[kahdah]

Yes however it has to be done.

[Advertisements]

is there any way to shut down explorer while i attemp to run these programs. Atf keeps shutting down on me

[marcw]

is there any way to shut down explorer while i attemp to run these programs. Atf keeps shutting down on me

[kahdah]

If you say you got task manager back then please navigate to and Stop explorer.exe from running then try to run the tools.

[marcw]

now we're in business. thanks

[kahdah]

no problem.

[marcw]

here is the hijack log. Something I should point out is that the log file appears on the infected computer as an outlook file instead of a notepad file

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:03:43 PM, on 10/14/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
C:\WINNT\System32\PSSVC.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\mgabg.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\PROGRA~1\Adaptec\DirectCD\directcd.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Upromise__RemindU\UpromiseRemindUv.exe
C:\WINNT\System32\PDesk\PDesk.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\hpodev07.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\PROGRA~1\HEWLET~1\HPOFFI~1\bin\hpoevm07.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Upromise__RemindU\up.exe
C:\WINNT\system32\taskmgr.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = www.tau.ac.il:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SoundFusion] RunDll32 cwcprops.cpl,CrystalControlWnd
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [Adaptec DirectCD] C:\PROGRA~1\Adaptec\DirectCD\directcd.exe
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINNT\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [QuickTime Task] C:\WINNT\System32\qttask.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [uprom] "C:\Program Files\Upromise__RemindU\UpromiseRemindUv.exe"
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINNT\System32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape\Netscp.exe" -turbo
O4 - HKCU\..\Run: [RMC] C:\Program Files\Reuters\RMC\RunRM.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msrr.exe" /background
O4 - HKCU\..\Run: [ProxyWay] C:\Program Files\ProxyWay\proxyway.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - .DEFAULT Startup: discfix.lnk = C:\DELL\discfix.cmd (User 'Default user')
O4 - .DEFAULT User Startup: discfix.lnk = C:\DELL\discfix.cmd (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HPAiODevice.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\hpodev07.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: RemindU - file://C:\Documents and Settings\jon

[marcw]

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 10/14/2007 at 02:02 PM

Application Version : 3.9.1008

Core Rules Database Version : 3324
Trace Rules Database Version: 1325

Scan type : Complete Scan
Total Scan Time : 00:51:45

Memory items scanned : 122
Memory threats detected : 0
Registry items scanned : 4467
Registry threats detected : 10
File items scanned : 30921
File threats detected : 25

Adware.MyWebSearch
HKLM\Software\Classes\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}
HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}
HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}
HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\InprocServer32
HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\InprocServer32#ThreadingModel
HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\Programmable
C:\PROGRAM FILES\MYWEBSEARCH\SRCHASTT\1.BIN\MWSSRCAS.DLL

Adware.FatPickle
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser#{34F459B8-1D37-4FF2-9EFA-192D8E3ABA6F}

Adware.Tracking Cookie
C:\Documents and Settings\jonathan levene\Cookies\jonathan levene@rbanner[1].txt
C:\Documents and Settings\jonathan levene\Cookies\jonathan [email protected][1].txt
C:\Documents and Settings\jonathan levene\Cookies\jonathan [email protected][2].txt

Adware.IPWins
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IpWins
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IpWins#DisplayName
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IpWins#UninstallString

Trojan.Downloader-NoName
C:\PROGRAM FILES\HLPSRV.0XE

Adware.WebRebates
C:\PROGRAM FILES\UPROMISE__REMINDU\UP.EXE

Trojan.ZQuest
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\COMMON FILES\LABUTU.DLL.VIR

Adware.k8l
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\COMMON FILES\PROKYJO.HTML.VIR

Unclassified.Unknown Origin
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\INTERNET EXPLORER\HOPE4444.DLL.VIR
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\INTERNET EXPLORER\HOPE83122.DLL.VIR

Adware.Adservs
C:\QOOBOX\QUARANTINE\C\WINNT\AM9UYXROYW4GBGV2ZW5L\ASAPPSRV.DLL.VIR
C:\WINNT\SYSTEM32\COMMS2\DNWLDR132.0XE

Trojan.Unknown Origin
C:\QOOBOX\QUARANTINE\C\WINNT\AM9UYXROYW4GBGV2ZW5L\UA6RSRLCSQB0V3PZTQC5.VBS.VIR
C:\QOOBOX\QUARANTINE\C\WINNT\TTC-4444.EXE.VIR
C:\QOOBOX\QUARANTINE\C\WINNT\UNINSTALL_NMON.VBS.VIR
C:\WINNT\SYSTEM32\QUE1\ADED83122.EXE

Trojan.Downloader-Gen/AVP
C:\QOOBOX\QUARANTINE\C\WINNT\AVP.EXE.VIR

Adware.WebBuying Assistant/Resident
C:\QOOBOX\QUARANTINE\C\WINNT\SYSTEM32\IWCWCND.DLL.VIR

