Help! My PC is serious infected by spyware!

• ndmmxiaomayi

  15 Jun 06, 13:24

  Originally posted by joeacid:

  Thanks hehe~ Hmm.... for the C:\WINDOWS\System32\hp100.tmp (file missing), i dunno why but no matter how many times i fix it, it'll still be there~
  
  Hmm... b4 i carry on to fixing C:\WINDOWS\System32\Kerne0110.exe, i wanna confirm it with u~ do i hav to fix this? Coz the last time u told me u're unsure of it~ so its okay to fix it?

  C:\WINDOWS\System32\hp100.tmp is a temporary file, so it will always appear no matter what.
  
  As for C:\WINDOWS\System32\Kerne0110.exe, it is safe to fix it. It's the F3 entry at the top of log that is hard to fix.
• joeacid

  16 Jun 06, 04:17

  Originally posted by ndmmxiaomayi:

  C:\WINDOWS\System32\hp100.tmp is a temporary file, so it will always appear no matter what.
  
  As for C:\WINDOWS\System32\Kerne0110.exe, it is safe to fix it. It's the F3 entry at the top of log that is hard to fix.

  Yup, C:\WINDOWS\System32\hp100.tmp always keep reappearing.
  
  I managed to fix:
  C:\WINDOWS\System32\Kerne0110.exe
  O2 - BHO: (no name) - {686a161d-5bd1-4999-8832-6393f41e564c} -
  O20 - Winlogon Notify: winjrs32 - C:\WINDOWS\SYSTEM32\winjrs32.dll
  
  But can't find this:
  O20 - Winlogon Notify: IPConfTSP - C:\WINDOWS\system32\h6l2lg3o16.dll
• joeacid

  16 Jun 06, 04:18

  Here's my new log file:
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
  C:\WINDOWS\System32\CTSvcCDA.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
  C:\WINDOWS\system32\rundll32.exe
  C:\WINDOWS\System32\devldr32.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\System32\dcomcfg.exe
  C:\Program Files\Creative\SBLive2k\AudioHQ\AHQTB.EXE
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Java\jre1.5.0_04\bin\jucheck.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd.exe
  C:\WINDOWS\System32\LVCOMSX.EXE
  C:\Program Files\Logitech\Video\LogiTray.exe
  C:\Program Files\MessengerPlus! 3\MsgPlus.exe
  C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe
  C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
  C:\WINDOWS\System32\ctfmon.exe
  C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
  C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
  C:\Program Files\Logitech\Video\FxSvr2.exe
  C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
  C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\WINDOWS\System32\wuauclt.exe
  C:\Program Files\Nevo\NevoMedia Player\NevoMediaPlayer.exe
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\Documents and Settings\joeling\Desktop\HijackThis.exe
  
  O2 - BHO: Nothing - {686a161d-5bd1-4999-8832-6393f41e564c} - C:\WINDOWS\System32\hp100.tmp
  O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
  O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive2k\AudioHQ\AHQTB.EXE
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
  O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
  O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
  O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
  O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
  O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe"
  O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
  O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
  O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
  O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
  O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O4 - Global Startup: NevoMedia Server.lnk = C:\Program Files\Nevo\NevoMedia Server\NevoMediaServer.exe
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O8 - Extra context menu item: Žg—p FlashGet ‰º�Ú - C:\PROGRA~1\FlashGet\jc_link.htm
  O8 - Extra context menu item: ‘S•”Žg—p FlashGet ‰º�Ú - C:\PROGRA~1\FlashGet\jc_all.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
  O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
  O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
  O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
  O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
  O9 - Extra button: Instant Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
  O16 - DPF: WebControlDeploy - https://grouper.com/v1/GrouperSetup.cab
  O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
  O18 - Protocol: cdl - {3DD53D40-7B8B-11D0-B013-00AA0059CE02} - C:\WINDOWS\System32\urlmon.dll
  O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
  O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\System32\msvidctl.dll
  O18 - Protocol: file - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\System32\urlmon.dll
  O18 - Protocol: ftp - {79EAC9E3-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\System32\urlmon.dll
  O18 - Protocol: gopher - {79EAC9E4-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\System32\urlmon.dll
  O18 - Protocol: http - {79EAC9E2-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\System32\urlmon.dll
  O18 - Protocol: https - {79EAC9E5-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\System32\urlmon.dll
  O18 - Protocol: ipp - (no CLSID) - (no file)
  O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll
  O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
  O18 - Protocol: local - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\System32\urlmon.dll
  O18 - Protocol: mailto - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
  O18 - Protocol: mctp - {D7B95390-B1C5-11D0-B111-0080C712FE82} - C:\Program Files\Microsoft ActiveSync\aatp.dll
  O18 - Protocol: mhtml - {05300401-BCBC-11D0-85E3-00C04FD85AB4} - C:\WINDOWS\System32\inetcomm.dll
  O18 - Protocol: mk - {79EAC9E6-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\System32\urlmon.dll
  O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll
  O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL
  O18 - Protocol: msdaipp - (no CLSID) - (no file)
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
  O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
  O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\System32\mshtml.dll
  O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\System32\msvidctl.dll
  O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
  O18 - Protocol: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINDOWS\System32\msdxm.ocx
  O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\System32\wiascr.dll
  O20 - Winlogon Notify: OptimalLayout - C:\WINDOWS\system32\l26olcj31fo.dll
  O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.exe
  O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
• joeacid

