[STXPKTRKT]

I am having problems with my computer:

As I start up the first thing to appear on the screen is a windows installer installing "AiOSoftware" it asks me for a disk even though I cancel the installation.

The popups have been taken care of, but can not get rid of the installation.

I ran the programs that were needed prior to posting in this forum.

I just can not get a log for AVG. I ran it twice and have no report.

I also installes SP2 on this PC it had not been installed.


Here are the other reports:


Here is the Panda Active Scan:;**************************************************************************
*********************************************************************************
************************
ANALYSIS: 2008-04-09 13:46:12
PROTECTIONS: 0
MALWARE: 15
SUSPECTS: 1
;*******************************************************************************
*********************************************************************************
*******************
PROTECTIONS
Description Version Active Updated
;===============================================================================
=================================================================================
===================
;===============================================================================
=================================================================================
===================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===============================================================================
=================================================================================
===================
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.trafficmp.com/]
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.trafficmp.com/]
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.trafficmp.com/]
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.trafficmp.com/]
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.trafficmp.com/]
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.247realmedia.com/]
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.tribalfusion.com/]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.serving-sys.com/]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.serving-sys.com/]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.serving-sys.com/]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.serving-sys.com/]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.serving-sys.com/]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.serving-sys.com/]
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.bs.serving-sys.com/]
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.ads.pointroll.com/]
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.ads.pointroll.com/]
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.ads.pointroll.com/]
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.ads.pointroll.com/]
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.ads.pointroll.com/]
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.ads.pointroll.com/]
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.ads.pointroll.com/]
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.realmedia.com/]
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.realmedia.com/]
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.realmedia.com/]
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.realmedia.com/]
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.questionmarket.com/]
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.questionmarket.com/]
00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.target.com/]
00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.atwola.com/]
00293517 Cookie/AdDynamix TrackingCookie No 0 Yes No C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\665nth3y.default\cookies.txt[.ads.addynamix.com/]
02906128 Adware/Zenosearch Adware Yes 1 Yes No C:\WINDOWS\SYSTEM32\MCNTOLWD.EXE
02909334 Rootkit/Agent.IKR Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{A543CC04-E825-4BE2-A089-E61B411D1346}\RP92\A0014609.sys
02909339 Adware/Maxifiles Adware No 1 Yes No C:\WINDOWS\system32\s7\gbsu011.exe
02912126 Trj/Downloader.TGP Virus/Trojan No 0 Yes No C:\WINDOWS\b155.exe_old
;===============================================================================
=================================================================================
===================
SUSPECTS
Sent Location 
;===============================================================================
=================================================================================
===================
No C:\WINDOWS\SYSTEM32\MCNTOLDN.EXE 
;===============================================================================
=================================================================================
===================
VULNERABILITIES
Id Severity Description 
;===============================================================================
=================================================================================
===================
184380 MEDIUM MS08-002 
184379 MEDIUM MS08-001 
182048 HIGH MS07-069 
182046 HIGH MS07-067 
182043 HIGH MS07-064 
179553 HIGH MS07-061 
176382 HIGH MS07-057 
176383 HIGH MS07-058 
170911 HIGH MS07-050 
170907 HIGH MS07-046 
170906 HIGH MS07-045 
170904 HIGH MS07-043 
164915 HIGH MS07-035 
164913 HIGH MS07-033 
164911 HIGH MS07-031 
160623 HIGH MS07-027 
157262 HIGH MS07-022 
157261 HIGH MS07-021 
157260 HIGH MS07-020 
157259 HIGH MS07-019 
156477 HIGH MS07-017 
150253 HIGH MS07-016 
150249 HIGH MS07-013 
150248 HIGH MS07-012 
150247 HIGH MS07-011 
150243 HIGH MS07-008 
150242 HIGH MS07-007 
150241 MEDIUM MS07-006 
141034 HIGH MS06-076 
141033 MEDIUM MS06-075 
141030 HIGH MS06-072 
137571 HIGH MS06-070 
137568 HIGH MS06-067 
133387 MEDIUM MS06-065 
133386 MEDIUM MS06-064 
133385 MEDIUM MS06-063 
133379 HIGH MS06-057 
131654 HIGH MS06-055 
129977 MEDIUM MS06-053 
129976 MEDIUM MS06-052 
126093 HIGH MS06-051 
126092 MEDIUM MS06-050 
126087 HIGH MS06-046 
126086 MEDIUM MS06-045 
126083 HIGH MS06-042 
126082 HIGH MS06-041 
126081 HIGH MS06-040 
123421 HIGH MS06-036 
123420 HIGH MS06-035 
120825 MEDIUM MS06-032 
120823 MEDIUM MS06-030 
120818 HIGH MS06-025 
120815 HIGH MS06-022 
120814 HIGH MS06-021 
117384 MEDIUM MS06-018 
114666 HIGH MS06-015 
114664 HIGH MS06-013 
108744 MEDIUM MS06-008 
108743 MEDIUM MS06-007 
108742 MEDIUM MS06-006 
104567 HIGH MS06-002 
104237 HIGH MS06-001 
96574 HIGH MS05-053 
93395 HIGH MS05-051 
93394 HIGH MS05-050 
93454 MEDIUM MS05-049 
;===============================================================================
=================================================================================
===================

