win32.zafi.b fake popup

I get a popup from windows security center telling me that my computer is infected with win32.zafi.b when I click repair it takes me to a website for security software which I did NOT install.

here is the log from hijack this:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:04:35 PM, on 1/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TVersity\Media Server\MediaServer.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: CDelHotkeys Object - {78875F5C-A685-4405-8DC5-D48DC65452B0} - C:\Program Files\Delicious Add-on for Internet Explorer\DeliciousExtension.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Delicious Toolbar - {61D1C847-DF80-423A-8C6D-DC03B97E6EBE} - C:\Program Files\Delicious Add-on for Internet Explorer\DeliciousExtension.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Pandora Radio - Listen to Free Internet Radio, Find New Music.url
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Delicious - {2C887991-08F0-11DC-A9B2-0012F0B227DD} - C:\Program Files\Delicious Add-on for Internet Explorer\DeliciousExtension.dll
O9 - Extra button: Bookmarks - {2C887992-08F0-11DC-A9B2-0012F0B227DD} - C:\Program Files\Delicious Add-on for Internet Explorer\DeliciousExtension.dll
O9 - Extra button: Tag - {2C887993-08F0-11DC-A9B2-0012F0B227DD} - C:\Program Files\Delicious Add-on for Internet Explorer\DeliciousExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll:

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: TVersityMediaServer - Unknown owner - C:\Program Files\TVersity\Media Server\MediaServer.exe

--

And here is the uninstall list

32 Bit HP CIO Components Installer
AC3Filter (remove only)
Adobe Acrobat 7.1.0 Standard - English, Français, Deutsch
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
ATI - Software Uninstall Utility
ATI Control Panel
ATI Display Driver
AVG Free 8.0
Broadcom 802.11 Wireless LAN Adapter
Conexant AC-Link Audio
Delicious Add-on for Internet Explorer
ElectricSheep 2.6.6
ffdshow [rev 1723] [2007-12-24]
Haali Media Splitter
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
HP Officejet J4500 Series
HP Wireless Assistant 2.00 C1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office XP Media Content
Microsoft Office XP Professional
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.0.5)
MSXML 4.0 SP2 (KB954430)
NetWaiting
REALTEK Gigabit and Fast Ethernet NIC Driver
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB960714)
Soft Data Fax Modem with SmartCP
Synaptics Pointing Device Driver
TVersity Codec Pack 1.2
TVersity Media Server 1.0.0.8 RC5
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
VLC media player 0.9.8a
Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Service Pack 3
Wireless Home Network Setup

Let me know if you need anything else
Edit: I also want to say thank you in advance for the help

here is the contents of dds.txt PART 1 of 2

DDS (Ver_09-01-07.01) - NTFSx86
Run by Kate at 16:22:43.40 on Mon 01/12/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1918.1414 [GMT -5:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\TVersity\Media Server\MediaServer.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Documents and Settings\Kate\Application Data\Google\yfijv17721328.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Documents and Settings\Kate\Desktop\dds.com

