Well friend told me to come here, here I am and I need some help..I dont know whats up or whats wrong but please let me know, thanks.

ok well i found out what it is now how do i delete it? its atmclk.exe
heres the new log file its only got it in there i took care of everything else

To delete it you can use KillBox - http://www.downloads.subratam.org/KillBox.zip
or Smitfraud - http://siri.urz.free.fr/Fix/SmitfraudFix.zip (simtfraud is even better I guess)

The program is a bit slow but it works. And don't forget to reboot after.

@justja, thank you for your attempt at assisting. However, users are not allowed to post on malware related threads, only those staff/members authorized by the Security Team Leader (Joe5).


@magisticpimp
Download Avenger from here:
http://swandog46.geekstogo.com/

Open the program. Check the 'Input script manually' option.
Click the Magnifying Glass icon.
In the box that opens, paste this:

Files to delete:
C:\WINDOWS\system32\atmclk.exe

and click 'Done'

Click the Traffic Light icon to start the program, and OK the prompts to reboot your PC.

Post the Avenger output.txt, which you can find at C:\Avenger\.txt; along with a new HijackThis log

oops sorry chiawaikian I didn't know

Thanks Im pretty sure it worked, not seeing those stupid warnings anymore, no more popups, as you asked heres the log files aswell.

Looking good , but to be sure everything is gone i would like you to run this tool:


Download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.
Then boot up in safemode (hit f8 when booting up)

Once in Safe Mode, open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.

A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt


And it seems youre symantec and kaspersky software is either (partially) uninstalled , or damaged. I would advice to either reinstall them or get an other firewall and AV , have a look in our download section if needed.

When I run that SmitfraudFix.cmd it opens and closes doesnt give me a chance to do anything at all, I think it was only the swsc that stayed open, but didnt have options like you told me to choose so I closed it, used the reboot utility and looked for a log, didnt get one. What now?

Thanks for telling me about my Kaspersky and all.

Did you extract the files to a folder on youre desktop , and try to run it? Or did you try to run it from inside the zip file? And where you in safemode?

Yes, Yes, I used it from Desktop, and I was in safemode

See if it will run in normal mode.

nope, gives me the same results as in safemode.