  16 Jun 06, 04:20

  Hi lpx88, can see help me unlock my Spyweeper? I saw those things scanned, but can't remove them
• ndmmxiaomayi

  16 Jun 06, 16:25

  Files keep disappearing because of Look2Me adware. It is a sneaky adware, pretty hard to remove. Try using your antivirus to clear it. If it is not possible, other ways will be tried.
• lpx88

  16 Jun 06, 20:02

  Originally posted by joeacid:

  Hi lpx88, can see help me unlock my Spyweeper? I saw those things scanned, but can't remove them

  ok..i risked infecting my own com safety and went to those malicious ahem sites to get this for you..so it better work....check yr pm...
• joeacid

  18 Jun 06, 05:19

  Originally posted by lpx88:

  ok..i risked infecting my own com safety and went to those malicious ahem sites to get this for you..so it better work....check yr pm...

  hehe thanks alot i'm looking for this downloaded subscriber version to use the thing u gave me~, do u know where i can gt it?
• Lucario

  18 Jun 06, 13:29

  joeacid,
  
  Please download Look2Me-Destroyer.exe to your desktop.

  
  [*]Close all windows before continuing.
  [*]Double-click Look2Me-Destroyer.exe to run it.
  [*]Put a check next to Run this program as a task.
  [*]You will receive a message saying Look2Me-Destroyer will close and re-open in approximately 10 seconds. Click OK
  [*]When Look2Me-Destroyer re-opens, click the Scan for L2M button, your desktop icons will disappear, this is normal.
  [*]Once it's done scanning, click the Remove L2M button.
  [*]You will receive a Done Scanning message, click OK.
  [*]When completed, you will receive this message: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, click OK.
  [*]Your computer will then shutdown.
  [*]Turn your computer back on.
  [*]Please post the contents of C:\Look2Me-Destroyer.txt and a new HiJackThis log.
  

  If you receive a message from your firewall about this program accessing the internet please allow it.
  
  If you receive a runtime error '339' please download MSWINSCK.OCX from the link below and place it in your C:\Windows\System32 Directory.
  http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX
  
  Please download SmitfraudFix (by S!Ri)
  Extract the content (a folder named SmitfraudFix) to your Desktop.
  
  Open the SmitfraudFix folder and double-click smitfraudfix.cmd
  Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
  Please copy/paste the content of that report into your next reply.
  
  **Please do not run option #2, or any other options until instructed to do so.
  
  Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
  http://www.beyondlogic.org/consulting/proc...processutil.htm
• Lucario

  18 Jun 06, 16:44

  There are actually two free versions of Spy Sweeper - the "Scan Version" and the "14-days trial" version. This is often overlooked. joeacid seems to be using the "Scan Version".
  
