Wierd and I can't fix

I just formated to get away from all my problems, but within 5 minutes of starting up xp pro and I had problems.

I have AVG, zone alarm, spyware search and destroy, a program from moosoft, nothing is detecting this.

For some reason, everything on my computer is being reset, my favorites, my program configurations, my screen saver wont stay off, my icons are randomly switching to other icons.

I don't know what's doing this. . .I have tried using an advert stinger aswell but no luck.

What should I do?

 

What operating system do you use, what are the specs of your machine: Processor size, RAM, Hard Drive, power supply, etc.

 

I said I used win Xp Pro

256 ram, 1.7

 

bump

 

Let's take one thing at a time

What do you mean, nothing is detecting this? And what is a program from Moosoft?

When you say "being reset" what do you mean?

Do you mean you are using a pop up blocker? What's it called?

Be very specific about what heppens when you turn on your computer, or open a program. Write down any error messages and post them here. We will need more information to be able to help you. Hopefully we'll be able to get to the bottom of it.

 

Ok I am using "The cleaner" from Moosoft, an anti trojan and adware program.

AVG is not decting any suspicious programs at all (no viruses)

By reset I mean, all my favorites in fire fox and IE are deleted, my configurations for Valve Hammer Editor are blank every time I go in after just resetting them, My icons, for istance a .jpg is showing as my Counter-Strike Icon.

My internet often craps out, I noticed when I close the program from task manager called "winupdt.exe" or something very much like that, everything goes back to normal.

I am using SP 2

all my diffenitions are updated for my programs...

By advert stinger, I mean that program which is just a basic scanning program.

I hope this is enough info, thanks for being patient.

 

Just did a quick search on the file you mentioned:

winupdt.exe W32/Rbot-FP is a worm that also has backdoor Trojan functionality, allowing unauthorised remote access to the infected computer via IRC channels.
Spreads to network shares with weak passwords and via network security exploits as a result of the backdoor Trojan element receiving the appropriate commands from a remote user.

Also set the registry entries below:
HKLM\SOFTWARE\Microsoft\Ole\EnableDCOM="N"
HKLM\SYSTEM\ControlSet001\Control\Lsa\restrictanonymous=dword:00000001
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\restrictanonymous=dword:00000001

It will try to delete network shares on the infected system and will terminate running processes related to anti-virus, computer security and system administration that could potentially be used to remove W32/Rbot-FP from the infected system.

Remove it by using RegRun Startup Optimizer.

Looks like you have a bugga. Try using a firewall and see if this thing is trying to connect out... that should be your definite proof that this thing's got to go....

 

Sigh. . I thought I could trust it because of it's name.

I will use what you suggested and tell you if it worked.

Is there anything out there that can detect it and actually get rid of it? I'd rather do that than just disable it.

 

Not likely! But now you see why malware is so hard to fight.

If you want to remove it completely, follow the instructions in this link READ ME FIRST: Basic Spyware, Trojan And Virus Removal completely!

If your problem persists, post again in the Spyware Specific forum.

Best luck!
PP

 

Sounds like you are being attack by sasser and msblaster:

http://snakefoot.fateback.com/tweak/winnt/service/rpc_exploit.html
http://snakefoot.fateback.com/tweak/winnt/service/lsa_exploit.html

Note instead of applying individual updates, then apply SP2.