After I made the mentioned basic steps, my pc starts with a system message "project1"  Run-time error '76': path not found.

 I have Virus Buster also, which quarantened Trojan.polyagent.a, but cannot remove.  It recognized an YB.worm.CodBot.j (WINNT/system32/keyboard.exe), and worm.rbot.een (WINNT/system32/crrs.exe), but the "access denied" to remove or to quaranteen them. Could you pls help?

 

My Hijack This log:

::Report End

 

 

 

 

Did you Scan with Ewido in Safe Mode? Ewido works better in safe mode.

 

1. First, get rid of look2me which is showing in your log.

Please download Look2Me-Destroyer.exe to your desktop.
http://www.atribune.org/ccount/click.php?id=7

Close all windows before continuing.
Double-click "Look2Me-Destroyer.exe" to run it.
Put a check next to "Run this program as a task".
You will receive a message saying Look2Me-Destroyer will close and re-open in approximately 10 seconds. Click OK
When Look2Me-Destroyer re-opens, click the "Scan for L2M" button, your desktop icons will disappear, this is normal.
Once it's done scanning, click the "Remove L2M" button.
You will receive a Done Scanning message, click OK.
When completed, you will receive this message: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, click OK.
Your computer will then shutdown.
Turn your computer back on.

Please post the contents of C:\Look2Me-Destroyer.txt and a new HiJackThis log.
If you receive a message from your firewall about this program accessing the internet please allow it.

If you receive a runtime error '339' please download MSWINSCK.OCX from the link below and place it in your C:\Windows\System32 Directory.
http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX

 

Then, use MS malicious software removal tool to remove W32.RBot.
http://www.microsoft.com/downloads/details.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

After that scan again with Hijackthis and post a new log here. Give us updates, whatever can't be deleted we can use Killbox.

Thanks a lot! The only remaining  the run-time error 76 by opening, the pop-ups, and the other problems have disappeared totally :) Look2me destroyer found  2 infected file, which were removed after. I copied MSWINSCK.OCX to the system 32 directory, run-time error 339 doesn't exist, but the above-mentioned '76'.

 

Not quite done I'm afraid there are still bad entries in your Hijackthis log.

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below.

You should 'not' have any open browsers when you are following the procedures below.

 

Download Brute Force Uninstaller http://www.merijn.org/files/bfu.zip and unzip it to it’s own folder (c:\BFU).

Run the program and click the Web button located on the top right corner

 

 

Checkmark the following boxes:
*Use settings specified in script for the above option
*Show log after script ends
Execute the script by clicking the Execute button.

When it finishes running, click the Save button for a copy of the log.
Post the log created by the script when you have completed the fix.

 

Fix these entries if still present:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
O4 - HKLM\..\Run: [mousepad] C:\\mousepad2.exe G
O4 - HKLM\..\Run: [newname] C:\\newname2.exe
O4 - HKLM\..\Run: [csr] csrrs.exe
O4 - HKLM\..\RunServices: [evil] updaters.exe G
O4 - HKLM\..\RunServices: [csr] csrrs.exe
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/6247971CanadaInc/ie/Bridge-c139.cab
O23 - Service: Keyboard Service System Files (Keyboard Service) - Unknown owner - C:\WINNT\System32\keyboard.exe (file missing)

 

The merijn result:

BFU v1.00.9
Windows 2000 SP4 (WinNT 5.00.2195 SP4)
Script started at 12:22:08, on 2006. 03. 19.

Failed: DllUnregister C:\WINNT\DH.dll|1 (file not found)
Failed: RegDelValue HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegistryTools (key not found)
Failed: RegDelValue HKCU\System\CurrentControlSet\Control\Lsa|p2pnetwork (key not found)
Failed: RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Associations|LowRiskFileTypes (key not found)
Failed: RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices|CU1 (key not found)
Failed: RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices|CU2 (key not found)
Option pause between commands: 300 ms
Option pause between commands: 50 ms
Failed: FolderDelete C:\Program Files\MsConfigs (folder not found)
Failed: FolderDelete C:\Program Files\winupdates (folder not found)
Failed: FolderDelete C:\Program Files\winupdate (folder not found)
Failed: FolderDelete C:\Program Files\winsupdater (folder not found)
Failed: FolderDelete C:\Program Files\MsUpdate (folder not found)
Failed: FolderDelete C:\Program Files\MsMovies (folder not found)
Failed: FolderDelete C:\Program Files\wmplayer (folder not found)
Failed: FolderDelete C:\Program Files\outlook (folder not found)
Failed: FileDelete C:\Program Files\Common Files\Windows\mc-*-*.exe (operation failed)
Failed: FileDelete C:\Program Files\Common Files\Download\mc-*-*.exe (operation failed)
Failed: FileDelete C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF7F21.tmp (operation failed)
Failed: FileDelete C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFABFA.tmp (operation failed)
Failed: FolderDelete C:\Program Files\Maxifiles (folder not found)
Failed: FolderDelete C:\Program Files\DNS (folder not found)
Failed: FolderDelete C:\Program Files\Common Files\FreeProd1 (folder not found)
Failed: FolderDelete C:\Program Files\Common Files\FreeProd2 (folder not found)
Failed: FolderDelete C:\Program Files\Common Files\InetGet (folder not found)
Failed: FolderDelete C:\Program Files\Common Files\InetGet2 (folder not found)
Failed: FolderDelete C:\Program Files\Common Files\VCClient (folder not found)
Script completed.

I'll post the HiJackThis log soon.