  The trial version is located at the bottom of http://www.webroot.com/consumer/products/spysweeper/latestv.html; users should be able to use that to remove spyware
  
  
• joeacid

  19 Jun 06, 04:39

  hi guys, thanks alot for your new info~ btw, the next thread here is my latest log file.
• joeacid

  19 Jun 06, 04:40

  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\rundll32.exe
  C:\WINDOWS\System32\devldr32.exe
  C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
  C:\WINDOWS\System32\CTSvcCDA.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\System32\dcomcfg.exe
  C:\Program Files\Creative\SBLive2k\AudioHQ\AHQTB.EXE
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  C:\Program Files\Java\jre1.5.0_04\bin\jucheck.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd.exe
  C:\WINDOWS\System32\LVCOMSX.EXE
  C:\Program Files\Logitech\Video\LogiTray.exe
  C:\Program Files\MessengerPlus! 3\MsgPlus.exe
  C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe
  C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
  C:\WINDOWS\System32\ctfmon.exe
  C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
  C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
  C:\Program Files\Logitech\Video\FxSvr2.exe
  C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Nevo\NevoMedia Player\NevoMediaPlayer.exe
  C:\WINDOWS\System32\wuauclt.exe
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
  C:\Documents and Settings\joeling\Desktop\HijackThis.exe
  
  O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
  O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive2k\AudioHQ\AHQTB.EXE
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
  O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
  O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
  O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
  O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
  O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe"
  O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
  O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
  O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
  O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
  O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O4 - Global Startup: NevoMedia Server.lnk = C:\Program Files\Nevo\NevoMedia Server\NevoMediaServer.exe
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O8 - Extra context menu item: Žg—p FlashGet ‰º�Ú - C:\PROGRA~1\FlashGet\jc_link.htm
  O8 - Extra context menu item: ‘S•”Žg—p FlashGet ‰º�Ú - C:\PROGRA~1\FlashGet\jc_all.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
  O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
  O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
  O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
  O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
  O9 - Extra button: Instant Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
  O16 - DPF: WebControlDeploy - https://grouper.com/v1/GrouperSetup.cab
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O20 - Winlogon Notify: Reliability - C:\WINDOWS\system32\s2pulc791f.dll
  O20 - Winlogon Notify: winjrs32 - C:\WINDOWS\SYSTEM32\winjrs32.dll
  O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.exe
  O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
  
• ndmmxiaomayi

  19 Jun 06, 07:33

  It looks clean now.
• Lucario

  19 Jun 06, 08:20

  Yup it's mostly clean but there are some files/entries which might be of concern
  
  C:\WINDOWS\System32\dcomcfg.exe
  
  http://www.processlibrary.com/directory/files/dcomcfg/
  http://www.liutilities.com/products/wintaskspro/processlibrary/dcomcfg/
  
  O20 - Winlogon Notify: Reliability - C:\WINDOWS\system32\s2pulc791f.dll
  
  Random entry. Looks like Look2me has morphed again
  
  O20 - Winlogon Notify: winjrs32 - C:\WINDOWS\SYSTEM32\winjrs32.dll
  
  Not much info on this one but it should also be fixed
  
  
• ShutterBug

  20 Jun 06, 16:51

  Pull out your hard disk, configure it as slave and plug into another PC with Norton Internet Security 2006 installed and updated, and scan the entire hard disk.
  
  You should be able to weed out whatever is spawning the those reg entries and DLLs, plus the "seed" file.
  
  After scanning and deleting all the detected adware, spyware and viruses with NIS2006, unhide all hidden files delete all that is inside TEMP and Temporary Internet Files folders.
  
  After having done all the above, re-install your hard disk, and you may have a better chance at restoring your platform. But do your restoration with your broadband modem turned off.
  
