Massive Spyware Infection

Last night (technically early this morning), my computer started acting up after visiting some....lets just say adult websites....and ever since has been unable to run anything. Whenever I attempt to run an executable program, a pop-up appears saying "Application cannot be executed. The file ______.exe is infected. Do you want to activate your antivirus software now." The blank is filled with literally every .exe program I have, anything from winword.exe to maplestory.exe, verclsid.exe to tsgmngr.exe. The only time I can run anything, albeit for a brief period, is when I boot up in safe mode, but soon enough I'm alerted to infection and can no longer execute programs.

Curiously, the one program that does self-execute is the Windows Life 2009 Free Scanner (something I didn't even know I had), which is the only antivirus that has so far picked up that I have 34 serious viruses/spyware/malware. Of course, it can't delete them, but instead directs me to website where I can purchase the full Windows Live antivirus software (interestingly the same thing happens if I click "Ok" on the box with the text I included in quotes above).

So here's where I stand: I cannot do anything, essentially, except during the first few minutes the system is booted up. I've scanned the system using Ad-Aware and Antivir, both of which only found cookies that were easily deleted. Antivirus Live, again, found 34 serious threats. Thankfully, the scan did provide the list, which you will find below:

 Spoiler

LdPinch V
Advanced Stealth Email
VMalum AWS
CNNIC Update U
Bancos DMD
Win32.Grams.I
Zlob AN
SillyDl BCL
CPush
Win32/Wadnock
Best search
Win32/Nuqel.E
Edge Tech
DisableKey
Emogen.B
MoonLight.V
Autorun.AOL
Sinowal.VXR
Antivirus360
BankerFox.A
P2PShared.U
BitTera.C
Azero.B
Sality.AN
WinWebSecurity2008
Downloader.JS.Small.fi
PSW.Win32.OnLineGames.sxa
Downloader.Win32.Braidupdate.c
Downloader.JS.Agent.sg
GameThief.Win32.OnLineGames/tnys
PSW.Win32.OnLineGames.rlh
Downloader.Win32.Delf.cgx
Backdoor.Win32.Small.x

Other basic information: Computer specs are a Toshiba A105-S4074 Satellite laptop running a Centrino Duo core processor and Windows XP Home Edition OS. I'm using up-to-date Avira Antivir Personal for antivirus and Comodo Personal Firewall for a firewall, and I have CCleaner, Ad-Aware, and HijackThis as separate anti-infection programs.

Let me know what information you need, if anything, towards helping, and I'll do my best to obtain it. Thanks again!

EDIT: Just to make this clear: I'm online and communicating through my MacBook, not my Toshiba. I have this second computer if need be.

First thing that comes to mind is using spybot S&D.

Second thing is research using a ubuntu live CD to do spyware removal. This is probably the best thing you can do, and if this fails, you're facing re-install.

Check if this "Windows Live 2009 Free Scanner" is legit. If I'm right, it's probably not, and probably part of your problem.

Edit: I don't recall if you need to actually install Malware Bytes or if it's all set once you download it. The registry key thing might not be necessary. But it was helpful for me to have that key since I can only install MapleStory on Safe Mode for dumb, unexplainable reasons.... Swerve's post might be a little bit better to look at, though this has got the same basic ideas. It's the accessing of the ideas that are different and/or better.

------------------------------

First off, the scanner isn't real. It's illegitimate. I've gotten so many viruses that I'm filled with certainty here.

Your case pretty bad. It's a hard call as to whether the viruses listed are real or not. I have a screenshot here of a fake virus scanning program that snuck in my computer once... and it lists BankerFox.A. But that was scareare. I saw you write Sality.AN, and it seems real, yet not listed here. Maybe it hasn't been found yet or it's sincerely a fake.

That screenie I mentioned

 Spoiler

Anyway, back to your case. The solution I can see is to tackle this under Safe Mode. The program should not start up under Safe Mode. But to install programs in Safe Mode or Safe Mode with Networking, you'll have to create a new registry key. There's two options. When you get into Safe Mode, about nothing should start up, but if this program starts up, you're in hot water.

