My Hjt

CapAyam · January 26, 2006

Logfile of HijackThis v1.99.1

Scan saved at 12:18:52 AM, on 1/27/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\Nhksrv.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\WINDOWS\System32\CTsvcCDA.EXE

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\MsPMSPSv.exe

C:\WINDOWS\system32\mssearchnet.exe

C:\WINDOWS\system32\nvctrl.exe

C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

C:\WINDOWS\DELLMMKB.EXE

C:\WINDOWS\system32\devldr32.exe

C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe

C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\ahead\InCD\InCD.exe

C:\Program Files\Microsoft AntiSpyware\gcasServ.exe

C:\Program Files\Netropa\OSD.exe

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe

C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe

C:\Program Files\Nikon\NkView6\NkvMon.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Effan\My Documents\My File\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.dellnet.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.dellnet.com/

R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} -

C:\Program Files\ICQToolbar\toolbaru.dll

O1 - Hosts: 207.68.172.246 msn.com

O2 - BHO: HomepageBHO - {4da4616d-7e6e-4fd9-a2d5-b6c535733e22} -

C:\WINDOWS\system32\hpED3E.tmp

O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1

\COMMON~1\Real\Toolbar\realbar.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -

C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll

O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program

Files\ICQToolbar\toolbaru.dll

O4 - HKLM\..\Run: [updReg] C:\WINDOWS\Updreg.exe

O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe

O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common

Files\Microsoft Shared\Works Shared\WkUFind.exe

O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32

\spool\drivers\w32x86\3\hpztsb04.exe

O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common

Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32

\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32

\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04

\bin\jusched.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -

atboottime

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [inCD] C:\Program Files\ahead\InCD\InCD.exe

O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft

AntiSpyware\gcasServ.exe"

O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money

Express.exe"

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe"

/background

O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -

quiet

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program

Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft

Office\Office10\OSA.EXE

O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?

O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program

Files\ICQToolbar\toolbaru.dll/SEARCH.HTML

O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!

\Common/ycsrch.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1

\MICROS~3\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program

Files\Yahoo!\Common/ycdict.htm

O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!

\Common/ycmap.htm

O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!

\Common/ycsms.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-

00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} -

C:\Program Files\Yahoo!\Common\yiesrvc.dll (file missing)

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program

Files\ICQLite\ICQLite.exe

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} -

C:\Program Files\ICQLite\ICQLite.exe

O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} -

C:\Program Files\IrfanView\Ebay\Ebay.htm

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-

00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage

Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -

http://a1540.g.akamai.net/7/1540/52/200203...com/qt505/us/wi

n/QuickTimeInstaller.exe

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -

http://update.microsoft.com/microsoftupdat...lient/muweb_sit

e.cab?1125170363015

O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) -

http://us.dl1.yimg.com/download.yahoo.com/.../ymmapi_416.dll

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) -

http://download.games.yahoo.com/games/popc...aploader_v5.cab

O16 - DPF: {E87A6788-1D0F-4444-8898-1D25829B6755} -

http://fdl.msn.com/public/chat/msnchat4.cab

O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) -

http://us.dl1.yimg.com/download.yahoo.com/.../yiebio4024.cab

O16 - DPF: {FCF289D4-0AC8-4ED8-BE31-E8AF09606AB5} (download_35mb_com.applet) -

http://www.35mb.com/downloadapplet.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{3243101D-0D98-40D0-83A9-D55D18F3BFB9}:

NameServer = 202.188.0.133,202.188.1.5

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1

\MSNMES~1\msgrapp.dll" (file missing)

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. -

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1

\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd -

C:\WINDOWS\System32\CTsvcCDA.EXE

O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program

Files\iPod\bin\iPodService.exe

O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner -

C:\WINDOWS\Nhksrv.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -

C:\WINDOWS\system32\nvsvc32.exe

I always get spyware warning everytime I use ie. This problem start when i install vcodec.

Can anyone help me to solve this problem.

jwbirdsong · January 26, 2006

First of all, you will need to print out this post and/or save a copy as a text file in Notepad so that you have a hard copy of these instructions; you can not have IE/Firefox/any browser open during the fix

Please temporarily disable MSAS by doing the following:

It may interfere with the fix.

