Spyware/Adware Infection Precaution Advisory

• rocky_509

  12 Aug 07, 21:59

  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 9:58:56 PM, on 8/12/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\WINDOWS\system32\cisvc.exe
  C:\Program Files\Eset\nod32krn.exe
  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
  C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
  C:\Program Files\Eset\nod32kui.exe
  C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
  C:\Program Files\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Common Files\Teleca Shared\Generic.exe
  C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
  C:\Program Files\Opera\Opera.exe
  C:\WINDOWS\system32\cidaemon.exe
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
  C:\Program Files\Windows Live\Messenger\usnsvc.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\Internet Download Manager\IDMan.exe
  C:\Program Files\RocketDock\RocketDock.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.singnet.com.sg/
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = fol.singnet.com:8080
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
  O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll (file missing)
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
  O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
  O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
  O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
  O4 - HKLM\..\Run: [System Files Updater] C:\WINDOWS\FlyakiteOSX\System Files Updater.exe /S
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
  O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
  O4 - HKLM\..\Run: [Rapget] C:\Documents and Settings\user\Desktop\rapget136\rapget.exe
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
  O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
  O4 - Global Startup: AudioDeck.lnk = C:\Program Files\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe
  O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
  O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-SG/a-UNO1/GAME_UNO1.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1182952140416
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
  O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
  O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
  O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
  O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
  O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
  
  --
  End of file - 7453 bytes
  
• rocky_509

  12 Aug 07, 22:00

  My com got virus uh?Suspect have leh.Nod32 detect.win32/adware.Relevant application.
• ndmmxiaomayi

  12 Aug 07, 22:15

  I suspect it's the Daemon Tools program. It installs extra programs if you don't read the license agreement carefully.
  
  

  [*]Open HijackThis.
  [*]Click on the Open the Misc Tools section button.
  [*]Look under System tools.
  [*]Click on the Open Uninstall Manager... button.
  [*]Click on the Save list... button.
  [*]It will prompt you to save. Save this log in a convenient location. By default it's named uninstall_list.txt.
  [*]Notepad will open. Please post this log in your next reply.
• rocky_509

  12 Aug 07, 22:42

  7-Zip 4.44 beta
  Ad-Aware 2007
  Ad-Aware SE Professional
  Adobe Flash Player 9 ActiveX
  Adobe Reader 8.1.0
  Apple Mobile Device Support
  Apple Software Update
  Barbie Magic Hair Styler
  BSplayer Pro 2.16.945
  CCleaner (remove only)
  CEDP Stealer 6.0 for Messenger
  ConvertXtoDVD 2.1.5.173
  DivX Content Uploader
  DivX Web Player
  Evil Msn
  Google Earth Pro
  Google Toolbar for Internet Explorer
  HijackThis 2.0.2
  Image Grabber II.NET
  Internet Download Manager
  iTunes
  J2SE Runtime Environment 5.0 Update 10
  J2SE Runtime Environment 5.0 Update 3
  Java(TM) 6 Update 2
  Java(TM) SE Runtime Environment 6 Update 1
  K-Lite Codec Pack 2.88 Full
  LimeWire PRO 4.14.4
  Microsoft .NET Framework 2.0
  Microsoft Office Professional Edition 2003
  Mozilla Firefox (2.0.0.6)
  MP3 Splitter & Joiner
  Nero 7 Ultra Edition
  neroxml
  NOD32 antivirus system
  NOD32 FiX v2.1
  Opera 9.20
  PowerDVD
  PSP Movie Creator(remove only)
  QuickTime
  Realtek RTL8139/810x Fast Ethernet NIC Driver Setup
  RocketDock 1.3.1
  SmartMovie Converter
  Sony Ericsson PC Suite
  Steam
  Strawberry Shortcake - Amazing Cookie Party
  Total Video Converter 3.02
  Update for Windows XP (KB898461)
  Veoh Player
  VIA Audio Driver Setup Program
  Windows Installer 3.1 (KB893803)
  Windows Live installer
  Windows Live Messenger
  Windows Live Sign-in Assistant
  Windows Media Format Runtime
  WinRAR archiver
  Yahoo! Install Manager
  Yahoo! Toolbar
  
  
• ndmmxiaomayi

  12 Aug 07, 23:13

  You have to remove NOD32 FiX 2.1... it's not advisable to crack a security product.
• rocky_509

  12 Aug 07, 23:22

  Originally posted by ndmmxiaomayi:

  You have to remove NOD32 FiX 2.1... it's not advisable to crack a security product.

  What's happen if i remove it?Will i able to run NOD32 still?
• ndmmxiaomayi

  12 Aug 07, 23:25

  Originally posted by rocky_509:

  What's happen if i remove it?Will i able to run NOD32 still?

  It will only be a trial product... after it expires, you can't use it.
  
  There are free softwares out there, use them. Or if you like NOD32, you have to purchase one.
• rocky_509

  12 Aug 07, 23:48

  No money to buy but i lyk NOD32 because it runs and scan system
  and makes no lagging unlike norton.
  