If you're on Safe Mode with Networking, which might be preferrable here, you should attempt to open your internet. Assuming the program launches at start-up and THEN blocks the opening of executable files, you should be fine here. When I caught Trojan Vundo, executable files weren't allowed for me either, there was a scareware background (I believe), and I was frantic too. Get on the internet and visit Malware Bytes. It's legitimate, and trust me, when I had Vundo, only this did the trick. All my scanners wouldn't do a thing to it. Since you made the new registry key, download and install the program, then do a full scan. You will find a BUNCH of horrific files. Delete them all, and consider running the scan again. Give your other programs a shot if you're not confident enough. In the end, I was left with 2-3 pesky files that needed a few more scans and time to finally go AWAY.

The best of security programs that the majority has will not be able to block viruses like these, and they won't be able to fix them either. Hopefully anything I said is of help.

Oh yeah! If your System Restore is "gone", which nasty viruses as these usually do, you can reenable it. Visit this page, and find 278. Click "Restore/Enable System Restore", as it is clickable, but not the "Undo" next to it. Forgot how the exact process goes as I haven't reenabled my System Restore in a few months, but that will bring you to fixing System Restore.

I use Malware Bytes as well. In fact, I suggested it to Chuey. Once, one of those fake antiviruses got into my computer. I tried to use AVG, but it did nothing. Then I tried to use McAfee, but it didn't get rid of everything. So I downloaded Malware Bytes' Anti Malware, and it detected 16 infections. I restarted my computer, and then the virus was gone.

As per our previous conversation I wanted to mention why virus remediation online is so difficult. It's very difficult to know whether or not removing the virus will cause adverse effects on your computer, whether or not there are hidden viruses on your computer, and the possibility of assessing the wrong virus.

First of all, Antivirus Live is not a legitimate antivirus program as mentioned by Chuey. A description of Antivirus Live holds as follows:

Antivirus Live (also known as AntivirusLive) is the latest Rogue Anti-Spyware creation from the notorious Magic Software stable. Antivirus Live uses malicious cutting-edge techniques, including the use of backdoor Trojans. Once active, Antivirus Live disables the computer's security options, making it extremely difficult to uninstall through the Control Panel or via Safe Mode. Antivirus Live then starts spewing annoying popup ads and runs a security scan which reports the fake detection of numerous viruses and threats. Antivirus Live will recommend buying its licensed copy to solve the alleged spyware problems. Do not fall for Antivirus Live's trickery. This hazardous parasite should be terminated from the system immediately.

Do not download Spyware Hunter. It is also a program notorious for giving false positives. As everyone mentioned you should try downloading Malware bytes on your Mac and loading it on a USB drive. You can download Malware bytes from this site: http://download.cnet.com/Malwarebytes-An...tag=button

Once you download it, transfer it to your USB and then bring it over to your infected laptop. Once you reach your infected laptop, boot in safe mode with no networking using f8 or delete key on startup. Drag over malwarebytes to your desktop and double click on the icon to execute the program. This will hopefully get rid of Antivirus Live.

Condition: Malwarebytes does not execute after numerous attempts.

This is not a problem with Malwarebytes. The virus is blocking Malwarebytes from being executed. Some viruses block programs by targeting the name of the executable file and can be bypassed by changing the name of the .exe file.

Warning! Imagine dumping.

 Spoiler

Step 1: Select Malwarebytes


Select 2: Right Click and Go To Properties


Step 3: Click on Open File Location


Step 4: Go to mbam.exe and "Rename" it to Something Like fred.exe


Step 5: Double click and execute

Condition: Still does not load bro.

Okay. Go to start and select on run. Type in "regedit"

We're going to clean out your registry ! Just to make sure you should see the following prompts listed on the screen.

 Spoiler

We're going to go and target Antivirus Live first because we KNOW this is an issue. When running a very basic google search the following websites indicate that Antivirus Live changes/adds the following files in your registry:

Source: http://www.spywareremove.com/removeAntivirusLive.html & http://www.spywarevoid.com/remove-antivi...al_removal

Registry:
HKEY_CURRENT_USER\Software\AvScan
HKEY_CLASSES_ROOT\CLSID\{BAD4551D-9B24-42cb-9BCD-818CA2DA7B63}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BAD4551D-9B24-42cb-9BCD-818CA2DA7B63}

and/or

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Antivirus Live"

You can go about deleting such files by searching the parent directory. Example, click on HKEY_CURRENT_USER > SOFTWARE > AvScan: right click and then select delete on malicious entry. Again this runs a risk of possibly deleting important registry files. Be cautious. If you catch anything else while sifting through your registry such as: SOFTWARE> boysgonewild.com then of course delete this as well. It's obviously a redirect and attached to the original virus infection.

