Please help me!

Hi, newbie here.

I've read the excellent http://forums.majorgeeks.com/showthread.php?t=35407 and followed it to the letter.

* Spybot found nothing
* MS Windows Defender found nothing
* Panda ActiveScan apparently found 4 Dialers and 9 Spyware, which it couldn't remove. Sadly, I couldn't save a log or get any more info as my net cut off (using a wireless network - I could ping URLs, but IE wouldn't connect to them until I'd restarted)


AVG is still popping with "Trojan horse Dialer.CCA" about every minute (from C:\Windows\Temp\win3A.tmp.exe" and web browsing generally seems more sluggish (I browse messageboards, and open each topic in a new window - I really notice it then). AVG can 'heal' the files, although it's presumably just a copy it's healing rather than finding the root of the problem.


Any help in getting things 'back the way they were' would be very much appreciated.

 

The rest of the files...

 

Redone the Panda scan...

 

HijackThis is improperly installed. Move HijackThis to C:\Program Files\HJT. After you have moved HijackThis; rename hijackthis.exe to analyse.exe.

Download
- Pocket Killbox
- ExplorerXP

Using Add or Remove Programs in the Control Panel; uninstall the following:

<< The installed version of Java on this compter is out-dated. Install Java Runtime Environment (JRE) 5.0 Update 8 available from http://java.sun.com/javase/downloads/index.jsp. Uninstall all older versions of Java on your computer, before installing the latest version of Java. >>

Copy the contents of the below quote box to Notepad; Save As FixReg.reg to your Desktop. DO NOT run it as this time we will do that later in Safe Mode.

Close Notepad.

In HJT Choose Open the Misc Tools Section choose Process Manager, Highlight:

Choose Kill Process. Click on the "Back" Button

Click the 'Scan' button. Place a checkmark in the box next to the following lines:

Click on the 'Fix checked' button. Wait for HijackThis to finish; close HijackThis.

Now run Pocket Killbox:

Choose Tools -> Delete Temp Files and click Delete Selected Temp Files

Then after it deletes the files click the Exit (Save Settings) button.

NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue..

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

Now boot into SAFE MODE

Locate FixReg.reg on your Desktop. Double-click on it and answer 'Yes' when asked if you want to merge with the registry.

Open ExplorerXP navigate to and DELETE the following: (Some of these may have already been deleted by Pocket Killbox)

Now run CCleaner. If you have Windows XP delete the contents of C:\WINDOWS\Prefetch.

Then, as an added precaution, Go to Start -> Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

REBOOT to Normal Mode.

Post a fresh Hijackthis log.