Search:

Done, thank you very much for your help.

Sorry for the delay, busy day. I ran spybot s&d earlier today twice and it found a few things, leftovers from smitfraud i assumed. I ran it again and it found nothing.

KASPERSKY ONLINE SCANNER...

I was able to change my desktop background and it has not changed back to the malware's yet. I also was able to delete the registry key to allow ctrl-alt-delete. Thanks for your help, I know this...

Note: I was able to delete the file only using hijackthis' delete on reboot. The process was even running in safemode.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:25:12 PM, on...

C:\WINDOWS\system32\wmsdkns.exe <<< delete that file --- Access denied

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:41:20 PM, on 4/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)...

And here is the updated HJT log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:29:44 PM, on 4/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2...

I did as instructed, but nothing has changed. Also, there was only the 1 entry under Hosts.

SmitFraudFix v2.309

Scan done at 15:13:29.01, Mon 04/07/2008
Run from C:\Documents and...

SmitFraudFix v2.309

Scan done at 13:13:35.32, Mon 04/07/2008
Run from C:\Documents and Settings\Toshiba User\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The...

KASPERSKY ONLINE SCANNER REPORT
Sunday, April 06, 2008 4:24:30 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0...

I'm having popups, my background was changed, and control alt delete is disabled. I've ran spybot s&d (updated today) in normal mode and safemode multiple times.

Logfile of Trend Micro HijackThis...