• _n00b_

  15 Aug 07, 12:07

  
  
  i keep getting this vundo file and i cant delete it...my virus scan on access scan keeps popping up too and also cant delete the file...i had to disable it so there will be no more popups...
  
  and i'm currently using FF but always failed to update and IE will pop up with some drivecleaner thing...
  
  any remedy?
• ndmmxiaomayi

  15 Aug 07, 12:11

  Step 1
  
  

  [*]Please download the latest copy of HijackThis from Trend Micro and save it to your desktop.
  [*]Double click on HJTInstall.exe to install it. Once installed, it will start automatically.
  [*]Close HijackThis.
  [*]Please go to C:\Program Files\Trend Micro\HijackThis and right click on HijackThis.exe. Select Rename.
  [*]Type in dumb and press Enter.
  [*]Double click on dumb to run it.
  [*]Select Do a system scan and save a logfile. Please post back this log in your next reply.

  Don't exit HijackThis yet.
  
  Step 2
  
  

  [*]Click on the Config... button at the bottom right hand corner.
  [*]At the top, click on the Misc Tools button.
  [*]Look under System tools.
  [*]Click on the Open Uninstall Manager... button.
  [*]Click on the Save list... button.
  [*]It will prompt you to save. Save this log in a convenient location. By default it's named uninstall_list.txt.
  [*]Notepad will open. Please post this list in your next reply.
• _n00b_

  15 Aug 07, 12:17

  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 12:16:25 PM, on 8/15/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16473)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  C:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Bonjour\mDNSResponder.exe
  C:\WINDOWS\system32\xxdnqkan.exe
  C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\WINDOWS\system32\svchost.exe
  C:\PROGRA~1\TVAV~1\TVAV~1\TVTray.exe
  C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe
  C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
  C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
  C:\WINDOWS\system32\RUNDLL32.EXE
  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  C:\WINDOWS\RTHDCPL.EXE
  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\Trend Micro\HijackThis\dumb.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://neopets.com/randomfriend.phtml?user=arataka777
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {0C5B4BE9-8DBC-49E2-9347-42E4FEDE78B9} - C:\WINDOWS\system32\mljjk.dll
  O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINDOWS\system32\pcjqipyi.dll
  O2 - BHO: (no name) - {E9BD0828-1FD9-410C-A50F-43EBE65D310F} - C:\WINDOWS\system32\efccabc.dll
  O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
  O3 - Toolbar: (no name) - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - (no file)
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
  O4 - HKLM\..\Run: [TVTray] C:\PROGRA~1\TVAV~1\TVAV~1\TVTray.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
  O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe"
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
  O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
  O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
  O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
  O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
  O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\system32\yvqomvjk.dll",forkonce
  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
  O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {02ECD07A-22D0-4AF0-BA0A-3F6B06086D08} (GamesCampus Control) - http://www.gamescampus.com/xiah/luncher/GamesCampus.cab
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
  O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
  O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
  O20 - Winlogon Notify: efccabc - C:\WINDOWS\SYSTEM32\efccabc.dll
  O20 - Winlogon Notify: mljjk - C:\WINDOWS\system32\mljjk.dll
  O20 - Winlogon Notify: winspool32 - winspool32.dll (file missing)
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
  O23 - Service: DomainService - - C:\WINDOWS\system32\xxdnqkan.exe
  O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
  O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: Windows User Mode Driver Frameworkre (Serviceikankan4) - Unknown owner - c:\windows\system32\SP00LSV.EXE (file missing)
  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
  O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe (file missing)
  
