BleepingComputer.com: Win32.Agent.Icb

I have only try use spybot to get rid of it, but it always seem to keep popping up. I don't know much info other then that. Didn't want to screw up anything else on my computer but going on a delete rampage.

(SBI $A0EF69BD) Settings
HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows\CurrentVersion\mid

[Running Processes]

alg.exe Local Service
ApntEx.exe Me
Apoint.exe
btdna.exe
csrss.exe
explorer.exe
firefox.exe
Goooglecrashhandler.exe
hkcmd.exe
igfxpers.exe
jucheck.exe
jusched.exe
lsass.exe
services.exe
smss.exe
spoolsv.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe (no really there is 9 of these running)
System
System idle process
taskmgr.exe
wdfmgr.exe
winampa.exe
winlogon.exe
wlcomm.exe
wscntfy.exe
xynkh.exe

Hello,let's run these and see if anything is left.
Next run MBAM (MalwareBytes):

■Supports for Windows 2000, XP, and Vista (32-bit and 64-bit).

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

• Make sure you are connected to the Internet.
  
• Double-click on mbam-setup.exe to install the application.
  
• When the installation begins, follow the prompts and do not make any changes to default settings.
  
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
    
  • Launch Malwarebytes' Anti-Malware
  
  
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  
• If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
  
• Then click on the Scan button.
  
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When removal is completed, a log report will open in Notepad.
  
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  
• Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.



Next run ATF and SAS:

Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".

From your regular user account..
Download Attribune's ATF Cleaner and then SUPERAntiSpyware , Free Home Version. Save both to desktop ..
DO NOT run yet.
Open SUPER from icon and install and Update it
Under Scanner Options make sure the following are checked (leave all others unchecked):
Close browsers before scanning.
Scan for tracking cookies.
Terminate memory threats before quarantining.
Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet.

Now reboot into Safe Mode: How to enter safe mode(XP)
Using the F8 Method
Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode.

Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox or Opera browser click that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

NOW Scan with SUPER
Open from the desktop icon or the program Files list
On the left, make sure you check C:\Fixed Drive.
Perform a Complete scan. After scan,Verify they are all checked.
Click OK on the summary screen to quarantine all found items.
If asked if you want to reboot, click "Yes" and reboot normally.

To retrieve the removal information after reboot, launch SUPERAntispyware again.
Click Preferences, then click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
If there are several logs, click the current dated log and press View log.
A text file will open in your default text editor.
Please copy and paste the Scan Log results in your next reply.
Click Close to exit the program.


Please ask any needed questions,post 2 logs and Let us know how the PC is running now.

Malwarebytes' Anti-Malware 1.38
Database version: 2357
Windows 5.1.2600 Service Pack 3

6/30/2009 7:17:09 PM
mbam-log-2009-06-30 (19-17-09).txt

Scan type: Quick Scan
Objects scanned: 112052
Time elapsed: 24 minute(s), 43 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 18

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\nvrsk.dll (Trojan.Agent) -> Delete on reboot.

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\appimbt_dlls (Spyware.Agent.H) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\Documents and Settings\Tina Shreves\xynkh.exe \s) Good: (Userinit.exe) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\nvrsk.dll (Spyware.Agent.H) -> Delete on reboot.
c:\WINDOWS\system32\nvtpm32.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\localservice\local settings\Temp\ms1240439569.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\networkservice\local settings\Temp\ms1238882485.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\networkservice\local settings\Temp\ms1239095964.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\networkservice\local settings\Temp\ms1239134792.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\networkservice\local settings\Temp\ms1239352940.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\networkservice\local settings\Temp\ms1239398376.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\networkservice\local settings\Temp\ms1240088098.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\networkservice\local settings\Temp\ms1240125902.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\networkservice\local settings\Temp\ms1240280506.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\networkservice\local settings\Temp\ms1241113888.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\networkservice\local settings\Temp\ms1241219072.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\networkservice\local settings\Temp\ms1242067553.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\networkservice\local settings\Temp\ms1243055089.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\networkservice\local settings\Temp\temporary internet files\Content.IE5\2H4R8PCF\inst[1].php (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\localservice\local settings\temporary internet files\Content.IE5\WDURS9QN\inst[1].php (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\azton.mt (Trojan.Agent) -> Quarantined and deleted successfully.








SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 06/30/2009 at 08:14 PM

Application Version : 4.26.1006

Core Rules Database Version : 3964
Trace Rules Database Version: 1905

Scan type : Quick Scan
Total Scan Time : 00:33:54

Memory items scanned : 214
Memory threats detected : 0
Registry items scanned : 402
Registry threats detected : 1
File items scanned : 4724
File threats detected : 36

Trojan.Agent/Gen
[buyw] C:\WINDOWS\SYSTEM32\BUYW.EXE
C:\WINDOWS\SYSTEM32\BUYW.EXE
C:\DOCUMENTS AND SETTINGS\TINA SHREVES\XYNKH.EXE

Adware.Tracking Cookie
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@1045344815[1].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@msnbc.112.2o7[1].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@dr.findlinks[1].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@insightexpressai[1].txt
C:\Documents and Settings\Tina Shreves\Cookies\system@shopica[1].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@stopzilla[1].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@questionmarket[2].txt
C:\Documents and Settings\Tina Shreves\Cookies\system@www.shopica[1].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@atwola[2].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@msnportal.112.2o7[1].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@microsoftwga.112.2o7[1].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@eaeacom.112.2o7[1].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@serving-sys[1].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@richmedia.yahoo[2].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@versiontracker[1].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@advertising[2].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@html[1].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@ads.clicksor[1].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@ads.bridgetrack[1].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@www.stopzilla[1].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@serw.clicksor[1].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@microsoftwlmessengermkt.112.2o7[1].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@msnaccountservices.112.2o7[1].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@www.versiontracker[1].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@windowsmedia[1].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@myroitracking[2].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@bs.serving-sys[2].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@hentaicounter[2].txt
C:\Documents and Settings\Tina Shreves\Cookies\system@cp.mysearch-finder[1].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@adinterax[1].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@qksrv[2].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@ads.outspark[1].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@at.atwola[1].txt
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@atdmt[2].txt



Firefox is running away faster now, It seem like they are still there, because i go to lunch my game and the idiot software shut down my computer still.

Hello again,, did you reboot normally after the MBAM scan? It was needed. Also you ran a quick scan with SAS. I lnow it takes an hour but there are no shrt cuts.

After SAS Rerun MBAM ///

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan.
After scan click Remove Selected, Post new scan log and Reboot into normal mode.

Post 2 logs and Let us know how the PC is running now.

I am not the OP but had the same problem last night and a search on google brought me to this page. Thank you SO MUCH for your step by step directions - it took a while, but I think it worked!

To istrategist
That sounds good, so please post your MBAM log in a new topic for review,thanks.

And yes I did restart after the scan was done.


SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/01/2009 at 12:43 PM

Application Version : 4.26.1006

Core Rules Database Version : 3964
Trace Rules Database Version: 1905

Scan type : Complete Scan
Total Scan Time : 00:47:49

Memory items scanned : 393
Memory threats detected : 0
Registry items scanned : 4355
Registry threats detected : 0
File items scanned : 15407
File threats detected : 1

Adware.Tracking Cookie
C:\Documents and Settings\Tina Shreves\Cookies\tina shreves@atdmt[1].txt



Malwarebytes' Anti-Malware 1.38
Database version: 2357
Windows 5.1.2600 Service Pack 3

7/1/2009 2:25:29 PM
mbam-log-2009-07-01 (14-25-29).txt

Scan type: Full Scan (C:\|D:\|E:\|)
Objects scanned: 239766
Time elapsed: 1 hour(s), 27 minute(s), 59 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\WINDOWS\system32\config\systemprofile\local settings\temporary internet files\Content.IE5\KD2FS9MJ\inst[1].php (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\config\systemprofile\local settings\temporary internet files\Content.IE5\UJKBO196\inst[1].php (Trojan.Agent) -> Quarantined and deleted successfully.

This is looking a lot better. I would like to do another scan .. How is it runnning now.

Please print out and follow these instructions: "How to use SDFix". <- This program is for Windows 2000/XP ONLY.
When using this tool, you must use the Administrator's account or an account with "Administrative rights"

• Disconnect from the Internet and temporarily disable your anti-virus, script blocking and any real time protection programs before performing a scan.
  
• When done, the SDFix report log will open in notepad and automatically be saved in the SDFix folder as Report.txt.
  
• If SDFix is unable to run after rebooting from Safe Mode, run SDFix in either Mode, and type F, then press Enter for it to finish the final stage and produce the report.
  
• Please copy and paste the contents of Report.txt in your next reply.
  
• Be sure to renable you anti-virus and and other security programs before connecting to the Internet.

-- If the computer has been infected with the VirusAlert! malware warning from the clock and the Start Menu icons or drives are not visible, open the SDFix folder, right-click on either the XP_VirusAlert_Repair.inf or W2K VirusAlert_Repair.inf (depending on your version of Windows) and select Install from the Context menu. Then reboot to apply the changes.

It's running great now! So much better then it was i forgot how fast my computer can run, I'm going to do the next step right now, i will edit this post and throw it up there once i'm done.