  To prevent this from happening again, install NIS2006 and keep it updated.
  And also, please remove all those FREE software you have downloaded; they are pretty much adware and spyware as well. Those FREE software that claims to remove or prevent Adware or Spyware or Viruses are lame applications. They aren't robust because they aren't a commercial product.
• joeacid

  20 Jun 06, 20:15

  Originally posted by Lucario:

  Yup it's mostly clean but there are some files/entries which might be of concern
  
  C:\WINDOWS\System32\dcomcfg.exe
  
  http://www.processlibrary.com/directory/files/dcomcfg/
  http://www.liutilities.com/products/wintaskspro/processlibrary/dcomcfg/
  
  O20 - Winlogon Notify: Reliability - C:\WINDOWS\system32\s2pulc791f.dll
  
  Random entry. Looks like Look2me has morphed again
  
  O20 - Winlogon Notify: winjrs32 - C:\WINDOWS\SYSTEM32\winjrs32.dll
  
  Not much info on this one but it should also be fixed
  
  

  Hi~ I managed to remove C:\WINDOWS\System32\dcomcfg.exe by going to the safemode. And fixed O20 - Winlogon Notify: winjrs32 - C:\WINDOWS\SYSTEM32\winjrs32.dll using the hijackthis.
  
  Can't find O20 - Winlogon Notify: Reliability - C:\WINDOWS\system32\s2pulc791f.dll
  
  Here's my new logfile
• joeacid

  20 Jun 06, 20:15

  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\System32\devldr32.exe
  C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
  C:\WINDOWS\System32\CTSvcCDA.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
  C:\Program Files\Creative\SBLive2k\AudioHQ\AHQTB.EXE
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  C:\Program Files\Java\jre1.5.0_04\bin\jucheck.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd.exe
  C:\WINDOWS\System32\LVCOMSX.EXE
  C:\Program Files\Logitech\Video\LogiTray.exe
  C:\Program Files\MessengerPlus! 3\MsgPlus.exe
  C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe
  C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
  C:\WINDOWS\System32\ctfmon.exe
  C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
  C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
  C:\Program Files\Logitech\Video\FxSvr2.exe
  C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\WINDOWS\system32\rundll32.exe
  C:\WINDOWS\System32\wuauclt.exe
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\Documents and Settings\joeling\Desktop\HijackThis.exe
  
  O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
  O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive2k\AudioHQ\AHQTB.EXE
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
  O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
  O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
  O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
  O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
  O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe"
  O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
  O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
  O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
  O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
  O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O4 - Global Startup: NevoMedia Server.lnk = C:\Program Files\Nevo\NevoMedia Server\NevoMediaServer.exe
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O8 - Extra context menu item: Žg—p FlashGet ‰º�Ú - C:\PROGRA~1\FlashGet\jc_link.htm
  O8 - Extra context menu item: ‘S•”Žg—p FlashGet ‰º�Ú - C:\PROGRA~1\FlashGet\jc_all.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
  O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
  O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
  O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
  O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
  O9 - Extra button: Instant Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
  O16 - DPF: WebControlDeploy - https://grouper.com/v1/GrouperSetup.cab
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O20 - Winlogon Notify: Explorer - C:\WINDOWS\system32\j4j60e1seh.dll
  O20 - Winlogon Notify: winjrs32 - C:\WINDOWS\SYSTEM32\winjrs32.dll
  O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.exe
  O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
  
• joeacid

  20 Jun 06, 20:16

  Originally posted by ShutterBug:

  Pull out your hard disk, configure it as slave and plug into another PC with Norton Internet Security 2006 installed and updated, and scan the entire hard disk.
  
  You should be able to weed out whatever is spawning the those reg entries and DLLs, plus the "seed" file.
  
  After scanning and deleting all the detected adware, spyware and viruses with NIS2006, unhide all hidden files delete all that is inside TEMP and Temporary Internet Files folders.
  
  After having done all the above, re-install your hard disk, and you may have a better chance at restoring your platform. But do your restoration with your broadband modem turned off.
  
  To prevent this from happening again, install NIS2006 and keep it updated.
  And also, please remove all those FREE software you have downloaded; they are pretty much adware and spyware as well. Those FREE software that claims to remove or prevent Adware or Spyware or Viruses are lame applications. They aren't robust because they aren't a commercial product.

