Logs and results

Welcome to Majorgeeks!


Are you running this Remote admistrator server yourself?
D:\WINDOWS\system32\r_server.exe

Did you add the below connection wizard for something? If not, add this to the things to fix below.
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://10.0.0.138/

Did you setup all the below security policies and what is the purpose of doing all this?

You need to go thru all of the items pointed out by Panda and delete all this bad stuff and be wary of downloading cracks! If you leave this to me to fix, my answer will be to delete just about everything shown except cmdow.exe & pskill.exe.

You also need to cleanup all the unnecessary junk from your Desktop. This makes it to easy for malware to hide and also Desktop clutter can cause slow downs. Store your ZIPs, JPGs,...etc in a safe long term storage location which your Desktop is not.

We HIGHLY recommend uninstalling Messenger Plus! Live It is the cause of tens of thousands of infected PCs on the internet. You should not trust this application!!!!!

Why are all of your Windows system files showing up with a date of October 1, 2006?

There are a lot of programs showing up in your Program Files folder that were recent installs. Are you sure they are all clean? Where did you get them all from? If P2P, then they are questionable.

You have multiple antivirus progams installed. Avast and Windows One Care! You must only use one as mentioned in step 3 of the READ ME. Uninstall one now.



Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O1 - Hosts: 66.98.148.65 auto.search.msn.com
O1 - Hosts: 66.98.148.65 auto.search.msn.es
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background

After clicking Fix, exit HJT.


Also download HOSTER and then follow the below steps.

• Unzip Hoster to a convenient folder such as C:\Hoster
• Run Hoster.exe, click Restore Original Hosts and then click OK.
• Click the X to exit the program

Now reboot in normal mode


Now attach the below new logs and tell me how the above steps went.

1. GetRunKey
2. ShowNew
3. HJT

Make sure you tell me how things are working now!

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.