  --
  End of file - 10916 bytes
  
• _n00b_

  15 Aug 07, 12:18

  Ad-Aware SE Personal
  Adobe Anchor Service CS3
  Adobe Asset Services CS3
  Adobe Audition 2.0
  Adobe Bridge 1.0
  Adobe Bridge CS3
  Adobe Bridge CS3
  Adobe Bridge Start Meeting
  Adobe Camera Raw 4.0
  Adobe CMaps
  Adobe Color - Photoshop Specific
  Adobe Color Common Settings
  Adobe Color EU Extra Settings
  Adobe Color JA Extra Settings
  Adobe Color NA Recommended Settings
  Adobe Common File Installer
  Adobe Default Language CS3
  Adobe Device Central CS3
  Adobe ExtendScript Toolkit 2
  Adobe Flash Player 9 ActiveX
  Adobe Flash Player Plugin
  Adobe Fonts All
  Adobe Help Center 2.0
  Adobe Help Viewer CS3
  Adobe Linguistics CS3
  Adobe PDF Library Files
  Adobe Photoshop CS3
  Adobe Photoshop CS3
  Adobe Photoshop CS3
  Adobe Premiere Pro CS3
  Adobe Premiere Pro CS3
  Adobe Premiere Pro CS3 Functional Content
  Adobe Reader 7.0.5 Language Support
  Adobe Reader 7.0.9
  Adobe Setup
  Adobe Setup
  Adobe Setup
  Adobe Stock Photos CS3
  Adobe Type Support
  Adobe Update Manager CS3
  Adobe Version Cue CS3 Client
  Adobe WinSoft Linguistics Plugin
  Adobe XMP DVA Panels CS3
  Adobe XMP Panels CS3
  Apex Video Converter Free 5.97
  avast! Antivirus
  BitComet 0.70
  Canon MP Drivers
  Canon MP Toolbox 4.1.1.0.mp10
  CCleaner (remove only)
  CDRWIN
  CinemaForge
  DivX Codec 3.1alpha release
  DriverCD
  DVD Decrypter (Remove Only)
  GG E-Sports Platform
  Google Toolbar for Firefox
  GTK+ 2.8.9 runtime environment
  Hamachi 1.0.1.5
  HijackThis 2.0.2
  InterVideo FilterSDK for 10moons
  iriver plus 3 (remove only)
  J2SE Runtime Environment 5.0 Update 10
  J2SE Runtime Environment 5.0 Update 11
  J2SE Runtime Environment 5.0 Update 3
  J2SE Runtime Environment 5.0 Update 6
  J2SE Runtime Environment 5.0 Update 8
  J2SE Runtime Environment 5.0 Update 9
  Java 2 Runtime Environment, SE v1.4.2_11
  Java(TM) 6 Update 2
  Java(TM) SE Runtime Environment 6 Update 1
  K-Lite Mega Codec Pack 1.53
  Macromedia Dreamweaver MX
  Macromedia Extension Manager
  Macromedia Shockwave Player
  Marvell Miniport Driver
  McAfee VirusScan Enterprise
  Megaupload Toolbar
  Microsoft .NET Framework 1.1
  Microsoft .NET Framework 2.0
  Microsoft AppLocale
  Microsoft Compression Client Pack 1.0 for Windows XP
  Microsoft Internationalized Domain Names Mitigation APIs
  Microsoft National Language Support Downlevel APIs
  Microsoft Office Standard Edition 2003
  Microsoft User-Mode Driver Framework Feature Pack 1.0
  Microsoft Windows Application Compatibility Database
  Microsoft Windows Journal Viewer
  mIRC
  Mozilla Firefox (2.0.0.5)
  MSN Music Assistant
  MSXML 4.0 SP2 (KB92797
  Musicmatch® Jukebox
  Nero 7 Demo
  Nokia Connectivity Cable Driver
  Nokia PC Connectivity Solution
  Nokia PC Suite
  NVIDIA Drivers
  PDF Settings
  Picasa 2
  PSP Movie Creator(remove only)
  QuickTime
  Razer Copperhead
  RealPlayer
  REALTEK GbE & FE Ethernet PCI NIC Driver
  Realtek High Definition Audio Driver
  RM Converter 3
  Security Update for Microsoft .NET Framework 2.0 (KB928365)
  Security Update for Windows Internet Explorer 7 (KB928090)
  Security Update for Windows Internet Explorer 7 (KB929969)
  Security Update for Windows Internet Explorer 7 (KB93176
  Security Update for Windows Internet Explorer 7 (KB933566)
  Skype 2.5
  Spybot - Search & Destroy 1.4
  TeamSpeak 2 RC2
  TV AV
  VSO Image Resizer 1.0.11b
  Windows Driver Package - Nokia Modem (06/12/2006 6.81.0.21)
  Windows Internet Explorer 7
  Windows Live Messenger
  Windows Live Messenger
  Windows Live OneCare safety scanner
  Windows Live Sign-in Assistant
  Windows Media Format 11 runtime
  Windows Media Format 11 runtime
  Windows Media Player 11
  Windows Media Player 11
  WinRAR archiver
  XviD4PSP
  Yahoo! Install Manager
  Yahoo! Toolbar
  YAWLE 0.5b
  
  
• _n00b_

  15 Aug 07, 12:19

  the 2 logfiles for reference...thanks...
  
  and i now get a blank page whenever i click on the email button in my msn...
• ndmmxiaomayi

  15 Aug 07, 12:23

  The email problem... not so sure what's happening there. Fix your virus problem first.
  
  

  [*]Please download VundoFix.exe by Atribune from Atribune and save it to your desktop.
  [*]Double click VundoFix.exe to run it.
  [*]Click the Scan for Vundo button.
  [*]Once it's done scanning, click the Remove Vundo button.
  [*]You will receive a prompt asking if you want to remove the files, click YES
  [*]Once you click yes, your desktop will go blank as it starts removing Vundo.
  [*]When completed, it will prompt that it will reboot your computer, click OK.
  [*]Please post the contents of C:\vundofix.txt and a new HiJackThis log.

  Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.
  
  In your next reply, please post:
  
  

  [*]VundoFix report (C:\VundoFix.txt)
  [*]A new HijackThis log
• _n00b_

  15 Aug 07, 12:35

  
  VundoFix V6.5.7
  
  Checking Java version...
  
  Java version is 1.5.0.3
  Old versions of java are exploitable and should be removed.
  
  Java version is 1.5.0.6
  Old versions of java are exploitable and should be removed.
  
  Java version is 1.5.0.8
  Old versions of java are exploitable and should be removed.
  
  Java version is 1.5.0.9
  Old versions of java are exploitable and should be removed.
  
  Java version is 1.5.0.10
  
  Java version is 1.5.0.11
  
  Scan started at 12:24:47 PM 8/15/2007
  
  Listing files found while scanning....
  
  C:\windows\system32\bgehjosw.exe
  C:\WINDOWS\system32\efccabc.dll
  C:\windows\system32\evhrifbw.exe
  C:\windows\system32\jvyrwyxc.exe
  C:\WINDOWS\system32\kjjlm.bak1
  C:\WINDOWS\system32\kjjlm.bak2
  C:\WINDOWS\system32\kjjlm.ini
  C:\windows\system32\kjvmoqvy.ini
  C:\WINDOWS\system32\mljjk.dll
  C:\WINDOWS\system32\pcjqipyi.dll
  C:\windows\system32\strahhvu.exe
  C:\WINDOWS\system32\yvqomvjk.dll
  
  Beginning removal...
  