Open Microsoft AntiSpyware.
Click on Options -> Settings.
In the left pane, click on Real-time Protection.
Under Startup Options uncheck Enable the Microsoft AntiSpyware Security Agents on startup (recommended).
Under Real-time spyware threat protection uncheck Enable real-time spyware threat protection (recommended).
After you uncheck these, click on the Save button and close Microsoft AntiSpyware.
Restart your computer.
Right click on the Microsoft AntiSpyware icon on the taskbar and select Shutdown Microsoft AntiSpyware

Make sure the settings are changed back when we are done.

Download smitRem.exe Â©noahdfear and save the file to your desktop.

Double click on the file to extract it to it's own folder on the desktop.

You may have previously ran some of the following programs, please run through the fix and run all programs listed, in order, and make sure to update all

Please download Ewido Anti-Malware, it is a free version of the program.

Install ewido security suite
When installing the program, under "Additonal Options" uncheck...
- Install background guard
- Install scan via context menu
[*] Launch ewido, there should now be an icon on your desktop, double-click it.
[*] The program will now open to the main screen.
[*] When you run ewido for the first time, you may get a warning "Database could not be found!". Click OK. We will fix this in a moment.
[*] You will need to update ewido to the latest definition files:
- On the left hand side of the main screen click update.
- Then click on Start Update.
[*] The update will start and a progress bar will show the updates being installed.
(the status bar at the bottom will display "Update successful")
[*] Close Ewido Security Suite

If you are having problems with the updater, you can use this link to manually update ewido.

Ewido manual updates

Next, please reboot your computer in SafeMode by doing the following:

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
Instead of Windows loading as normal, a menu should appear
Select the first option, to run Windows in Safe Mode.

Now scan with HJT and place a checkmark next to the following items

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present <<--- Leave IF set by you.
O16 - DPF: {FCF289D4-0AC8-4ED8-BE31-E8AF09606AB5} (download_35mb_com.applet) - http://www.35mb.com/downloadapplet.cab

Close all other windows and browsers and click FIX CHECKED

Close HiJackThis.

Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.

Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.

Run Ewido:

Click on scanner
Click on Complete System Scan, the scan will now begin.
While the scan is in progress you will be prompted to clean files, click OK.
When it asks if you want to clean the first file, put a checkmark in the lower left corner of the box that says "Perform action on all infections", then choose clean and click OK.
Once the scan has completed, there will be a button located at the bottom of the screen named Save Report.
Click Save Report.
Now save the report .txt file to your desktop.
Close Ewido

Next go to Control Panel click Display > Desktop > Customize Desktop > Web > Uncheck "Security Info" if present.

Reboot back into Windows and scan your system with Ad-aware:

Ad-aware SE - Download - Home Page

If you have a previous version of Ad-Aware installed, during the installation of the new version you will be prompted to uninstall or keep the older version - be sure to uninstall the previous version.

After installing Ad-aware, you will be prompted to update the program and run a full scan. De-select all boxes so that it does not run.

Manually run "Ad-Aware SE Personal" and from the main screen Click on "Check for Updates Now".

Once the definitions have been updated:

Reconfigure Ad-Aware for Full Scan as per the following instructions:

Launch the program, and click on the Gear at the top of the start screen.
Under General Settings the following boxes should all be checked off: (Checked will be indicated by a green circle with a check mark in it, Un-Checked is a red circle with an X in it. If it is greyed out, those features are only available in the retail version.)
- "Automatically save logfile"
- Automatically quarantine objects prior to removal"
- Safe Mode (always request confirmation)
- Prompt to update outdated confirmation) - Change to 7 days.
[*]Click the "Scanning" button (On the left side).
[*]Under Drives & Folders, select "Scan within Archives"
[*]Click "Click here to select Drives + folders" and select your installed hard drives.
[*]Under Memory & Registry, select all options.
[*]Click the "Advanced" button (On the left hand side).
[*]Under "Shell Integration", select "Move deleted files to Recycle Bin".
[*]Under "Log-file detail", select all options.
[*]Click on the "Defaults" button on the left.
[*]Type in the full url of what you want as your default homepage and searchpage e.g. http://www.google.com.
[*]Click the "Tweak" button (Again, on the left hand side).
[*]Expand "Scanning Engine" by clicking on the "+" (Plus) symbol and select the following:
- "Unload recognized processes during scanning."
- "Obtain command line of scanned processes"
- "Scan registry for all users instead of current user only"
[*]Under "Cleaning Engine", select the following:
- "Automatically try to unregister objects prior to deletion."
- "During removal, unload explorer and IE if necessary"
- "Let Windows remove files in use at next reboot."
- "Delete quarantined objects after restoring"
[*]Click on "Safety Settings" and select "Write-protect system files after repair (Hosts file, etc)"
[*]Click on "Proceed" to save these Preferences.
[*]Click on the "Scan Now" button on the left.
[*]Under "Select Scan Mode, be sure to select "Use Custom Scanning Options".

Close all programs except ad-aware.

Click on "Next" in the bottom right corner to start the scan.

Run the Ad-Aware scan and allow it to remove everything it finds and then REBOOT - Even if not prompted to.

After you log back in, Ad-Aware may run to finalize the scan and remove any locked files that it may of found. Allow it to finish.

Then run this online virus scan: ActiveScan

Once you are on the Panda site click the Scan your PC button
A new window will open...click the Check Now button
- Enter your Country
- Enter your State/Province
- Enter your e-mail address and click send(*NOTE it's perfectly safe to do so..You will NOT be spammed from this)
- Select either Home User or Company
Click the big Scan Now button
If/when you get a notice that Panda wants to install an ActiveX component allow it
It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
When download is complete, click on Local Disks to start the scan
When the scan completes, if anything is detected, click the See Report button, then Save Report and save it to a convenient location like your desktop.

Post the contents

of the Panda scan report
a new HijackThis Log
smitfiles.txt
Ewido Log

in a reply to this thread.

jwbirdsong · January 26, 2006

Also when you go to post your replies and have Notepad open..click Format>click wordwrap once to toggle the setting.

Edited January 26, 2006 by jwbirdsong

CapAyam · January 28, 2006

Hi. First of all i would like to thank you for helping. Here is what you asking for.

1-Panda scan report

I leave the pc when i scan, but when i came back it had reboot automaticaly. So i try start scanning again but i always got this same mssg again an again.. An error has occurred downloading Panda ActiveScan. Please repeat the process. If the error occurs again, restart your system and try againPossible causes of this error are:

Not allowing the application's ActiveX control to be downloaded.

Problems with the Internet connection.

The error could be due to a download error or an installation error due to lack of hard disk space, privileges etc.,...

and my pc still got 1.8gb free space.

2-New HijackThis Log

Logfile of HijackThis v1.99.1

Scan saved at 12:40:59 AM, on 1/29/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\Nhksrv.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\WINDOWS\System32\CTsvcCDA.EXE

C:\Program Files\ewido anti-malware\ewidoctrl.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

C:\WINDOWS\DELLMMKB.EXE

C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\ahead\InCD\InCD.exe

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\devldr32.exe

C:\WINDOWS\System32\MsPMSPSv.exe

C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe

C:\Program Files\Nikon\NkView6\NkvMon.exe

C:\Program Files\Netropa\OSD.exe

C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe

C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Effan\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/

R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll

O1 - Hosts: 207.68.172.246 msn.com

O2 - BHO: (no name) - {4da4616d-7e6e-4fd9-a2d5-b6c535733e22} - C:\WINDOWS\system32\hpD5DE.tmp (file missing)

O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll

O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll

O4 - HKLM\..\Run: [updReg] C:\WINDOWS\Updreg.exe

O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe

O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe

O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [inCD] C:\Program Files\ahead\InCD\InCD.exe

O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"

O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?

O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe

O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML

O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm

O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm

O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (file missing)

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe

O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200203...meInstaller.exe

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1125170363015

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/.../ymmapi_416.dll

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popc...aploader_v5.cab

O16 - DPF: {E87A6788-1D0F-4444-8898-1D25829B6755} - http://fdl.msn.com/public/chat/msnchat4.cab

O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.yahoo.com/.../yiebio4024.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{3243101D-0D98-40D0-83A9-D55D18F3BFB9}: NameServer = 202.188.0.133,202.188.1.5

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE

O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe

O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

3-smitfiles.txt

smitRem Â© log file

version 2.8

by noahdfear

Microsoft Windows XP [Version 5.1.2600]

The current date is: Sat 01/28/2006

The current time is: 20:09:22.14

Running from

C:\Documents and Settings\Effan\Desktop\smitRem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key

PSGuard.com key not present!

checking for WinHound.com key

WinHound.com key not present!

spyaxe uninstaller NOT present

Winhound uninstaller NOT present

SpywareStrike uninstaller NOT present

Existing Pre-run Files

~~~ Program Files ~~~

~~~ Shortcuts ~~~

Online Security Guide.url

Security Troubleshooting.url

~~~ Favorites ~~~

Antivirus Test Online.url

~~~ system32 folder ~~~

1024 dir

msvol.tlb

ld****.tmp

mssearchnet.exe

ncompat.tlb

nvctrl.exe

hp***.tmp

~~~ Icons in System32 ~~~

ts.ico

ot.ico

~~~ Windows directory ~~~

~~~ Drive root ~~~

~~~ Miscellaneous Files/folders ~~~

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03

Killing PID 1416 'explorer.exe'

