windows xp computer HElP please

You did not follow the instructions for obtaining a Bitdefender log and as a result you have attached a log summary which is of no use to us. Those directions are very explicit on how the log must be obtained. It clearly tells you that it will be an HTML file with a .txt extension. You post a pure text log summary. Don't worry about it right now. I don't want you to waste time running another scan if you do not have the full log saved.

First look in Add/Remove programs for anything related to MyWay or MyWaySearch etc and uninstall if found. Thanks to Dell you have this junk on your PC.

You have a bunch of other nasties too. Some will more than likely require some special procedure to remove but let's try an easy way out (if it works). Run the below scanners and attach the Ewido log

Running Ewido Anti-Malware

Afterwards also attach a new HJT log so we can see what remains.

 

Start by downloading a tool we will need:

- Pocket KillBox

Extract it to its own folder somewhere that you will be able to locate it later.

IMPORTANT: You should print or save the below locally, so you can refer to them while offline. You must exit all browsers before running the below steps and it would be best if you actually physically unplug your cable to the internet, reboot, and do not run anything but what I give you to do. Also it would be good to exit all processes and items in your System tray.

Do the above before continuing! Okay unplug your cable now.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [winsync] c:\windows\system32\kpkd4d.exe reg_run
O4 - HKLM\..\Run: [vpeqwzta] c:\windows\system32\rreukzby.exe
O4 - HKLM\..\Run: [testit.exe] c:\windows\system32\testit.exe
O4 - HKLM\..\Run: [seli] c:\windows\exe82.exe
O4 - HKLM\..\Run: [mediapluscash.exe] c:\windows\system32\mediapluscash.exe
O4 - HKLM\..\Run: [igsya] c:\windows\system32\blfjtc\igsya.exe
O4 - HKLM\..\Run: [gahwap] c:\windows\system32\lvblqai\gahwap.exe
O4 - HKLM\..\Run: [9020] c:\windows\exe82.exe

Now exit HijackThis after clicking Fix checked!

Now run Pocket Killbox:
Choose Tools > Delete Temp Files and click OK.

Run Killbox.exe. Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion…say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note some of the files listed below may not exist but we need to check for them anyway.
c:\windows\system32\kpkd4d.exe
c:\windows\system32\rreukzby.exe
c:\windows\system32\testit.exe
c:\windows\exe82.exe
c:\windows\system32\mediapluscash.exe
c:\windows\system32\blfjtc\igsya.exe
c:\windows\system32\lvblqai\gahwap.exe
c:\windows\exe82.exe

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

After reboot locate the below with Windows Explorer and delete them (hopefully many of these will already be gone. This is a double check with a few changes! )
c:\windows\system32\kpkd4d.exe
c:\windows\system32\rreukzby.exe
c:\windows\system32\testit.exe
c:\windows\exe82.exe
c:\windows\system32\mediapluscash.exe
c:\windows\system32\blfjtc <--- delete the whole folder
c:\windows\system32\lvblqai <--- delete the whole folder
c:\windows\exe82.exe

Now attach a new HJT log and tell me how the steps went.
Make sure you tell me how things are working now!

One of the issues may come back with a new name. The item I'm referring to is the below line from your HJT log:
O4 - HKLM\..\Run: [winsync] c:\windows\system32\kpkd4d.exe reg_run

This one almost always requires some additional special tools to remove.

 

We may need to run another tool if you are still seeing Smitfraud problems. Are you? If so post the Spybot log.

That cannot be true. We had HijackThis remove about 8 items of malware that were loading at startup.

Exactly which programs are you referring to?

One thing you may need to do was covered in step 3 of the READ & RUN ME. You appear to have AOL antivirus and McAfee running. You must use only one AV so you need to uninstall one of them. But since I do not use AOL I'm not sure exactly what the below really is:

O23 - Service: AOL Antivirus Update Service (aolavupd) - America Online - C:\Program Files\Common Files\AOL\1142898414\ee\services\sscFirewallPlugin\ver1_10_3_1\aolavupd.exe

Did they actually install an antivirus? What is AOL Antivirus Update Service? Sounds like it is for updating an AV but whose? Did they install one? Is it running? Is this actually the AV too? Or are they monitoring your McAfee AV? If the last question is answered yes, that's a waste of system resources.

 

Okay InetGet2 was on my list of things to remove and there may still be one more of them along with a few other things to do. Let's continue!

Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files"
Once you have saved it double click it and allow it to add into the registry.

Now boot into safe mode to delete the below (you can try normal mode first but use safe mode as a fall bak if files will not delete):
C:\PROGRAM FILES\COMMON FILES\system32.dll
C:\PROGRAM FILES\COMMON FILES\InetGet2 <-- the whole folder
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\vidctrl <-- the whole folder
C:\Temp\MG.exe
C:\WINDOWS\dmFsZXJpZQAA <-- the whole folder
C:\WINDOWS\dmVyc2llIGwA <-- the whole folder
C:\WINDOWS\ubber60.ini

Now reboot and tell how things are working. If everything is good, it is time to move onto the below (and have the owners read this info too):

How to Protect yourself from malware!

 

The link I gave you was broken. Here is the correct one:
How to Protect yourself from malware!

I don't see anything strange in the Ccleaner log. I'm not sure what you problem was with Spybot but if it is working now, don't worry about it. The best way to reinstall programs though is, uninstall, reboot, cleanup left over files and folders manually, reinstall.

 

Those are just cookies. They are not problems or malware (even though some scanners like to call them problems, they are not). If you surf, you will get cookies and you do not have to go to the particular site mentioned. The cookies can come from other sites. For example. You will even get TribalFusion here on MGs! It is not a problem.