected Archive Folders\Deleted Items\information\release.exe
Virus:W32/Netsky.B.worm Disinfected Archive Folders\Deleted Items\unknown\me.zip[me.exe]
Virus:W32/Netsky.B.worm Disinfected Archive Folders\Deleted Items\hello\party.exe
Virus:W32/Netsky.Z.worm Disinfected Archive Folders\Deleted Items\Important\Notice.zip[Notice.txt .exe]
Virus:W32/Bagle.pwdzip Disinfected Archive Folders\Deleted Items\Unable to deliver your message\RE: Protected message\the_message.zip
Virus:W32/Bagle.AB.worm Disinfected Archive Folders\Deleted Items\Unable to deliver your message\Encrypted document\MoreInfo.com
Virus:W32/Bagle.BE.worm!CME-245 Disinfected Personal Folders\Deleted Items\Re: Thanks :)\price.com
Virus:W32/Bagle.AH.worm Disinfected Personal Folders\Deleted Items\Re:\Fish.com
Virus:W32/Bagle.AH.worm Disinfected Personal Folders\Deleted Items\Re:\Dog.exe
Spyware:Cookie/SearchingBooth Not disinfected C:\Documents and Settings\Brent\Local Settings\Temp\Cookies\brent@adamg[1].txt
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Brent\Local Settings\Temp\Cookies\brent@drivecleaner[2].txt
Spyware:Cookie/Diglnk Not disinfected C:\Documents and Settings\Brent\Local Settings\Temp\Cookies\brent@mbop[2].txt
Spyware:Cookie/Mysearch Not disinfected C:\Documents and Settings\Brent\Local Settings\Temp\Cookies\brent@mysearch[2].txt
Spyware:Cookie/Rn11 Not disinfected C:\Documents and Settings\Brent\Local Settings\Temp\Cookies\brent@rn11[1].txt
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Brent\Local Settings\Temp\Cookies\brent@www.drivecleaner[1].txt
Virus:Trj/Downloader.MO Disinfected C:\Documents and Settings\Brent\Local Settings\Temp\ICD1.tmp\default.inf
Adware:Adware/Mirar Not disinfected C:\Documents and Settings\Brent\Local Settings\Temp\mit7.tmp[NNBar_VCSetup_876087_log.exe]
Virus:Trj/Downloader.LQD Disinfected C:\Documents and Settings\Brent\Local Settings\Temp\svchost.exe
Adware:Adware/Mytoolbar Not disinfected C:\Documents and Settings\Brent\MQUB.exe
Adware:Adware/Mytoolbar Not disinfected C:\Documents and Settings\Brent\OBEQ.exe
Possible Virus. Not disinfected C:\Documents and Settings\Brent\PLAL.exe
Possible Virus. Not disinfected C:\Documents and Settings\Brent\QDPH.exe
Possible Virus. Not disinfected C:\Documents and Settings\Brent\QMGI.exe
Possible Virus. Not disinfected C:\Documents and Settings\Brent\RNLJ.exe
Possible Virus. Not disinfected C:\Documents and Settings\Brent\SGRR.exe
Adware:Adware/Mytoolbar Not disinfected C:\Documents and Settings\Brent\TMUC.exe
Possible Virus. Not disinfected C:\Documents and Settings\Brent\TSOO.exe
Virus:Trj/Downloader.LOD Disinfected C:\Documents and Settings\Brent\URFS.exe
Spyware:Cookie/888 Not disinfected C:\Documents and Settings\Kids\Cookies\kids@888[1].txt
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Kids\Cookies\kids@drivecleaner[2].txt
Spyware:Cookie/Diglnk Not disinfected C:\Documents and Settings\Kids\Cookies\kids@mbop[2].txt
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Kids\Cookies\kids@searchportal.information[1].txt
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Kids\Cookies\kids@www.drivecleaner[1].txt
Spyware:Cookie/myaffiliateprogram Not disinfected C:\Documents and Settings\Kids\Cookies\kids@www.myaffiliateprogram[1].txt
Spyware:Cookie/Mysearch Not disinfected C:\Documents and Settings\NetworkService\Cookies\system@mysearch[1].txt
Adware:Adware/DeluxeComunications Not disinfected C:\DXC9.exe
Potentially unwanted tool:Application/KillApp.A Not disinfected C:\mgsda.exe
Potentially unwanted tool:Application/KillApp.A Not disinfected C:\mmeahxjg.exe
Potentially unwanted tool:Application/KillApp.A Not disinfected C:\oquxow.exe
Virus:Bck/Freeze.C Disinfected C:\Program Files\ScreenSaver.com\Living Rainforest\UNINSTAL.EXE
Virus:Bck/Freeze.C Disinfected C:\Program Files\ScreenSaver.com\Living Spring Gardens\UNINSTAL.EXE
Adware:Adware/DollarRevenue Not disinfected C:\topaff.exe

[BAW01]

