Verified answer

Kaspersky Anti-Virus 6.0

lets get that out of ur pc ur some antivirus will miss key keylogger and trojans . frist of all you need to download avg antispyware this is verry good in getting all kinda bad files . then you need to download Adaware

a-squared< is verry good in picking up traking software files that is on the pc and it will find them . then download antispyware blocker that will find any type of virus . trojans files with antispyware blocker when you run that at the top of the box ur see

C:\ WINDOWS

remove the word windows and just leave in

C:\

then hit scan it will search all of the pc every file for virus or trojans and this will not have any problem with ur antivirus you have i have this my self .

then download spyware doctor that will search the pc for even more spyware adaware . just having 1 or 2 antispyware dont cut any ice at all you neeed what i said to download . when you have them run ur pc in safemode and scan the pc with then 1 at a time . this way from safemode the trojan and keylogger cant hide them self coz there is not internet access on in safe mode all the software i said to download will get the trojans and keylogger

if they say some are in the registry you watch what path there in and get in the registry and right hit on that folder and hit remove dont worry when the pc restart up win xp will creat a new clean folder for you

First off, download ATF Cleaner and delete all temporary files where malware can hide. Make sure you set your Windows Explorer to show all hidden system files before you run ATF.

Update your antivirus. If you do not have one, download and install AVG or Avast!. They are free.

Also install and update:

1. Ad-Aware SE

2. Spybot Search and Destroy

3. Windows Defender (free from Microsoft)

4. Microsoft Malware Remover (free also)

5. SpywareBlaster

6. Ewido

7. Google Toolbar

8. McAfee SiteAdvisor

9. Firewall like Comodo Personal Firewall or Sygate Personal Firewall

10. CWShredder - there are 2 versions. Make sure you install both the last Merijn version and the latest version from TrendMicro.

11. About:Buster

12. HijackThis

Update them RIGHT AFTER YOU INSTALL THEM.

All the above are FREEWARE. All of them are easily Googleble.

Reboot to Safe Mode and run your antivirus, #1-4, 6, 10 (both versions) & 11.

Reboot in Normal Mode. Run HijackThis (or HJT for short). DO NOT REPAIR OR FIX anything that it will list in its scan log. Just copy the whole log.

Register for free at MCH Forums:

http://mycomputerheadaches.tz4.com/

After you register, post your HJT scan log at the above site, specifically at the System Security Forum. Precede your posting with a detailed description of your problem. And use a descriptive subject line. For example:

WinXP: Yahoo Messenger infection

Ask for farther assistance there or at our sister group (see link below).

Be patient. OJ, our resident HJT expert, has a life outside of his cyberlife. So just wait until he responds. Do read all the postings at the Announcements Forum to follow what you need to do as an MCH member.

I strongly recommend that you back up the registry before making any changes to your Registry. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified subkeys only. For instructions on how to make a backup of the Windows registry:

How to back up Windows Registry

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf...

Note: If the Registry Editor does not open, the worm has made changes to the registry that prevent it from running. To fix this, download and run the Tool to reset shell\open\command registry keys, which also fixes this problem:

http://www.symantec.com/security_response/writeup....

Click Start > Run.

Type regedit

Click OK.

Navigate to the subkeys:

HKEY_LOCAL_MACHINE\Software\

Microsoft\Ole

HKEY_LOCAL_MACHINE\SYSTEM\

ControlSet001\Control\Lsa

HKEY_LOCAL_MACHINE\SYSTEM\

CurrentControlSet\Control\Lsa

HKEY_LOCAL_MACHINE\Software\

Microsoft\Windows\CurrentVersion\Run

HKEY_CURRENT_USER\Software\

Microsoft\Windows\CurrentVersion\Run

HKEY_CURRENT_USER\Software\

Microsoft\Windows\CurrentVersion\

RunServices

In the right pane, delete the value:

"Windows Messenger Messenger" = "winmsg.exe"

Navigate to the subkeys:

HKEY_CURRENT_USER\Software\Microsoft\

Windows\CurrentVersion\Policies\System

In the right pane, delete the values:

"DisableRegistryTools" = "Invalid dword value"

"DisableTaskManager" = "Invalid dword value"

Close the Registry Editor.

Our sister Yahoogroup is:

MCH Yahoogroup

http://mch.tz4.com/

To drive restart it, open the torrent application up. After you could have performed this get the venture supervisor window up, I am assuming you know the way to do that since your spectacular query. Click at the software itself at the tm (venture supervisor) after which correct click on it. When you correct click on it there will have to be an alternative referred to as Show Process. Click in this alternative, it will have to take you to one more tab, at this factor DON'T MESS WITH ANYTHING. Click at the torrent procedure if it is not already decided on after which click on at the 'End Process' button. After this open your torrent application once more, and it will have to have restarted, wish this helped, Happy Piratebaying xD

Try Sophos antirootkit

http://www.snapfiles.com/reviews/Sophos-Anti-Rootk...

hit ctrl+alt+delete all at once twice in a row