This is the Hijack This POst:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:59:20 PM, on 4/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\mcntolwd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Family\Desktop\HiJackThis_v2.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: (no name) - {02586E7B-19C6-47AC-8F1B-1E7AFBF60AA5} - (no file)
O2 - BHO: (no name) - {6542EF4A-75B1-4D0B-9344-0774DD735604} - (no file)
O2 - BHO: (no name) - {CFEBD538-86D6-4C57-AA4E-7BF1704C48D0} - C:\WINDOWS\System32\urqrr.dll (file missing)
O2 - BHO: (no name) - {EA8B75E0-0541-41D4-888A-8DDE2845482E} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\System32\mcntolwd.exe DWram
O4 - HKLM\..\Run: [g]eeV\mWhjlnspB] C:\WINDOWS\System32\mcntoldn.exe DWram
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [{F8-8B-B6-6B-DW}] c:\windows\system32\rwwnw64d.exe DWram
O4 - HKLM\..\RunOnce: [RemoveInstallPath] cmd.exe C:\WINDOWS\system32\cmd.exe /c rmdir /S /Q "C:\PROGRA~1\nvcoi" > nul
O4 - HKCU\..\Run: [Oxirx] "C:\Documents and Settings\Family\Application Data\??crosoft\w?auboot.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [qzki] C:\PROGRA~1\COMMON~1\qzki\qzkim.exe
O4 - HKCU\..\Run: [Mmlo] "C:\DOCUME~1\Family\MYDOCU~1\CROSOF~1\attrib.exe" -vt yazb
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [JavaCore] C:\Program Files\JavaCore\JavaCore.exe
O4 - HKUS\S-1-5-18\..\Run: [autoload] C:\Documents and Settings\LocalService\cftmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [autoload] C:\Documents and Settings\LocalService\cftmon.exe (User 'Default user')
O4 - Startup: Deewoo.lnk = C:\WINDOWS\system32\mcntolwd.exe
O4 - Startup: DW_Start.lnk = C:\WINDOWS\system32\knwnw64r.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.imageservr.com
O15 - Trusted Zone: *.storageguardsoft.com
O15 - Trusted Zone: *.gomyhit.com (HKLM)
O15 - Trusted Zone: *.imageservr.com (HKLM)
O15 - Trusted Zone: *.storageguardsoft.com (HKLM)
O16 - DPF: {50BD5CDA-4BA8-4048-8FAA-763F222E41D8} - ms-its:mhtml:file://c:\\nores.mht!http://adxanet.net/c...::/xpreload.ocx
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1207697347943
O20 - Winlogon Notify: awtqopm - awtqopm.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

--
End of file - 4481 bytes


Here is the Unistall List from Hijackthis:

Adobe Flash Player ActiveX
Adobe Reader 7.0.7
Adobe Shockwave Player
AVG Anti-Spyware 7.5
Hallmark Card Studio Special Edition
Heavy Weapon Deluxe
HijackThis 2.0.2
HP Photo & Imaging 3.1
HP PSC & OfficeJet 3.0
Memories Disc Creator 2.0
Merriam-Webster 3.0
Merriam-Webster Macros for Microsoft Word
Microsoft .NET Framework 1.1
Microsoft Office Professional Edition 2003
Mozilla Firefox (2.0.0.13)
Panda ActiveScan 2.0
Spybot - Search & Destroy
SUPERAntiSpyware Free Edition
Update for Windows XP (KB898461)
Webster's Spanish Dictionary
Windows Installer 3.1 (KB893803)
Windows Media Format Runtime
Windows Media Player 10
Windows XP Service Pack 2
WordPerfect Office 11





Thanks in advance for your help.

