Trojan horse

So then please uninstall either avast! or AVG.

Let's try this then:

Download to the desktop:Dr.Web CureIt

• Doubleclick the drweb-cureit.exe file and Allow to run the express scan
• This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
• Once the short scan has finished, Click Options > Change settings
• Choose the "Scan"-tab, remove the mark at "Heuristic analysis".
• Back at the main window, mark the drives that you want to scan.
• Select all drives. A red dot shows which drives have been chosen.
• Click the green arrow at the right, and the scan will start.
• Click 'Yes to all' if it asks if you want to cure/move the file.
• When the scan has finished, look if you can click next icon next to the files found:
  
  If so, click it and then click the next icon right below and select Move incurable as you'll see in next image:
  
  This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
• After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
• Save the report to your desktop. The report will be called DrWeb.csv
• Close Dr.Web Cureit.
• Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
• After reboot, post the contents of the log from Dr.Web you saved previously in your next reply with a new hijackthis log.

Hi
Apparently, it doesnt matter whether it was DrWebAntiVirus or eset or kaspersky. none of them can pass this file C:\Windows\System32\config\SOFTWARE.SAV .. what is that file ??? I saw the file .. can i remove the file? all the scan programs that you gave me are freezing when reaching this file. There MUST be something wrong
i wasn't able to carry on with your instructions .. i installed CureIt and it deleted some trojans (NtRootKit, StartPage, and BackDoor) and some adawares .. but no log files and no scan complete.
what am i supposed to do with SOFTWARE.SAV?? please HELP ME!!

That likely means that your registry is corrupted.

You don't have any windows CDs?

First Of All I really want to thank you sir for helping me this far. I feel i learned a lot in this forum.
Second. I just noticed something. after i stopped DrWebCureIt and restarted the computer, i opened firefox and nothing popped up(it used to show trojan generic 14.DYJ by AVG before) but now its not there! . Although, it suddenly popped up a while after when i was offline and just using the computer. what does that mean? and what should i do with these files on my desktop? MalwareBytes, RSIT, ERUNT, NTREGOP, fix.reg, and Dr web Cure it. can i use any of them before i go for the last option? ( reformatting)
I do have 4 CDs which came with the dell box. they are: operating system(vista home sp1 32 bit). application (powerDVD .. ) . Drivers and Utilities (dell inspiron 1545) and Microsoft Works.
which one should i use?

Thanks again.

Z

That is glad to hear

Most of those will get removed in final instructions.

I don't think that reformatting is needed.

Do you have had any problems with registry or any registry related error messages before using ERUNT?

well thanks!!
I haven't dealt with the registry before. but AFTER installing ERUNT i have had error messages when i turn the computer on. this is how they look like:

unable to create file
C:\Windows\ERDNT\Auto\8-3-2009\ERDNT.INF

Registry backup will continue, but no restore information fro the ERDNT program will be saved. This means that later restoration of the registry can only be done manually, by using another OS to copy back the files --- and when i press OK it shows:

Error saving file
C:\Windows\ERDNT\Auto\8-3-2009\SECURITY !

continue with the next file?

if i keep pressing OK it changes from SECURITY to SYSTEM and so on for about ten error messages but if i click NO they all cancel
is this of any importance? because you asked whether i have had problems with the registry.
and what if those trojans pop up again what do you recommend? because i saw them once
thanks

OK, those error messages do mean that windows registry is not as it should be.

Please try step 4. suggested here in last post

lack of response