<div>
You have a couple of options here: 
 
1) If you already have an anti-virus on your computer you can simply initiate a full system scan and (in most cases) it will find and quarantine / delete the virus. 
 
2) If you do not want to purchase an antivirus program you can download and install the AVG Free Edition (<a href="http://free.avg.com/" rel="ugc">http://free.avg.com/</a>) and then perform a full system scan and it should pick up and quarantine / delete the virus. 
 
3) If you would like to purchase an antivirus program you can visit (and this is just my personal preference) <a href="http://www.kaspersky.com/" rel="ugc">http://www.kaspersky.com/</a>&nbsp;and purchase / download their antivirus application, install it, then perform a full system scan. 
 
Good Luck.
</div>

<div>
Scanning the system with an antivirus scanner usually will remove common viruses. Sometimes antivirus scanners can't remove some viruses especially malware. 
 
It would help if we could look at a hijackthis log, it might show in the scan or if it comes with malware it should show in the hijackthis log. 
Download Hijackthis: 
<a href="http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download" rel="ugc">http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download</a> 
 
Open Hijackthis, click &quot;Do a system scan and save a logfile&quot; please don't fix anything yet. 
Please attach the logfile as &quot;Code Snippet&quot;.
</div>

<div>
Hello dfxdeimos, Im unable to run avg, I have installation problems below: 
 
Local machine: installation failed 
&nbsp; &nbsp; Installation: 
&nbsp; &nbsp; &nbsp; &nbsp; Error: Action failed for file avgemc.exe: starting service.... 
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Error 0x8007041d 
&nbsp; &nbsp; &nbsp; &nbsp; Warning: Preparation to unload of the service avg8wd failed. 
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Specified file was not found. 
&nbsp; &nbsp; Rollback: 
&nbsp; &nbsp; &nbsp; &nbsp; Error: Action failed for file avgwd.log: restoring from backup.... 
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Error 0x80070005 %DESTINATION% = &quot;C:\Documents and Settings\All Users\Datos de programa\avg8\Log\avgwd.log&quot;, %SOURCE% = &quot;C:\Documents and Settings\All Users\Datos de programa\avg8\Log\avgwd.log.install_backup&quot; 
&nbsp; &nbsp; &nbsp; &nbsp; Warning: Action failed for file avgmfx86.sys: stopping service.... 
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Service AvgMfx86 failed to progress during stopping at checpoint 0 (wait hint 10000 ms) in 91000 ms. 
 
Any suggestions, Thankyou 
 
 

</div>

<div>
Hello rpggamergirl, I downloaded the hijackthis but it wont &nbsp;run the file. Im unable to perform a scan. I double click on the Icon and it wont do anything. 
 
Thanks
</div>

<div>
Did you try renaming it?.....if it still won't run try changing the exe extension to .com
</div>

<div>
Hello rpggamergirl, I had to rename hijackthis and also the log to be able to save it, here is the log 

<pre><code class="code-10 nolinks" id="code-123142">Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:44:18 PM, on 7/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
 
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\Archivos de programa\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\MSTMON_Q.EXE
C:\Archivos de programa\Java\jre1.5.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Archivos comunes\DataViz\DvzIncMsgr.exe
C:\Archivos de programa\Palm\Hotsync.exe
C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBCFMonitorService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrador\Escritorio\hhhhh.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\ARCHIV~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Archivos de programa\Archivos comunes\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] &quot;C:\Archivos de programa\CyberLink\PowerDVD\PDVDServ.exe&quot;
O4 - HKLM\..\Run: [KONICA MINOLTA PagePro 1350WStatusDisplay] C:\WINDOWS\system32\MSTMON_Q.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Archivos de programa\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [braviax] braviax.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe (User 'Default user')
O4 - Startup: Palm Registration.lnk = C:\Archivos de programa\Palm\register.exe
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Archivos de programa\Archivos comunes\DataViz\DvzIncMsgr.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Archivos de programa\Palm\Hotsync.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&amp;xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KX-HCM10 Control) - http://suplyaire.viewnetcam.com:5003/kxhcm10.ocx
O16 - DPF: {33704B0F-9EB7-434B-B752-EA6CFFB87423} (pmjpegaudio Class) - http://sacam2.viewnetcam.com:5002/JpegInst.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1208534760440
O16 - DPF: {87BE3784-6977-4E84-AA08-55A96B9CEAC5} (Bl_camera Control) - http://sacam.viewnetcam.com:50001/bl_camera.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Archivos de programa\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Archivos de programa\AVG\AVG8\avgpp.dll (file missing)
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O20 - AppInit_DLLs: cru629.dat
O20 - Winlogon Notify: crypt - C:\WINDOWS\SYSTEM32\crypts.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
 
--
End of file - 5856 bytes
</code></pre>
</div>

<div>
Well done! 
 
