This Looks like what you have it is a network worm so that is how it spreads through the network the only difference is the letter this one is (BVK) and yours is (BKV) I'm sure they do the same thing, you can see all the registry changes it makes, and it appears to disable some software and then tries to connect to a server. W32/Sdbot-BVK is a worm and IRC backdoor Trojan for the Windows platform. W32/Sdbot-BVK can spread via network shares protected by weak passwords, or by exploiting common vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), PNP (MS05-039), and ASN.1 (MS04-007). W32/Sdbot-BVK runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels. W32/Sdbot-BVK includes functionality to access the internet and communicate with a remote server via HTTP. When first run W32/Sdbot-BVK copies itself to \netbtd.exe. The file netbtd.exe is registered as a new system driver service named "NetBTD", with a display name of "NetBTD(ntbtd)" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under: HKLM\SYSTEM\CurrentControlSet\Services\NetBTD\ W32/Sdbot-BVK sets the following registry entries, disabling the automatic startup of other software: HKLM\SYSTEM\CurrentControlSet\Services\Messenger Start 4 HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry Start 4 HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr Start 4 Registry entries are set as follows: HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotAllowXPSP2 1 HKLM\SOFTWARE\Microsoft\Ole EnableDCOM N HKLM\SYSTEM\CurrentControlSet\Control\Lsa restrictanonymous 1 Registry entries are created under: HKLM\SOFTWARE\Microsoft\Security Center\ HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\ HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\ RSS:Atom Get reports on the latest virus threats delivered to your computer

DDS.txt . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 9.0.8112.16421 Run by DK at 18:12:58 on 2012-06-12 Microsoft� Windows Vista� Home Premium 6.0.6002.2.1252.1.1033.18.3062.1241 [GMT -4:00] . AV: Microsoft Security Essentials *Enabled/Updated* (9765EA51-0D3C-7DFB-6091-10E4E1F341F6) SP: Windows Defender *Disabled/Updated* (D68DDC3A-831F-4fae-9E44-DA132C1ACF46) SP: Microsoft Security Essentials *Enabled/Updated* (2C040BB5-2B06-7275-5A21-2B969A740B4B) . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss c:\Program Files\Microsoft Security Client\MsMpEng.exe C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\SUPERAntiSpyware\SASCORE.EXE C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe C:\Program Files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe C:\Program Files\Common Files\Intuit\DataProtect\QBIDPService.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Windows\System32\hkcmd.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\taskeng.exe C:\Windows\system32\taskeng.exe C:\Users\DK\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\DK\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\DK\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\rundll32.exe C:\Users\DK\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\DK\AppData\Local\Google\Chrome\Application\chrome.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\Windows\system32\WUDFHost.exe C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE C:\Windows\system32\svchost.exe -k SDRSVC C:\Users\DK\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uInternet Settings,ProxyOverride = *.local BHO: Adobe PDF Link Helper: (18df081c-e8ad-4283-a596-fa578c2ebdc3) - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: (53707962-6f74-2d53-2644-206d7942484f) - c:\program files\spybot - search & destroy\SDHelper.dll BHO: Groove GFS Browser Helper: (72853161-30c5-4d22-b7f9-0bbc1d38a37e) - c:\progra~1\micros~2\office14\GROOVEEX.DLL BHO: Java(tm) Plug-In SSV Helper: (761497bb-d6f0-462c-b6eb-d4daf1d92d43) - c:\program files\java\jre6\bin\ssv.dll BHO: Office Document Cache Handler: (b4f3a835-0e21-4959-ba22-42b3008e02ff) - c:\progra~1\micros~2\office14\URLREDIR.DLL BHO: Java(tm) Plug-In 2 SSV Helper: (dbc80044-a445-435b-bc74-9c25c1c588a9) - c:\program files\java\jre6\bin\jp2ssv.dll TB: (7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA) - No File TB: (2318C2B1-4965-11D4-9B18-009027A5CD4F) - No File uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe uRun: [Microsoft Works Update Detection] c:\program files\microsoft works\WkDetect.exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Intuit SyncManager] c:\program files\common files\intuit\sync\IntuitSyncManager.exe startup mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey uPolicies-explorer: HideSCAHealth = 1 (0x1) mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - c:\progra~1\micros~2\office14\ONBttnIE.dll/105 IE: (2670000A-7350-4f3c-8081-5663EE0C6C49) - (48E73304-E1D6-4330-914C-F5F514E3486C) - c:\program files\microsoft office\office14\ONBttnIE.dll IE: (789FE86F-6FC4-46A1-9849-EDE0DB0C95CA) - (FFFDC614-B694-4AE6-AB38-5D6374584B52) - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll DPF: (8AD9C840-044E-11D1-B3E9-00805F499D93) - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: (CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA) - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: (CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA) - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: (E2883E8F-472F-4FB0-9522-AC9BF37916A7) - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: DhcpNameServer = 192.168.1.1 71.242.0.12 TCP: Interfaces\(331C4984-7B67-4895-92BF-FBD07719C629) : DhcpNameServer = 192.168.1.1 71.242.0.12 Filter: text/xml - (807573E5-5146-11D5-A672-00B0D022E945) - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL Handler: intu-help-qb5 - (867FCB77-9823-4cd6-8210-D85F968D466F) - c:\program files\intuit\quickbooks 2008\HelpAsyncPluggableProtocol.dll Handler: qbwc - (FC598A64-626C-4447-85B8-53150405FD57) - c:\windows\system32\mscoree.dll Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL Notify: igfxcui - igfxdev.dll SEH: Groove GFS Stub Execution Hook: (b5a7f190-dda6-4420-b3ba-52453494e6cd) - c:\progra~1\micros~2\office14\GROOVEEX.DLL SEH: SABShellExecuteHook Class: (5ae067d3-9afb-48e0-853a-ebb7f4a000da) - c:\program files\superantispyware\SASSEH.DLL . ============= SERVICES / DRIVERS =============== . R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 171064] R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2010-2-17 12880] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67664] R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCORE.EXE [2011-5-4 116608] R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-1-3 63928] R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504] R2 IHA_MessageCenter;IHA_MessageCenter;c:\program files\verizon\iha_messagecenter\bin\Verizon_IHAMessageCenter.exe [2011-7-1 290832] R2 QBVSS;QBIDPService;c:\program files\common files\intuit\dataprotect\QBIDPService.exe [2011-8-19 1248256] R3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-10 4640000] R3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\rtl8187B.sys [2011-6-14 281088] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-18 257696] S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2011-6-12 31125880] S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2011-4-27 74112] S3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\NisSrv.exe [2012-3-26 214952] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] . =============== Created Last 30 ================ . 2012-06-12 20:05:54 56200 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\(c63b0218-fda0-4f49-a66a-fbbac2d29431)\offreg.dll 2012-06-12 14:38:15 713784 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\nisbackup\gapaengine.dll 2012-06-12 14:38:15 713784 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\(94e954c4-9303-4459-aace-f4d82ef5da4b)\gapaengine.dll 2012-06-12 14:36:16 6737808 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\(c63b0218-fda0-4f49-a66a-fbbac2d29431)\mpengine.dll 2012-06-12 01:09:54 6737808 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll 2012-05-16 22:05:38 677136 ----a-w- c:\programdata\microsoft\ehome\packages\mcespotlight\mcespotlight\SpotlightResources.dll . ==================== Find3M ==================== . 2012-05-04 17:57:10 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-05-04 17:57:09 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-04-04 19:56:40 22344 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-04-03 08:16:12 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe 2012-04-03 08:16:11 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-04-02 13:36:21 2044928 ----a-w- c:\windows\system32\win32k.sys 2012-03-30 12:39:11 914304 ----a-w- c:\windows\system32\drivers\tcpip.sys 2012-03-29 13:39:19 31232 ----a-w- c:\windows\system32\drivers\tcpipreg.sys 2012-03-25 17:34:20 472808 ----a-w- c:\windows\system32\deployJava1.dll 2012-03-21 00:44:12 74112 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys 2012-03-21 00:44:12 171064 ----a-w- c:\windows\system32\drivers\MpFilter.sys 2012-03-20 23:28:50 53120 ----a-w- c:\windows\system32\drivers\partmgr.sys . ============= FINISH: 18:13:49.82 =============== Attach.txt . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft� Windows Vista� Home Premium Boot Device: \Device\HarddiskVolume1 Install Date: 6/14/2011 9:30:53 PM System Uptime: 6/12/2012 4:29:45 PM (2 hours ago) . Motherboard: Gateway : : Processor: Intel(R) Pentium(R) Dual CPU T2370 @ 1.73GHz : U2E1 : 1333/mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 298 GiB total, 207.691 GiB free. D: is CDROM () E: is Removable . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP405: 5/23/2012 11:07:30 AM - Windows Update RP406: 5/24/2012 1:57:24 PM - Windows Update RP407: 5/25/2012 5:02:37 PM - Windows Update RP408: 5/26/2012 5:59:33 PM - Windows Update RP409: 5/27/2012 6:32:30 PM - Windows Update RP410: 5/28/2012 7:53:40 PM - Windows Update RP411: 5/29/2012 11:27:49 AM - Windows Update RP412: 5/30/2012 12:05:57 PM - Windows Update RP413: 5/31/2012 12:35:48 PM - Windows Update RP414: 6/1/2012 5:13:40 PM - Windows Update RP415: 6/2/2012 10:49:47 AM - Windows Update RP416: 6/3/2012 6:47:47 PM - Windows Update RP417: 6/4/2012 11:25:04 AM - Windows Update RP418: 6/4/2012 10:49:10 PM - Windows Update RP419: 6/5/2012 4:54:34 PM - Windows Update RP420: 6/6/2012 9:34:37 AM - Scheduled Checkpoint RP421: 6/6/2012 11:11:02 AM - Windows Update RP422: 6/7/2012 10:32:10 AM - Scheduled Checkpoint RP423: 6/7/2012 12:15:48 PM - Windows Update RP425: 6/7/2012 10:23:25 PM - Microsoft Antimalware Checkpoint RP426: 6/8/2012 4:39:47 PM - Windows Update RP427: 6/9/2012 4:43:40 PM - Windows Update RP428: 6/10/2012 7:42:19 PM - Windows Update RP429: 6/11/2012 9:08:02 PM - Windows Update RP430: 6/12/2012 10:34:30 AM - Windows Update RP432: 6/12/2012 11:29:23 AM - Microsoft Antimalware Checkpoint RP433: 6/12/2012 5:35:38 PM - Windows Backup . ==== Installed Programs ====================== . Adobe AIR Adobe Anchor Service CS3 Adobe Asset Services CS3 Adobe Bridge CS3 Adobe Bridge Start Meeting Adobe Camera Raw 4.0 Adobe CMaps Adobe Color - Photoshop Specific Adobe Color Common Settings Adobe Color EU Extra Settings Adobe Color JA Extra Settings Adobe Color NA Recommended Settings Adobe Default Language CS3 Adobe Device Central CS3 Adobe ExtendScript Toolkit 2 Adobe Flash Player 11 ActiveX Adobe Fonts All Adobe Help Viewer CS3 Adobe Linguistics CS3 Adobe PDF Library Files Adobe Photoshop CS3 Adobe Reader X (10.1.3) Adobe Setup Adobe Stock Photos CS3 Adobe Type Support Adobe Update Manager CS3 Adobe Version Cue CS3 Client Adobe WinSoft Linguistics Plugin Adobe XMP Panels CS3 Brother MFL-Pro Suite MFC-490CW Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition Google Chrome Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) IHA_MessageCenter Intel(R) Graphics Media Accelerator Driver Intel(R) Matrix Storage Manager Java Auto Updater Java(TM) 6 Update 31 Malwarebytes Anti-Malware version 1.61.0.1400 Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4 Client Profile Microsoft .NET Framework 4 Extended Microsoft Application Error Reporting Microsoft IntelliPoint 8.1 Microsoft Office 2010 Service Pack 1 (SP1) Microsoft Office Access MUI (English) 2010 Microsoft Office Access Setup Metadata MUI (English) 2010 Microsoft Office Excel MUI (English) 2010 Microsoft Office Groove MUI (English) 2010 Microsoft Office InfoPath MUI (English) 2010 Microsoft Office OneNote MUI (English) 2010 Microsoft Office Outlook MUI (English) 2010 Microsoft Office PowerPoint MUI (English) 2010 Microsoft Office Professional Plus 2010 Microsoft Office Proof (English) 2010 Microsoft Office Proof (French) 2010 Microsoft Office Proof (Spanish) 2010 Microsoft Office Proofing (English) 2010 Microsoft Office Publisher MUI (English) 2010 Microsoft Office Shared MUI (English) 2010 Microsoft Office Shared Setup Metadata MUI (English) 2010 Microsoft Office Word MUI (English) 2010 Microsoft Security Client Microsoft Security Essentials Microsoft SQL Server Compact 3.5 SP1 English Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Word 2002 Microsoft Works 2002 Setup Launcher Microsoft Works 6.0 Microsoft Works Suite Add-in for Microsoft Word MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MSXML 4.0 SP2 Parser and SDK PaperPort Image Printer PDF-XChange Viewer PDF Settings PHOTOfunSTUDIO 5.0 QuickBooks QuickBooks Pro 2012 REALTEK RTL8187SE Wireless LAN Driver REALTEK USB Wireless LAN Driver Samsung Kies SAMSUNG USB Driver for Mobile Phones ScanSoft PaperPort 11 Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft .NET Framework 4 Extended (KB2487367) Security Update for Microsoft .NET Framework 4 Extended (KB2656351) Security Update for Microsoft Excel 2010 (KB2597166) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2553091) Security Update for Microsoft Office 2010 (KB2553096) Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2598039) 32-Bit Edition Security Update for Microsoft PowerPoint 2010 (KB2553185) 32-Bit Edition Security Update for Microsoft SharePoint Workspace 2010 (KB2566445) Security Update for Microsoft Visio Viewer 2010 (KB2597981) 32-Bit Edition Spybot - Search & Destroy 1.4 SUPERAntiSpyware SupportSoft Assisted Service Synaptics Pointing Device Driver Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft .NET Framework 4 Extended (KB2468871) Update for Microsoft .NET Framework 4 Extended (KB2533523) Update for Microsoft .NET Framework 4 Extended (KB2600217) Update for Microsoft Office 2010 (KB2494150) Update for Microsoft Office 2010 (KB2553065) Update for Microsoft Office 2010 (KB2553092) Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition Update for Microsoft Office 2010 (KB2553385) 32-Bit Edition Update for Microsoft Office 2010 (KB2566458) Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition Update for Microsoft Office 2010 (KB2597091) 32-Bit Edition Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition Update for Microsoft OneNote 2010 (KB2589345) 32-Bit Edition Update for Microsoft Outlook 2010 (KB2553248) 32-Bit Edition Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition Vz In Home Agent WhoCrashed 3.04 WinRAR 4.01 (32-bit) Works Suite OS Pack Works Synchronization . ==== Event Viewer Messages From Past Week ======== . 6/6/2012 11:19:35 AM, Error: Microsoft-Windows-PrintSpooler [6161] - The document CMO signed.pdf, owned by EC, failed to print on printer Brother MFC-490CW Printer. Try to print the document again, or restart the print spooler. Data type: NT EMF 1.008. Size of the spool file in bytes: 4007636. Number of bytes printed: 3175820. Total number of pages in the document: 3. Number of pages printed: 0. Client computer: \\DK-PC. Win32 error code returned by the print processor: 87. The parameter is incorrect. 6/12/2012 3:48:39 PM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 6/12/2012 2:45:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments "" in order to run the server: (E60687F7-01A1-40AA-86AC-DB1CBF673334) 6/12/2012 2:25:42 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: (145B4335-FE2A-4927-A040-7C35AD3180EF) 6/12/2012 2:20:45 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: MpFilter SASDIFSV SASKUTIL spldr Wanarpv6 6/12/2012 2:20:45 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start. 6/12/2012 2:19:56 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: (9E175B6D-F52A-11D8-B9A5-505054503030) 6/12/2012 2:19:48 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: (1BE1F766-5536-11D1-B726-00C04FB926AF) 6/12/2012 2:19:42 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: (DD522ACC-F821-461A-A407-50B198B896DC) . ==== End Of File ===========================

Karla, I did the same thing. One of the screens which popped up looked just like AVG, which is my AV. It was running a scan but there were smaller windows which looked like Windows and said,'security alert! your computer has a virus, you must update your antivirus. It had the colors of a Windows warning with the red X and blue background. The AV scan was zipping along with these alerts popping up. I was so confused, luckily I didn't react immediately (which is what I tend to do), I sat and looked at the windows and realized the scan (which looked exactly like AVG) was not AVG. It was missing the 'G'. The top of the screen just said AV. When I saw that, I knew the other boxes weren't Windows. I couldn't X anything or stop the scan. I tried to open AVG but it wouldn't open. I tried Malwarebytes, no luck. I then tried to shut down the computer and the Start button wouldn't work. More pop-ups all over the place. I manually shut the computer off. When I restarted, I did the same as Karla. I clicked on Malwarebytes immediatelly before the other processes started. It instantly grabbed 3 items before it scanned (thought that was odd). After the scan it showed 7 items: Trojan horse Fake AV.CDC Virus identified Exploit PDF Trojan.Fraudepack AV Suite Rogue.AVSecurity Suite Temp Files IE5 Rogue AV Security Suite. I don't know how to show the log. I might reinstall Windows and be done with this. It was very upsetting. My netbook seems to work normally but the proxy settings were changed and it has frozen a few times. Jane