============== Pseudo HJT Report ===============

BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: CDelHotkeys Object: {78875f5c-a685-4405-8dc5-d48dc65452b0} - c:\program files\delicious add-on for internet explorer\DeliciousExtension.dll
BHO: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
TB: Delicious Toolbar: {61d1c847-df80-423a-8c6d-dc03b97e6ebe} - c:\program files\delicious add-on for internet explorer\DeliciousExtension.dll
TB: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
EB: Delicious Sidebar: {9d19c405-ba93-461b-871f-97992cc45972} - c:\program files\delicious add-on for internet explorer\DeliciousExtension.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [Acrobat Assistant 7.0] "c:\program files\adobe\acrobat 7.0\distillr\Acrotray.exe"
mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe"
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [hpWirelessAssistant] c:\program files\hpq\hp wireless assistant\HP Wireless Assistant.exe
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [wclock] "c:\documents and settings\kate\application data\google\yfijv17721328.exe" 2
StartupFolder: c:\documents and settings\kate\start menu\programs\startup\Pandora Radio - Listen to Free Internet Radio, Find New Music.url
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobea~1.lnk - c:\windows\installer\{ac76ba86-1033-f400-ba7e-100000000002}\SC_Acrobat.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2C887991-08F0-11DC-A9B2-0012F0B227DD} - {B8D8B1D0-83AF-451B-8CD9-8F1BF4ED8FEA} - c:\program files\delicious add-on for internet explorer\DeliciousExtension.dll
IE: {2C887992-08F0-11DC-A9B2-0012F0B227DD} - {9D19C405-BA93-461b-871F-97992CC45972} - c:\program files\delicious add-on for internet explorer\DeliciousExtension.dll
IE: {2C887993-08F0-11DC-A9B2-0012F0B227DD} - {4D3D441F-9543-4941-B664-2EDCF9FC1B56} - c:\program files\delicious add-on for internet explorer\DeliciousExtension.dll
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: AtiExtEvent - Ati2evxx.dll
AppInit_DLLs: avgrsstx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\kate\applic~1\mozilla\firefox\profiles\dcqpcocr.default\

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-1-2 97928]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-1-2 26824]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [2005-8-22 231424]
R4 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-1-2 875288]
R4 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-1-2 231704]
R4 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-1-2 76040]

Part 2 of 2 (DDS.txt)