No wonder you can't run any program braviax is there! 
 
SDFix should be able to take care of it.. IF you can run it. 
Do you have other pc there where you can download and extract SDFix before transfering it to the infected pc? 
You need to rename SDFix before you saved it to your pc, or download and extract it using another pc. Let us know how you go. Once SDFix has been extracted braviax won't stop it from running. 
Download SDFix and save it to your desktop.(either one below) 
<a href="http://downloads.andymanchesta.com/RemovalTools/SDFix.zip" rel="ugc">http://downloads.andymanchesta.com/RemovalTools/SDFix.zip</a> 
<a href="http://downloads.andymanchesta.com/RemovalTools/SDFix.exe" rel="ugc">http://downloads.andymanchesta.com/RemovalTools/SDFix.exe</a> 
 
If needed: How to use SDFix. 
<a href="http://www.bleepingcomputer.com/forums/topic131299.html" rel="ugc">http://www.bleepingcomputer.com/forums/topic131299.html</a> 
 
Double click SDFix and it will extract the files to %systemdrive% 
(Drive that contains the Windows Directory, typically C:\SDFix) 
 
Please then reboot your computer in Safe Mode by doing the following : 
 
* Restart your computer 
* After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; 
* Instead of Windows loading as normal, a menu with options should appear; 
* Select the first option, to run Windows in Safe Mode, then press &quot;Enter&quot;. 
* Choose your usual account. 
 
* Open the extracted folder and double click &quot;RunThis.bat&quot; to start the script. 
* Type &quot;Y&quot; to begin the script. 
* It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot. 
* Press any Key and it will restart the PC. 
* Your system will take longer that normal to restart as the fixtool will be running and removing files. 
* When the desktop loads the Fixtool will complete the removal and display &quot;Finished&quot;, then press any key to end the script and load your desktop icons. 
* Finally open the SDFix folder on your desktop and attach the &quot;Report.txt&quot; back 

</div>

<div>
Combofix will also remove it, but you need to rename combofix before saving it to your desktop, renaming it after it has been downloaded will not work, it has to be renamed before saving the file. 
 
Please download ComboFix by sUBs: 
<a href="http://download.bleepingcomputer.com/sUBs/ComboFix.exe" rel="ugc">http://download.bleepingcomputer.com/sUBs/ComboFix.exe</a> 
 
You must download it to and run it from your Desktop 
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix. 
Double click combofix.exe &amp;&nbsp;follow the prompts. 
When finished, it will produce a log. Please save that log and attach it in your next reply along with a fresh HJT log 
Re-enable all the programs that were disabled during the running of ComboFix.. 
 
 
Note: 
Do not mouse-click combofix's window while it is running. That may cause it to stall. 
 
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
</div>

<div>
Did you try running SDFix as well? 
 
Can you please check if it runs? in Safe Mode. 
Braviax patches beep.sys, and I think SDFix also includes a clean copy of beep.sys 
 
 
I'll post the script later.
</div>

<div>
rpggamergirl, here is the log for sdfix. 

<pre><code class="code-100 nolinks" id="code-123165">[b]SDFix: Version 1.207 [/b]
Run by Administrador on Mon 07/21/2008 at 10:01 PM
 
Microsoft Windows XP [Versi¢n 5.1.2600]
Running From: C:\SDFix
 
[b]Checking Services [/b]:
 
[b]Name [/b]: 
BBE41
 
[b]Path [/b]:
System32\Drivers\Bbe41.sys 
 
BBE41 - Deleted
 
 
 
Restoring Default Security Values
Restoring Default Hosts File
 
Rebooting
 
Service BBE41 - Deleted
 
[b]Checking Files [/b]: 
 
Trojan Files Found:
 
C:\WINDOWS\system32\ntos.exe - Deleted
C:\WINDOWS\system32\drivers\BBE41.sys - Deleted
C:\WINDOWS\system32\wsnpoem\video.dll - Deleted
C:\WINDOWS\system32\wsnpoem\audio.dll - Deleted
 
 
 
Folder C:\WINDOWS\system32\wsnpoem - Removed
 
 
Removing Temp Files
 
[b]ADS Check [/b]:
 
 
 
 [b]Final Check [/b]:
 
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-21 22:07:04
Windows 5.1.2600 Service Pack 2 NTFS
 
scanning hidden processes ...
 
scanning hidden services &amp; system hive ...
 
scanning hidden registry entries ...
 
scanning hidden files ...
 