[Advertisements]

Please print the below instructions or copy them to Notepad. Make sure to work through the fixes in the order mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. Also if you have any programs that may prevent system changes (like Spybot's TeaTimer program, Ad-aware's Ad-Watch, and others), make sure you disable them before doing any of the fixes (or accept the changes for the fix we give you when asked by the programs).

Go to My Computer->Tools (or View)->Folder Options->View tab:
* Under the Hidden files and folders heading, select Show hidden files and folders (it's Show all files for Windows 98).
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm and then click OK.
** You may change the above options back after your log is clean. If we ask you to fix something that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep).

Download ATF Cleaner at http://www.atribune..../click.php?id=1
Double-click ATF-Cleaner.exe to run the program. Under Main choose Select All
Click the Empty Selected button.

If you use the Firefox browser click Firefox at the top and choose Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use the Opera browser click 'Opera' at the top and choose 'Select All'
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

Restart your computer and boot into Safe Mode (if you don't know how, go to http://www.bleepingc...showtutorial=61 ). Make sure to close any internet browsers that may still be open.

Uninstall the following via the Add/Remove Panel (Start->Settings->Control Panel->Add/Remove Programs) if found:

JavaCore

Run a scan in HijackThis. Check each of the following if they still exist and hit 'Fix Checked' after you checked the last one:

O2 - BHO: (no name) - {02586E7B-19C6-47AC-8F1B-1E7AFBF60AA5} - (no file)
O2 - BHO: (no name) - {6542EF4A-75B1-4D0B-9344-0774DD735604} - (no file)
O2 - BHO: (no name) - {CFEBD538-86D6-4C57-AA4E-7BF1704C48D0} - C:\WINDOWS\System32\urqrr.dll (file missing)
O2 - BHO: (no name) - {EA8B75E0-0541-41D4-888A-8DDE2845482E} - (no file)
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\System32\mcntolwd.exe DWram
O4 - HKLM\..\Run: [g]eeV\mWhjlnspB] C:\WINDOWS\System32\mcntoldn.exe DWram
O4 - HKLM\..\Run: [{F8-8B-B6-6B-DW}] c:\windows\system32\rwwnw64d.exe DWram
O4 - HKLM\..\RunOnce: [RemoveInstallPath] cmd.exe C:\WINDOWS\system32\cmd.exe /c rmdir /S /Q "C:\PROGRA~1\nvcoi" > nul
O4 - HKCU\..\Run: [Oxirx] "C:\Documents and Settings\Family\Application Data\??crosoft\w?auboot.exe"
O4 - HKCU\..\Run: [qzki] C:\PROGRA~1\COMMON~1\qzki\qzkim.exe
O4 - HKCU\..\Run: [Mmlo] "C:\DOCUME~1\Family\MYDOCU~1\CROSOF~1\attrib.exe" -vt yazb
O4 - HKCU\..\Run: [JavaCore] C:\Program Files\JavaCore\JavaCore.exe
O4 - Startup: Deewoo.lnk = C:\WINDOWS\system32\mcntolwd.exe
O4 - Startup: DW_Start.lnk = C:\WINDOWS\system32\knwnw64r.exe
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.imageservr.com
O15 - Trusted Zone: *.storageguardsoft.com
O15 - Trusted Zone: *.gomyhit.com (HKLM)
O15 - Trusted Zone: *.imageservr.com (HKLM)
O15 - Trusted Zone: *.storageguardsoft.com (HKLM)
O16 - DPF: {50BD5CDA-4BA8-4048-8FAA-763F222E41D8} - ms-its:mhtml:file://c:\\nores.mht!http://adxanet.net/c...::/xpreload.ocx
O20 - Winlogon Notify: awtqopm - awtqopm.dll (file missing)

Locate the following Files/Folders and delete them if they exist (if no location given, just do a search for them):

C:\WINDOWS\System32\mcntolwd.exe
C:\WINDOWS\System32\mcntoldn.exe
c:\windows\system32\rwwnw64d.exe
C:\PROGRA~1\nvcoi
C:\Documents and Settings\Family\Application Data\??crosoft\
C:\PROGRA~1\COMMON~1\qzki\
C:\DOCUME~1\Family\MYDOCU~1\CROSOF~1\
C:\Program Files\JavaCore\
C:\WINDOWS\system32\mcntolwd.exe
C:\WINDOWS\system32\knwnw64r.exe
c:\nores.mht

Restart the computer.

Go to http://www.bleepingc...to-use-combofix and follow the instructions on how to install the Recovery Console and run ComboFix. Go through all the steps until posting the log part. Post the combofix log here.