=============== Created Last 30 ================

2009-01-12 12:25 --d----- c:\program files\Trend Micro
2009-01-12 11:58 578,560 ac------ c:\windows\system32\dllcache\user32.dll
2009-01-12 11:57 --d----- c:\windows\ERUNT
2009-01-12 11:52 --d----- C:\SDFix
2009-01-12 03:05 --d-h--- C:\$AVG8.VAULT$
2009-01-12 02:55 48,456 a------- c:\windows\system32\UninstallElectricSheep.exe
2009-01-12 02:55 --d----- c:\windows\system32\electricsheep-cache
2009-01-10 17:47 --d----- c:\program files\uTorrent
2009-01-10 17:47 --d----- c:\docume~1\kate\applic~1\uTorrent
2009-01-10 16:59 421,888 a------- c:\windows\system32\ac3filter.acm
2009-01-10 16:59 --d----- c:\program files\AC3Filter
2009-01-10 16:58 --d----- c:\program files\Haali
2009-01-10 16:57 7,680 a------- c:\windows\system32\ff_vfw.dll
2009-01-10 16:57 547 a------- c:\windows\system32\ff_vfw.dll.manifest
2009-01-10 16:57 60,273 a------- c:\windows\system32\pthreadGC2.dll
2009-01-10 16:57 --d----- c:\program files\ffdshow
2009-01-10 16:57 --d----- c:\program files\TVersity Codec Pack
2009-01-10 16:55 --d----- c:\program files\TVersity
2009-01-10 16:52 --d----- c:\program files\VideoLAN
2009-01-09 22:46 --d----- c:\program files\MSXML 4.0
2009-01-08 21:51 --d----- c:\program files\common files\HP
2009-01-08 21:51 --d----- c:\program files\common files\Hewlett-Packard
2009-01-08 21:50 118,272 a------- c:\windows\system32\hpz3l5mu.dll
2009-01-08 21:33 176,495 a------- c:\windows\hpwins19.dat
2009-01-08 21:33 997 a------- c:\windows\hpwmdl19.dat
2009-01-08 21:16 25,856 ac------ c:\windows\system32\dllcache\usbprint.sys
2009-01-08 21:16 25,856 a------- c:\windows\system32\drivers\usbprint.sys
2009-01-08 21:16 32,128 ac------ c:\windows\system32\dllcache\usbccgp.sys
2009-01-08 21:16 32,128 a------- c:\windows\system32\drivers\usbccgp.sys
2009-01-03 16:26 --d----- c:\program files\Windows Media Connect 2
2009-01-03 16:25 --d----- c:\windows\system32\LogFiles
2009-01-02 00:15 10,520 a------- c:\windows\system32\avgrsstx.dll
2009-01-02 00:15 76,040 a------- c:\windows\system32\drivers\avgtdix.sys
2009-01-02 00:15 97,928 a------- c:\windows\system32\drivers\avgldx86.sys
2009-01-02 00:15 --d----- c:\windows\system32\drivers\Avg
2009-01-02 00:15 --d----- c:\docume~1\kate\applic~1\AVGTOOLBAR
2009-01-02 00:15 --d----- c:\program files\AVG
2009-01-02 00:15 --d----- c:\docume~1\alluse~1\applic~1\avg8
2009-01-01 23:59 --d----- c:\docume~1\kate\applic~1\Delicious IE Extension
2009-01-01 23:57 --d----- c:\program files\Delicious Add-on for Internet Explorer
2009-01-01 23:48 --d----- c:\windows\system32\scripting
2009-01-01 23:48 --d----- c:\windows\system32\en
2009-01-01 23:48 --d----- c:\windows\system32\bits
2009-01-01 23:48 --d----- c:\windows\l2schemas
2009-01-01 23:46 --d----- c:\windows\ServicePackFiles
2009-01-01 23:45 13,696 a------- c:\windows\system32\wpa.bak
2009-01-01 23:42 --d----- c:\windows\EHome
2009-01-01 22:50 --d----- c:\windows\network diagnostic
2009-01-01 22:43 613,334 -c------ c:\windows\system32\dllcache\wmplayer.chm
2009-01-01 22:42 17,272 -c------ c:\windows\system32\dllcache\wmdm.inf
2009-01-01 22:41 327,040 -------- c:\windows\system32\drivers\ati2mtaa.sys
2009-01-01 22:25 272,128 -c------ c:\windows\system32\dllcache\bthport.sys
2009-01-01 22:25 272,128 -------- c:\windows\system32\drivers\bthport.sys
2009-01-01 22:25 138,496 -c------ c:\windows\system32\dllcache\afd.sys
2009-01-01 22:23 203,136 -c------ c:\windows\system32\dllcache\rmcast.sys
2009-01-01 22:23 691,712 -c------ c:\windows\system32\dllcache\inetcomm.dll
2009-01-01 22:23 333,824 -c------ c:\windows\system32\dllcache\srv.sys
2009-01-01 22:23 1,846,400 -c------ c:\windows\system32\dllcache\win32k.sys
2009-01-01 22:21 2,145,280 -c------ c:\windows\system32\dllcache\ntkrnlmp.exe
2009-01-01 22:21 2,189,184 -c------ c:\windows\system32\dllcache\ntoskrnl.exe
2009-01-01 22:21 2,023,936 -c------ c:\windows\system32\dllcache\ntkrpamp.exe
