doac00

Ahh okay good news - just remove that directory - shall do. Thanks again. A moderator can readily close this now.

Mieke, Thank you very much - your time on this is much appreciated. I have one small issue - I deleted Combofix off my PC already by hitting the delete key. I may have even cleaned the recycle bin and run CCleaner so here is the question. If I install combofix off my pen drive again onto the desktop can I still run the command prompt to uninstall it or would it need to have been the original one? I may not have cleaned the recycle bin so I'll check first and pop that back onto desktop and run the uninstall. Sorry about that - ahead of myself. Wife will be happy to surf again and I'll read your prevention page. I now have AVG, Ad Aware and an active-X watcher activated so will probably need to read your speed up page as well ;-) Regard and thanks again.

Mieke, Any chance you could quickly check the combofix log and let me know the PC is "clean" again - it seems to be functioning fine now but that doesn't mean it's still not got something sinister still lurking. Thanks

Combofix log. ComboFix 09-06-08.05 - The Doaney's 10/06/2009 18:42.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1023.628 [GMT 1:00] Running from: c:\documents and settings\The Doaney's\Desktop\ComboFix.exe AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\UACqpabwwasmmkndrs.dat G:\Autorun.inf G:\Desktop.ini . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_UACd.sys ((((((((((((((((((((((((( Files Created from 2009-05-10 to 2009-06-10 ))))))))))))))))))))))))))))))) . 2009-06-09 17:28 . 2009-06-09 17:28 -------- d-----w- c:\documents and settings\The Doaney's\Application Data\Malwarebytes 2009-06-08 17:49 . 2009-05-26 12:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-06-08 17:49 . 2009-06-08 17:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-06-08 17:49 . 2009-06-08 17:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-06-08 17:49 . 2009-05-26 12:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-06-08 17:20 . 2009-06-08 17:20 -------- d-----w- c:\program files\Trend Micro 2009-06-08 17:15 . 2009-06-08 17:15 -------- d-----w- c:\documents and settings\All Users\Application Data\TEMP 2009-06-08 17:15 . 2009-06-08 17:15 -------- d-----w- c:\program files\SpywareBlaster 2009-06-07 12:15 . 2009-06-07 12:03 15688 ----a-w- c:\windows\system32\lsdelete.exe 2009-06-07 12:01 . 2009-06-07 12:01 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F} 2009-06-07 12:01 . 2009-03-12 08:17 2902048 -c--a-w- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}\Ad-AwareAE.exe 2009-06-07 12:01 . 2009-06-07 12:01 -------- d-----w- c:\program files\Lavasoft 2009-06-07 12:01 . 2009-06-07 12:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft 2009-06-07 08:21 . 2009-06-07 08:47 -------- d-----w- c:\documents and settings\The Doaney's\Application Data\Lavasoft 2009-05-25 08:26 . 2009-05-25 08:26 152576 ----a-w- c:\documents and settings\The Doaney's\Application Data\Sun\Java\jre1.6.0_13\lzma.dll 2009-05-12 17:32 . 2009-05-12 17:32 -------- d-----w- c:\program files\iPod 2009-05-12 17:32 . 2009-05-12 17:32 -------- d-----w- c:\program files\iTunes 2009-05-12 17:32 . 2009-05-12 17:32 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-05-12 17:30 . 2009-05-12 17:30 -------- d-----w- c:\program files\Bonjour 2009-05-12 17:28 . 2009-05-12 17:29 -------- d-----w- c:\program files\QuickTime 2009-05-12 17:24 . 2009-05-12 17:24 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-05-25 08:28 . 2008-09-07 18:42 -------- d-----w- c:\program files\Java 2009-05-23 19:46 . 2008-09-07 18:44 -------- d-----w- c:\documents and settings\The Doaney's\Application Data\Azureus 2009-05-12 17:32 . 2008-12-25 12:05 -------- d-----w- c:\program files\Common Files\Apple 2009-05-11 09:24 . 2008-08-17 19:41 11952 ----a-w- c:\windows\system32\avgrsstx.dll 2009-05-11 09:24 . 2008-08-17 19:41 325896 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2009-05-11 09:24 . 2008-08-17 19:41 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2009-05-11 09:24 . 