Wait. Before we proceed. Let's disable System Restore. Conduct a search for System Restore:

 Spoiler

Search for "System".

In the left pane, click "System Protection".

To turn off System Protection for a hard disk, clear the check box next to the disk, and then click OK.

Wait! System Restore is supposed to help me!!!! Most viruses have the potential to infect a System Restore calendar and re-download viruses on "restore points" thereby bringing the malicious software back every month or so, I know this because my sister happened to get my computer into a similar situation. There are numerous better solutions than using system restore. One method which my friend uses is to save the image to a CD where he can reinstall the OS along with the files by booting the CD.

Let's proceed! Reboot your computer and load up in safe mode one more time.

Try running Malwarebytes again!

Condition: Still does not load bro.

Okay. There are several things we can do but more or less I've give you the basic concept of how to remove viruses.

1. Use various automated antivirus programs. Personally some antivirus programs conflict with one another. One combination I prefer using is a Spybot which is a definitions based anti-virus tool along with Adaware which is a heuristic antivirus tool. AVG and a bevy of other antivirus tools are grand as well. Do now download a fake one. Please.

2. Hijack this log. Download and execute hijack this and get a log. Repost it here, there, everywhere. Get advice from everyone. Someone out there has had to have had the same virus and was helped by some kind soul in the past. Try some other scans like Belarc and so forth. Again, keep away from fake ones.

3. It's vundo or some other root-kit program. Sweet! No, this really sucks. I would suggest trying a program called Avenger: http://swandog46.geekstogo.com/avenger2/avenger2.html
This program is extremely powerful at targeting rootkits but at the same time because a rootkit heavily rewrites your OS it can also cause major problems for your computer at the same time. I would use swandog in conjunction with feedback from your hijack this log on a professional page like Microsoft or getting feedback from someone computer savvy.

4. This is the most important! Always cross-reference with google/wikipedia. Downloading anything deserves a google search with an added search of (+ virus or + removal). Also when you are going about sifting through your registry, cross-referencing suspicious keys can lead you to identify other viruses possibly infecting your computer.

That's pretty much all the advice I can give. Again it's hard not knowing what you exactly have but you should try all of the above advice and try getting back to us. Good luck with your virus remediation issue.

Note: I don't believe you should re-enable your system restore simply because of personal issues with it in the past. It's up to your discretion whether or not you want to trust it to help you problem but I don't trust it at all as a sure-fire virus solution.

Update:

I was able to speedily Control + Alt + Delete, click on the first suspicious-looking process I could find, and end it, all before one of the annoying Antivirus Live popups blocked Task Manager. It must have been the AntivirusLive process, because once I did that the popups ceased, the incessant fake scanning ceased, and I could once again execute programs.

With newfound hope I hopped online and downloaded a bunch of anti-spyware programs, including Malware Bytes and Spybot Search & Destroy. Unfortunately, S&D could not connect to the server, and thus wouldn't install, but I got Malware Bytes up and running and removed 4 trojans with the first scan.

Since then I ran a full system scan that picked up nothing, and my computer seems to be back to normal in terms of not showing any symptoms listed in my first post that would indicate an infection. Still, I'm anxious about logging in to anything important (email, Facebook, MS, etc.)...does it appear that I'm safe? Antivir and Comodo Personal Firewall are working properly, Adaware, Antivir, and Malware Bytes full system scans detect nothing, and again, everything seems to be running smoothly..but as Swerve said, lord knows what Malware programs I really have/had, and whether or not they found another way to survive and dodge my scans.

So am I safe to use my computer normally again? If not, what do you recommend doing? Thanks again for all the help!

Lots of "fake" spyware removal programs have been popping up lately, and are usually installed when you get a popup from a website, and it says something along the lines of "you have x amount of spyware installed on your computer. Click here for a free removal."

The names are usually generic, such as you got with the Windows Life Security etc. All I can say to prevent this from happening again, is to know what programs you have for firewall and for anti-virus/spyware removal. That will flag you on what a bad popup is.

The main target for these "fake" anti-virus? The elderly. They are gullible and will click on anything when they think there is an issue. The program that gets installed usually throws up false positives, which is why you only got 4 viruses removed by a real program. The list of programs that was listed in the OP by the Windows Life program seemed very generic, and some of the programs didnt seem to be real.

