There's some cleanup/removal info here...

Here is a link that might be useful: symantec.com/security...

Could also try the Microsoft Malicious Removal Tool that lists Zlob as one that it removes.

Click Start > Run >type MRT and do a scan.

No it's not normal for AVG to popup a message while using CCleaner, could be a coincidence or CCleaner triggered something during it's scan.

You can also download this tool in the link, read the instructions, update the definition files and run the tool, use the free version. Also create a restore point before running- Start > programs > accessories > system tools > system restore, look for option to create a restore point, and create one better to have a bad restore point then none at all. If this superantispyware works, then flush the restore points by turning system restore on then off. Trojan Zlob can be difficult to remove and may require other tools..

Here is a link that might be useful: superantispyware.

Trojan Zlob comes in many names, do you know the exact name that AVG could not heal.

Vault line says: Trojan Horse downloader.Zlob
Location: c:\doc&settings\TemporaryInternetFiles\contentIE5\23AH8PEB\VideoAccessCodecInstall[1]exe
Backup Copy
infected

In poking around vault I found View, Action, etc. Under Action the list of options are
Display Objects Details
Empty Vault
Heal Files (ghosted)
Delete Files
Restore Files
Restore Files as

Empty Vault sounds like a great option unless it empties back onto my computer. Delete Files always scares me unless I know they mean infected files. Also, if its already in quarantine, shouldnt my computer be working properly again?

Thanks for your help Mikie, Randy and Zeb. I'll try working on the fixes you sent later tonight when I have uninterrupted time. Sandy

More then likley there are other files infected probably in the system 32 folder, zlob can infect many files that avg may not even see, so there running on the system, For now don't worry about the AVG vault those files can't hurt you, do not delete any files. Run that superantispyware link I gave you. After that I have another tool you can download and print out a log and paste it here if we get to that point I will be able to see the virus, Trojan. (in the log), and give you other directions and recommend a help site that I belong to to help you remove it.

Directions for superantispyware:
Download Superantispyware.

http://www.superantispyware.com/ Use the link I gave you..

Once downloaded and installed update the definitions
and then run a full system scan quarantine what it finds!

* Double-click SUPERAntiSypware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)

http://www.superantispyware.com/definitions.html

* Under "Configuration and Preferences", click the Preferences button.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):
o Close browsers before scanning.
o Scan for tracking cookies.
o Terminate memory threats before quarantining.
* Click the "Close" button to leave the control center screen.
* Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
* On the left, make sure you check C:\Fixed Drive.
* On the right, under "Complete Scan", choose Perform Complete Scan.
* Click "Next" to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
* Make sure everything has a checkmark next to it and click "Next".
* A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
* If asked if you want to reboot, click "Yes".
*

Run randy ca tool first, that may do it depends how bad you are infected, even it that tool works I would still run the superantispyware.

zep

Ran Randy's tool and it came up clean. Before I start your process, you mentioned if problems I would need to download manually and unzip. How do I unzip? Using IE. Sandy

Think there's actually something wrong with computer itself. I usually hear lots more action going on in the tower--especially at startup. Or even scanning with AV spyware, come to think of it.

Usually there is no problem, if you do have to manually download them xp will un - zip it, you would right click the file an choose " extract" let me know if you do run into that normally you do not. Is the computer connecting ok and browsing ok, not sure what you mean by hear more action.. Do you have pop-ups?

If you want to try this first and you are willing go to link I gave you, on the right side of the page in the green area download the latest version of hijackthis, save it to your desk top, double click it, now on the tool do a "system scan & save a log file, copy and paste the log file into a reply here that way we can see what is wrong you can do this before or after the other tool Would really like to see this scan it will tell us alot of what is going on, take your time.

Here is a link that might be useful: hijackthis

The hijackthis link is the link I'm talking about, the first link is superantispyware so you have to links. you can do any one first, just try to post a hijackthis log.

fwiw, F-Secure has a .reg file for some safemode cleanup.

This utility deactivates the components of variants of the Zlob trojan which silently install spyware/adware/rogue anti-spyware. (Such as SpywareQuake, SpyFalcon, MalwareWipe and SpywareStrike.)