  Thanks, i wish to try out ur method,but i dun hav another PC with an OS
• ceecookie

  20 Jun 06, 20:24

  Originally posted by ndmmxiaomayi:

  It looks clean now.

  and while ur checking his logfile have a go at mine's
  
  
  Logfile of HijackThis v1.99.1
  Scan saved at 20:23:26, on 20/06/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\brsvc01a.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\brss01a.exe
  C:\WINDOWS\System32\cisvc.exe
  C:\WINDOWS\runservice.exe
  C:\Program Files\Norton AntiVirus\navapsvc.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  C:\PROGRA~1\NORTON~1\navapw32.exe
  C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
  C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  C:\WINDOWS\System32\AcerGoto.exe
  C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
  C:\Program Files\Brother\ControlCenter2\brctrcen.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\UberIcon\UberIcon Manager.exe
  C:\Program Files\Microsoft ActiveSync\wcescomm.exe
  C:\PROGRA~1\MICROS~3\rapimgr.exe
  C:\Program Files\BOINC\boincmgr.exe
  C:\Program Files\BOINC\boinc.exe
  C:\WINDOWS\system32\cidaemon.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
  C:\Program Files\Motherboard Monitor 5\MBM5.EXE
  C:\WINDOWS\boinc.scr
  C:\WINDOWS\system32\wisptis.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  C:\Program Files\BOINC\projects\setiathome.berkeley.edu\setiathome_5.15_windows_intelx86.exe
  c:\program files\common files\installshield\updateservice\isuspm.exe
  C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Documents and Settings\Default\Desktop\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://www.yahoo.com
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr7/*http://www.yahoo.com
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr6/*http://www.yahoo.com
  N3 - Netscape 7: user_pref("browser.startup.homepage", "www.yahoo.com"); (C:\Documents and Settings\Default\Application Data\Mozilla\Profiles\default\zed5nycl.slt\prefs.js)
  N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRA%7E1%5CNETSCAPE%5CNETSCA%7E1%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Default\Application Data\Mozilla\Profiles\default\zed5nycl.slt\prefs.js)
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
  O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\zh-sg\msntb.dll
  O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\zh-sg\msntb.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
  O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
  O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
  O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
  O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
  O4 - HKLM\..\Run: [AcerGoto] C:\WINDOWS\System32\AcerGoto.exe
  O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
  O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
  O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
  O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe
  O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [System Files Updater] C:\WINDOWS\FlyakiteOSX\Tools\System Files Updater.exe /S
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
  O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
  O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Startup: BOINC Manager.lnk = C:\Program Files\BOINC\boincmgr.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
  O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
  O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
  O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
  O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
  O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O15 - Trusted Zone: www.gunbound.com
  O15 - Trusted Zone: www.hotmail.com
  O15 - Trusted Zone: http://www.neopets.com
  O15 - Trusted Zone: www.superdudes.net
  O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
  O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
  O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  
• ndmmxiaomayi

  22 Jun 06, 07:41

  joeacid: Your system is clean now.
• joeacid

  22 Jun 06, 13:20

  Originally posted by ndmmxiaomayi:

  joeacid: Your system is clean now.

  haha thanks, i dunno but the is still around and my webpage always cannot be loaded. Hijackers nowadays seems to be powerful and more hidden
• joeacid

  14 Jul 06, 21:08

  Erm... guys~ need help~ can help me look at my log file? ~ Not sure why but i got quite a number of adware again~ i din surf anywhere this time...
• joeacid

  14 Jul 06, 21:09

  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\rundll32.exe
  C:\WINDOWS\System32\devldr32.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
  C:\WINDOWS\System32\CTSvcCDA.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
  C:\Program Files\Creative\SBLive2k\AudioHQ\AHQTB.EXE
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd.exe
  C:\WINDOWS\System32\LVCOMSX.EXE
  C:\Program Files\Logitech\Video\LogiTray.exe
  C:\Program Files\MessengerPlus! 3\MsgPlus.exe
  C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe
  C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
  C:\WINDOWS\System32\ctfmon.exe
  C:\Program Files\Logitech\Video\FxSvr2.exe
  C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
  C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Nevo\NevoMedia Player\NevoMediaPlayer.exe
  C:\Program Files\BitComet\BitComet.exe
  C:\Program Files\eMule\eMule.exe
  C:\WINDOWS\System32\wuauclt.exe
  C:\WINDOWS\System32\ishost.exe
  C:\WINDOWS\System32\ismon.exe
  C:\WINDOWS\System32\isnotify.exe
  C:\WINDOWS\System32\issearch.exe
  C:\WINDOWS\system32\rundll32.exe
  C:\WINDOWS\System32\conime.exe
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\Documents and Settings\joeling\Desktop\HijackThis.exe
  
