[BigDod]

AVG keeps finding Win32/Heur infections on everything that I run on my computer. If I scan with Malwarebytes Antimalware AVG continually finds infections and when I restart my computer it will not boot. I did a clean reinstall of the computer and once I loaded the progs I require it all started again.

Here is my Hyjackthis log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:09:26, on 11/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBNE.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Allan\Desktop\spybotsd162.exe
C:\DOCUME~1\Allan\LOCALS~1\Temp\is-3D0OL.tmp\spybotsd162.tmp
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Documents and Settings\Allan\mccylb.exe \s
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON Stylus Photo R265 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBNE.EXE /FU "C:\WINDOWS\TEMP\E_S85.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Smart Card (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe

--
End of file - 5033 bytes


I would be grateful for any help

[Advertisements]

Hi there this is a difficult virus to remove but it can be done

Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

• Doubleclick the drweb-cureit.exe file and Allow to run the express scan
• This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
• Once the short scan has finished, mark the drives that you want to scan.
• Select all drives. A red dot shows which drives have been chosen.
• Click the green arrow at the right, and the scan will start.
• Click 'Yes to all' if it asks if you want to cure/move the file.
• When the scan has finished, in the menu, click file and choose save report list
• Save the report to your desktop. The report will be called DrWeb.csv
• Close Dr.Web Cureit.

THEN


Programme here

Step 1. Preparation to disinfection:

Download the file Sality_off.rar
Unpack the file Sality_off.rar
Run the file Sality_off.exe with the key -m
To do this select run from the start menu.
Select browse and locate sality_off.exe click once.
The file will now appear in the run box.
Using the mouse double left click in the box and the cursor will then appear after the .exe part. now press the spacebar and type in -m then select OK

Step 2. Signs of a disinfected/ clean computer

when restarted, the utility sality_off.exe –m does not detect any signs of infection (the line "infected thread terminated" is missing)
Your Anti-Virus is running and works in normal mode
full computer scan does not detect infected objects on the computer

Step 3. Cleaning the registry of infected computers in the domain network:

download the file Sality_RegKeys.zip ( link on the same page)
unpack the file Sality_RegKeys.zip
run the file Disable_autorun.reg from the archive Sality_RegKeys.zip
Click Yes to confirm adding the information to the registry

LAST PROGRAMME


We will now do a deep search of your processes and files

Download avz4.zip from here

• Unzip it to your desktop to a folder named avz4
• Double click on AVZ.exe to run it.
• Run an update by clicking the Auto Update button on the Right of the Log window:
• Click Start to begin the update

Note: If you recieve an error message, chose a different source, then click Start again

• Start AVZ.
  
• Choose from the menu "File" => "Standard scripts " and mark the "Healing/Quarantine and Advanced System Investigation" check box.
• Click on the “Execute selected scripts”.
• Automatic scanning, healing and system check will be executed.
• A logfile (avz_sysinfo.htm) will be created and saved in the LOG folder in the AVZ directory as virusinfo_syscure.zip.
• It is necessary to reboot your machine, because AVZ might disturb some program operations (like antiviruses and firewall) during the system scan.
• All applications will work properly after the system restart.

When restarted

• Start AVZ.
  
• Choose from the menu "File" => "Standard scripts " and mark the “Advanced System Investigation" check box.
• Click on the "Execute selected scripts".
• A system check will be automatically performed, and the created logfile (avz_sysinfo.htm) will be saved in the LOG folder in the AVZ directory as virusinfo_syscheck.zip.

Attach both zip files to your next post

To attach a file, do the following:

• Click Add Reply
• Under the reply panel is the Attachments Panel
• Browse for the attachment file you want to upload, then click the green Upload button
• Once it has uploaded, click the Manage Current Attachments drop down box
• Click on to insert the attachment into your post

Logs : DR Web and AVZ

[Essexboy]

Hi there this is a difficult virus to remove but it can be done

Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

• Doubleclick the drweb-cureit.exe file and Allow to run the express scan
• This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
• Once the short scan has finished, mark the drives that you want to scan.
• Select all drives. A red dot shows which drives have been chosen.
• Click the green arrow at the right, and the scan will start.
• Click 'Yes to all' if it asks if you want to cure/move the file.
• When the scan has finished, in the menu, click file and choose save report list
• Save the report to your desktop. The report will be called DrWeb.csv
• Close Dr.Web Cureit.