Starting registry repairs

Registry repairs complete

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SharedTask Export after registry fix

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]

"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"

"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deleting files

Remaining Post-run Files

~~~ Program Files ~~~

~~~ Shortcuts ~~~

~~~ Favorites ~~~

~~~ system32 folder ~~~

nvctrl.exe

~~~ Icons in System32 ~~~

~~~ Windows directory ~~~

~~~ Drive root ~~~

~~~ Miscellaneous Files/folders ~~~

~~~ Wininet.dll ~~~

CLEAN!

~~~ Upon reboot ~~~

wininet.old present!

oleadm.dll not present!

oleext.dll not present!

~~~ Upon completion ~~~

wininet.old not present!

oleadm.dll not present!

oleext.dll not present!

~~~~ Rechecking C:\WINDOWS\system32\wininet.dll for infection ~~~~

~~~~ C:\WINDOWS\system32\wininet.dll Clean! ~~~~

4-Ewido Log

---------------------------------------------------------

ewido anti-malware - Scan report

---------------------------------------------------------

+ Created on: 10:21:53 PM, 1/28/2006

+ Report-Checksum: C8D1B676

+ Scan result:

:mozilla.6:C:\Documents and Settings\Effan\Application Data\Phoenix\Profiles\default\58qeh3xi.slt\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup

C:\Documents and Settings\Effan\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\BlackBox.class-7fb5dbb4-1c32dafb.class -> Trojan.Java.ClassLoader.f : Cleaned with backup

C:\Documents and Settings\Effan\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-645f4c2c-5de80dcc.class -> Trojan.ClassLoader.Dummy.d : Cleaned with backup

C:\Documents and Settings\Effan\Cookies\effan@com[2].txt -> Spyware.Cookie.Com : Cleaned with backup

C:\Documents and Settings\Effan\Cookies\[email protected][1].txt -> Spyware.Cookie.2o7 : Cleaned with backup

C:\Documents and Settings\Guest\Cookies\[email protected][1].txt -> Spyware.Cookie.2o7 : Cleaned with backup

C:\Documents and Settings\Hani\Cookies\[email protected][2].txt -> Spyware.Cookie.2o7 : Cleaned with backup

C:\Documents and Settings\Hani\Cookies\[email protected][2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup

C:\Documents and Settings\Hani\Cookies\[email protected][1].txt -> Spyware.Cookie.Euroclick : Cleaned with backup

C:\Documents and Settings\Hani\Cookies\[email protected][2].txt -> Spyware.Cookie.Specificclick : Cleaned with backup

C:\Documents and Settings\Hani\Cookies\hani@adorigin[1].txt -> Spyware.Cookie.Adorigin : Cleaned with backup

C:\Documents and Settings\Hani\Cookies\[email protected][1].txt -> Spyware.Cookie.Adorigin : Cleaned with backup

C:\Documents and Settings\Hani\Cookies\[email protected][1].txt -> Spyware.Cookie.Euniverseads : Cleaned with backup

C:\Documents and Settings\Hani\Cookies\[email protected][2].txt -> Spyware.Cookie.Pointroll : Cleaned with backup

C:\Documents and Settings\Hani\Cookies\[email protected][1].txt -> Spyware.Cookie.Hyperbanner : Cleaned with backup

C:\Documents and Settings\Hani\Cookies\hani@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup

C:\Documents and Settings\Hani\Cookies\hani@casalemedia[1].txt -> Spyware.Cookie.Casalemedia : Cleaned with backup

C:\Documents and Settings\Hani\Cookies\hani@com[1].txt -> Spyware.Cookie.Com : Cleaned with backup

C:\Documents and Settings\Hani\Cookies\[email protected][2].txt -> Spyware.Cookie.Clickzs : Cleaned with backup

C:\Documents and Settings\Hani\Cookies\[email protected][1].txt -> Spyware.Cookie.Overture : Cleaned with backup

C:\Documents and Settings\Hani\Cookies\[email protected][1].txt -> Spyware.Cookie.Com : Cleaned with backup

C:\Documents and Settings\Hani\Cookies\[email protected][1].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup

C:\Documents and Settings\Hani\Cookies\[email protected][1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup

C:\Documents and Settings\Hani\Cookies\[email protected][1].txt -> Spyware.Cookie.2o7 : Cleaned with backup

