This may need to be in the Software Forum and not the Malware Forum...what makes you think its Malware?

Also - what version of Windows are you currently running?

I will get you started, due to time constraints one of the regulars may get back to you before I can.

Please run Vundofix

http://vundofix.atribune.org/

Follow the instructions noted, then...

Regardless if all of your logs are clean, you have 24 gigs of music and videos, your computer is not going to be optimal. Opening internet connections opens more processes, so yes you may slow down...

Good deal - If it was in the Antivirus chest, it was already quarantined so you're good :icon_smile:

What trojan name is it showing, and does it give you the file location of where this trojan is?

Shouldnt be a problem, however the windows.old folder is for older documents and settings...do you already have your important documents backed up? If so you can just delete the windows.old folder.

Well I see no signs of a rootkit...hate to sound repetitive but you could attach one more new HijackThis log. If it shows this time we are going to Killbox it.

Alright - Smitrem removed the remnants of SpyFalcon so thats good.

I want you to copy and paste C:\daemon.exe here at this website and upload it for analysis
http://virusscan.jotti.org/

Please...

Could you please follow the previous instructions first, then we'll get to the updates.

They could be tied in together with your current issue.

Well friend, this is a new one on me :)

The logs didnt show me what I was hoping to see

Download Autoruns
http://www.sysinternals.com/Files/Autoruns.zip
--Extract to its own folder
--double...

Download WinPFind
http://www.bleepingcomputer.com/files/winpfind.php
-Follow step 9 here on how to properly run it:
http://wiki.castlecops.com/Vundo_Rootkit_Detection_and_Removal_Procedure
-Save...

Alright - if you go to C:\WINDOWS with the Viewing of Hidden Files and Folders enabled, do you see a C: in there?

It is showing C:\WINDOWS\C:\WINDOWS\System32\svchost.exe and the correct path is...

I see this post was accidently overlooked, sorry about that, it has been busy around here. :)

If you are still requiring assistance, please let me know. It may take some manual steps to remove the...

Couple more scans for me, then we'll get to your log.

Download smitRem.exe (http://noahdfear.geekstogo.com/click%20counter/click.php?id=1) -Save it to your Desktop.
-DoubleClick it to extract...

Glad I could help Brian :)

I have worked a few of their more difficult practice logs at MRU yes. But, I never went thru to graduation. I was already pretty well involved with malware when I signed up there.

I would...

Ok here is the problem

System Restore Service is legit with the service name srservice

But, the directory C:\WINDOWS\C:\WINDOWS\System32\svchost.exe is all whack.

So this is what I want you...

If caperjack's advice doesnt work, you have a few options.

1. Uninstall and Reinstall Service Pack 2. You cant just repair or reinstall IE when you have SP2

1. Since you said it happened...

That particular error usually reflect either a Driver or RAM problem. I would guess it has something to do with the driver if it only started doing it after installing the writer.

Or you could try...

They will steer you in the right direction ;)

A great place to learn would be www.malwareremoval.com

1. Your HijackThis log looks fine. To clean it up a bit I would uninstall Logitech Desktop messenger if you do not use it.

2. Could you let me know what the file is, and the location in which...

Because of the technology that Spysweeper uses, alot of times it alarms you of potentially masked rootkit files. Typically this is nothing to be alarmed about as it only looks for differences between...

Thanks alot for the suggestions Dojo :)

Keep them coming.

This is similiar to the fact that the Mac OS is now experiencing viruses targeting it. Simply put, it's getting popular as mentioned.

The fact that FF doesnt use Active X will always make it more...

The line is still there in your HijackThis log, if this is a new one, then you need to re-do my previous steps about disabling and deleting this service, you told me it was not in the log
O23 -...

Can you please attach a new HijackThis log then?

Ok - nothing showing in that log, but your 023 service is still there because it has to be Disabled and deleted.

Fixing it in HijackThis does not solve the problem.

Go to Start>Run and type...

little bump :)

In a case like this...a repair may work, but a reformat and clean start may be the way to go.

Log looks good to me :)

I would uninstall Logitech Desktop Messenger if you do not use it.

Download ISeeYou
http://forum.networktechs.com/attachment.php?attachmentid=22664&d=1143686508
-Reboot to Safe Mode
-double...

EDIT - Tay beat me to it ;)

One solid Cartwheel for the Chocolate ones I guess....never been big on Ice Cream ;)

Open Task Manager (Ctrl+Alt+Del) and kill the following process


Go to Start>Run type Services.msc
-Locate the following service


-Right click and choose Stop if not greyed out
-Choose...

Spysweeper should grab the Look2Me infection, although by the log the user already has it and Ewido installed, but dont forget these

Alright - Last thing to do.

Check Add/Remove Programs and verify mirarsearch is not listed.

NEXT
Copy the contents to notepad
-Save the file as fix.reg
-Double click the file and answer YES...

Yeah - that one looks fine, Other than one toolbar, Ewido just found cookies which is normal..

The quick launch has got me baffled friend.

For the Kaspersky - I would just delete everything out of Symantecs Quarantine and then delete the remaining files in Safe Mode.

If you can, you may...

This right here is a Lop Infection

Download Pocket Killbox
http://bleepingcomputer.com/files/spyware/KillBox.zip
-Unzip to its own folder

Open Killbox and check Delete on Reboot
-Copy and...