2008-08-17 19:41 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2009-05-02 07:36 . 2008-09-13 18:23 7114736 ----a-w- c:\documents and settings\The Doaney's\Application Data\Azureus\plugins\azemp\azmplay.exe 2009-03-19 15:32 . 2009-03-19 15:32 23400 ----a-w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys 2009-03-19 15:32 . 2008-12-25 12:08 23400 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys 2009-03-18 18:59 . 2009-03-18 18:59 152576 ----a-w- c:\documents and settings\The Doaney's\Application Data\Sun\Java\jre1.6.0_10\lzma.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "\\POWER-PC\EPSON Stylus Photo RX560 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIBPE.EXE" [2006-05-23 139264] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AVG8_TRAY"="f:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-11 1947928] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888] "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-06-07 518488] "AlcxMonitor"="ALCXMNTR.EXE" - c:\windows\Alcxmntr.exe [2004-09-07 57344] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\The Doaney's\Start Menu\Programs\Startup\ Switch2.lnk - c:\documents and settings\The Doaney's\Application Data\Microsoft\Installer\{067B5E9A-A4BA-4BF2-AFF2-6D5414B2E88A}\NewShortcut1_067B5E9AA4BA4BF2AFF26D5414B2E88A.exe [2008-8-18 135168] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - f:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696] ColorVisionStartup.lnk - c:\program files\ColorVision\Utility\ColorVisionStartup.exe [2006-1-31 385024] Microsoft Office.lnk - f:\program files\Mircosoft Office\Office\OSA9.EXE [1999-2-17 65588] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-05-11 09:24 11952 ----a-w- c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "f:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "f:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "f:\\Program Files\\Azureus\\Azureus.exe"= "c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [07/06/2009 13:03 64160] R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [17/08/2008 20:41 325896] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [17/08/2008 20:41 108552] R2 avg8emc;AVG Free8 E-mail Scanner;f:\progra~1\AVG\AVG8\avgemc.exe [13/08/2008 22:42 908568] R2 avg8wd;AVG Free8 WatchDog;f:\progra~1\AVG\AVG8\avgwdsvc.exe [13/08/2008 22:42 298776] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [09/03/2009 20:06 1005904] S3 TNET1130;D-Link AirPlus XtremeG+ Wireless Adapter;c:\windows\system32\drivers\GPLUS.sys [08/02/2009 15:19 202496] . Contents of the 'Scheduled Tasks' folder 2009-06-07 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 12:03] 2009-05-11 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] . - - - - ORPHANS REMOVED - - - - SafeBoot-procexp90.Sys . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ uInternet Settings,ProxyOverride = *.local . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-06-10 18:47 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(2768) c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Windows Media Player\wmpnetwk.exe f:\program files\AVG\AVG8\avgrsx.exe f:\progra~1\AVG\AVG8\avgnsx.exe f:\program files\AVG\AVG8\avgcsrvx.exe c:\windows\system32\wscntfy.exe c:\program files\Belkin\Switch2\Switch2.exe c:\program files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2009-06-10 18:49 - machine was rebooted ComboFix-quarantined-files.txt 2009-06-10 17:49 Pre-Run: 7,819,816,960 bytes free Post-Run: 7,801,417,728 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=signature(ea1aa9c7)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons signature(ea1aa9c7)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect 157 --- E O F --- 2009-05-14 06:34

ok will do - right I know combofix needs to be run from the desktop - is there an option just to scan and log or is that the defualt behaviour prior to cut and pasting a notepad file onto it?? I'd do this, this evening when I can fire up the home PC again to run it - have Combofix on my pen-drive ready to rock and roll.