Adware:Adware/SpySheriff Not disinfected C:\WINDOWS\inet20111\OEM.exe
Adware:Adware/SpySheriff Not disinfected C:\WINDOWS\inet20111\OEM.exe.bak
Dialer:Dialer.ILS Not disinfected C:\WINDOWS\inet20111\SCHEDULE.EXE.BAK
Adware:Adware/SAHAgent Not disinfected C:\WINDOWS\INF\bi7.inf
Spyware:Spyware/BetterInet Not disinfected C:\WINDOWS\SYSTEM32\b7s.dll
Virus:Trj/Qhost.gen Disinfected C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20061022-082452.backup
Possible Virus. Not disinfected C:\WINDOWS\SYSTEM32\EEME.exe
Adware:Adware/Mytoolbar Not disinfected C:\WINDOWS\SYSTEM32\ESRM.exe
Possible Virus. Not disinfected C:\WINDOWS\SYSTEM32\HLBB.exe
Possible Virus. Not disinfected C:\WINDOWS\SYSTEM32\HQHE.exe
Adware:Adware/Mytoolbar Not disinfected C:\WINDOWS\SYSTEM32\IHLQ.exe
Adware:Adware/Maxifiles Not disinfected C:\WINDOWS\SYSTEM32\install.exe
Adware:Adware/Mytoolbar Not disinfected C:\WINDOWS\SYSTEM32\IOLM.exe
Adware:Adware/Mytoolbar Not disinfected C:\WINDOWS\SYSTEM32\JJED.exe
Virus:Trj/Agent.DCQ Disinfected C:\WINDOWS\SYSTEM32\kernele7.exe
Possible Virus. Not disinfected C:\WINDOWS\SYSTEM32\msasvc.exe
Possible Virus. Not disinfected C:\WINDOWS\SYSTEM32\POPH.exe
Adware:Adware/Mytoolbar Not disinfected C:\WINDOWS\SYSTEM32\SBLB.exe
Adware:Adware/DollarRevenue Not disinfected C:\WINDOWS\SYSTEM32\vv815.exe
Adware:Adware/BestTTraffic Not disinfected C:\WINDOWS\SYSTEM32\wlrpl.exe
Adware:Adware/SpySheriff Not disinfected C:\WINDOWS\SYSTEM32\Z1469.EXE
Adware:Adware/SpySheriff Not disinfected C:\WINDOWS\SYSTEM32\Z180.EXE
Virus:Trj/Wupi.O Disinfected C:\WINDOWS\SYSTEM32\Z2985.EXE
Virus:Trj/Clicker.VE Disinfected C:\WINDOWS\SYSTEM32\zkPeCrypt.dll
Possible Virus. Not disinfected C:\WINDOWS\system32Fastmp3_Setup1.exe

[teacup61]

Hello BAW01,

Welcome to Safer Networking Forums :)

I hate to the bearer of bad news, but your log shows a very dangerous Trojan is residing on your PC.

The Trojan attempts to steal passwords, as well as logging keypresses and open window titles to text files and periodically sends the collected information to a remote user via HTTP. The Trojan downloads and executes additional files from a remote site. Configuration files may also be downloaded which define further behaviors.

I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or it if it contains any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the Trojan has been identified and can be killed, because of it's backdoor functionality, Your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be a reformat and reinstall of the OS. If it were on my PC I would not hesitate for a moment to do so. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud? (http://www.dslreports.com/faq/10451)

When Should I Format, How Should I Reinstall (http://www.dslreports.com/faq/10063)

Should you decide not to follow that advice, we will of course do our best to clean the computer of any infections that we can see but, as I already stated, we can in no way guarantee it to be trustworthy.

Should you have any questions, please feel free to ask.

Please let us know what you have decided to do.

Regards,
tea

[BAW01]

Tea,
Thank you for your reply. I believe I am at the point that I would like to re-format just to be more at ease with it once I'm done. Do you have any recommendations for where to get how-to-steps on re-formatting/re-building a harddrive. It has been a long time since I've had to do something like that.

Also if you don't mind, can you identifying the Trojan you found in my logs for me.

Thanks again and I appreciate the service you all are providing.

[teacup61]

Hello,

Where do I start. :( I put together a few that I found, and links for you, so you can see what they do.

O4 - HKCU\..\Run: [1] "C:\WINDOWS\system32\1.exe"
http://virusinfo.prevx.com/pxparall.asp?PXC=a10e59310031

C:\WINDOWS\system32\msasvc.exe
http://fileinfo.prevx.com/adware/qqc6f641158518-MSAS22915957/MSASVC.EXE.html

F3 - REG:win.ini: run=C:\WINDOWS\inet20111\services.exe
http://www.nuker.com/container/details/trojan_inet.php

O4 - HKLM\..\Run: [pVRV3eP] C:\WINDOWS\system32\ujtnzbw.exe
http://research.sunbelt-software.com/threatdisplay.aspx?name=Trojan-Clicker.Agent.3&threatid=76236

Also, this showed in Panda : Virus:trj/torpig.a
http://www.liutilities.com/products/wintaskspro/processlibrary/ibm00001/

The dslreports link I gave you can direct you to the MS help forum, and this link might also help you in the process. http://faq.oit.gatech.edu/0305.html

Regards,
tea

[tashi]

Good luck BAW01. :)

This topic has been archived.

In the event you need it re-opened, please send me a private message (pm) and provide a link to the thread. Applies only to the original topic starter.