  O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
  O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive2k\AudioHQ\AHQTB.EXE
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
  O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
  O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
  O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
  O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
  O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe"
  O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
  O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
  O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
  O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
  O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
  O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O4 - Global Startup: NevoMedia Server.lnk = C:\Program Files\Nevo\NevoMedia Server\NevoMediaServer.exe
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O8 - Extra context menu item: Žg—p FlashGet ‰º�Ú - C:\Program Files\FlashGet\jc_link.htm
  O8 - Extra context menu item: ‘S•”Žg—p FlashGet ‰º�Ú - C:\Program Files\FlashGet\jc_all.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
  O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
  O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
  O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
  O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
  O9 - Extra button: Instant Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
  O16 - DPF: WebControlDeploy - https://grouper.com/v1/GrouperSetup.cab
  O18 - Protocol: bw+0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw+0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw-0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw-0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw00 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw00s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw10 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw10s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw20 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw20s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw30 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw30s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw40 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw40s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw50 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw50s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw60 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw60s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw70 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw70s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw80 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw80s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw90 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bw90s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwa0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwa0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwb0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwb0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwc0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwc0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwd0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwd0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwe0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwe0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwf0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwf0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
  O18 - Protocol: bwg0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwg0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwh0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwh0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwi0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwi0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwj0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwj0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwk0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwk0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwl0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwl0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwm0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwm0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwn0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwn0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwo0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwo0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwp0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwp0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwq0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwq0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwr0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwr0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bws0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bws0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwt0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwt0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwu0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwu0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwv0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwv0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bww0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bww0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwx0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwx0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwy0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwy0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwz0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: bwz0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O18 - Protocol: offline-8876480 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
  O20 - Winlogon Notify: BITS - C:\WINDOWS\system32\irnsl5571.dll
  O20 - Winlogon Notify: ldr64 - C:\WINDOWS\SYSTEM32\ldr64.dll
  O20 - Winlogon Notify: winjrs32 - C:\WINDOWS\SYSTEM32\winjrs32.dll
  O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
  O21 - SSODL: cinnamomum - {93ac7c30-3878-4eaa-9420-7977285df5b1} - C:\WINDOWS\System32\pmnqguh.dll
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.exe
  O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
• R3SsH|n

  14 Jul 06, 21:20

  how u know is adware?
• ndmmxiaomayi

  14 Jul 06, 22:16

  C:\WINDOWS\System32\ishost.exe
  C:\WINDOWS\System32\ismon.exe
  C:\WINDOWS\System32\isnotify.exe
  C:\WINDOWS\System32\issearch.exe
  C:\WINDOWS\System32\conime.exe

  You sure you didn't do anything wrong this time? You got some very nasty stuff...
  
  Did you download any anti-spywares lately? What about your BitComet and eMule?
• ndmmxiaomayi

  15 Jul 06, 00:05

  Either you download Ewido Anti-spyware and scan offline or you scan online at http://www.ewido.net/
  
  Also update your antivirus and do a full system scan.
  
  Remove anything found.
  
  To remove issearch.exe, try using this fix. Restart your computer after this.
  
  Go to registry editor. (Start, Run, regedit)
  
  Find and delete the keys in red.
  
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\ishost
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ishost
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\PornMag Pass
  HKEY_CURRENT_USER\Software\PornMag Pass
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\isnotify
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\isnotify
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\issearch
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\issearch
  
  Restart your computer in Safe Mode. Delete these files if they are found. You need to enable hidden files in order to delete them. My Computer, Tools, Folder Options. Select View tab. Under Hidden files and folders, tick Show hidden files and folders.
  