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
 
 
[b]Remaining Services [/b]:
 
 
 
 
Authorized Application Key Export:
 
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
&quot;%windir%\\system32\\sessmgr.exe&quot;=&quot;%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019&quot;
&quot;%windir%\\Network Diagnostic\\xpnetdiag.exe&quot;=&quot;%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000&quot;
&quot;C:\\Archivos de programa\\MSN Messenger\\msnmsgr.exe&quot;=&quot;C:\\Archivos de programa\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1&quot;
&quot;C:\\Archivos de programa\\MSN Messenger\\livecall.exe&quot;=&quot;C:\\Archivos de programa\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)&quot;
&quot;C:\\Archivos de programa\\Intuit\\QuickBooks 2008\\QBDBMgrN.exe&quot;=&quot;C:\\Archivos de programa\\Intuit\\QuickBooks 2008\\QBDBMgrN.exe:*:Enabled:QuickBooks 2008 Data Manager&quot;
&quot;C:\\Archivos de programa\\AVG\\AVG8\\avgemc.exe&quot;=&quot;C:\\Archivos de programa\\AVG\\AVG8\\avgemc.exe:*:Enabled:avgemc.exe&quot;
&quot;C:\\Archivos de programa\\AVG\\AVG8\\avgupd.exe&quot;=&quot;C:\\Archivos de programa\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe&quot;
 
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
&quot;%windir%\\system32\\sessmgr.exe&quot;=&quot;%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019&quot;
&quot;%windir%\\Network Diagnostic\\xpnetdiag.exe&quot;=&quot;%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000&quot;
&quot;C:\\Archivos de programa\\MSN Messenger\\msnmsgr.exe&quot;=&quot;C:\\Archivos de programa\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1&quot;
&quot;C:\\Archivos de programa\\MSN Messenger\\livecall.exe&quot;=&quot;C:\\Archivos de programa\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)&quot;
 
[b]Remaining Files [/b]:
 
 
File Backups: - C:\SDFix\backups\backups.zip
 
[b]Files with Hidden Attributes [/b]:
 
Mon 7 Jan 2008 352 A..H. --- &quot;C:\WINDOWS\nod32fixtemdono.reg&quot;
Wed 13 Oct 2004 1,694,208 A.SH. --- &quot;C:\Archivos de programa\Messenger\msmsgs.exe&quot;
Wed 15 Aug 2007 782,336 A.SH. --- &quot;C:\Documents and Settings\Administrador\Mis documentos\FOTOS CITATION\SIVF.tmp&quot;
Fri 18 Apr 2008 0 A.SH. --- &quot;C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp&quot;
Thu 7 Dec 2006 3,096,576 A..H. --- &quot;C:\Documents and Settings\Administrador\Datos de programa\U3\temp\Launchpad Removal.exe&quot;
Wed 11 Aug 2004 444,416 A..H. --- &quot;C:\Documents and Settings\Administrador\Mis documentos\respaldo\BK_Pen24Feb\Copia de VALUACION UC\Copia de VALUACION 5\~WRL1204.tmp&quot;
Sun 26 Jun 2005 1,407,488 A..H. --- &quot;C:\Documents and Settings\Administrador\Mis documentos\respaldo\BK_Pen24Feb\VALUACION 10114E\Copia (2) de VALUACION 02\~WRL1175.tmp&quot;
Sun 26 Jun 2005 1,483,776 A..H. --- &quot;C:\Documents and Settings\Administrador\Mis documentos\respaldo\BK_Pen24Feb\VALUACION 10114E\Copia (2) de VALUACION 02\~WRL2120.tmp&quot;
Sun 26 Jun 2005 1,401,856 A..H. --- &quot;C:\Documents and Settings\Administrador\Mis documentos\respaldo\BK_Pen24Feb\VALUACION 10114E\Copia (2) de VALUACION 02\~WRL3926.tmp&quot;
Sun 26 Jun 2005 1,407,488 A..H. --- &quot;C:\Documents and Settings\Administrador\Mis documentos\respaldo\BK_Pen24Feb\VALUACION 10114E\VALUACION 02\~WRL1175.tmp&quot;
Sun 26 Jun 2005 1,483,776 A..H. --- &quot;C:\Documents and Settings\Administrador\Mis documentos\respaldo\BK_Pen24Feb\VALUACION 10114E\VALUACION 02\~WRL2120.tmp&quot;
Sun 26 Jun 2005 1,401,856 A..H. --- &quot;C:\Documents and Settings\Administrador\Mis documentos\respaldo\BK_Pen24Feb\VALUACION 10114E\VALUACION 02\~WRL3926.tmp&quot;
 
[b]Finished![/b]
</code></pre>
</div>

<div>
That's great! &nbsp;looks like maybe just one more left. 
 
