Ok, long story short, i was looking for a keygen for one of my games, downloaded the wrong thing, and got a slew of viruses from it. Most were trojans and other low end stuff, and quick action with process explorer and some manual hunting killed most of them. There is 1 left, and i think i killed it already, but i downloaded and installed malwarebyte and ran it.

here is the log

Malwarebytes' Anti-Malware 1.44
Database version: 3654
Windows 6.1.7600
Internet Explorer 8.0.7600.16385

1/28/2010 8:43:36 PM
mbam-log-2010-01-28 (20-43-27).txt

Scan type: Quick Scan
Objects scanned: 96509
Time elapsed: 3 minute(s), 56 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 2
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\kr_done1 (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\crntdll (Backdoor.Bot) -> No action taken.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\Windows\system32\userinit.exe,C:\Users\Anubis\pxurh.exe \s) Good: (Userinit.exe) -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Windows\System32\kr_done1 (Malware.Trace) -> No action taken.

kill the registry infections and the 1 file infection?

You should. Remove it and see what happens.

ok guess not. sometimes when opening a web page i get redirected to another page. Its annoying. So now what?

This post has been edited by Captiosus: Jan 29 2010, 11:47 AM

Please download Qoofix by RubbeR DuckY from http://www.malwarebytes.org/Qoofix.zip

1. Unzip all files to a convenient location such as C:\Qoofix.
2. Go to the folder you unzipped all files and run Qoofix.exe.
3. Click Begin Removal and wait for the scan to finish.
4. If an infection has been found, select yes to restart your computer.

Finally post a new HijackThis log and the contents of the Qoofix logfile.

I assume you know how to go with the HJT.

i already found the solution by mahself. One of the viruses had patched my atapi.sys file and that resulted in the redirects. But TY anyways. Another person got it and thats what led me to figuring out what this thing was hiding in.

see this thread
http://computerhelpforum.org/forum/general...ome/t27410.html
for more.