Adware.Vundo Variant
C:\QOOBOX\QUARANTINE\C\WINNT\SYSTEM32\KHFGHIG.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINNT\SYSTEM32\NNNMJKI.DLL.VIR
C:\QOOBOX\QUARANTINE\C\WINNT\SYSTEM32\PMNLKKJ.DLL.VIR

Trojan.Downloader-FakeRX
C:\QOOBOX\QUARANTINE\C\WINNT\SYSTEM32\QIAWPBJJ.DLL.VIR

Trojan.ZQuest-Installer
C:\QOOBOX\QUARANTINE\C\WINNT\TK58.EXE.VIR

Trojan.Agent-Deinstall
C:\WINNT\SYSTEM32\HAP1\WR12DRVER.0XE

Trojan.Main/SPP
C:\WINNT\SYSTEM32\QIAWPBJJ.EXE

[marcw]

File/Folder C:\WINNT\SYSTEM32\acespy not found.
File/Folder C:\Program Files\Temporary not found.
File/Folder C:\WINNT\SYSTEM32\vMW02a not found.
File/Folder C:\WINNT\am9uYXRoYW4gbGV2ZW5l not found.
File/Folder C:\Temp\xOe not found.
File/Folder C:\Documents and Settings\All Users\Application Data\Viewpoint not found.
File/Folder C:\WINNT\SYSTEM32\ace16win.dll not found.
File/Folder C:\Documents and Settings\jonathan levene\ie_update3r.exe not found.
File/Folder C:\Program Files\1NB4I5N3.bat not found.
File/Folder C:\WINNT\system32\drivers\perfect_cleaner_header.gif not found.
File/Folder C:\WINNT\system32\drivers\perfect_cleaner_header_small.gif not found.
File/Folder C:\WINNT\system32\drivers\spy_away_header_small.gif not found.
File/Folder C:\WINNT\tsitra1000106.exe not found.
C:\WINNT\system32\drivers\perfect_cleaner_box_small.jpg moved successfully.

Created on 10/14/2007 12:44:33

[marcw]

i was mistaken in thinking that it was explorer that was forcing the other programs to shut down. It seems like there are only a few programs I can run without a problem. I can run internet explorer, netscape, superantispy, and otmoveit. Programs like notepad, hijackthis and atf just keep shutting down. EVen task manager can only perform one task before it shuts down

[kahdah]

okay :

Please download the OTMoveIt by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt.exe to run it.
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
  
  C:\Program Files\Upromise__RemindU
  
  
  
• Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
• Click the red Moveit! button.
  Click "Exit" to close OTMoveIt.
  
  **When ready to Reply on the forum, please Paste the content of the latest log which is located at the root of the drive where the OTMoveIt folder is:
  C:\_OTMoveIt\MovedFiles\********_******.log
  (where "********_******" is the "date_time")

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
========================================
Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Extended (if available otherwise Standard)
  
  • Scan Options:
  Scan Archives
  Scan Mail Bases
• Click OK
• Now under select a target to scan:Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

====================================
Please post back eiththese logs:
New Hijackthis log
Kaspersky log.

[marcw]

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Sunday, October 14, 2007 4:11:45 PM
Operating System: Microsoft Windows 2000 Professional, Service Pack 4 (Build 2195)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 14/10/2007
Kaspersky Anti-Virus database records: 435896
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 31459
Number of viruses found: 22
Number of infected objects: 27
Number of suspicious objects: 1
Duration of the scan process: 00:53:19