SDFix: Version 1.240
Run by Tina Shreves on Wed 07/01/2009 at 10:01 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :


Infected user32.dll Found!

user32.dll File Locations:

"C:\WINDOWS\$NtServicePackUninstall$\user32.dll" 577024 08/04/2004 12:56 AM
"C:\WINDOWS\ServicePackFiles\i386\user32.dll" 578560 04/13/2008 05:12 PM
"C:\WINDOWS\SoftwareDistribution\Download\dc3b8fb011c281dea1cb7a45f880da78\sp1qfe\user32.dll" 561152 03/02/2005 11:20 AM
"C:\WINDOWS\SoftwareDistribution\Download\dc3b8fb011c281dea1cb7a45f880da78\sp2gdr\user32.dll" 577024 03/02/2005 11:09 AM
"C:\WINDOWS\SoftwareDistribution\Download\dc3b8fb011c281dea1cb7a45f880da78\sp2qfe\user32.dll" 577024 03/02/2005 11:19 AM
"C:\WINDOWS\system32\user32.DLL" 578560 05/08/2009 07:48 PM
"C:\WINDOWS\system32\dllcache\user32.dll" 578560 05/08/2009 07:48 PM

[C:\WINDOWS\$NtServicePackUninstall$\user32.dll] C72661F8552ACE7C5C85E16A3CF505C4
[C:\WINDOWS\ServicePackFiles\i386\user32.dll] B26B135FF1B9F60C9388B4A7D16F600B
[C:\WINDOWS\SoftwareDistribution\Download\dc3b8fb011c281dea1cb7a45f880da78\sp1qfe\user32.dll] 74202EB1BD67E8BE9509E38C8D2234B0
[C:\WINDOWS\SoftwareDistribution\Download\dc3b8fb011c281dea1cb7a45f880da78\sp2gdr\user32.dll] DE2DB164BBB35DB061AF0997E4499054
[C:\WINDOWS\SoftwareDistribution\Download\dc3b8fb011c281dea1cb7a45f880da78\sp2qfe\user32.dll] 1800F293BCCC8EDE8A70E12B88D80036
[C:\WINDOWS\system32\user32.DLL] 5D2D3CF92B4573EE88D28FCD9C588FF0
[C:\WINDOWS\system32\dllcache\user32.dll] 5D2D3CF92B4573EE88D28FCD9C588FF0


[C:\WINDOWS\System32\kczhlyj] 7A458487FBD7CE3B5FFB4BAA309BF428
[C:\WINDOWS\System32\nrgidks] B26B135FF1B9F60C9388B4A7D16F600B
[C:\WINDOWS\System32\nyxbyfxw] 7A458487FBD7CE3B5FFB4BAA309BF428
[C:\WINDOWS\System32\sesm] 7A458487FBD7CE3B5FFB4BAA309BF428


Note: SDFix does not repair this file!



Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found

Hello, sorry i lost this topic among the pile..
This looks good now but I want to chaeck those last 2.

Would you run part 1 of S!Ri's SmitfraudFix
Please download SmitfraudFix

Double-click SmitfraudFix.exe
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm

SmitFraudFix v2.423

Scan done at 21:53:51.92, Tue 07/07/2009
Run from C:\Program Files\Mozilla Firefox\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\DAEMON Tools Pro\DTProShellHlp.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\BitTorrent\bittorrent.exe
C:\Program Files\Mozilla Firefox\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Tina Shreves


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\TINASH~1\LOCALS~1\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Tina Shreves\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\TINASH~1\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"


»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, following keys are not inevitably infected!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

»»»»»»»»»»»»»»»»»»»»»»»» RK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""




»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel® PRO/Wireless 3945ABG Network Connection - Packet Scheduler Miniport
DNS Server Search Order: 192.168.0.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{2DBF85B4-B6FB-4E1B-8F9D-49783FE1E367}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{2DBF85B4-B6FB-4E1B-8F9D-49783FE1E367}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{2DBF85B4-B6FB-4E1B-8F9D-49783FE1E367}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End



No worry It happens i kept checking back.

You look good here.. If there are no more signs of infection there,then....

Now you should Create a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been backed up, renamed and saved in System Restore. Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:

• Go to Start > Programs > Accessories > System Tools and click "System Restore".
  
• Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name, then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.

• Then use Disk Cleanup to remove all but the most recently created Restore Point.
  
• Go to Start > Run and type: Cleanmgr
  
• Click "Ok". Disk Cleanup will scan your files for several minutes, then open.
  
• Click the "More Options" tab, then click the "Clean up" button under System Restore.
  
• Click Ok. You will be prompted with "Are you sure you want to delete all but the most recent restore point?"
  
• Click Yes, then click Ok.
  
• Click Yes again when prompted with "Are you sure you want to perform these actions?"
  
• Disk Cleanup will remove the files and close automatically.

Vista Users can refer to these links: Create a New Restore Point and Disk Cleanup.

Alright :D Thanks for the help my computer is running so much better now.

You're most welcome, please take a moment to read quietman7's excellent prevention tips in post 17 here
Click>>Tips to protect yourself against malware and reduce the potential for re-infection: