<iframe> tag found, it may be dangerous

Ok, I’m VERY sorry, for the misunderstanding. You had a lot of cracks on board.That you cannot deny.
However, your log, there are some unusual entries, does Pmc-server-2005\d\Avimark\avimark.exe mean anything to you ?
Also O4 - HKLM..\Run: [auditadmin] C:\windows\temp\auditadmin.cmd, I do not think this is bad. Can you find auditadmin.cmd, at all, if so, send it and avimark.exe to virustotal, and post the results.

http://www.virustotal.com/

Once again, i apologise, for accusing you of any wrong doing.

Apology ACCEPTED. And thanks for helping me work through this!

avimark.exe is our practice management software for a veterinary clinic. It is the main program our whole staff uses everyday.

I am not sure about auditadmin. I cannot find it. Avimark does audit all changes to peoples’ accounts and medical records

That list of cracks, I still do not understand. Most of the software listed in the log is not on this computer. Much of it was for free programs and for Avast. I still think that those files may have been from from the spam bot. But all staff in the clinic has access to this computer, so anything is possible.

I see C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe which is a vulnerable level of Sun Java.

Go to Add/Remove Programs and un-install all Sun Java installs.

Download and install the latest Sun Java Runtime Environment:
http://filehippo.com/download_java_runtime

Run Secunia Online Software Inspector to see what other applications have vulnerabilities:
http://secunia.com/vulnerability_scanning/online

Well MBAM, seems to have removed the main culprit sndmixer32.exe .
What I would do is run HijackThis again.This time,choose scan only. Put ticks next to the following entries

R3 - URLSearchHook: (no name) - - (no file)

O4 - HKLM..\Run: [auditadmin] C:\windows\temp\auditadmin.cmd

Close all other programs, and choose fix selected

Also, run MBAM again,(quick scan) to make sure the scan are coming clean

Also download SuperAntispyware, install,update,and run a quick scan, and post any findings.

It’s up to you if you want to go the extra mile, but I recommend, from a clean pc, download Avira rescue program. Double click on the file,insert blank cd,and the program will be burnt to disc.Insert the cd into the pc that was infected, and reboot

Follow the instructions in the link,especially choosing ‘English’

http://forum.avira.com/wbb/index.php?page=Thread&postID=730130#post730130

This program works without booting windows, and is very good at finding nasties.If it finds anything,it will rename the extension eg bad.exe to bad.xxx. Please report any findings before renaming.

If Avast has stopped alerting you,you may not want to run the disc. Once again sorry for the misunderstanding :slight_smile:

Regarding those cracks, these are programs that unlock paid programs for free. They are notorious
for containing the very worst of viruses, when executed.So if someone is using your pc to download these, I would be quite concerned.