C:\Documents and Settings\Hani\Cookies\[email protected][1].txt -> Spyware.Cookie.Masterstats : Cleaned with backup

C:\Documents and Settings\Hani\Cookies\[email protected][1].txt -> Spyware.Cookie.2o7 : Cleaned with backup

C:\Documents and Settings\Hani\Cookies\[email protected][1].txt -> Spyware.Cookie.Overture : Cleaned with backup

C:\Documents and Settings\Hani\Cookies\hani@serving-sys[2].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup

C:\Documents and Settings\Hani\Cookies\hani@statcounter[2].txt -> Spyware.Cookie.Statcounter : Cleaned with backup

C:\Documents and Settings\Hani\Cookies\[email protected][1].txt -> Spyware.Cookie.Adbrite : Cleaned with backup

C:\Documents and Settings\Hani\Cookies\hani@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup

C:\Documents and Settings\Mama\Cookies\[email protected][1].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup

C:\Documents and Settings\Mama\Cookies\mama@com[2].txt -> Spyware.Cookie.Com : Cleaned with backup

C:\Program Files\Microsoft AntiSpyware\Quarantine\4E7B1117-85BB-4C05-85C4-E16DD1\90108ECA-EC37-4EDE-B864-0F88A2 -> Not-A-Virus.Hoax.Win32.Renos.at : Cleaned with backup

C:\Program Files\Microsoft AntiSpyware\Quarantine\AC248ACA-63AB-4E74-BD18-44A07A\8F5E0E50-79D7-44E0-9286-9D2F05 -> Not-A-Virus.Hoax.Win32.Renos.at : Cleaned with backup

C:\Program Files\Yahoo!\YPSR\Quarantine\20051030151807.zip/WINDOWS/NDNuninstall4_34.exe -> Spyware.NewDotNet : Cleaned with backup

C:\Program Files\Yahoo!\YPSR\Quarantine\20051030151807.zip/WINDOWS/NDNuninstall4_80.exe -> Spyware.NewDotNet : Cleaned with backup

C:\Program Files\Yahoo!\YPSR\Quarantine\20051030151807.zip/WINDOWS/NDNuninstall5_20.exe -> Spyware.NewDotNet : Cleaned with backup

C:\Program Files\Yahoo!\YPSR\Quarantine\20051030151807.zip/WINDOWS/NDNuninstall5_40.exe -> Spyware.NewDotNet : Cleaned with backup

C:\Program Files\Yahoo!\YPSR\Quarantine\20051030151807.zip/WINDOWS/NDNuninstall5_48.exe -> Adware.NewDotNet : Cleaned with backup

C:\Program Files\Yahoo!\YPSR\Quarantine\20051030151807.zip/WINDOWS/NDNuninstall5_64.exe -> Spyware.NewDotNet : Cleaned with backup

C:\Program Files\Yahoo!\YPSR\Quarantine\20051030151807.zip/WINDOWS/NDNuninstall6_10.exe -> Spyware.NewDotNet : Cleaned with backup

C:\Program Files\Yahoo!\YPSR\Quarantine\20051030151807.zip/WINDOWS/NDNuninstall6_22.exe -> Spyware.NewDotNet : Cleaned with backup

C:\Program Files\Yahoo!\YPSR\Quarantine\20051030151807.zip/WINDOWS/NDNuninstall6_30.exe -> Spyware.NewDotNet : Cleaned with backup

C:\Program Files\Yahoo!\YPSR\Quarantine\20051030151807.zip/WINDOWS/NDNuninstall6_38.exe -> Spyware.NewDotNet : Cleaned with backup

C:\Program Files\Yahoo!\YPSR\Quarantine\20051030151807.zip/WINDOWS/NDNuninstall6_90.exe -> Adware.NewDotNet : Cleaned with backup

C:\Program Files\Yahoo!\YPSR\Quarantine\20051030151807.zip/Program Files/newdotnet/uninstall6_38.exe -> Spyware.NewDotNet : Cleaned with backup

C:\Program Files\Yahoo!\YPSR\Quarantine\20051030151807.zip/Program Files/newdotnet/newdotnet6_90.dll -> Spyware.NewDotNet : Cleaned with backup

C:\Program Files\Yahoo!\YPSR\Quarantine\20051030151807.zip/Program Files/newdotnet/uninstall5_40.exe -> Spyware.NewDotNet : Cleaned with backup

C:\Program Files\Yahoo!\YPSR\Quarantine\20051030151807.zip/Program Files/newdotnet/uninstall6_90.exe -> Adware.NewDotNet : Cleaned with backup

C:\Program Files\Yahoo!\YPSR\Quarantine\20051030151807.zip/Program Files/newdotnet/newdotnet6_90.to_be_deleted -> Spyware.NewDotNet : Cleaned with backup

C:\Program Files\Yahoo!\YPSR\Quarantine\ppq42.tmp\ME2.DLL_tobedeleted -> Spyware.Downloadware : Cleaned with backup

C:\Program Files\Yahoo!\YPSR\Quarantine\ppq43.tmp\bdedownloader.dll -> Spyware.Altnet : Cleaned with backup

C:\Program Files\Yahoo!\YPSR\Quarantine\ppq43.tmp\bdefdi.dll -> Spyware.Altnet : Cleaned with backup

C:\Program Files\Yahoo!\YPSR\Quarantine\ppq43.tmp\dman25.dll -> Adware.BrilliantDigital : Cleaned with backup