1. Open Notepad. 
2. Now copy/paste the text between the lines below into the Notepad window: 
------------------------------------------------------------------------ 
Rootkit:: 
C:\WINDOWS\system32\drivers\tcpsr.sys 
------------------------------------------------------------------------ 
 
3. Save the above as CFScript.txt on your desktop. 
4. Then drag the CFScript.txt into ComboFix.exe. This will start ComboFix again. 
 
NOTE: You need to change ALL passwords that has been used in that pc, these nasties are password and info stealers.
</div>

<div>
Good job, thanks for the log. 
Can you attach a fresh hijackthis log too please? 
 
I also need you to do an online scan with Kaspersky to check if it finds any bad files, just to confirm that the pc is clean. Save the report please. 
 
Using Internet Explorer, run Kaspersky Online Scanner 
<a href="http://www.kaspersky.com/virusscanner" rel="ugc">http://www.kaspersky.com/virusscanner</a> 
&nbsp; &nbsp; 
* Click 'Accept' in the window that pops up. 
* You will be prompted to install an ActiveX component from Kaspersky, Click on the information bar and select Install ActiveX Control if so. This may happen more than once. That is OK. You also may get a warning from your Windows Firewall. You can tell it to unblock. 
* The program will launch and then start to download the latest definition files. 
* Once the scanner is installed and the definitions downloaded, click 'Next'. 
* Now click on 'Scan Settings' 
* In the scan settings make sure that the following are selected: 
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; o Scan using the following Anti-Virus database: 'Extended' (If available, otherwise 'Standard') 
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; o Scan Options: 'Scan Archives' and 'Scan Mail Bases' 
* Click 'OK' 
* Now under 'Select a target to scan' select 'My Computer' 
* The scan will take a while, so be patient and let it run. Once the scan is complete, it will display whether your system has been infected. 
* Now click on the 'Save Report As...' button: 
* Make sure it says Save as a text file - change it if not 
* Save the file to your desktop. 
 

</div>

<div>
Hello rpggamergirl, online scan with Kaspersky 

<pre><code class="code-10 nolinks" id="code-123824">--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
 Tuesday, July 22, 2008
 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
 Kaspersky Online Scanner 7 version: 7.0.25.0
 Program database last update: Tuesday, July 22, 2008 09:38:14
 Records in database: 984243
--------------------------------------------------------------------------------
 
Scan settings:
	Scan using the following database: extended
	Scan archives: yes
	Scan mail databases: yes
 
Scan area - My Computer:
	C:\
	D:\
	E:\
 
Scan statistics:
	Files scanned: 38563
	Threat name: 1
	Infected objects: 1
	Suspicious objects: 0
	Duration of the scan: 00:30:37
 
 
File name / Threat name / Threats count
C:\Documents and Settings\Administrador\Configuración local\Datos de programa\Identities\{85A0C99D-C38D-4E30-B85F-F50554C088C3}\Microsoft\Outlook Express\Bandeja de salida.dbx	Infected: Trojan-Spy.Win32.KeySpy.x	1
 
The selected area was scanned.
</code></pre>
</div>

<div>
Nice walkthrough rpggamergirl, you deserve extra brownie points! =]
</div>

<div>
and here is the fresh hijackthis 

<pre><code class="code-10 nolinks" id="code-123843">Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:05:04 PM, on 7/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
 