HijackThis log:

 Spoiler

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:09:09 PM, on 12/7/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\TDispVol.exe
C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Toshiba\Tvs\TvsTray.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\WINDOWS\system32\dla\DLACTRLW.exe
C:\toshiba\ivp\ism\pinger.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\DNA\btdna.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.toshiba.com/search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?o=101760&l=dis
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\DLACTRLW.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [DLPSP] "C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Face...oader5.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resource...oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: Dell Printer Status Watcher (DLPWD) - Dell Inc. - C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE
O23 - Service: Dell Printer Status Database (DLSDB) - Dell Inc. - C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

--
End of file - 9324 bytes

Well, looking at this this website...

The GameGuard Service and Toshiba HKLM looks safe, but that system32 file looks fishy...

[B]Do not take my word on this. I am not that tech savvy. Just wait for someone tech savvy to confirm (or deny) my words.[/B]

C:\Program Files\DNA\btdna.exe <kill this its a phantom process of bittorrent
and by kill i mean turn it off/close it

this prog may be helpful for when you go into reg mode:
http://technet.microsoft.com/en-us/sysin...63902.aspx

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe <do you use bitdefender? if not kill this thing too

and jsut for the laughs
O23 - Service: DVD-RAM_Service - Matsupomegranatea Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
thats all i have for input

Update:

 text

I was able to speedily Control + Alt + Delete, click on the first suspicious-looking process I could find, and end it, all before one of the annoying Antivirus Live popups blocked Task Manager. It must have been the AntivirusLive process, because once I did that the popups ceased, the incessant fake scanning ceased, and I could once again execute programs.

With newfound hope I hopped online and downloaded a bunch of anti-spyware programs, including Malware Bytes and Spybot Search & Destroy. Unfortunately, S&D could not connect to the server, and thus wouldn't install, but I got Malware Bytes up and running and removed 4 trojans with the first scan.

Since then I ran a full system scan that picked up nothing, and my computer seems to be back to normal in terms of not showing any symptoms listed in my first post that would indicate an infection. Still, I'm anxious about logging in to anything important (email, Facebook, MS, etc.)...does it appear that I'm safe? Antivir and Comodo Personal Firewall are working properly, Adaware, Antivir, and Malware Bytes full system scans detect nothing, and again, everything seems to be running smoothly..but as Swerve said, lord knows what Malware programs I really have/had, and whether or not they found another way to survive and dodge my scans.

So am I safe to use my computer normally again? If not, what do you recommend doing? Thanks again for all the help!

If by "normal" you mean the same actions that caused this, then no. But if you've now learned something? Safer than before is certainly a possibility.

You might also want to burn an antiviral/malware boot CD... take your pick.
F-Secure, Trinity, and Avira which might pickup more if Windows isn't running, [url=http://devbuilds.kaspersky-labs.com/devbuilds/RescueDisk/"]Kaspersky[/url] is beta, but works

eh, forgot Hiren's sort of an all-in-one rescue clutter cd

Well, looking at this this website...

The GameGuard Service and Toshiba HKLM looks safe, but that system32 file looks fishy...

[B]Do not take my word on this. I am not that tech savvy. Just wait for someone tech savvy to confirm (or deny) my words.[/B]

Thanks! I know enough to understand all of those functions (though not specifically that system32 file, though it did look fishy and was tagged as so), so I eliminated the ones I knew were bad/suspicious/extraneous. My log looks really good now so F2.

Thanks again everyone!

Check if this "Windows Live 2009 Free Scanner" is legit. If I'm right, it's probably not, and probably part of your problem.

Yeah. It might be a fake antivirus that tells you you have problems, but really they want you to "register" with them, or "buy" the software from them, but really they are trying to get your info to buy 10,000 dollars worth of stuff with your credit card or a card they make in your name. I got one of those too, once. Get Spybot Search and Destroy, and try and nuke it.

If you can't solve the problem yourself, take it to a repair shop. Right now, do NOT make any sensitive transactions or put passwords in your computer. Somebody might be reading what you are inputting.

I would just reformat the whole thing if u dont mine loosing stuff.happen to me recently

Reformatting is excessive. When you fall and get a bruise you don't need to visit the doctor unless you have a case of anemia or some other drastic health-jeopardizing condition. Reformatting after every minor infection will never allow you to develop basic troubleshooting skills which you can use to help other people with computer problems. Fixing your own virus issues allows you to develop an ideal skill set. When dealing with other people, not everyone can afford to have their computer reformated and often times have important files saved on to their hd.