Hi kahchoon88,
These two entries in your HijackThis! log are very suspicious:
O23 - Service: Window Services Pack Install (Spullepdsvc) - Unknown owner - C:\Program Files\Common Files\xbnz000.exe (file missing)
O23 - Service: Window Services Pack Installe (Spullerpdsvc) - Unknown owner - C:\Program Files\Common Files\spupdsvc.exe (file missing)
The fact that HijackThis! reports the files missing does not always mean the service is not running. (The avast! services run even though the file is reported as missing.)
Pleas follow these instructions to check for the suspicious service and stop it:
Click "Start" > "Run" and type "Services.msc" (without quotes) then hit "Ok".
Click the "Extended" tab.
Scroll down and find the services called Spullepdsvc and Spullerpdsvc
Click once on the services to highlight them.
Click "Stop".
Right-click on the service.
Click on "Properties".
Select the "General" tab.
Click the Arrow-down tab on the right-hand side on the "Start-up Type" box.
From the drop-down menu, click on "Disabled".
Click "Apply", then "OK".
Now you will want to delete the services:
Open HijackThis.
Click on the “Open Misc. tools section” button.
Click on the “Delete an NT service” button.
Type Spullepdsvc in the space provided and click OK.
Repeat for Spullerpdsvc.
The program will ask you to reboot. Accept.
Try scanning with Ewido again and with these services disabled it may be able to delete the malware.
The following entry also contains a suspicious double entry:
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,userinit.exe
Follow these instructions to correct it:
Run regedit and navigate to:
HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Winlogon
In there there should be a value (on right hand side of screen) called Userinit.
The data for this value is probably something similar to:
C:\windows\system32\userinit.exe,C:\windows\system32\userinit.exe,
If you do see a duplicated string in there similar to the above - simply double click on the Userinit value and edit the data so as to delete everything to the right of the first comma (,). In the case above you would leave only:
C:\windows\system32\userinit.exe,
After that I sugest you reboot into safe mode and run scans with Ewido, Ad-Aware, Spybot etc.
Good luck!
