Infected and at a loss

Not Sure what spyware has hold of my PC

I need a little help identifying and removing what has gotten hold of my PC.
I keep getting a flashing toolbar warning. When I click on it it takes me
to IE browser sit ISECURITYPAGE.COM. I have tried using ad-aware. It does
Identify win32.trojandownloader.zlob but can't seem to remove it. Could I possibly get some help identifying and removing infection?

 

This is my 2nd thread for today after trying to do recommened things first.
I am still getting toolbar warning, saying I am infected. When I click this icon
I am directed randomly to different software packages claiming they can scan
and repair for a nominal cost. The other problem is, if I am using the IE browser I will randomly be brought to porno sites. Could someone maybe
take a look at my attachment and direct me to a possible solution.


thanks

 

It took me quite a long time to get all the appropriate logs for your review.
I am still getting tool tray icon a yellow trangle with title 'System alert: Trojan-Spy.Win32Amx'
Here are the log attachments;

 

heres the last two logs,
I hope this information will lead to a resolution.

Thank you for you help

 

Please follow the removal procedure here: SpywareQuake & SpyFalcon Removal Procedure

Once you have completed this to remove the mediacodec infection please post new logs so we can see if anything else is lurking in there.

 

I have run all the scripts for removing SpywareQuake & SpyFalcon removal.
there were no files found that had the specified dll extensions.Also no files
found with the other files that I was to look for.
After I rebooted in normal mode and was looking for files to delete in my c drive my PC-cillin program
flagged this file and instructed me to delete it ,if it was not needed. I tried but access was denied!

c:\program files\mediacodec\pmmon.exe
Troj Zlob.ayg

Basically nothing has been fixed and I am still getting system alert message on toolbar tray and still being directed to websites for software to fix my
suspected spyware. Maybe you could look at my logs to see if they show up
anything related to pmmon.exe and trojan infection Zlob?

 

Zlob IS smitfraud. you have a medic codec infection which I have already seen in your logs. This is why I asked you to run that procedure.

If you look again at the procedure you will see C:\Program Files\Media-Codec listed as on of the folders to remove. whilst there is a minor difference in the listed one has a hyphen and yours doesn't they are in fact the same thing.

Download

- Pocket KillBox

Extract it to its own folder somewhere that you will be able to locate later.

IMPORTANT: You should print or save the below locally, so you can refer to them while offline. You must exit all browsers before running the below steps and it would be best if you actually physically unplug your cable to the internet, reboot, and do not run anything but what I give you to do. Also it would be good to exit all processes and items in your System tray.

Do the above before continuing! Okay unplug your cable now.

Make sure you have rebooted in Normal Mode (do not open any other processes)


Run HijackThis. Click the 'Do a system scan only' button.


Once the scan has completed click Config

Click Misc Tools

Click Open Process Manager

Terminate the following processes by selecting them from the list and clicking Kill Process
If you do not see a process just move on to the next one.

Exit HijackThis

Now run Pocket Killbox:

Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot.

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

Now boot into SAFE MODE

Open Windows Explorer navigate to and DELETE the following: (Some of these may have already been deleted by Pocket Killbox)

If you have Windows XP delete the contents of C:\WINDOWS\Prefetch.

REBOOT to Normal Mode.


Let me know how things are running now

Post a fresh HijackThis log, a fresh newfiles log and a fresh activescan log.[/QUOTE]

 

Thank Matt for all of your help, your last instruction set did the trick. My machine is back to its old self. The killbox really did the trick, removing the offending programs on reboot. If there is anything I can do to document my problem so other can benifit please just ask.

Truly greatful