THEN


Programme here

Step 1. Preparation to disinfection:

Download the file Sality_off.rar
Unpack the file Sality_off.rar
Run the file Sality_off.exe with the key -m
To do this select run from the start menu.
Select browse and locate sality_off.exe click once.
The file will now appear in the run box.
Using the mouse double left click in the box and the cursor will then appear after the .exe part. now press the spacebar and type in -m then select OK

Step 2. Signs of a disinfected/ clean computer

when restarted, the utility sality_off.exe –m does not detect any signs of infection (the line "infected thread terminated" is missing)
Your Anti-Virus is running and works in normal mode
full computer scan does not detect infected objects on the computer

Step 3. Cleaning the registry of infected computers in the domain network:

download the file Sality_RegKeys.zip ( link on the same page)
unpack the file Sality_RegKeys.zip
run the file Disable_autorun.reg from the archive Sality_RegKeys.zip
Click Yes to confirm adding the information to the registry

LAST PROGRAMME


We will now do a deep search of your processes and files

Download avz4.zip from here

• Unzip it to your desktop to a folder named avz4
• Double click on AVZ.exe to run it.
• Run an update by clicking the Auto Update button on the Right of the Log window:
• Click Start to begin the update

Note: If you recieve an error message, chose a different source, then click Start again

• Start AVZ.
  
• Choose from the menu "File" => "Standard scripts " and mark the "Healing/Quarantine and Advanced System Investigation" check box.
• Click on the “Execute selected scripts”.
• Automatic scanning, healing and system check will be executed.
• A logfile (avz_sysinfo.htm) will be created and saved in the LOG folder in the AVZ directory as virusinfo_syscure.zip.
• It is necessary to reboot your machine, because AVZ might disturb some program operations (like antiviruses and firewall) during the system scan.
• All applications will work properly after the system restart.

When restarted

• Start AVZ.
  
• Choose from the menu "File" => "Standard scripts " and mark the “Advanced System Investigation" check box.
• Click on the "Execute selected scripts".
• A system check will be automatically performed, and the created logfile (avz_sysinfo.htm) will be saved in the LOG folder in the AVZ directory as virusinfo_syscheck.zip.

Attach both zip files to your next post

To attach a file, do the following:

• Click Add Reply
• Under the reply panel is the Attachments Panel
• Browse for the attachment file you want to upload, then click the green Upload button
• Once it has uploaded, click the Manage Current Attachments drop down box
• Click on to insert the attachment into your post

Logs : DR Web and AVZ

[BigDod]

 virusinfo_syscheck.zip   24.64KB   883 downloads  virusinfo_syscure.zip   24.12KB   811 downloads  DrWeb.zip   1.41KB   930 downloadsrWeb.zip]Here are the logs requested

[Essexboy]

Hmm DR Web is reporting Virut which is a real nasty

OK lets try this fix to kill the rootkits

AVZ FIX

• Double click on AVZ.exe
  
• Click File > Custom scripts
  
• Copy & paste the contents of the following codebox in the box in the program (start with begin and end with end )
  