  Attempting to delete C:\windows\system32\bgehjosw.exe
  C:\windows\system32\bgehjosw.exe Has been deleted!
  
  Attempting to delete C:\WINDOWS\system32\efccabc.dll
  C:\WINDOWS\system32\efccabc.dll Could not be deleted.
  
  Attempting to delete C:\windows\system32\evhrifbw.exe
  C:\windows\system32\evhrifbw.exe Has been deleted!
  
  Attempting to delete C:\windows\system32\jvyrwyxc.exe
  C:\windows\system32\jvyrwyxc.exe Has been deleted!
  
  Attempting to delete C:\WINDOWS\system32\kjjlm.bak1
  C:\WINDOWS\system32\kjjlm.bak1 Has been deleted!
  
  Attempting to delete C:\WINDOWS\system32\kjjlm.bak2
  C:\WINDOWS\system32\kjjlm.bak2 Has been deleted!
  
  Attempting to delete C:\WINDOWS\system32\kjjlm.ini
  C:\WINDOWS\system32\kjjlm.ini Has been deleted!
  
  Attempting to delete C:\windows\system32\kjvmoqvy.ini
  C:\windows\system32\kjvmoqvy.ini Has been deleted!
  
  Attempting to delete C:\WINDOWS\system32\mljjk.dll
  C:\WINDOWS\system32\mljjk.dll Could not be deleted.
  
  Attempting to delete C:\WINDOWS\system32\pcjqipyi.dll
  C:\WINDOWS\system32\pcjqipyi.dll Has been deleted!
  
  Attempting to delete C:\windows\system32\strahhvu.exe
  C:\windows\system32\strahhvu.exe Has been deleted!
  
  Attempting to delete C:\WINDOWS\system32\yvqomvjk.dll
  C:\WINDOWS\system32\yvqomvjk.dll Has been deleted!
  
  Performing Repairs to the registry.
  Done!
  
  Beginning removal...
  
  Attempting to delete C:\WINDOWS\system32\efccabc.dll
  C:\WINDOWS\system32\efccabc.dll Has been deleted!
  
  Performing Repairs to the registry.
  Done!
  
• _n00b_

  15 Aug 07, 12:37

  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 12:37:08 PM, on 8/15/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16473)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  C:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Bonjour\mDNSResponder.exe
  C:\WINDOWS\system32\xxdnqkan.exe
  C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\WINDOWS\system32\svchost.exe
  C:\PROGRA~1\TVAV~1\TVAV~1\TVTray.exe
  C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe
  C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
  C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
  C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
  C:\WINDOWS\system32\RUNDLL32.EXE
  C:\WINDOWS\RTHDCPL.EXE
  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\Trend Micro\HijackThis\dumb.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://neopets.com/randomfriend.phtml?user=arataka777
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {0C5B4BE9-8DBC-49E2-9347-42E4FEDE78B9} - C:\WINDOWS\system32\mljjk.dll (file missing)
  O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
  O3 - Toolbar: (no name) - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - (no file)
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
  O4 - HKLM\..\Run: [TVTray] C:\PROGRA~1\TVAV~1\TVAV~1\TVTray.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
  O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe"
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
  O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
  O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
  O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
  O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
  O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {02ECD07A-22D0-4AF0-BA0A-3F6B06086D08} (GamesCampus Control) - http://www.gamescampus.com/xiah/luncher/GamesCampus.cab
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
  O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
  O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
  O20 - Winlogon Notify: winspool32 - winspool32.dll (file missing)
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
  O23 - Service: DomainService - - C:\WINDOWS\system32\xxdnqkan.exe
  O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
  O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: Windows User Mode Driver Frameworkre (Serviceikankan4) - Unknown owner - c:\windows\system32\SP00LSV.EXE (file missing)
  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
  O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe (file missing)
  
  --
  End of file - 10549 bytes
  
• ndmmxiaomayi

  15 Aug 07, 12:51

  Please download Combofix from Tech Support Forum or Bleeping Computer. Save it to your desktop.
  
  Double click to run it. Follow the prompts. Once done, it will reboot and a log will be produced. Please post that log and a new HijackThis log in your next reply.
  
  Do not mouse click on Combofix while it is running. That may cause it to stall.
• _n00b_

  15 Aug 07, 13:12

  ComboFix 07-08-14.4 - "Luc" 2007-08-15 13:00:31.1 - NTFSx86
  Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.442 [GMT 8:00]
  * Created a new restore point
  
  ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
  
  C:\WINDOWS\system32\krrnpyku.ini
  C:\WINDOWS\system32\ukypnrrk.dll
  C:\WINDOWS\system32\xxdnqkan.exe
  
  ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
  
  -------\LEGACY_DOMAINSERVICE
  -------\DomainService
  
  ((((((((((((((((((((((((( Files Created from 2007-07-15 to 2007-08-15 )))))))))))))))))))))))))))))))
  
