online protection tool

When online I keep getting a popup called online protection tool. It says it's from Microsoft but I'm pretty sure it isn't. I would like some help in removing this if possible.

Thanks
wrando

Edited by Orange Blossom, 04 April 2010 - 03:50 PM.
Move to AII as no logs posted. ~ OB

Hello and welcome ...
Reset the router to its default configuration. This can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labeled "reset" located on the back of the router. Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds). If you don’t know the router's default password, you can look it up HERE.


Next run MBAM (MalwareBytes):

Please download Malwarebytes Anti-Malware (v1.45) and save it to your desktop.alternate download link 1
alternate download link 2
MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
• If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
• Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
• Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

• If Malwarebytes Anti-Malware results in any error messages, check the Help file's list of error codes within its program folder first. If you do not find any information, please refer to Common Issues, Questions, and their Solutions, Frequently Asked Questions. If the error you are receiving is not in the list, please report it here so the research team can investigate.

• Some types of malware will target Malwarebytes Anti-Malware and other security tools to keep them from running properly. If that's the case, please refer to the suggestions provided in For those having trouble running Malwarebytes Anti-Malware.

Thanks
wrando

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Database version: 3956

Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.13

4/5/2010 9:20:51 AM
mbam-log-2010-04-05 (09-20-51).txt

Scan type: Quick scan
Objects scanned: 173623
Time elapsed: 13 minute(s), 49 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 3
Files Infected: 132

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f10587e9-0e47-4cbe-abcd-7dd20b862223} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Pornovid (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{dd475484-701d-49e0-a64b-210f88d6eaf6}\NameServer (Trojan.DNSChanger) -> Data: 85.255.114.85,85.255.112.25 -> Quarantined and deleted successfully.

Folders Infected:
C:\Program Files\Bug Doctor (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\Bug Doctor (Rogue.BugDoctor) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\CRYPT.DLL (Hacktool) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\Bug Doctor Help.chm (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\BugDoctor.exe (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnFridayApril062007085749.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnFridayJanuary122007104920.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnFridayMarch162007111142.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnFridayMay042007104333.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnFridayMay182007121042.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnMondayApril162007082509.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnMondayApril232007090100.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnMondayFebruary192007152636.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnMondayFebruary262007081746.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnMondayJanuary082007121953.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnMondayJanuary082007224342.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnMondayJanuary222007085739.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnMondayJune042007124404.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnMondayMay142007090144.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnSaturdayJanuary132007184539.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnSaturdayJune302007231725.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnSaturdayMarch032007092826.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnSaturdayMay262007085835.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnSundayJanuary072007002423.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnSundayJanuary072007110602.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnSundayJanuary072007201928.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnSundayJuly012007092646.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnSundayJune102007101146.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnSundayJune172007114748.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnSundayJune242007090716.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnSundayMarch112007120645.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnSundayMarch182007113622.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnSundayMay202007111755.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnThursdayJune282007112848.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnThursdayMarch152007183537.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnThursdayMay102007122246.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnThursdayMay312007105456.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnTuesdayApril102007084543.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnTuesdayFebruary202007091508.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnTuesdayJune122007151004.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnTuesdayJune262007090140.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnTuesdayMarch062007110103.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnTuesdayMay082007190909.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnTuesdayMay152007081828.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnWednesdayFebruary212007114831.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnWednesdayJanuary102007064653.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnWednesdayJanuary102007221115.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnWednesdayJune202007094421.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnWednesdayJune272007104934.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnWednesdayMarch212007190346.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\FixedOnWednesdayMarch282007074819.xml (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\Get Bonuses.url (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin.ini (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\unins000.dat (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\unins000.exe (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\bug.swf (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\fixing_error-disable.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\fixing_error-normal.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\fixing_error-pressed.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\fixing_error-rollover.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\fix_complete-disable.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\fix_complete-normal.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\fix_complete-pressed.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\fix_complete-roll_over.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\LiveUpdate_disable.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\LiveUpdate_normal.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\LiveUpdate_pressed.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\LiveUpdate_rollover.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\main_disable.jpg (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\main_enable.jpg (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\main_pressed.jpg (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\main_roll_over.jpg (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\mask.bmp (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\mask1.bmp (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\scan.swf (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\scancomplete.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\scanning_error-disable.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\scanning_error-normal.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\scanning_error-pressed.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\scanning_error-rollover.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\scan_complete-disable.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\scan_complete-normal.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\scan_complete-pressed.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\scan_complete-roll_over.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\schedule_disable.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\schedule_normal.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\schedule_pressed.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\schedule_rollover.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\skin.ini (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\SubMainDisable.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\SubMainNormal.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\SubMainPressed.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\SubMainRollOver.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\support_disable.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\support_normal.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\support_pressed.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\support_rollover.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\unlock_key-disable.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\unlock_key-normal.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\unlock_key-pressed.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Bug Doctor\skin\unlock_key-roll_over.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\Bug Doctor\BugDoctor.lnk (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\Bug Doctor\Get Bonuses!.lnk (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\Bug Doctor\Uninstall BugDoctor.lnk (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Desktop\BugDoctor.lnk (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Documents and Settings\wr\Desktop\BugDoctor.lnk (Rogue.BugDoctor) -> Quarantined and deleted successfully.
C:\Documents and Settings\wr\Favorites\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\wr\Favorites\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\wr\Favorites\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Program Files\2wconfig.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\GNU_REGEX.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\wwwapp.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\wwwcache.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\wwwcore.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\wwwdir.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\wwwdll.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\wwwfile.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\wwwftp.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\wwwgophe.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\wwwhtml.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\wwwhttp.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\wwwinit.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\wwwmime.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\wwwmux.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\wwwnews.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\wwwssl.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\wwwstream.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\wwwtelnt.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\wwwtrans.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\wwwutils.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\wwwwais.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\wwwxml.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files\wwwzip.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\wr\Start Menu\Get 320% Welcome Bonus!.lnk (Adware.PurityScan) -> Quarantined and deleted successfully.

