I was able to get malwarebytes to work.. first is results of scan last week. then most recent.
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.orgDatabase version: 6515
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
5/5/2011 4:23:27 PM
mbam-log-2011-05-05 (16-23-27).txt
Scan type: Full scan (C:\|)
Objects scanned: 170897
Time elapsed: 21 minute(s), 13 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
c:\documents and settings\owner\application data\Sun\Java\deployment\cache\6.0\38\7bbb1226-389a8718 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
i updated and ran most recent scan... results below.Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.orgDatabase version: 6579
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
5/14/2011 6:01:32 PM
mbam-log-2011-05-14 (18-01-32).txt
Scan type: Full scan (C:\|)
Objects scanned: 186043
Time elapsed: 27 minute(s), 31 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 2
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 5
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pboriqoba (IPH.Trojan.Hiloti.B) -> Value: Pboriqoba -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dxagolalocupuwo (Trojan.Hiloti) -> Value: Dxagolalocupuwo -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_CLASSES_ROOT\exefile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("C:\Documents and Settings\owner\Local Settings\Application Data\nkx.exe" -a "%1" %*) Good: ("%1" %*) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
c:\WINDOWS\icapubik.dll (IPH.Trojan.Hiloti.B) -> Quarantined and deleted successfully.
c:\WINDOWS\uz3dbav.dll (Trojan.Hiloti) -> Quarantined and deleted successfully.
c:\documents and settings\owner\application data\Adobe\plugs\mmc5126593.txt (Rogue.Installer.Gen) -> Quarantined and deleted successfully.
c:\documents and settings\owner\application data\Sun\Java\deployment\cache\6.0\55\3e9e6c37-3f50b0a7 (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\documents and settings\owner\local settings\Temp\0.04894478671244262.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