  C:\Windows\System32\ishost.exe
  C:\Program Files\PornMagPass\isinst.exe
  C:\Program Files\PornMagPass\PornMagPass.exe
  C:\Program Files\PornMagPass\PornMag Pass.url
  C:\Program Files\PornMagPass\uninst.exe
  C:\Documents and Settings\username\Start Menu\PornMag Pass\PornMag Pass Login.lnk
  C:\Documents and Settings\username\Start Menu\PornMag Pass\PornMag Pass.lnk
  C:\Documents and Settings\username\Desktop\PornMag Pass.lnk
  C:\Windows\System32\ishost.exe
  C:\Windows\System32\ismon.exe
  C:\WINDOWS\Temp\iservice.dll
  C:\Windows\System32\isnotify.exe
  C:\Windows\Application Data\81f71843.exe
  C:\Documents and Settings\username\Local Settings\Temp\runsvc32.exe
  C:\Program Files\\security toolbar\security toolbar.dll
  C:\Windows\System32\81f71843.exe
  C:\Windows\System32\acvgxw.dll
  C:\Windows\System32\appmagr.dll
  C:\Windows\System32\atmclk.exe
  C:\Windows\System32\autodisc32.dll
  C:\Windows\System32\bbgif32.dll
  C:\Windows\System32\bggif32.dll
  C:\Windows\System32\bgif32.dll
  C:\Windows\System32\bpkwb.dll
  C:\Windows\System32\cd_clint.dll
  C:\Windows\System32\cd_gif.dll
  C:\Windows\System32\cd_htm.dll
  C:\Windows\System32\cd_load.exe
  C:\Windows\System32\cd_swf.dll
  C:\Windows\System32\clsemixer.dll
  C:\Windows\System32\cmesys.exe
  C:\Windows\System32\cmeupd.exe
  C:\Windows\System32\components\flx1.dll
  C:\Windows\System32\components\flx2.dll
  C:\Windows\System32\components\flx3.dll
  C:\Windows\System32\components\flx4.dll
  C:\Windows\System32\components\flx5.dll
  C:\Windows\System32\components\flx6.dll
  C:\Windows\System32\components\flx7.dll
  C:\Windows\System32\components\flx8.dll
  C:\Windows\System32\cws_iestart.exe
  C:\Windows\System32\dbf065d3.exe
  C:\Windows\System32\dbgif32.dll
  C:\Windows\System32\dcomcfg.exe
  C:\Windows\System32\ddm_d.exe
  C:\Windows\System32\ddmp.dll
  C:\Windows\System32\dfrgsrv.exe
  C:\Windows\System32\dxmpp.dll
  C:\Windows\System32\gator.exe
  C:\Windows\System32\ginuerep.dll
  C:\Windows\System32\gmt.exe
  C:\Windows\System32\guxxa.dll
  C:\Windows\System32\hvcycg.dll
  C:\Windows\System32\hzclqhc.dll
  C:\Windows\System32\iedriver.exexplore.exe
  C:\Windows\System32\imfdfcj.dll
  C:\Windows\System32\intxt.exe
  C:\Windows\System32\iqzv.dll
  C:\Windows\System32\ishost.exe
  C:\Windows\System32\ismon.exe
  C:\Windows\System32\isnotify.exe
  C:\Windows\System32\issearch.exe
  C:\Windows\System32\ixt0.dll
  C:\Windows\System32\ixt1.dll
  C:\Windows\System32\ixt2.dll
  C:\Windows\System32\ixt3.dll
  C:\Windows\System32\ixt4.dll
  C:\Windows\System32\ixt5.dll
  C:\Windows\System32\ixt6.dll
  C:\Windows\System32\johnwb.dll
  C:\Windows\System32\lwpfwjb.dll
  C:\Windows\System32\mscornet.exe
  C:\Windows\System32\mssearchnet.exe
  C:\Windows\System32\mswinb32.dll
  C:\Windows\System32\mswinb32.exe
  C:\Windows\System32\mswinf32.exe
  C:\Windows\System32\mswinup32.dll
  C:\Windows\System32\mswinxml.dll
  C:\Windows\System32\mtc.dll
  C:\Windows\System32\mzoeut.dll
  C:\Windows\System32\netwrap.dll
  C:\Windows\System32\notifysb.dll