  begin
  SetAVZGuardStatus(True);
  SearchRootkit(true, true);
   DelBHO('{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}');
   DelBHO('{08B81DFE-6DCD-4737-9711-9C1F5B5ADE7B}');
   StopService('htgmnoih');
   DeleteService('htgmnoih');
   SetServiceStart('htgmnoih', 4);
   TerminateProcessByName('c:\windows\system32\reader_s.exe');
   TerminateProcessByName('c:\documents and settings\allan\reader_s.exe');
   TerminateProcessByName('c:\documents and settings\allan\mccylb.exe');
   BC_DeleteFile('c:\documents and settings\allan\mccylb.exe');
   DeleteFile('c:\documents and settings\allan\mccylb.exe');
   BC_DeleteFile('c:\documents and settings\allan\reader_s.exe');
   DeleteFile('c:\documents and settings\allan\reader_s.exe');
   BC_DeleteFile('c:\windows\system32\reader_s.exe');
   DeleteFile('c:\windows\system32\reader_s.exe');
   BC_DeleteFile('C:\Documents and Settings\Allan\mccylb.exe');
   DeleteFile('C:\Documents and Settings\Allan\mccylb.exe');
   BC_DeleteFile('C:\Documents and Settings\Allan\reader_s.exe');
   DeleteFile('C:\Documents and Settings\Allan\reader_s.exe');
   BC_DeleteFile('C:\WINDOWS\System32\reader_s.exe');
   DeleteFile('C:\WINDOWS\System32\reader_s.exe');
   BC_DeleteFile('C:\WINDOWS\system32\vbgugde.dll');
   DeleteFile('C:\WINDOWS\system32\vbgugde.dll');
   BC_DeleteFile('C:\WINDOWS\system32\Drivers\htgmnoih.sys');
   DeleteFile('C:\WINDOWS\system32\Drivers\htgmnoih.sys');
   BC_DeleteFile('C:\WINDOWS\System32\Drivers\htgmnoih.sys');
   DeleteFile('C:\WINDOWS\System32\Drivers\htgmnoih.sys');
   DeleteFile('C:\Documents');
   BC_DeleteFile('C:\Documents');
   BC_DeleteFile('Settings\Allan\mccylb.exe');
   DeleteFile('Settings\Allan\mccylb.exe');
   BC_DeleteFile('\s');
   DeleteFile('\s');
   BC_DeleteFile('and.exe');
   DeleteFile('and.exe');
   BC_DeleteFile('vbgugde.dll');
   DeleteFile('vbgugde.dll');
   BC_DeleteFile('c:\windows\system32\vbgugde.dll');
   DeleteFile('c:\windows\system32\vbgugde.dll');
  BC_ImportDeletedList;
  ExecuteSysClean;
  BC_Activate;
  RebootWindows(true);
  end.

• Note: When you run the script, your PC will be restarted
  
• Click Run
  
• Restart your PC if it doesn't do it automatically.

ON COMPLETION

• Start AVZ.
  
• Choose from the menu "File" => "Standard scripts " and mark the “Advanced System Investigation" check box.
• Click on the "Execute selected scripts".
• A system check will be automatically performed, and the created logfile (avz_sysinfo.htm) will be saved in the LOG folder in the AVZ directory as virusinfo_syscheck.zip.

Attach the zip file to your next post

[BigDod]

Zip file as requested. I am posting on a different computer as all network functions on the bad one are stuffed  virusinfo_syscheck.zip   21.73KB   636 downloads

[Essexboy]

Still one to get but looking better

AVZ FIX

• Double click on AVZ.exe
  
• Click File > Custom scripts
  
• Copy & paste the contents of the following codebox in the box in the program (start with begin and end with end )
  

  begin
  SetAVZGuardStatus(True);
  SearchRootkit(true, true);
   StopService('htgmnoih');
   DeleteService('htgmnoih');
   SetServiceStart('htgmnoih', 4);
   BC_DeleteFile('htgmnoih.sys');
   DeleteFile('htgmnoih.sys');
   BC_DeleteFile('C:\WINDOWS\System32\Drivers\htgmnoih.sys');
   DeleteFile('C:\WINDOWS\System32\Drivers\htgmnoih.sys');
  BC_ImportDeletedList;
  ExecuteSysClean;
  BC_Activate;
  RebootWindows(true);
  end.

• Note: When you run the script, your PC will be restarted
  
• Click Run
  
• Restart your PC if it doesn't do it automatically.

ON COMPLETION

• Start AVZ.
  
• Choose from the menu "File" => "Standard scripts " and mark the “Advanced System Investigation" check box.
• Click on the "Execute selected scripts".
• A system check will be automatically performed, and the created logfile (avz_sysinfo.htm) will be saved in the LOG folder in the AVZ directory as virusinfo_syscheck.zip.

Attach the zip file to your next post

After running AVZ then

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3


* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:




Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Logs required : AVZ and Combofix

[BigDod]

 ComboFix.txt   15.92KB   805 downloads  virusinfo_syscheck.zip   21.73KB   658 downloads
Here are the logs requested but I am not sure if AVZ wrote a new one as the time stamp is the same as previous.