[greyknight17]

Please print the below instructions or copy them to Notepad. Make sure to work through the fixes in the order mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. Also if you have any programs that may prevent system changes (like Spybot's TeaTimer program, Ad-aware's Ad-Watch, and others), make sure you disable them before doing any of the fixes (or accept the changes for the fix we give you when asked by the programs).

Go to My Computer->Tools (or View)->Folder Options->View tab:
* Under the Hidden files and folders heading, select Show hidden files and folders (it's Show all files for Windows 98).
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm and then click OK.
** You may change the above options back after your log is clean. If we ask you to fix something that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep).

Download ATF Cleaner at http://www.atribune..../click.php?id=1
Double-click ATF-Cleaner.exe to run the program. Under Main choose Select All
Click the Empty Selected button.

If you use the Firefox browser click Firefox at the top and choose Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use the Opera browser click 'Opera' at the top and choose 'Select All'
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

Restart your computer and boot into Safe Mode (if you don't know how, go to http://www.bleepingc...showtutorial=61 ). Make sure to close any internet browsers that may still be open.

Uninstall the following via the Add/Remove Panel (Start->Settings->Control Panel->Add/Remove Programs) if found:

JavaCore

Run a scan in HijackThis. Check each of the following if they still exist and hit 'Fix Checked' after you checked the last one:

O2 - BHO: (no name) - {02586E7B-19C6-47AC-8F1B-1E7AFBF60AA5} - (no file)
O2 - BHO: (no name) - {6542EF4A-75B1-4D0B-9344-0774DD735604} - (no file)
O2 - BHO: (no name) - {CFEBD538-86D6-4C57-AA4E-7BF1704C48D0} - C:\WINDOWS\System32\urqrr.dll (file missing)
O2 - BHO: (no name) - {EA8B75E0-0541-41D4-888A-8DDE2845482E} - (no file)
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\System32\mcntolwd.exe DWram
O4 - HKLM\..\Run: [g]eeV\mWhjlnspB] C:\WINDOWS\System32\mcntoldn.exe DWram
O4 - HKLM\..\Run: [{F8-8B-B6-6B-DW}] c:\windows\system32\rwwnw64d.exe DWram
O4 - HKLM\..\RunOnce: [RemoveInstallPath] cmd.exe C:\WINDOWS\system32\cmd.exe /c rmdir /S /Q "C:\PROGRA~1\nvcoi" > nul
O4 - HKCU\..\Run: [Oxirx] "C:\Documents and Settings\Family\Application Data\??crosoft\w?auboot.exe"
O4 - HKCU\..\Run: [qzki] C:\PROGRA~1\COMMON~1\qzki\qzkim.exe
O4 - HKCU\..\Run: [Mmlo] "C:\DOCUME~1\Family\MYDOCU~1\CROSOF~1\attrib.exe" -vt yazb
O4 - HKCU\..\Run: [JavaCore] C:\Program Files\JavaCore\JavaCore.exe
O4 - Startup: Deewoo.lnk = C:\WINDOWS\system32\mcntolwd.exe
O4 - Startup: DW_Start.lnk = C:\WINDOWS\system32\knwnw64r.exe
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.imageservr.com
O15 - Trusted Zone: *.storageguardsoft.com
O15 - Trusted Zone: *.gomyhit.com (HKLM)
O15 - Trusted Zone: *.imageservr.com (HKLM)
O15 - Trusted Zone: *.storageguardsoft.com (HKLM)
O16 - DPF: {50BD5CDA-4BA8-4048-8FAA-763F222E41D8} - ms-its:mhtml:file://c:\\nores.mht!http://adxanet.net/c...::/xpreload.ocx
O20 - Winlogon Notify: awtqopm - awtqopm.dll (file missing)

Locate the following Files/Folders and delete them if they exist (if no location given, just do a search for them):

C:\WINDOWS\System32\mcntolwd.exe
C:\WINDOWS\System32\mcntoldn.exe
c:\windows\system32\rwwnw64d.exe
C:\PROGRA~1\nvcoi
C:\Documents and Settings\Family\Application Data\??crosoft\
C:\PROGRA~1\COMMON~1\qzki\
C:\DOCUME~1\Family\MYDOCU~1\CROSOF~1\
C:\Program Files\JavaCore\
C:\WINDOWS\system32\mcntolwd.exe
C:\WINDOWS\system32\knwnw64r.exe
c:\nores.mht

Restart the computer.

Go to http://www.bleepingc...to-use-combofix and follow the instructions on how to install the Recovery Console and run ComboFix. Go through all the steps until posting the log part. Post the combofix log here.

[greyknight17]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.