  2007-08-15 12:59 51,200 --a------ C:\WINDOWS\nircmd.exe
  2007-08-15 12:24 d-------- C:\VundoFix Backups
  2007-08-15 12:13 d-------- C:\Program Files\Trend Micro
  2007-08-15 02:59 94,552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
  2007-08-15 02:59 90,112 --a------ C:\WINDOWS\system32\AvastSS.scr
  2007-08-15 02:59 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
  2007-08-15 02:59 733,824 --a------ C:\WINDOWS\system32\aswBoot.exe
  2007-08-15 02:59 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
  2007-08-15 02:59 26,888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
  2007-08-15 02:59 23,416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
  2007-08-15 02:59 d-------- C:\Program Files\Alwil Software
  2007-08-09 13:00 d-------- C:\Program Files\Winnydows
  2007-08-09 13:00 d-------- C:\Program Files\ffdshow
  2007-08-09 12:56 d-------- C:\temp
  2007-08-09 12:52 d-------- C:\Program Files\PQDVD
  2007-08-05 10:53 d-------- C:\quarantine
  2007-07-21 20:09 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
  2007-07-21 18:01 d-------- C:\WINDOWS\OPTIONS
  2007-07-21 18:01 d-------- C:\DOCUME~1\Luc\APPLIC~1\InstallShield
  2007-07-20 21:41 172,032 --a------ C:\WINDOWS\system32\igfxres.dll
  2007-07-20 21:16 57,344 --a------ C:\WINDOWS\system32\igxprd32.dll
  2007-07-20 21:16 5,760,096 --a------ C:\WINDOWS\system32\drivers\igxpmp32.sys
  2007-07-20 21:16 245,760 --a------ C:\WINDOWS\system32\igfxsrvc.exe
  2007-07-20 21:16 204,800 --a------ C:\WINDOWS\system32\igfxCoIn_v4820.dll
  2007-07-20 21:16 2,681,344 --a------ C:\WINDOWS\system32\igxpdx32.dll
  2007-07-20 21:16 150,528 --a------ C:\WINDOWS\system32\igxpgd32.dll
  2007-07-20 21:16 135,168 --a------ C:\WINDOWS\system32\igfxtray.exe
  2007-07-20 21:16 1,717,920 --a------ C:\WINDOWS\system32\igxpdv32.dll
  2007-07-20 21:16 d-------- C:\Intel
  2007-07-20 20:48 143,360 -ra------ C:\WINDOWS\system32\RtlCPAPI.dll
  2007-07-20 20:46 69,632 -r------- C:\WINDOWS\Alcmtr.exe
  2007-07-20 20:46 364,544 -r------- C:\WINDOWS\RtlUpd.exe
  2007-07-20 20:46 2,879,488 -r------- C:\WINDOWS\SkyTel.exe
  2007-07-20 20:46 2,158,592 -r------- C:\WINDOWS\MicCal.exe
  2007-07-20 20:46 d-------- C:\Program Files\Marvell
  2007-07-20 16:37 61,440 -ra------ C:\WINDOWS\system32\iAlmCoIn_v4543.dll
  2007-07-20 16:37 40,960 -ra------ C:\WINDOWS\system32\ialmuTRK.dll
  2007-07-20 16:37 40,960 -ra------ C:\WINDOWS\system32\ialmuTHA.dll
  2007-07-20 16:36 956,026 -ra------ C:\WINDOWS\system32\ialmdd5.dll
  2007-07-20 16:36 520,192 --a------ C:\WINDOWS\system32\igfxcfg.exe
  2007-07-20 16:36 49,152 -ra------ C:\WINDOWS\system32\ialmrem.dll
  2007-07-20 16:36 47,616 --a------ C:\WINDOWS\system32\igfxsrvc.dll
  2007-07-20 16:36 450,560 --a------ C:\WINDOWS\system32\igldev32.dll
  2007-07-20 16:36 45,694 -ra------ C:\WINDOWS\system32\ialmrnt5.dll
  2007-07-20 16:36 40,960 -ra------ C:\WINDOWS\system32\ialmuSVE.dll
  2007-07-20 16:36 40,960 -ra------ C:\WINDOWS\system32\ialmuRUS.dll
  2007-07-20 16:36 40,960 -ra------ C:\WINDOWS\system32\ialmuPTG.dll
  2007-07-20 16:36 40,960 -ra------ C:\WINDOWS\system32\ialmuPTB.dll
  2007-07-20 16:36 40,960 -ra------ C:\WINDOWS\system32\ialmuPLK.dll
  2007-07-20 16:36 40,960 -ra------ C:\WINDOWS\system32\ialmuNOR.dll
  2007-07-20 16:36 40,960 -ra------ C:\WINDOWS\system32\ialmuNLD.dll
  2007-07-20 16:36 40,960 -ra------ C:\WINDOWS\system32\ialmuKOR.dll
  2007-07-20 16:36 40,960 -ra------ C:\WINDOWS\system32\ialmuJPN.dll
  2007-07-20 16:36 40,960 -ra------ C:\WINDOWS\system32\ialmuITA.dll
  2007-07-20 16:36 40,960 -ra------ C:\WINDOWS\system32\ialmuHUN.dll
  2007-07-20 16:36 40,960 -ra------ C:\WINDOWS\system32\ialmuHEB.dll
  2007-07-20 16:36 40,960 -ra------ C:\WINDOWS\system32\ialmuFRC.dll
  2007-07-20 16:36 40,960 -ra------ C:\WINDOWS\system32\ialmuFRA.dll
  2007-07-20 16:36 40,960 -ra------ C:\WINDOWS\system32\ialmuFIN.dll
  2007-07-20 16:36 40,960 -ra------ C:\WINDOWS\system32\ialmuESP.dll
  2007-07-20 16:36 40,960 -ra------ C:\WINDOWS\system32\ialmuENG.dll
  2007-07-20 16:36 40,960 -ra------ C:\WINDOWS\system32\ialmuELL.dll
  2007-07-20 16:36 40,960 -ra------ C:\WINDOWS\system32\ialmuDEU.dll
  2007-07-20 16:36 40,960 -ra------ C:\WINDOWS\system32\ialmuDAN.dll
  2007-07-20 16:36 40,960 -ra------ C:\WINDOWS\system32\ialmuCSY.dll
  2007-07-20 16:36 40,960 -ra------ C:\WINDOWS\system32\ialmuCHT.dll
  2007-07-20 16:36 40,960 -ra------ C:\WINDOWS\system32\ialmuCHS.dll
  2007-07-20 16:36 40,960 -ra------ C:\WINDOWS\system32\ialmuARB.dll
  2007-07-20 16:36 40,960 -ra------ C:\WINDOWS\system32\ialmuARA.dll
  2007-07-20 16:36 3,293,184 --a------ C:\WINDOWS\system32\igfxress.dll
  2007-07-20 16:36 24,576 --a------ C:\WINDOWS\system32\igfxexps.dll
  2007-07-20 16:36 238,650 -ra------ C:\WINDOWS\system32\ialmdev5.dll
  2007-07-20 16:36 204,800 --a------ C:\WINDOWS\system32\igfxpph.dll
  2007-07-20 16:36 204,800 --a------ C:\WINDOWS\system32\igfxdev.dll
  2007-07-20 16:36 2,334,720 --a------ C:\WINDOWS\system32\iglicd32.dll
  2007-07-20 16:36 163,840 --a------ C:\WINDOWS\system32\igfxzoom.exe
  2007-07-20 16:36 159,744 --a------ C:\WINDOWS\system32\igfxext.exe
  2007-07-20 16:36 155,648 --a------ C:\WINDOWS\system32\hkcmd.exe
  2007-07-20 16:36 135,168 --a------ C:\WINDOWS\system32\igfxdo.dll
  2007-07-20 16:36 131,072 --a------ C:\WINDOWS\system32\igfxpers.exe
  2007-07-20 16:36 121,467 -ra------ C:\WINDOWS\system32\ialmdnt5.dll
  2007-07-20 16:36 114,688 -ra------ C:\WINDOWS\system32\ialmudlg.exe
  2007-07-20 16:36 102,400 --a------ C:\WINDOWS\system32\hccutils.dll
  2007-07-20 16:36 1,166,972 -ra------ C:\WINDOWS\system32\drivers\ialmnt5.sys
  2007-07-20 02:33 5,810 -ra------ C:\WINDOWS\system32\drivers\ASACPI.sys
  
