Spyware/Virus causing wacko results

[dl65]

Wraith......  Ok ....I see a new one that has appeared from somewhere.....

Mark for removal .......

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "% ProgramFiles%\WinPcap\rpcapd.ini (file missing)

Now then this one .....

O17 - HKLM\System\CCS\Services\Tcpip\..\{B5B3DEDA-EF7F-40AE-81C8-EF9F78409863}: NameServer = 67.21.13.2,67.21.13.4  ....If this is something that you use and recognise as being safe leave it otherwise mark it for removal.

Next please explain why you have 2 anti viruses installed now ?
The point here is we are trying to get your system clean and you seem to be adding things. Dont do that until we get a clean logfile.......
Are you using proxy server setting ? ...I'm trying to understand your R0 and R1 entries ......
And you do have you system restore turned off don't you ?

dl65  

[Fed]

DL, there's at least 3 threads running on this, I see he fixed it somewhere else.
After bouncing around from thread to thread I say just cut him adrift but remember the name in case he comes back. LOL!

[Xeratul]

Anymore, eh?
 
I believe I've removed most of the malicious entries.
 
The source of my problem seems to be this Alcan.32 worm. I scan for it and my software picks it up and deletes it. The next day it seems to be there again causing the same problem...
 
I'm looking for a more permanent fix, what is causing it to not be properly deleted? :-?

[Xeratul]

Wraith......  Ok ....I see a new one that has appeared from somewhere.....

Mark for removal .......

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "% ProgramFiles%\WinPcap\rpcapd.ini (file missing)

Now then this one .....

O17 - HKLM\System\CCS\Services\Tcpip\..\{B5B3DEDA-EF7F-40AE-81C8-EF9F78409863}: NameServer = 67.21.13.2,67.21.13.4  ....If this is something that you use and recognise as being safe leave it otherwise mark it for removal.

Next please explain why you have 2 anti viruses installed now ?
The point here is we are trying to get your system clean and you seem to be adding things. Dont do that until we get a clean logfile.......
Are you using proxy server setting ? ...I'm trying to understand your R0 and R1 entries ......
And you do have you system restore turned off don't you ?

dl65  

The proxy settings I don't use anymore so I suppose I can delete those.

I don't understand is having two antivirus installed going to conflict?

The winpcap thing is for my ethereal I suppose I will delete that too.

I have system restore turned off.

DL, there's at least 3 threads running on this, I see he fixed it somewhere else.
After bouncing around from thread to thread I say just cut him adrift but remember the name in case he comes back. LOL!

I'm sorry the reason I posted so many threads is sort of because I discovered the problems one at a time untill I discovered they were all connected. Limewire problem http://www.computerhope.com/cgi-bin/yabb/YaBB.cgi?num=1140579109 -- cmd problem -- http://www.computerhope.com/cgi-bin/yabb/YaBB.cgi?num=1140571622/0 -- and the task manager problem

I tried to make this thread to combine them all. Do you think I should delete the other threads?

[GX1_Man]

There is no reason to have two antivirus programs active and problems can result.  

[Backdated]

Without looking at your HijackThis log it's almost certain that your current problem evolves from having two AV suites installed. I'd put money on one seeing the virus in the quarantine folder of the other.
Having said that, was System Restore disabled? Have all temp and temp internet folders been cleared? Has the recycle bin been emptied?