Computer problem...Help..please

Had a bit of a virus/spyware problem over the last couple of days.

My AVG antivirus software picked up a virus yesterday which I deleted. Thought no more of it until I logged on today and It picked up another virus. Then loads of pop ups appeared along with a new icon on my desk top and one on my tool bar.

I got rid of the pop ups but I was left with this in my tool bar and try as I might I cannot get rid of it.

The system intrusion detected which shows up as 'virus allert' current items is the problem. It continually flips between the red circle with white diagonal cross and the windows update icon (a cunning use of a familar safe icon!!) When I clicked on the message it brought up a web page which offered lots of anti spyware software all of which had a free scan funtion which download software onto the pc. The free scan picked up loads of stuff very quickly (in fact it was the quickest scan i've ever seen). However in order to remove the so called problems the site requires you to buy the full product on line, in fact even hitting the help button takes you to the buy online page. I'm guessing that this is a scam to either relive you of the 50$ (can't even get the dollar sign in the right place) for the product or simply get you card details. Now after my mate did lots of deleting he has stopped the system intrusion detected message opening this web page when it is clicked. He also managed to get rid of a page that came up when I opened internet explorer. Said page informed me that my pc was undere the contol of another pc and my personal documents were being looked at. It listed my i.p address and other info about my pc and had more links to sites where I could buy software to fix my problem. This page however was not online since it came up when my internet connection was disconnected.

Oh and pop ups have started appearing, from gambling sites and adult friend finder!! WTF

After updating my spybot software, installing zone alarm and adaware se personal things have got a lot better but i can still not remove this virus allert from my tool bar. I can set it to always hide which stops the anoying message popping up but it is still there and I am worried there may also be other files on the pc not being detected. Virus allert doesn't show up when you do a 'ctrl alt del' and if you right click on it nothing happens (btw microsoft antispyware and windows firewall have both been useless, the pair of them being comprehensively bipassed by the virus/spyware )

Sorry for the long waffle but I would really appreciate some advice on this one. Has anyone had this before?

Oh two more things, it doesn't appear on other accounts on the pc just mine although it still shows up in safe mode and my mate tried doing a system restore from before the problems started but it fails (a symptom of the problem?) 

micky_h wrote: Have you checked to see if theres anything new in your Add/Programs in the Control Panel? Give Spybot a try and AVG if you havent already got it. Worst case senario is you'll have to format the hard drive and re-install everything.

Yes, there's nothing at all in add/programs. Or anywhere else for that matter. My mate, who is an works with computers and maintains a network has never seen a virus/spyware that is so hard to find/eliminate. Got Spybot and AVG. Spybot has removed most of the offending files that got dumped on mp PC but these are obviously a few still there.

Reformatting the hard drive is the last option. Not something I'm looking forward to  

Thanks for the responses guys.

A few things for me to try. What I don't get is how come it is only affecting my account. Does that mean that the files are somewhere in my documents?

Ok stephen, here you go...

Logfile of HijackThis v1.99.1
Scan saved at 00:14:56, on 08/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\mssearchnet.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\DOCUME~1\PETERF~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.co.uk/myway
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: HomepageBHO - {27150f81-0877-42e9-af13-55e5a3439a26} - C:\WINDOWS\system32\hpA5B.tmp (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Filter: application/x-internet-signup - {A173B69A-1F9B-4823-9FDA-412F641E65D6} - C:\Program Files\Tiscali\Tiscali Internet\dlls\tiscalifilter.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

Got rid of those files except

C:\WINDOWS\system32\mssearchnet.exe
Which it would let me delete, because it was being used by another program......

That file does look like the one though. It's icon is a little yellow triange with an exclamation mark in.

Not sure how relevant this is but when I run spybot it get a hit. It says that I have to reboot the computer in order to get rid of the problem which I do. Spybot them comes in during start up clicks and wirrs and then i click fix and hey presto probelm sorted. However when I log off and on again and rescan the problem is back.... 

It says it has sorted them but I just did a rescan and it's back.......

newdotnet isn't there but here's a screen dump. Sorry about the size..