Are these spywares?

• vertmonyet

  5 Mar 07, 18:40

  Bar888 and Ipwins.exe.
  
  i'm confused. when i want to remove them, i fear that will mess up my comp.
  
  sometimes it says ipwins.exe failed to initialize or something.
  
  one more thing, when i start my comp, after everything loads, before Windows Live load, this will come out. Application Launcher. Failed to open or something like that. then i will have to click Ok.
  
  will printscreen sooner or later.
• Master -_-

  5 Mar 07, 18:42

  Description of IPWINS.EXE
  ClickSpring/PurityScan-related adware threat
  
  Adware applications, toolbars and browser extensions may serve advertisements even while you are not surfing the Internet.
  
  This application may serve various types of advertising, not limited to pop-up ads.
  
  
• R3SsH|n

  5 Mar 07, 18:45

  from their names...they don't sound friendly do they?
• ndmmxiaomayi

  5 Mar 07, 18:48

  Yes.
  
  Refer to the STOMP Spyware thread to download HijackThis.
  
  Save a log and post here.
• vertmonyet

  5 Mar 07, 18:57

  downloaded HijackThis. when i open file, it closes my itself after 3 secs.
  then it already saved log file after i clicked on the first option. when i open to copy it, it closes halfway again halfway copying.
  
  edit: done this by selectiong all using mouse.
  
  Logfile of HijackThis v1.99.1
  Scan saved at 6:55:37 PM, on 3/5/2007
  Platform: Windows XP (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 (6.00.2600.0000)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\System32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  C:\WINDOWS\System32\svchosts.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\WINDOWS\System32\jxlytomcts\services.exe
  C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
  C:\WINDOWS\V0220Mon.exe
  C:\Program Files\Ipwindows\ipwins.exe
  C:\Program Files\Common Files\{6CECD019-0A26-1033-0225-040410260001}\Update.exe
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
  C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
  C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
  C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\WINDOWS\system32\mspaint.exe
  C:\Documents and Settings\homesweethome\Desktop\HijackThis.exe
  