Edited by wrando, 05 April 2010 - 08:23 AM.

Hello that was productive..Everything we give you to use will be free,but if you like something you are free to buy something. They are goood tools.

Now let's run these and het whatever may be left.



Next run ATF and SAS: If you cannot access Safe Mode,run in normal ,but let me know.

Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".

From your regular user account..
Download Attribune's ATF Cleaner and then SUPERAntiSpyware , Free Home Version. Save both to desktop ..
DO NOT run yet.
Open SUPER from icon and install and Update it
Under Scanner Options make sure the following are checked (leave all others unchecked):
Close browsers before scanning.
Scan for tracking cookies.
Terminate memory threats before quarantining.
Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet.

Now reboot into Safe Mode: How to enter safe mode(XP)
Using the F8 Method
Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode.

Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox or Opera browser click that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

NOW Scan with SUPER
Open from the desktop icon or the program Files list
On the left, make sure you check C:\Fixed Drive.
Perform a Complete scan. After scan,Verify they are all checked.
Click OK on the summary screen to quarantine all found items.
If asked if you want to reboot, click "Yes" and reboot normally.

To retrieve the removal information after reboot, launch SUPERAntispyware again.
Click Preferences, then click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
If there are several logs, click the current dated log and press View log.
A text file will open in your default text editor.
Please copy and paste the Scan Log results in your next reply.
Click Close to exit the program.


Please ask any needed questions,post logs and Let us know how the PC is running now.

><><>

this is the log from Super

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 04/05/2010 at 01:43 PM

Application Version : 4.35.1002

Core Rules Database Version : 4770
Trace Rules Database Version: 2582

Scan type : Complete Scan
Total Scan Time : 00:56:28

Memory items scanned : 221
Memory threats detected : 0
Registry items scanned : 6057
Registry threats detected : 1
File items scanned : 16696
File threats detected : 0

Trojan.DNS-Changer (Hi-Jacked DNS)
HKLM\SYSTEM\CONTROLSET003\SERVICES\TCPIP\PARAMETERS\INTERFACES\{DD475484-701D-49E0-A64B-210F88D6EAF6}#NAMESERVER

thanks
wrando

Looks like it should be gone, Any issues there?

It all seems good. What ever it was it had stopprd my XP updates and I was able to install service pack 3 and about 60 other updates and install explorer 8

Thank You

Excellent.. The updates may have already done this but do it anyway.
Now you should Create a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been backed up, renamed and saved in System Restore. Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:

• Go to Start > Programs > Accessories > System Tools and click "System Restore".
• Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name, then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.

• Then use Disk Cleanup to remove all but the most recently created Restore Point.
• Go to Start > Run and type: Cleanmgr
• Click "Ok". Disk Cleanup will scan your files for several minutes, then open.
• Click the "More Options" tab, then click the "Clean up" button under System Restore.
• Click Ok. You will be prompted with "Are you sure you want to delete all but the most recent restore point?"
• Click Yes, then click Ok.
• Click Yes again when prompted with "Are you sure you want to perform these actions?"
• Disk Cleanup will remove the files and close automatically.

Vista and Windows 7 users can refer to these links: Create a New Restore Point in Vista or Windows 7 and Disk Cleanup in Vista.

I'm going to follow your instructions, but I have run into a problem. When I need to use Java I get a blue screen error and the computer shuts down.

Ok, first we'll replace it as if it was outdated. i have a canned for this.

Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:

• Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
• Look for "JDK 6 Update 19 (JDK or JRE)".
• Click the "Download JRE" button to the right.
• Select your Platform: "Windows".
• Select your Language: "Multi-language".
• Read the License Agreement, and then check the box that says: "Accept License Agreement".
• Click Continue and the page will refresh.
• Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
• Close any programs you may have running - especially your web browser.

Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.

• Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-6u19-windows-i586.exe to install the newest version.
• If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
• When the Java Setup - Welcome window opens, click the Install > button.
• If offered to install a Toolbar, just uncheck the box before continuing unless you want it.

-- Starting with Java 6u10, the uninstaller incorporated in each new release uses Enhanced Auto update to automatically remove the previous version when updating to a later update release. It will not remove older versions, so they will need to be removed manually.
-- Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version.

Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click Ok and reboot your computer.

I had already uninstalled and reinstalled Java and it seems to be fine

Thanks again

Is this good advice all free?

No charge, on the house.. This is the only free lunch I have ever found