Ok Mr. Bob. Let me start with the bonehead manouver:
I did what I said I was going to do, (!!!#@?) and when I saw your last message about 99% through the Kapersky scan I turned the firewall back on....(DA)
Now, you had asked about what message I was getting when installing AVG (I will get Avast too) here we go and it came while copying the files:
Local Machine: Installation failed
Installation:
Error: Action failed for registry key
HKLM\software\mircosoft\windows\currentversion\run\creating registry key....
Access is denied (5)
Alright, I had to hand write that and type it here, so it was "like" that.
I followed all of the directions with the exception of the bonehead manouver I mentioned above, and was not able to get Trend to work.
Many of the items were present that you told me to look for.
Regarding the command to look for and delete THE BEST OFFERS\
when selecting delete it opened an IE window whose address was c:\windows\boncpar.htm
and on the "page" it included:
"If you want to uninstall ...it can be removed by going to
www.bestoffersnetworks.com/uninstall to get uninstall tool"
Now, I may be a bonehead, but...so I just ignored that and uttered some choice words.
When removing Zango from the Uninstall feature it gave a message that an error occured and it could be that it has already been unistalled do you want to remove it from the unistall list. I ignored that too, and said cancel.
In the HJT fix these were the only three that were found:
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKCU\..\Run: [pshower] C:\WINDOWS\system32\pshwr.exe
Regarding the files to delete:
C:\Program Files\Zango
C:\WINDOWS\SYSTEM32\PSHWR.EXE
C:\Program Files\MailSkinner\
C:\WINDOWS\SYSTEM32\InstallerV3.exe
I also deleted Installerv4 andInstallerv5
C:\WINDOWS\kwv2.dat
c:\documents and settings\mommy\favorites\1111
C:\WINDOWS\STWSI
C:\Program Files\FCHelp
C:\Program Files\knights_shiryu1\insthlp.dat
C:\Program Files\TBONAS\TBONcomp.dll
C:\WINDOWS\SYSTEM32\InstallerV3.exe
C:\WINDOWS\SYSTEM32\InstallerV4.exe
C:\WINDOWS\SYSTEM32\kagtolwq.exe
C:\WINDOWS\SYSTEM32\zbvugea.exe
also saw three dat files for the last one, did not delete them though (maybe another bonehead manouver)
I saw this:
C:\WINDOWS\SYSTEM32\kill all spyware
and it smells funny but I left it...
you said to look for lanbruns.exe did not see it but I saw lanbrup.exe and left it
I also discovered "virushunter4.exe" smelled funny too but I left it
this one too left it but:
zseyqgxmad.exe also with three dat files too.
Alright I think I wrote down everything I found and removed, but it could be that I removed one you ordered while not writting it.
Kapersky scan log to follow (post too long)