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://sg.rd.yahoo.com/customize/ie/defaults/sp/msgr7/*http://sg.search.yahoo.com/
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://sg.yahoo.com
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://sg.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://sg.search.yahoo.com/
  F3 - REG:win.ini: load=C:\WINDOWS\System32\jxlytomcts\services.exe
  F3 - REG:win.ini: run=C:\WINDOWS\System32\jxlytomcts\services.exe
  F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,jqmnqih.exe
  O1 - Hosts: 1.1.1.1 f-secure.com
  O1 - Hosts: 1.1.1.1 www.f-secure.com
  O1 - Hosts: 1.1.1.1 ftp.f-secure.com
  O1 - Hosts: 1.1.1.1 ftp.sophos.com
  O1 - Hosts: 1.1.1.1 liveupdate.symantec.com
  O1 - Hosts: 1.1.1.1 customer.symantec.com
  O1 - Hosts: 1.1.1.1 dispatch.mcafee.com
  O1 - Hosts: 1.1.1.1 download.mcafee.com
  O1 - Hosts: 1.1.1.1 rads.mcafee.com
  O1 - Hosts: 1.1.1.1 mast.mcafee.com
  O1 - Hosts: 1.1.1.1 my-etrust.com
  O1 - Hosts: 1.1.1.1 www.my-etrust.com
  O1 - Hosts: 1.1.1.1 nai.com
  O1 - Hosts: 1.1.1.1 www.nai.com
  O1 - Hosts: 1.1.1.1 networkassociates.com
  O1 - Hosts: 1.1.1.1 secure.nai.com
  O1 - Hosts: 1.1.1.1 securityresponse.symantec.com
  O1 - Hosts: 1.1.1.1 service1.symantec.com
  O1 - Hosts: 1.1.1.1 sophos.com
  O1 - Hosts: 1.1.1.1 www.sophos.com
  O1 - Hosts: 1.1.1.1 support.microsoft.com
  O1 - Hosts: 1.1.1.1 symantec.com
  O1 - Hosts: 1.1.1.1 www.symantec.com
  O1 - Hosts: 1.1.1.1 update.symantec.com
  O1 - Hosts: 1.1.1.1 updates.symantec.com
  O1 - Hosts: 1.1.1.1 us.mcafee.com
  O1 - Hosts: 1.1.1.1 vil.nai.com
  O1 - Hosts: 1.1.1.1 viruslist.com
  O1 - Hosts: 1.1.1.1 www.viruslist.com
  O1 - Hosts: 1.1.1.1 grisoft.com
  O1 - Hosts: 1.1.1.1 www.grisoft.com
  O1 - Hosts: 1.1.1.1 free.grisoft.com
  O1 - Hosts: 1.1.1.1 trendmicro.com
  O1 - Hosts: 1.1.1.1 housecall.trendmicro.com
  O1 - Hosts: 1.1.1.1 www.trendmicro.com
  O1 - Hosts: 1.1.1.1 pandasoftware.com
  O1 - Hosts: 1.1.1.1 www.pandasoftware.com
  O1 - Hosts: 1.1.1.1 usa.kaspersky.com
  O1 - Hosts: 1.1.1.1 ewido.net
  O1 - Hosts: 1.1.1.1 www.ewido.net
  O1 - Hosts: 1.1.1.1 zonelabs.com
  O1 - Hosts: 1.1.1.1 www.zonelabs.com
  O1 - Hosts: 1.1.1.1 bitdefender.com
  O1 - Hosts: 1.1.1.1 www.bitdefender.com
  O1 - Hosts: 1.1.1.1 download.bitdefender.com
  O1 - Hosts: 1.1.1.1 upgrade.bitdefender.com
  O1 - Hosts: 1.1.1.1 spywareinfo.com
  O1 - Hosts: 1.1.1.1 www.spywareinfo.com
  O1 - Hosts: 1.1.1.1 merijn.org
  O1 - Hosts: 1.1.1.1 www.merijn.org
  O1 - Hosts: 1.1.1.1 sysinternals.com
  O1 - Hosts: 1.1.1.1 www.sysinternals.com
  O1 - Hosts: 1.1.1.1 onguardonline.gov
  O1 - Hosts: 1.1.1.1 www.onguardonline.gov
  O1 - Hosts: 1.1.1.1 avast.com
  O1 - Hosts: 1.1.1.1 www.avast.com
  O1 - Hosts: 1.1.1.1 safety.live.com
  O1 - Hosts: 1.1.1.1 www.paretologic.com
  O1 - Hosts: 1.1.1.1 paretologic.com
  O1 - Hosts: 1.1.1.1 virusscan.jotti.org
  O1 - Hosts: 1.1.1.1 services.google.com
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
  O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
  O4 - HKLM\..\Run: [Windows Recylinder Check] olisatrqoi.exe
  O4 - HKLM\..\Run: [hdsxfb] C:\WINDOWS\System32\imoggd.exe reg_run
  O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
  O4 - HKLM\..\Run: [V0220Mon.exe] C:\WINDOWS\V0220Mon.exe
  O4 - HKLM\..\Run: [IpWins] C:\Program Files\Ipwindows\ipwins.exe
  O4 - HKLM\..\RunServices: [Windows Recylinder Check] olisatrqoi.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [eaayh] C:\WINDOWS\System32\imoggd.exe reg_run
  O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
  O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
  O4 - HKCU\..\RunOnce: [DeleteDLL] cmd.exe /c del C:\PROGRA~1\COMMON~1\{3CECD~1\Bar888.dll > nul
  O4 - Startup: services.lnk = ?
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
  O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O9 - Extra button: (no name) - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\System32\dmonwv.dll (file missing)
  O9 - Extra 'Tools' menuitem: Java - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\System32\dmonwv.dll (file missing)
  O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
  O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\homesweethome\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
  O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
  O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
  O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab
  O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
  O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  O23 - Service: Client IP-IPX - Unknown owner - C:\WINDOWS\System32\svchosts.exe" -e te-110-12-0000282 (file missing)
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  
  
• ndmmxiaomayi

  5 Mar 07, 19:23

  Download XP SP1a and install it.
• ndmmxiaomayi

  5 Mar 07, 19:35

  http://download.microsoft.com/download/e/4/4/e4481402-244d-460a-8f98-ca0e5905a97c/sp1aexpress_usa.exe
  
  Direct link for it.
• vertmonyet

  5 Mar 07, 19:53

  Originally posted by ndmmxiaomayi:

  Download XP SP1a and install it.

  may i know whats the purpose of this?
  
• ndmmxiaomayi

  5 Mar 07, 19:55

  Originally posted by vertmonyet:

  may i know whats the purpose of this?
  

  To at least patch up some of the critical Microsoft bugs so you won't get infected while cleaning you up.
• vertmonyet

  5 Mar 07, 20:00

  Originally posted by ndmmxiaomayi:

  To at least patch up some of the critical Microsoft bugs so you won't get infected while cleaning you up.

  ohok thanks. so it means i'm infected?
  
  and err. this thing. install icon. i delete it, it comes back again. any "medicine" to remove it?
• ndmmxiaomayi

  5 Mar 07, 20:37

  Originally posted by vertmonyet:

  ohok thanks. so it means i'm infected?
  
  and err. this thing. install icon. i delete it, it comes back again. any "medicine" to remove it?

  Yup.
  
  Which install icon?
• vertmonyet

  5 Mar 07, 20:50

  Originally posted by ndmmxiaomayi:

  Yup.
  
  Which install icon?

  just a small computer icon with a little box on the outside.
  i've installed the link you gave me.
  so i dont have to do anything?
  
  just let it do its work when i scan and remove viruses like you said?i'm using 7.5 AVG btw.
  pardon my questions.
• ndmmxiaomayi

  5 Mar 07, 21:23

  Originally posted by vertmonyet:

  just a small computer icon with a little box on the outside.
  i've installed the link you gave me.
  so i dont have to do anything?
  
  just let it do its work when i scan and remove viruses like you said?i'm using 7.5 AVG btw.
  pardon my questions.

  Er... can't imagine it.
  
  Got screenshot?
  
  You need to give me another HijackThis log.
  
  The link given to you is to update Windows and nothing else.
• MyPillowTalks

  6 Mar 07, 18:11

  mayi can give links to all microsoft update? cos mine... the validate part....u noe.....
  
  
• ndmmxiaomayi

  6 Mar 07, 18:16

  Originally posted by MyPillowTalks:

  mayi can give links to all microsoft update? cos mine... the validate part....u noe.....
  
  

  XP SP1a I've given out.
  
  XP SP2, no choice, got network installation, but don't know can bypass...
  
  http://www.microsoft.com/downloads/details.aspx?FamilyId=049C9DBE-3B8E-4F30-8245-9E368D3CDB5A&displaylang=en
• vertmonyet

  7 Mar 07, 17:25

  Logfile of HijackThis v1.99.1
  Scan saved at 5:24:41 PM, on 3/7/2007
  Platform: Windows XP SP1 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\System32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  C:\WINDOWS\System32\svchosts.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\System32\jxlytomcts\services.exe
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
  C:\WINDOWS\V0220Mon.exe
  C:\Program Files\Ipwindows\ipwins.exe
  C:\Program Files\Common Files\{6CECD019-0A26-1033-0225-040410260001}\Update.exe
  C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
  C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
  C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
  C:\Documents and Settings\homesweethome\Desktop\HijackThis.exe
  