Here is a link that might be useful: http://www.f-secure.com/v-descs/zlob.shtml

Right, But zlob can bring other junk with it I'd like to see a hijackthislog, and follow through with superantispyware scan, This makes certain everthing is gone, there is always the possibility of other infections.

In breenthumb's post above about the AVG message about the zlob it says the item is in the temporary Internet files. To get rid of it, empty the temporary Internet files. In Internet Explorer it will be
Tools/ Internet Options/Browsing History. In Browsing History there is a button to click to delete Temporary Internet files .

We dont see any hijack this pasties around here.
Good thing too.

I know where it is the problem is other files get infected an we need to see what they may be

That's right in fact zlob is here:

c:\doc&settings\TemporaryInternetFiles\contentIE5\23AH8PEB\VideoAccessCodecInstall[1]exe

Got it. Is it OK to copy it here? Mikie, does your last post mean its not supposed to be on this forum? Sandy

Many forums will delete the thread if a hijack this is posted. I'm not seeing any here.. maybe its allowed, maybe it catches it automatically.
I consider it rude to others and its exposing enough information on you that someone may possibly see ways to access your computer. There's no moderater here to quickly modify your post and hide any security holes you might have.

If you wish to run HiJackThis you can paste the result into the link I have provided below. It will analyse it for you and make suggestions. Then if needed you could post any line or lines you felt unsure about here for discussion.

Be sure to use the option to back up your registry before proceeding. I also like to delete carefully doing only one or two perhaps then reboot and run HJT again. That way if a problem arises you do not have a long list of suspects to dig through trying to pin the culprit down.

I had never considered the view Mickie put, it is very reasonable I guess. I have wondered at some HJT logs I have seen wondering how they could be posted giving away some things perhaps better left in the dark.

Here is a link that might be useful: HiJackThis parser

breenthumb, guy's are right this is not the forum to pursue malware removal I like owbist idea this was not the best decision on my part to go this far, I am hoping the superantisptware was helpful, if you have problems related to malware still, I can recommend a forum to pursue the removal process, please be carefull with hijackthis and only use it for the log do not try to make any changes your self with the program. If you do paste a few lines here, would like to see to 02 lines, the 20 line, 04 lines are all your start up programs, 023 lines are all non Microsoft Services such as Norton, Macfee, ect.

OK, I understand and it makes sense. Sometimes, on these forums its easy to forget that its not just forum members and GW that can read posts. I'll try the other ways suggested. Thanks for all your time and the explanations.

I've done some googling and I'm not seeing what would be expected from Zlob. No popups, nor sites that pop up telling me I've been infected and click here to remove. and I haven't been to any porn sites, unless you'd call searching for California King bedding on legitimate sites porn.

What I am seeing is cursor not responding properly, and sometimes getting a strange mssg. on AVG antispy saying "connect to server" when I'm already connected and trying to run a search. Still under warranty but Best Buy Geek said it would take 7-10 days to diagnose. Yikes! Think I'll buy a new mouse in hopes that will help. I'm a Bills fan, so used to hoping for miracles.

Thanks again, all. Sandy

Well you don't sound to bad then maybe a mouse will do, here is a site I belong to very friendly not to big, good with malware removal should you decide to need there service and of course free, did not realize you were under warranty.. GO BILLS..

Here is a link that might be useful: help site

Thanks everyone for the links. Really frustrating trying to do even that with this darn mouse not responding. I've found that if I CLICK and PUSH or pull back on left button it will go. Did try plugging in the one that came with computer, but that didn't work at all. (Not sure it was in the right place but did green to green and it seemed to fit.) I'm off to buy a mouse.

Daylilydazed, I have this set to empty temp files, cookies and history on shutoff and its been rebooted lots of times in the past few days. Thanks again. Sandy

Very good, you can find your mouse settings here if you should need them, take the mouse with you so there is no confusion on connector type, there are 2 USB and the type you are presently using..

Mouse settings in case---Start > Control Panel > look for Mouse..

That was it! Left button was shot. And the computer simply needs to be off before plugging in the other style mouse. So much for the Geek Squad.

Sorry for the mistaken problem. They happened so close together it took me a while to realize what was really going on. But I've saved a bunch of good links from this. Thank you. Sandy