Oh RavenCajun, I'm trying to stay calm but hubby is going to freak if I have to tell him I got Trojans on a practically new computer. *taking deep breaths* You're right (again! lol)....some of these programs seem to automatically download things I didn't want. In the Remove programs area I found things that I knew could be included with other items I downloaded but I never wanted them, but there they were! Examples: Open Office, Google Toolbar, Yahoo Toolbar, Webshots something-or-other, etc. I promise to be much more careful in the future by making sure to inspect for something that is checked as if I want it, but don't. Even though I "Remove Selected" on everything, this info below shows "no action taken". This is the log that Popped Up Automatically when I clicked "Remove Selected": Malwarebytes' Anti-Malware 1.30 Database version: 1328 Windows 6.0.6001 Service Pack 1 10/27/2008 12:15:08 PM mbam-log-2008-10-27 (12-14-53).txt Scan type: Quick Scan Objects scanned: 43155 Time elapsed: 4 minute(s), 47 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 4 Registry Values Infected: 6 Registry Data Items Infected: 14 Folders Infected: 1 Files Infected: 9 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\(030a0f33-5b99-482e-83f5-2eeb8457878b) (Trojan.BHO) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\(9034a523-d068-4be8-a284-9df278be776e) (Trojan.Zlob) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\(144a6b24-0ebc-4d89-bf09-a06a718e57b5) (Trojan.Zlob) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\(daed9266-8c28-4c1c-8b58-5c66eff1d302) (Search.Hijack) -> No action taken. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\(144a6b24-0ebc-4d89-bf09-a06a718e57b5) (Trojan.Zlob) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.securewebinfo.com (Trojan.Zlob) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.safetyincludes.com (Trojan.Zlob) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.securemanaging.com (Trojan.Zlob) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wblogon (Trojan.Zlob) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\start (Trojan.Zlob) -> No action taken. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchURL (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchURL (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar (Hijack.Search) -> Bad: (http://windiwsfsearch.com/ie6.html) Good: (http://www.google.com/) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar (Hijack.Search) -> Bad: (http://windiwsfsearch.com/ie6.html) Good: (http://www.google.com/) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Hijack.Search) -> Bad: (http://windiwsfsearch.com/search?q=(searchTerms)) Good: (http://www.google.com/) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Hijack.Search) -> Bad: (http://windiwsfsearch.com/search?q=(searchTerms)) Good: (http://www.google.com/) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant (Hijack.Search) -> Bad: (http://windiwsfsearch.com) Good: (http://www.google.com/) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\w\ (Hijack.Search) -> Bad: (http://windiwsfsearch.com/search?q=%s) Good: (http://www.google.com/) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\w\ (Hijack.Search) -> Bad: (http://windiwsfsearch.com/search?q=%s) Good: (http://www.google.com/) -> No action taken. Folders Infected: C:\Windows\System32\675873 (Trojan.BHO) -> No action taken. Files Infected: C:\Users\Lady\My Documents\My Music\My Music.url (Trojan.Zlob) -> No action taken. C:\Users\Lady\My Documents\My Pictures\My Pictures.url (Trojan.Zlob) -> No action taken. C:\Users\Lady\My Documents\My Videos\My Video.url (Trojan.Zlob) -> No action taken. C:\Users\Lady\My Documents\My Documents.url (Trojan.Zlob) -> No action taken. C:\ProgramData\Microsoft\Windows\Start Menu\Antivirus Scan.url (Trojan.Zlob) -> No action taken. C:\ProgramData\Microsoft\Windows\Start Menu\Online Spyware Test.url (Trojan.Zlob) -> No action taken. C:\Users\Public\Desktop\Antivirus Scan.url (Rogue.Link) -> No action taken. C:\Users\Public\Desktop\Online Spyware Test.url (Rogue.Link) -> No action taken. C:\Users\Lady\Favorites\Antivirus Scan.url (Rogue.Link) -> No action taken. Also, before reading your post I hand-copied some things that showed up in my Free AVG when it automatically scanned in the wee hours of this morning. Trojan Fake Alfert - IEBT " Media-Codec " Media-Codec/V4 " SmitFraudVariant/IE Anti-Spyware " Unclassified/ALGG " Unclassified-Packed/Suspicious " Downloader ZLOB_r.DE " " " " DO " " " " DF " Generic7.BDKJ Adware Media-Codec/ZLOB And even though I thought the bad stuff was gone and I've started with a fresh reboot, when I am in IE7, it freezes and I get one of two messages: APPCRASH or APPHANGB1 Of course I went to WebShots and sure 'nuff, there was the big box with the message "This page will not function properly without enabling Java". gggrrrrr!