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://sg.rd.yahoo.com/customize/ie/defaults/sp/msgr7/*http://sg.search.yahoo.com/
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://sg.yahoo.com
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://sg.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://sg.search.yahoo.com/
  F3 - REG:win.ini: load=C:\WINDOWS\System32\jxlytomcts\services.exe
  F3 - REG:win.ini: run=C:\WINDOWS\System32\jxlytomcts\services.exe
  F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,jqmnqih.exe
  O1 - Hosts: 1.1.1.1 f-secure.com
  O1 - Hosts: 1.1.1.1 www.f-secure.com
  O1 - Hosts: 1.1.1.1 ftp.f-secure.com
  O1 - Hosts: 1.1.1.1 ftp.sophos.com
  O1 - Hosts: 1.1.1.1 liveupdate.symantec.com
  O1 - Hosts: 1.1.1.1 customer.symantec.com
  O1 - Hosts: 1.1.1.1 dispatch.mcafee.com
  O1 - Hosts: 1.1.1.1 download.mcafee.com
  O1 - Hosts: 1.1.1.1 rads.mcafee.com
  O1 - Hosts: 1.1.1.1 mast.mcafee.com
  O1 - Hosts: 1.1.1.1 my-etrust.com
  O1 - Hosts: 1.1.1.1 www.my-etrust.com
  O1 - Hosts: 1.1.1.1 nai.com
  O1 - Hosts: 1.1.1.1 www.nai.com
  O1 - Hosts: 1.1.1.1 networkassociates.com
  O1 - Hosts: 1.1.1.1 secure.nai.com
  O1 - Hosts: 1.1.1.1 securityresponse.symantec.com
  O1 - Hosts: 1.1.1.1 service1.symantec.com
  O1 - Hosts: 1.1.1.1 sophos.com
  O1 - Hosts: 1.1.1.1 www.sophos.com
  O1 - Hosts: 1.1.1.1 support.microsoft.com
  O1 - Hosts: 1.1.1.1 symantec.com
  O1 - Hosts: 1.1.1.1 www.symantec.com
  O1 - Hosts: 1.1.1.1 update.symantec.com
  O1 - Hosts: 1.1.1.1 updates.symantec.com
  O1 - Hosts: 1.1.1.1 us.mcafee.com
  O1 - Hosts: 1.1.1.1 vil.nai.com
  O1 - Hosts: 1.1.1.1 viruslist.com
  O1 - Hosts: 1.1.1.1 www.viruslist.com
  O1 - Hosts: 1.1.1.1 grisoft.com
  O1 - Hosts: 1.1.1.1 www.grisoft.com
  O1 - Hosts: 1.1.1.1 free.grisoft.com
  O1 - Hosts: 1.1.1.1 trendmicro.com
  O1 - Hosts: 1.1.1.1 housecall.trendmicro.com
  O1 - Hosts: 1.1.1.1 www.trendmicro.com
  O1 - Hosts: 1.1.1.1 pandasoftware.com
  O1 - Hosts: 1.1.1.1 www.pandasoftware.com
  O1 - Hosts: 1.1.1.1 usa.kaspersky.com
  O1 - Hosts: 1.1.1.1 ewido.net
  O1 - Hosts: 1.1.1.1 www.ewido.net
  O1 - Hosts: 1.1.1.1 zonelabs.com
  O1 - Hosts: 1.1.1.1 www.zonelabs.com
  O1 - Hosts: 1.1.1.1 bitdefender.com
  O1 - Hosts: 1.1.1.1 www.bitdefender.com
  O1 - Hosts: 1.1.1.1 download.bitdefender.com
  O1 - Hosts: 1.1.1.1 upgrade.bitdefender.com
  O1 - Hosts: 1.1.1.1 spywareinfo.com
  O1 - Hosts: 1.1.1.1 www.spywareinfo.com
  O1 - Hosts: 1.1.1.1 merijn.org
  O1 - Hosts: 1.1.1.1 www.merijn.org
  O1 - Hosts: 1.1.1.1 sysinternals.com
  O1 - Hosts: 1.1.1.1 www.sysinternals.com
  O1 - Hosts: 1.1.1.1 onguardonline.gov
  O1 - Hosts: 1.1.1.1 www.onguardonline.gov
  O1 - Hosts: 1.1.1.1 avast.com
  O1 - Hosts: 1.1.1.1 www.avast.com
  O1 - Hosts: 1.1.1.1 safety.live.com
  O1 - Hosts: 1.1.1.1 www.paretologic.com
  O1 - Hosts: 1.1.1.1 paretologic.com
  O1 - Hosts: 1.1.1.1 virusscan.jotti.org
  O1 - Hosts: 1.1.1.1 services.google.com
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
  O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
  O4 - HKLM\..\Run: [Windows Recylinder Check] olisatrqoi.exe
  O4 - HKLM\..\Run: [hdsxfb] C:\WINDOWS\System32\imoggd.exe reg_run
  O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
  O4 - HKLM\..\Run: [V0220Mon.exe] C:\WINDOWS\V0220Mon.exe
  O4 - HKLM\..\Run: [IpWins] C:\Program Files\Ipwindows\ipwins.exe
  O4 - HKLM\..\RunServices: [Windows Recylinder Check] olisatrqoi.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [eaayh] C:\WINDOWS\System32\imoggd.exe reg_run
  O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
  O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
  O4 - Startup: services.lnk = ?
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
  O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O9 - Extra button: (no name) - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\System32\dmonwv.dll (file missing)
  O9 - Extra 'Tools' menuitem: Java - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\System32\dmonwv.dll (file missing)
  O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
  O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\homesweethome\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
  O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
  O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
  O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab
  O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
  O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  O23 - Service: Client IP-IPX - Unknown owner - C:\WINDOWS\System32\svchosts.exe" -e te-110-12-0000282 (file missing)
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  
  What wrong with HijackThis? everytime i try to do a scan it closes by itself.
• Xcert