C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP386\A0121365.exe -> Adware.NewDotNet : Cleaned with backup

C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP386\A0121369.exe -> Adware.NewDotNet : Cleaned with backup

C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP417\A0127003.dll -> Not-A-Virus.Hoax.Win32.Renos.at : Cleaned with backup

C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP423\A0127230.exe -> Downloader.Zlob.fa : Cleaned with backup

C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP424\A0127271.exe -> Downloader.Zlob.fa : Cleaned with backup

C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP424\snapshot\MFEX-1.DAT -> Downloader.Zlob.fa : Cleaned with backup

C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP426\A0127425.dll -> Not-A-Virus.Hoax.Win32.Renos.v : Cleaned with backup

C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP426\A0127430.exe -> Downloader.Zlob.fa : Cleaned with backup

C:\WINDOWS\Downloaded Program Files\popcaploader.dll -> Not-A-Virus.RiskWare.Downloader.PopCap.a : Cleaned with backup

C:\WINDOWS\SYSTEM32\nvctrl.exe -> Hijacker.SpyAxe : Cleaned with backup

::Report End

Edited January 28, 2006 by elfie

jwbirdsong · January 28, 2006

Looking really good!!

First of all, you will need to print out this post and/or save a copy as a text file in Notepad; that way you have a hard copy of these instructions; you can not have IE/Firefox/any browser open during the fix

Next, please enable viewing of hidden files as follows:

1) Go to My Computer, and click on the "Tools" menu

2) Click "Folder options"

3) Select the "View" tab

4) Make sure "Show hidden files and folders" is selected

5) Make sure "Hide extensions for known file types" is unchecked

6) Make sure "Hide protected operating system files (recommended)" is unchecked

Please run HijackThis and click "Scan." Place checks next to the following entries:

O2 - BHO: (no name) - {4da4616d-7e6e-4fd9-a2d5-b6c535733e22} - C:\WINDOWS\system32\hpD5DE.tmp (file missing)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popc...aploader_v5.cab

You may also optionally check the following entries for removal:

All of the following are UN-needed to run at startup. They can be ran as needed; saving system resources for better uses.

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

Close all browser and other windows except for HijackThis, and click "Fix Checked".

Restart your computer and try the Online scan HERE instead...Click on the Online scan button NOT the File scanner..agree to privacy statment and accept the Active X download..Once scan is complete save a log and post a new HijackThis and the Online scan results

ADDED..Also update your Java..go to Control Panel>click on the Java applet>Click Update tab and then Update button...Once the new version is installed and rebooted..Open ADD/Remove in Control Panel and uninstall ALL Java that is NOT version JRE 5 update 6

CapAyam · January 29, 2006

Hi jwbirdsong.

Here are my new...

1) HijackThis

Logfile of HijackThis v1.99.1

Scan saved at 4:19:06 AM, on 1/30/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\Nhksrv.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\WINDOWS\System32\CTsvcCDA.EXE

C:\Program Files\ewido anti-malware\ewidoctrl.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

C:\WINDOWS\DELLMMKB.EXE

C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\ahead\InCD\InCD.exe

C:\Program Files\Microsoft AntiSpyware\gcasServ.exe

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe

C:\Program Files\Nikon\NkView6\NkvMon.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\devldr32.exe

C:\WINDOWS\System32\MsPMSPSv.exe

C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe

C:\Program Files\Netropa\OSD.exe

C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Documents and Settings\Effan\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php