2009-01-01 22:21 2,066,048 -c------ c:\windows\system32\dllcache\ntkrnlpa.exe
2009-01-01 22:21 455,296 -c------ c:\windows\system32\dllcache\mrxsmb.sys
2009-01-01 22:21 337,408 -c------ c:\windows\system32\dllcache\netapi32.dll
2009-01-01 22:18 --dsh--- c:\documents and settings\kate\UserData
2009-01-01 22:18 26,488 a------- c:\windows\system32\spupdsvc.exe
2009-01-01 22:18 --d----- c:\windows\system32\PreInstall
2009-01-01 22:18 --d-h--- c:\windows\$hf_mig$
2009-01-01 22:11 --d----- c:\windows\system32\SoftwareDistribution
2009-01-01 22:06 --d----- c:\program files\HP DVB-T TV Tuner
2009-01-01 22:05 --d----- c:\program files\HP
2009-01-01 22:02 604,928 a------- c:\windows\system32\drivers\BCMWL5.SYS
2009-01-01 22:02 --d----- c:\program files\Broadcom
2009-01-01 22:02 47,104 a------- c:\windows\system32\WACntlPnl.cpl
2009-01-01 22:02 --d----- c:\program files\HPQ
2009-01-01 21:58 36,864 a------- c:\windows\system32\drivers\AmdK8.sys
2009-01-01 21:54 --d----- C:\W309BF54
2009-01-01 21:51 --d----- c:\windows\system32\ReinstallBackups
2009-01-01 21:51 201,856 a------- c:\windows\system32\drivers\SynTP.sys
2009-01-01 21:51 196,608 a------- c:\windows\system32\SynCtrl.dll
2009-01-01 21:51 163,840 a------- c:\windows\system32\SynCOM.dll
2009-01-01 21:51 143,360 a------- c:\windows\system32\SynTPAPI.dll
2009-01-01 21:51 110,592 a------- c:\windows\system32\SynTPCo4.dll
2009-01-01 21:51 --d----- c:\program files\Synaptics
2009-01-01 21:49 78,720 a------- c:\windows\system32\drivers\Rtnicxp.sys
2009-01-01 21:49 --d----- c:\windows\OPTIONS
2009-01-01 21:49 6,272 a------- c:\windows\system32\drivers\splitter.sys
2009-01-01 21:48 --d----- c:\program files\NetWaiting
2009-01-01 21:48 --d----- c:\program files\CONEXANT
2009-01-01 21:46 --d----- c:\program files\ATI Technologies
2009-01-01 21:45 --d----- C:\swsetup
2009-01-01 21:04 552 a------- c:\windows\system32\d3d8caps.dat
2009-01-01 20:13 376 a------- c:\windows\ODBC.INI
2009-01-01 20:13 --d----- c:\program files\Microsoft ActiveSync
2009-01-01 20:12 --d----- c:\windows\ShellNew
2009-01-01 20:00 12,160 ac------ c:\windows\system32\dllcache\mouhid.sys
2009-01-01 20:00 12,160 a------- c:\windows\system32\drivers\mouhid.sys
2009-01-01 20:00 21,504 a------- c:\windows\system32\hidserv.dll
2009-01-01 20:00 10,368 a------- c:\windows\system32\drivers\hidusb.sys
2009-01-01 19:31 --d----- c:\documents and settings\Kate
2009-01-01 19:25 --ds---- c:\windows\system32\Microsoft
2009-01-01 19:22 8,192 a------- c:\windows\REGLOCS.OLD
2009-01-01 19:20 1,875,968 ac------ c:\windows\system32\dllcache\msir3jp.lex
2009-01-01 19:19 78,336 ac------ c:\windows\system32\dllcache\chajei.ime
2009-01-01 19:18 --dsh--- c:\documents and settings\all users\DRM
2009-01-01 19:18 488 a---hr-- c:\windows\system32\WindowsLogon.manifest
2009-01-01 19:18 488 a---hr-- c:\windows\system32\logonui.exe.manifest
2009-01-01 19:18 --ds---- c:\windows\Downloaded Program Files
2009-01-01 19:18 --d--r-- c:\windows\Offline Web Pages
2009-01-01 19:18 749 a---hr-- c:\windows\WindowsShell.Manifest
2009-01-01 19:18 749 a---hr-- c:\windows\system32\wuaucpl.cpl.manifest
2009-01-01 19:18 749 a---hr-- c:\windows\system32\sapi.cpl.manifest
2009-01-01 19:18 749 a---hr-- c:\windows\system32\nwc.cpl.manifest
2009-01-01 19:18 749 a---hr-- c:\windows\system32\ncpa.cpl.manifest
2009-01-01 19:18 749 a---hr-- c:\windows\system32\cdplayer.exe.manifest
2009-01-01 19:18 --d-h--- c:\program files\WindowsUpdate
2009-01-01 19:17 --d----- c:\program files\common files\MSSoap
2009-01-01 19:15 --d----- c:\program files\Online Services
2009-01-01 19:15 --d----- c:\program files\Messenger
2009-01-01 19:15 --d----- c:\program files\MSN Gaming Zone
2009-01-01 19:14 --d----- c:\program files\Windows NT
2009-01-01 14:07 --d----- c:\program files\common files\ODBC
2009-01-01 14:07 --d----- c:\program files\common files\SpeechEngines
2009-01-01 14:06 --d--r-- c:\documents and settings\all users\Documents