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\ARCHIV~1\AVG\AVG8\avgwdsvc.exe
C:\Archivos de programa\DynDNS Updater\DynUpSvc.exe
C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBCFMonitorService.exe
C:\ARCHIV~1\AVG\AVG8\avgrsx.exe
C:\ARCHIV~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\Archivos de programa\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\MSTMON_Q.EXE
C:\Archivos de programa\Java\jre1.5.0_03\bin\jusched.exe
C:\ARCHIV~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Archivos comunes\DataViz\DvzIncMsgr.exe
C:\Archivos de programa\DynDNS Updater\DynTray.exe
C:\Archivos de programa\Palm\Hotsync.exe
C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\ARCHIV~1\AVG\AVG8\aAvgApi.exe
C:\Archivos de programa\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Administrador\Escritorio\HiJackThis.exe
 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Archivos de programa\AVG\AVG8\avgssie.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\ARCHIV~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\ARCHIV~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Archivos de programa\Archivos comunes\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] &quot;C:\Archivos de programa\CyberLink\PowerDVD\PDVDServ.exe&quot;
O4 - HKLM\..\Run: [KONICA MINOLTA PagePro 1350WStatusDisplay] C:\WINDOWS\system32\MSTMON_Q.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Archivos de programa\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARCHIV~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Palm Registration.lnk = C:\Archivos de programa\Palm\register.exe
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Archivos de programa\Archivos comunes\DataViz\DvzIncMsgr.exe
O4 - Global Startup: DynDNS Updater Tray Icon.lnk = C:\Archivos de programa\DynDNS Updater\DynTray.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Archivos de programa\Palm\Hotsync.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&amp;xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KX-HCM10 Control) - http://suplyaire.viewnetcam.com:5003/kxhcm10.ocx
O16 - DPF: {33704B0F-9EB7-434B-B752-EA6CFFB87423} (pmjpegaudio Class) - http://sacam2.viewnetcam.com:5002/JpegInst.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1208534760440
O16 - DPF: {87BE3784-6977-4E84-AA08-55A96B9CEAC5} (Bl_camera Control) - http://sacam.viewnetcam.com:50001/bl_camera.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Archivos de programa\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Archivos de programa\AVG\AVG8\avgpp.dll
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\ARCHIV~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARCHIV~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: DynDNS Updater - Dynamic Network Services, Inc. - C:\Archivos de programa\DynDNS Updater\DynUpSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
 
--
End of file - 6572 bytes
</code></pre>
</div>

<div>
rpggamergirl, Im very pleased with your dedication and outstanding profesionalism throughout the succesful solution of my virus problem. 
 
Congratulations and Im very thankful! 
 
suply 
 

</div>

<div>
suply, 
 
You're welcome, it's a pleasure working with you. 
Thank you for the nice feedback, I very much appreciate it. 
 
Now that you're done with combofix, please uninstall it. 
Go to Start &gt;&nbsp;Run and 'copy and paste' next command in the field: 
 
ComboFix /u 
 
The procedure will delete ComboFix and its associated files and folders. 
It will also reset System Restore. 
 
 
Thank you for using Experts-Exchange! 

</div>

<div>
<div class="content wysiwyg-content">
I recently received in my hotmail inbox an email I thought it was from &nbsp;UPS but then realized it was a Virus once It was too late I had already opened the file. 
 
UPS Tracking Number 4606078241 
From: United Parcel Service (favjulfo@bow-group.com) 
Sent: Sun 7/20/08 7:44 PM 
To: &nbsp; 
 
Security scan upon download &nbsp; 
&nbsp;ups_invoi...zip (48.4 KB) 
Unfortunately we were not able to deliver postal package you sent on July the 1st in timebecause the recipients address is not correct.Please print out the invoice copy attached and collect the package at our office Your UPS 
 
I would like to know what type of theat could I have in my computer and what is the most convinient way to remove the virus from its unknown alocation inside the unit. 
 
Im unable to upload the file due to the extension its a .exe 
 
 

</div>
</div>

I recently received in my hotmail inbox an email I thought it was from  UPS but then realized it was a Virus once It was too late I had already opened the file.

UPS Tracking Number 4606078241 
From: United Parcel Service (favjulfo@bow-group.com) 
Sent: Sun 7/20/08 7:44 PM 
To:  

Security scan upon download   
 ups_invoi...zip (48.4 KB) 
Unfortunately we were not able to deliver postal package you sent on July the 1st in timebecause the recipients address is not correct.Please print out the invoice copy attached and collect the package at our office Your UPS

I would like to know what type of theat could I have in my computer and what is the most convinient way to remove the virus from its unknown alocation inside the unit.

Im unable to upload the file due to the extension its a .exe




How do I scan and remove a virus from my computer, opened zip file by mistake

Anti-virus software was originally developed to detect and remove computer viruses. However, with the proliferation of other kinds of malware, antivirus software started to provide protection from other computer threats. In particular, modern antivirus software can protect from malicious browser helper objects (BHOs), browser hijackers, ransomware, keyloggers, backdoors, rootkits, trojan horses, worms, malicious layered service providers (LSPs), dialers, fraud tools, adware and spyware. Some products also include protection from other computer threats, such as infected and malicious URLs, spam, scam and phishing attacks, online identity theft (privacy), online banking attacks, social engineering techniques, Advanced Persistent Threat (APT), botnets and DDoS attacks.