  C:\Windows\System32\nvctrl.exe
  C:\Windows\System32\qrucmr.dll
  C:\Windows\System32\redirect.dll
  C:\Windows\System32\reglogs.dll
  C:\Windows\System32\regperf.exe
  C:\Windows\System32\repigsp.exe
  C:\Windows\System32\replmap.dll
  C:\Windows\System32\rmzdzx.dll
  C:\Windows\System32\runsrv32.dll
  C:\Windows\System32\runsrv32.exe
  C:\Windows\System32\shell386.exe
  C:\Windows\System32\shellgui32.dll
  C:\Windows\System32\sivudro.dll
  C:\Windows\System32\spoolsrv32.exe
  C:\Windows\System32\srpcsrv32.dll
  C:\Windows\System32\stickrep.dll
  C:\Windows\System32\suprox.dll
  C:\Windows\System32\svchosts.dll
  C:\Windows\System32\systemwb.dll
  C:\Windows\System32\sysu.exe
  C:\Windows\System32\thlwin32.dll
  C:\Windows\System32\twain32.dll
  C:\Windows\System32\txfdb32.dll
  C:\Windows\System32\udpmod.dll
  C:\Windows\System32\ulztc.dll
  C:\Windows\System32\vhywj.dll
  C:\Windows\System32\viwpzla.dll
  C:\Windows\System32\vpxnk.dll
  C:\Windows\System32\wbeconm.dll
  C:\Windows\System32\wfkduei.dll
  C:\Windows\System32\wiatwain.dll
  C:\Windows\System32\winapi32.dll
  C:\Windows\System32\winbl32.dll
  C:\Windows\System32\winlfl32.dll
  C:\Windows\System32\winsrv32.exe
  C:\Windows\System32\xenadot.dll
  C:\Windows\System32\xt0.dll
  C:\Windows\System32\xt1.dll
  C:\Windows\System32\xuefh.dll
  C:\Windows\System32\xxxdialer.exe
  C:\Windows\System32\yhbdupd.dll
  C:\Windows\dpe.dll
  C:\Windows\fsg_4203.exe
  C:\Windows\runsvc32.exe
  C:\Windows\sdfje.exe
  002211.exe
  a.exe
  a0000037.exe
  appmagr.dll
  atmclk.exe
  atmclk2.exe
  c:\exefile.exe
  c:\ntpnt.exe
  c:\r.exe
  dcomcfg.exe
  dfrgsrv.exe
  dxmpp.dll
  exe.exe
  exefile.exe
  ginuerep.dll
  ioctrl.dll
  iubm.exe
  l.exe
  load01.exe
  loader138.exe
  main.exe
  mscornet.exe
  mssearchnet.exe
  mw_wbeconm.dll
  netwrap.dll
  notifysb.dll
  nvctrl.exe
  reger.exe
  regperf.exe
  repigsp.exe
  scam.a.exe
  scam.alexaie.dll
  Scam.alxie328.dll
  Scam.alxres.dll
  Scam.alxtb1.dll
  scam.bridge.dll
  Scam.btgrab.dll
  Scam.dailytoolbar.dll
  scam.dlmax.dll
  Scam.jao.dll
  scam.pynix.dll
  Scam.questmod.dll
  scam.susp.exe
  scam.tcpservice2.exe
  Scam.wstart.dll
  Scam.zserv.dll
  security toolbar.dll
  sivudro.dll
  sss_bot.exe
  suprox.dll
  svchosts.dll
  twain32.dll
  wbeconm.dll
  wiatwain.dll
  winapi32.dll
  winbl32.dll
  xenadot.dll
  yhbdupd.dll
  
  For conime.exe, I'm not too sure what it is. It can be a malicious file. On the hand, it is used by Windows as well. Scan with antivirus to double check.
  
  After all these are done, reboot. Do a full system scan with all your anti-spywares and antivirus. For safety sake, try not to use eMule and BitComet when you are not using them.
  
  If you need more help, you may refer to these links:
  Removing ishost, isnotify, issearch and ismon.exe
  About rogue anti-spywares
  Symantec's writeup on conime.exe
  
  You may want to do an online scan at Panda and TrendMicro to make sure that your antivirus and anti-spywares don't miss anything.
  
  Next time don't surf porn sites...