  (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
  
  2007-08-15 12:29 96256 --a------ C:\WINDOWS\system32\drivers\sptd7901.sys
  2007-08-15 12:20 --------- d-------- C:\DOCUME~1\Luc\APPLIC~1\MegauploadToolbar
  2007-08-15 03:18 --------- d-------- C:\Program Files\DAEMON Tools
  2007-08-09 12:50 --------- d-------- C:\Program Files\WinAVI MP4 Converter
  2007-08-07 21:29 --------- d-------- C:\Program Files\mIRC
  2007-08-05 08:42 --------- d-------- C:\Program Files\MegauploadToolbar
  2007-07-24 23:34 --------- d-------- C:\DOCUME~1\Luc\APPLIC~1\Vso
  2007-07-23 13:23 --------- d-------- C:\Program Files\Common Files\Logitech
  2007-07-21 18:01 --------- d--h----- C:\Program Files\InstallShield Installation Information
  2007-07-21 18:01 --------- d-------- C:\Program Files\Realtek
  2007-07-07 22:00 --------- d-------- C:\Program Files\CDRWIN
  2007-07-06 02:30 --------- d-------- C:\Program Files\DVD Decrypter
  2007-07-06 00:13 --------- d-------- C:\Program Files\Total Video Converter
  2007-06-29 21:17 --------- d-------- C:\Program Files\MSN Messenger
  2007-06-25 22:30 86016 --a------ C:\WINDOWS\system32\WNASPINT.DLL
  2007-05-16 23:12 86528 --a--c--- C:\WINDOWS\system32\dllcache\directdb.dll
  2007-05-16 23:12 85504 --a--c--- C:\WINDOWS\system32\dllcache\wabimp.dll
  2007-05-16 23:12 683520 --a--c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
  2007-05-16 23:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll
  2007-05-16 23:12 510976 --a--c--- C:\WINDOWS\system32\dllcache\wab32.dll
  2007-05-16 23:12 1314816 --a--c--- C:\WINDOWS\system32\dllcache\msoe.dll
  2006-11-03 00:35 66 --a--c--- C:\DOCUME~1\Luc\APPLIC~1\SQSDRVRM.SYS
  2005-05-13 09:12:00 217,073 -csha-r C:\WINDOWS\meta4.exe
  2005-10-24 03:13:58 66,560 --sha-r C:\WINDOWS\MOTA113.exe
  2005-10-13 13:27:00 422,400 -csha-r C:\WINDOWS\x2.64.exe
  2006-12-31 02:16:36 313,344 -csha-w C:\WINDOWS\system32\avisynth.dll
  2005-07-14 04:31:20 27,648 --sha-r C:\WINDOWS\system32\AVSredirect.dll
  2005-06-26 07:32:28 616,448 -csha-r C:\WINDOWS\system32\cygwin1.dll
  2005-06-21 14:37:42 45,568 --sha-r C:\WINDOWS\system32\cygz.dll
  2004-01-25 16:18:34 70,656 --sha-w C:\WINDOWS\system32\i420vfw.dll
  2006-04-27 02:24:24 2,945,024 -csha-r C:\WINDOWS\system32\Smab.dll
  2005-02-28 05:16:22 240,128 --sha-r C:\WINDOWS\system32\x.264.exe
  2004-01-25 16:18:44 70,656 --sha-w C:\WINDOWS\system32\yv12vfw.dll
  
  ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
  
  *Note* empty entries & legit default entries are not shown
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0C5B4BE9-8DBC-49E2-9347-42E4FEDE78B9}]
  C:\WINDOWS\system32\mljjk.dll
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "NvCplDaemon"="RUNDLL32.exe" [2004-08-04 20:00 C:\WINDOWS\system32\rundll32.exe]
  "nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe]
  "TVTray"="C:\PROGRA~1\TVAV~1\TVAV~1\TVTray.exe" [2004-09-10 10:14]
  "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
  "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40]
  "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-11-08 00:32]
  "QuickTime Task"="C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" [2007-02-16 10:54]
  "ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2004-09-22 20:00]
  "McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 03:50]
  "Network Associates Error Reporting Service"="C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" [2003-10-07 09:48]
  "NvMediaCenter"="RUNDLL32.exe" [2004-08-04 20:00 C:\WINDOWS\system32\rundll32.exe]
  "RTHDCPL"="RTHDCPL.EXE" [2006-08-01 19:10 C:\WINDOWS\RTHDCPL.exe]
  "SkyTel"="SkyTel.EXE" [2006-05-16 18:04 C:\WINDOWS\SkyTel.exe]
  "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-04-16 12:51]
  "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-04-16 12:51]
  "Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-04-16 12:51]
  "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-19 00:13]
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54]
  "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00]
  "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 13:32]
  "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 01:04]
  
  C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
  Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa]
  antiwpa.dll 2005-07-06 15:15 5632 C:\WINDOWS\system32\antiwpa.dll
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winspool32]
  winspool32.dll
  
  R0 iteraid;ITERAID_Service_Install;C:\WINDOWS\system32\DRIVERS\iteraid.sys
  R1 NaiAvTdi1;NaiAvTdi1;C:\WINDOWS\system32\drivers\mvstdi5x.sys
  R3 Cap7134;713x TV Card Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys
  R3 EntDrv51;EntDrv51;\??\C:\WINDOWS\system32\drivers\EntDrv51.sys
  R3 PhTVTune;TV AV WDM TVTuner (FM1216ME);C:\WINDOWS\system32\DRIVERS\PhTVTune.sys
  S2 Serviceikankan4;Windows User Mode Driver Frameworkre;c:\windows\system32\SP00LSV.EXE
  S3 DrvFltIp;DrvFltIp;\??\C:\Program Files\MRBDG\DrvFltIp.sys
  S3 kaspersky1;kaspersky1;\??\C:\Documents and Settings\- L -\Desktop\Kaspersky_Engine_5[1].3.310_(Public_Version)\kaspersky.sys
  S3 UsbFltr;%SvcDisplayName%;C:\WINDOWS\system32\drivers\copperhd.sys
  
  *Newly Created Service* - ENTDRV51
  
  **************************************************************************
  
  catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2007-08-15 13:08:45
  Windows 5.1.2600 Service Pack 2 NTFS
  
  scanning hidden processes ...
  
  scanning hidden autostart entries ...
  
  scanning hidden files ...
  
  scan completed successfully
  hidden files: 0
  
  **************************************************************************
  
  Completion time: 2007-08-15 13:10:50 - machine was rebooted
  C:\ComboFix-quarantined-files.txt ... 2007-08-15 13:10
  
  --- E O F ---
  
• _n00b_

  15 Aug 07, 13:14

  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 1:12:25 PM, on 8/15/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16473)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  C:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Bonjour\mDNSResponder.exe
  C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  C:\PROGRA~1\TVAV~1\TVAV~1\TVTray.exe
  C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe
  C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
  C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
  C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
  C:\WINDOWS\system32\RUNDLL32.EXE
  C:\WINDOWS\RTHDCPL.EXE
  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\WINDOWS\system32\notepad.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\Trend Micro\HijackThis\dumb.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://neopets.com/randomfriend.phtml?user=arataka777
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {0C5B4BE9-8DBC-49E2-9347-42E4FEDE78B9} - C:\WINDOWS\system32\mljjk.dll (file missing)
  O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
  O3 - Toolbar: (no name) - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - (no file)
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
  O4 - HKLM\..\Run: [TVTray] C:\PROGRA~1\TVAV~1\TVAV~1\TVTray.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
  O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe"
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
  O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
  O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
  O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
  O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {02ECD07A-22D0-4AF0-BA0A-3F6B06086D08} (GamesCampus Control) - http://www.gamescampus.com/xiah/luncher/GamesCampus.cab
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
  O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
  O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
  O20 - Winlogon Notify: winspool32 - winspool32.dll (file missing)
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
  O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
  O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: Windows User Mode Driver Frameworkre (Serviceikankan4) - Unknown owner - c:\windows\system32\SP00LSV.EXE (file missing)
  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
  O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe (file missing)
  
