I have no idea what's goin on..

Hello and welcome to Techspot.

Go HERE and follow the instructions in the order they are given.

Post a fresh HJT log as an attachment, only after doing the above.


Regards Howard :wave: :wave:

I`m not sure what you mean.

Just follow the instructions I gave you and then attach a fresh HJT log.

Regards Howard

HJT new log file

Hopefully this is working now.

Please reply to he same thread - it makes it easier for us to follow

You have an agobot and an rbot infection, and a Hosts entry that is not nasty but is redundant and should be cleaned. Clearly Norton didn't do much to protect you, much like many other people posting here.

I suspect you may have missed a few steps in Howards Instructions. Could you please look again and, in particular, make sure you run Ewido as per the "how to remove trojans" thread.

Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html

Go to add remove programmes in your control panel and uninstall anything to do with(if there).

winsupdater

Close control panel.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

winsupdater.exe
winlog.exe

Close task manager.

Run HJT with no other programmes open. Have HJT fix the following, by placing a tick in the little box next to(if there).

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q404&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=presario&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tconl.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q404&bd=presario&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O1 - Hosts: 64.91.255.87 www.dcsresearch.com

O4 - HKLM\..\Run: [winsupdater] C:\Program Files\winsupdater\winsupdater.exe /auto

O4 - HKLM\..\Run: [] winlog.exe

O4 - HKLM\..\RunServices: [] winlog.exe

O16 - DPF: {22CF0C35-80CE-11D3-9354-00105AA793BF} (Ipa Control) - http://www.immdesign.com/webview/IPAWebView.cab

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files(if there).

C:\Program Files\winsupdater\winsupdater.exe /auto

winlog.exe


Reboot into normal mode and turn system restore back on.


Regards Howard