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\jonathan levene\Application Data\Mozilla\Profiles\Default User\b84ipbqb.slt\history.dat Object is locked skipped
C:\Documents and Settings\jonathan levene\Application Data\Mozilla\Profiles\Default User\b84ipbqb.slt\parent.lock Object is locked skipped
C:\Documents and Settings\jonathan levene\Application Data\Sun\Java\Deployment\log\plugin150_10.trace Object is locked skipped
C:\Documents and Settings\jonathan levene\COOKIES\index.dat Object is locked skipped
C:\Documents and Settings\jonathan levene\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\jonathan levene\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\jonathan levene\Local Settings\HISTORY\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\jonathan levene\Local Settings\HISTORY\History.IE5\MSHist012007101420071015\index.dat Object is locked skipped
C:\Documents and Settings\jonathan levene\Local Settings\Temp\hsperfdata_jonathan levene\796 Object is locked skipped
C:\Documents and Settings\jonathan levene\Local Settings\Temporary Internet Files\Content.IE5\EXJNNZPE\index[2].htm Infected: Exploit.JS.Agent.au skipped
C:\Documents and Settings\jonathan levene\Local Settings\Temporary Internet Files\Content.IE5\F0EF8WL7\in[1].php Infected: Exploit.VBS.Phel.dp skipped
C:\Documents and Settings\jonathan levene\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\jonathan levene\Local Settings\Temporary Internet Files\Content.IE5\W5VZAC50\324123[1].htm Infected: Exploit.Win32.IMG-ANI.ak skipped
C:\Documents and Settings\jonathan levene\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\jonathan levene\NTUSER.DAT.LOG Object is locked skipped
C:\qoobox\Quarantine\C\Documents and Settings\jonathan levene\ie_update3r.exe.vir Infected: Trojan.Win32.Delf.aio skipped
C:\qoobox\Quarantine\C\Program Files\Common Files\{DCDF9~1\system.dll.vir Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped
C:\qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3BROVLY.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.at skipped
C:\qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.bc skipped
C:\qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
C:\qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.l skipped
C:\qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.af skipped
C:\qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
C:\qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
C:\qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
C:\qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
C:\qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
C:\qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.a skipped
C:\qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.an skipped
C:\qoobox\Quarantine\C\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.as skipped
C:\qoobox\Quarantine\C\WINNT\b122.exe.vir Infected: Trojan-Downloader.Win32.Agent.dpn skipped
C:\qoobox\Quarantine\C\WINNT\mgrs.exe.vir Infected: Trojan-Downloader.Win32.Alphabet.gen skipped
C:\qoobox\Quarantine\C\WINNT\SYSTEM32\vMW02a\vMW02a1065.exe.vir Infected: Trojan-Downloader.Win32.VB.bkw skipped
C:\qoobox\Quarantine\C\WINNT\tsitra1000106.exe.vir Infected: Trojan-Downloader.Win32.Agent.dve skipped
C:\qoobox\Quarantine\C\WINNT\tsitra572.exe.vir Infected: Trojan-Downloader.Win32.Agent.dve skipped
C:\RECYCLER\S-1-5-21-2025429265-1383384898-1060284298-1000\Dc1.log Suspicious: Exploit.HTML.Mht skipped
C:\VundoFix Backups\__c00D8169.dat.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.ft skipped
C:\WINNT\CSC\00000001 Object is locked skipped
C:\WINNT\DEBUG\ipsecpa.log Object is locked skipped
C:\WINNT\DEBUG\oakley.log Object is locked skipped
C:\WINNT\DEBUG\PASSWD.LOG Object is locked skipped
C:\WINNT\SCHEDLGU.TXT Object is locked skipped
C:\WINNT\SECURITY\LOGS\scepol.log Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\DEFAULT Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SAM Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SECURITY Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SYSTEM Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SYSTEM.ALT Object is locked skipped
C:\WINNT\SYSTEM32\DRIVERS\ETC\hosts Infected: Trojan.Win32.Qhost.my skipped
C:\WINNT\SYSTEM32\htbt.flag Object is locked skipped
C:\WINNT\SYSTEM32\sulimo.dat Infected: not-virus:Hoax.Win32.Renos.lq skipped
C:\WINNT\SYSTEM32\vtr.dll Infected: not-virus:Hoax.Win32.Renos.lq skipped

Scan process completed.

[kahdah]

Download the HostsXpert 3.7 - Hosts File Manager Here
Unzip HostsXpert 3.7 - Hosts File Manager to your desktop

Open up the HostsXpert 3.7 - Hosts File Manager program.

• Make sure that the "make hosts writable?" button in the upper right corner is enabled.
• Click back up Host files
• then click Restore orginal host files
• close program

===========================

• Please double-click OTMoveIt.exe to run it.
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
  
  C:\WINNT\SYSTEM32\DRIVERS\ETC\hosts
  C:\WINNT\SYSTEM32\sulimo.dat
  C:\WINNT\SYSTEM32\vtr.dll
  C:\Documents and Settings\jonathan levene\Local Settings\Temporary Internet Files\Content.IE5\W5VZAC50\324123[1].htm
  C:\Documents and Settings\jonathan levene\Local Settings\Temporary Internet Files\Content.IE5\F0EF8WL7\in[1].php
  C:\Documents and Settings\jonathan levene\Local Settings\Temporary Internet Files\Content.IE5\EXJNNZPE\index[2].htm
  
  
• Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
• Click the red Moveit! button.
  Click "Exit" to close OTMoveIt.
  
  **When ready to Reply on the forum, please Paste the content of the latest log which is located at the root of the drive where the OTMoveIt folder is:
  C:\_OTMoveIt\MovedFiles\********_******.log
  (where "********_******" is the "date_time")

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
====================================
Please post back with the newest OtMove it log and a new Hijackthis log.

[marcw]

kaspersky seems to have set me back a bit. i lost my task manager and now not only am i still getting explorer.exe eorros, but I'm also getting printer.exe errors.

I'm trying to get my task manager back so I can kill those two. then I'll try to get the hijack log

also, after I ran kaspersky, my homepage was changed to google. should that have happened

[kahdah]

No it should not have happened.

To get your Task Manager back please double click on Superantispyware to run it and go to View Control Center.
Go to the tab that says repairs.
Then choose Enable Task Manager.
Then click perform repair.


After that then continue.

Please do the OTMove it if you can first then :

Please download SmitfraudFix (by S!Ri) to your Desktop.

Double-click SmitfraudFix.exe
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

**If the tool fails to launch from the Desktop, please move SmitfraudFix.exe directly to the root of the system drive (usually C:), and launch from there.


Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlog...processutil.htm

[marcw]

finaly gt the task manager back. once i stopped explorer.exe, printer.exe disappeared
now I'll try to get that hijack log