[Essexboy]

OK I believe we are getting somewhere now

1. Please open Notepad

• Click Start , then Run
• Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::

File::
c:\windows\system32\drivers\ethpxmlo.sys
c:\windows\system32\drivers\ethfiopj.sys
c:\windows\system32\drivers\ethdvqxd.sys
c:\windows\system32\drivers\ethxwgqd.sys
c:\windows\system32\drivers\ethkonqm.sys
c:\windows\_id.dat
c:\windows\system32\B.tmp
c:\windows\adobe.bat
c:\windows\system32\B.tmp
c:\windows\system32\4.tmp
c:\windows\system32\7.tmp
c:\windows\system32\2.tmp
c:\windows\system32\8F.tmp
c:\windows\system32\8D.tmp
c:\windows\system32\89.tmp
c:\windows\[u]0[/u]02853_.tmp
c:\windows\System32\Drivers\tfqfcfdz.sys
c:\windows\System32\Drivers\yihsfmge.sys
c:\windows\System32\Drivers\yxqosnat.sys
c:\windows\system32\vbgugde.dll
c:\windows\Tasks\At*.job
c:\windows\system32\drivers\gqrnahavkdimm.sys 
c:\windows\system32\drivers\puflls.sys
C:\DeskUpdate.tmp

Driver::
ethdvqxd
ethfiopj
ethkonqm
ethpxmlo
ethxwgqd
tfqfcfdz
yihsfmge
yxqosnat
djxfnpsiyjuzf
cespnrtuy

3. Then in the text file go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES

4. Save the above as CFScript.txt

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.




6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

• Combofix.txt
• A new HijackThis log.

THEN

To ensure that I get all the information this log will need to be attached (instructions at the end) if it is to large to attach then upload to Mediafire and post the sharing link.

Download OTScanit2 to your Desktop and double-click on it to extract the files. It will create a folder named OTScanIt on your desktop.

• Close ALL OTHER PROGRAMS.
• Open the OTScanit folder and double-click on OTScanit.exe to start the program.
• Check the box that says Scan All Users
• Check the Radio button for Rootkit check YES
• Under Additional Scans check the following:
  • File - Lop Check
  • File - Purity Scan
  • Evnt - EventViewer Errors/Warnings (last 10)
• Now click the Run Scan button on the toolbar.
• Let it run unhindered until it finishes.
• When the scan is complete Notepad will open with the report file loaded in it.
• Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Please attach the log in your next post.

To attach a file, do the following:

• Click Add Reply
• Under the reply panel is the Attachments Panel
• Browse for the attachment file you want to upload, then click the green Upload button
• Once it has uploaded, click the Manage Current Attachments drop down box
• Click on to insert the attachment into your post

[BigDod]

I have added logs to a zip file.

 Reports.zip   40.11KB   641 downloads

[Essexboy]

I would like you to try the net on completion of this fix and let me know what happens

Start OTScanit. Copy/Paste the information in the quotebox below into the pane where it says "Paste fix here" and then click the Run Fix button.

[Unregister Dlls]
[Registry - Safe List]
< Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\
YN -> {DFB852A3-47F8-48C4-A200-58CAB36FD2A2}:{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> Reg Error: Key does not exist or could not be opened. [Menu: Spybot - Search && Destroy Configuration]
[Files/Folders - Created Within 30 Days]
NY -> At2.job -> %SystemRoot%\tasks\At2.job
NY -> At1.job -> %SystemRoot%\tasks\At1.job
NY -> lfp.exe -> %UserProfile%\lfp.exe
[Files/Folders - Modified Within 30 Days]
NY -> At1.job -> %SystemRoot%\tasks\At1.job
NY -> At3.job -> %SystemRoot%\tasks\At3.job
[File - Lop Check]
NY -> At1.job -> C:\WINDOWS\Tasks\At1.job
NY -> At2.job -> C:\WINDOWS\Tasks\At2.job
NY -> At3.job -> C:\WINDOWS\Tasks\At3.job
[Empty Temp Folders]

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here along with a new Hijackthis log.

I will review the information when it comes back in.

Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.

[BigDod]

 hijackthis.txt   3.19KB   697 downloads  OTScanIt.Txt   2.92KB   774 downloads

Here are the logs as requested. I had no trouble running the fix but computer rebooted automatically. In device Manager everything under network adaptors has a yellow exclamation mark and states possible corrupt drivers (code 39)

Edit - Added picture showing Device Manager errors

Edited by BigDod, 13 February 2009 - 12:57 PM.

[Essexboy]

To clear the adapter problem in task manager right click the affected elements and select uninstall - reboot windows and the drivers will be re-installed

Let me know how that goes whilst I look at the logs

[BigDod]

The only ones that could be uninstalled were the Realtek ones, the others stated that they might be required for the computer to boot. When the computer was restarted the Realtek ones reinstalled but were still the same.

[Essexboy]

The realtek installed but still had an exclamation mark ?

[BigDod]

Yes and when properties are looked at the message about corrupt drivers was still the same.