Can anybody please help and do a quick check of the logs - do I need any more steps like combofix etc..?? Thanks kindly

I posted in the general section and was instructed to use rootrepeal to rid myself of the rookit system file, which I did, and thus then managed to run MBAM to do it's stuff. I then removed 7 objects that where found. I thus need to find out if the PC is now clean and hence can someone look at the HJack report and MBAM report shown below; Thanks in advance! Malwarebytes' Anti-Malware 1.37 Database version: 2255 Windows 5.1.2600 Service Pack 3 09/06/2009 19:21:26 mbam-log-2009-06-09 (19-21-26).txt Scan type: Quick Scan Objects scanned: 75970 Time elapsed: 4 minute(s), 28 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 6 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Rootkit.Trace) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\WINDOWS\system32\UAClybpyqyrsrqsdrr.dll (Trojan.TDSS) -> Quarantined and deleted successfully. c:\WINDOWS\system32\UACtowylvrdopclteh.dll (Trojan.TDSS) -> Quarantined and deleted successfully. c:\WINDOWS\Temp\UAC7c3f.tmp (Trojan.TDSS) -> Quarantined and deleted successfully. c:\WINDOWS\Temp\UAC89bc.tmp (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> Quarantined and deleted successfully. c:\WINDOWS\system32\drivers\UACipfulksentsaypu.sys (Trojan.Agent) -> Quarantined and deleted successfully. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:32:40, on 09/06/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16827) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe F:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\svchost.exe F:\PROGRA~1\AVG\AVG8\avgrsx.exe F:\PROGRA~1\AVG\AVG8\avgemc.exe F:\PROGRA~1\AVG\AVG8\avgnsx.exe F:\Program Files\AVG\AVG8\avgcsrvx.exe C:\WINDOWS\Explorer.EXE F:\PROGRA~1\AVG\AVG8\avgtray.exe C:\WINDOWS\ALCXMNTR.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe F:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Belkin\Switch2\Switch2.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - F:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [AVG8_TRAY] F:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [\\POWER-PC\EPSON Stylus Photo RX560 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBPE.EXE /FU "C:\DOCUME~1\THEDOA~1\LOCALS~1\Temp\E_S3.tmp" /EF "HKCU" O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Switch2.lnk = ? O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: ColorVisionStartup.lnk = C:\Program Files\ColorVision\Utility\ColorVisionStartup.exe O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Mircosoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - F:\Program Files\AVG\AVG8\avgpp.dll O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - F:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - F:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

ok found the sys file and wiped it out. I then was able to run MBAM and it found 7 objects which I asked it to remove. I thus have a report from MBAM. I have also run a HJack report - I'll post these both tomorrow in the HJK section for an expert to review and hopefully declare my PC "clean". Thanks for the advice - so far so good.

Fatdcuk, I will indeed run the rootrepeal program from desktop, look for the sys file and remove as suggested - I think from the Ad aware logs it's definetly looking like they start with uca+"load of characters" type files so it fits the bill you describe. Then run mbam to do it's stuff. I will not feel confident it's clean though until I get logs onto the HJT section for an expert to review. cheers

Ok will do - I'll grab a hjack report while I'm on it this evening as well. If I get mbam running I'll ask for a report too. I'll cut and paste that onto a notepad txt file, pop onto pen drive and use my work laptop to send it in, if required. Thx

Folks, It seems my PC is infected with this bug (which has a variety of names). It will not allow me to run Malwarebytes but I think I may be able to get round that by changing the name of the exe file, as I suspect this bug is stopping me from running it as well as the likes of spybot etc.. The name itself is what Ad aware calls it, as it can detect but as it so happens not remove this pest. I have Trend Hjacker available to run, if required, to get some reports. All help to remove it would be appreciated as it would save me doing a clean install yet again. Environment is Windows XP SP2. Thanks