  --
  End of file - 10406 bytes
  
• ndmmxiaomayi

  15 Aug 07, 13:36

  Step 1
  
  

  [*]Go to Start > All Programs > Spybot - Search & Destroy > Spybot Search & Destroy.
  [*]Click on Mode > Advanced Mode. When it prompts you, click Yes.
  [*]On the left hand side, click on Tools.
  [*]Check (tick) this box if it is not yet ticked: Resident.
  [*]You will notice that Resident is now added under Tools. Click on Resident.
  [*]Uncheck (untick) this box: Resident "TeaTimer" (Protection of over-all system settings) active.
  [*]Exit Spybot Search & Destroy.

  
  
  Step 2
  
  Open HijackThis and select Do a system scan only
  
  Put a tick next to this lines:
  
  O2 - BHO: (no name) - {0C5B4BE9-8DBC-49E2-9347-42E4FEDE78B9} - C:\WINDOWS\system32\mljjk.dll (file missing)
  O3 - Toolbar: (no name) - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - (no file)
  O20 - Winlogon Notify: winspool32 - winspool32.dll (file missing)
  O23 - Service: Windows User Mode Driver Frameworkre (Serviceikankan4) - Unknown owner - c:\windows\system32\SP00LSV.EXE (file missing)
  
  Click Fix checked.
  
  Close HijackThis.
  
  Step 3
  
  Reboot into Safe Mode by following the instructions below:
  
  Restart your computer in Safe Mode.
  
  

  [*]When you see BIOS screen, start pressing F8.
  [*]A boot menu will appear shortly.
  [*]Using the up down arrows, select Safe Mode and press the Enter key.
  [*]Windows will now load.
  [*]Log in to your usual account.

  
  
  Step 4
  
  Show hidden files and folders
  

  [*]Open My Computer.
  [*]Go to Tools > Folder Options.
  [*]Select the View tab.
  [*]Scroll down to Hidden files and folders.
  [*]Select Show hidden files and folders.
  [*]Uncheck (untick) Hide extensions of known file types.
  [*]Uncheck (untick) Hide protected operating system files (Recommended).
  [*]Click Yes when prompted.
  [*]Click OK.
  [*]Close My Computer.

  
  
  Delete these files if they are present:
  
  C:\Windows\system32\winspool32.dll
  c:\windows\system32\SP00LSV.EXE
  
  Restart your computer back to Normal Mode and post a new HijackThis log.
• _n00b_

  15 Aug 07, 14:26

  i only found spoolssv.exe...deleted this file only...the other file cant find...only have similar files like winspools.exe...no need to touch right?
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 2:26:14 PM, on 8/15/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16473)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  C:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\Program Files\Bonjour\mDNSResponder.exe
  C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  C:\WINDOWS\Explorer.EXE
  C:\PROGRA~1\TVAV~1\TVAV~1\TVTray.exe
  C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe
  C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
  C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
  C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
  C:\WINDOWS\system32\RUNDLL32.EXE
  C:\WINDOWS\RTHDCPL.EXE
  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\Trend Micro\HijackThis\dumb.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://neopets.com/randomfriend.phtml?user=arataka777
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
  O4 - HKLM\..\Run: [TVTray] C:\PROGRA~1\TVAV~1\TVAV~1\TVTray.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
  O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe"
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
  O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
  O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
  O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
  O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {02ECD07A-22D0-4AF0-BA0A-3F6B06086D08} (GamesCampus Control) - http://www.gamescampus.com/xiah/luncher/GamesCampus.cab
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
  O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
  O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
  O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
  O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: Windows User Mode Driver Frameworkre (Serviceikankan4) - Unknown owner - c:\windows\system32\SP00LSV.EXE (file missing)
  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
  O23 - Service: Print Spooler (Spooler) - Unknown owner - C:\WINDOWS\system32\spoolsv.exe (file missing)
  O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe (file missing)
  
  --
  End of file - 10039 bytes
  
• ndmmxiaomayi

  15 Aug 07, 15:15

  i only found spoolssv.exe...deleted this file only...the other file cant find...only have similar files like winspools.exe...no need to touch right?

  spoolssv.exe - if that's the correct spelling, you need to delete this file. Note the extra "s" in this file name.
  
  spoolsv.exe is Windows file.
  
  winspools.exe is not a Windows file, you need to delete it.
  
  sp00lsv.exe - is not Windows file either. The O has been replaced with 0 (zero).
  
  You need to delete those files, except spoolsv.exe.
• _n00b_

  15 Aug 07, 15:26

  i see
  
  winspool.drv, winspool.exe
  
  spoolss.dll, spool folder
  
  these are the similar items...
• ndmmxiaomayi

  15 Aug 07, 15:30

  Originally posted by _n00b_:

  i see
  
  winspool.drv, winspool.exe
  
  spoolss.dll, spool folder
  
  these are the similar items...

  All these need to go...
• _n00b_

  15 Aug 07, 15:52

  i'm unable to delete winspool.drv...says access is denied...