==================== Find3M ====================

2009-01-01 23:49 78,115 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-01-01 19:16 21,640 a------- c:\windows\system32\emptyregdb.dat
2008-10-23 07:36 286,720 a------- c:\windows\system32\gdi32.dll
2008-10-16 15:38 826,368 a------- c:\windows\system32\wininet.dll

============= FINISH: 16:23:05.12 ===============

Please download the OTMoveIt3 by OldTimer.

• Save it to your desktop.
  
• Please double-click OTMoveIt3.exe to run it.
  
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :processes
  explorer.exe
  
  :files
  C:\Documents and Settings\Kate\Application Data\Google\*.*
  
  :reg
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "wclock"=-
  
  :commands
  [purity]
  [emptytemp]
  [start explorer]
  [reboot]
  
  
  
  
• Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt3
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.

ok the program seems to have frozen upon completion. The log is there I just cant copy and paste it. Run it again?

Okay.
Can you read the log for me?

Under =====FILES====
It will say Moved Successfully next to the files list?
And under ===REGISTRY===
It should have this on the end of the key
\\deleted successfully.

no i cant read the log it doesnt scroll because it is frozen. It is strange because task mgr says it is running but when I try to click on the program itself it doesnt let me do anything.

Okay.
The log is here in a notepad file:
C:\_OTMoveIt <== inside that folder.

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
DllUnregisterServer procedure not found in C:\Documents and Settings\Kate\Application Data\Google\mjkspc.dll
C:\Documents and Settings\Kate\Application Data\Google\mjkspc.dll NOT unregistered.
C:\Documents and Settings\Kate\Application Data\Google\mjkspc.dll moved successfully.
C:\Documents and Settings\Kate\Application Data\Google\yfijv17721328.exe moved successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\wclock deleted successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\Kate\LOCALS~1\Temp\etilqs_0PC4ysdhVSiqFzp4MATf scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Kate\LOCALS~1\Temp\fla9.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
File delete failed. C:\Documents and Settings\Kate\Local Settings\Application Data\Mozilla\Firefox\Profiles\dcqpcocr.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Kate\Local Settings\Application Data\Mozilla\Firefox\Profiles\dcqpcocr.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Kate\Local Settings\Application Data\Mozilla\Firefox\Profiles\dcqpcocr.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Kate\Local Settings\Application Data\Mozilla\Firefox\Profiles\dcqpcocr.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Kate\Local Settings\Application Data\Mozilla\Firefox\Profiles\dcqpcocr.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Kate\Local Settings\Application Data\Mozilla\Firefox\Profiles\dcqpcocr.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01122009_163423

Hello.
Looks good now, what problems remain?

i will reboot and tell you if any probs turn up if not, thank you very much

EDIT: after reboot I am no experiencing those problems. Should I delete the moved files that are in the OT moveit folder??? they are still present after reboot

Yeah.

We need to make a new restore point.

To turn off System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
4. Click Yes when you receive the prompt to the turn off System Restore.

Now we need to make a new restore point.
To turn on System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (To turn on System Restore), and then click OK.

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers.

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
https://addons.mozilla.org/en-US/firefox/addon/722
https://addons.mozilla.org/en-US/firefox/addon/1865
https://addons.mozilla.org/en-US/firefox/addon/433

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
Update Checker

5) Finally, consider maintaining a firewall. Some good free firewalls are Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

Hopefully this should take care of your problems! Good luck.

is windows firewall good enough?

No, it's not secure enough
I would seriously recommend a 3rd party firewall.

Since this issue is resolved, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.