  7 Mar 07, 19:52

  post deleted
• ndmmxiaomayi

  7 Mar 07, 23:56

  Your computer has multiple infections, including a backdoor. A backdoor gives intruders complete control of your computer, logs your keystrokes, steal personal information, etc.
  
  You are strongly advised to do the following:
  
  

  [*]Disconnect the computer from the Internet and from any networked computers until it is cleaned.
  [*]Back up all your important data except programs. The programs can be reinstalled back from the orignal disc or from the Net.
  [*]Call all your banks, financial institutions, credit card companies and inform them that you may be a victim of identity theft and put a watch on your accounts. If you don't mind the hassle, change all your account numbers.
  [*]From a clean computer, change all your passwords (ISP login password, your email address(es) passwords, financial accounts, PayPal, eBay, Amazon, online groups and forums and any other online activities you carry out which require a username and password).

  Do NOT change your passwords from this computer as the attacker will be able to get all the new passwords and transaction records.
  
  Due to its backdoor functionality, your computer is very likely to have been compromised and there is no way that it can be trusted again. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be to do a reformat and reinstallation of the operating system (OS). However, if you do not have the resources to reinstall your OS and would like me to attempt to clean your machine, I will be happy to do so.
  
  To help you understand more, please take some time to read the follwing articles:
  
  What are Remote Access Trojans and why are they dangerous
  How do I respond to a possible identity theft and how do I prevent it
  When should do a reformat and reinstallation of my OS
  Where to backup your files
  How to backup your files in Windows XP
  Restoring your backups
  
  If you decide to continue, please do the following:
  
  Get an antivirus
  
  I don't see an antivirus program running in your log. It could be that you disabled it, or you don't have an antivirus at all.
  
  If you have disabled it, please re-enable it back.
  
  If you have no antivirus, please download ONE antivirus from one of the links below:
  
  AVG Antivirus Free
  AntiVir for Windows 2000 and Windows XP
  avast! 4 Home Edition
  Clamwin
  _____________________________________________________________
  
  Download HostXpert from Funkytoad and save it to your desktop.
  
  

  [*]Right click on HostsXpert.zip and select Extract All....
  [*]Click Next on seeing the Welcome to the Compressed (zipped) Folders Extraction Wizard.
  [*]Click on the Browse button. Click on Desktop. Then click OK.
  [*]Tick the Show extracted files box.
  [*]Once extracted, HostsXpert folder will open.
  [*]Double click on HostsXpert.exe to start it.
  [*]On your right hand side, you will see Backup and Restore.
  [*]Click on Restore Microsoft Hosts File (see screenshot below, boxed up in red).
  
  
  
  [*]Exit HostsXpert.

  
  _____________________________________________________________
  
  

  [*]Download SDFix by AndyManchesta and save it to your desktop.
  [*]Double click on SDFix.exe. By default, it will install to C:\.
  [*]Click on Install.

  
  
  Next, boot into Safe Mode.
  
  

  [*]When you see BIOS screen, start pressing F8.
  [*]A boot menu will appear shortly.
  [*]Using the up down arrows, select Safe Mode and press the Enter key.
  [*]Windows will now load.
  [*]Log in to your usual account.
  [*]Navigate to C:\SDfix (if you installed it to the default location, otherwise, locate where you installed it)
  [*]Double click on RunThis.bat
  [*]Type Y to begin the cleanup process.
  [*]It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  [*]Press any key to reboot.
  [*]When the PC restarts the tool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  [*]Once the desktop icons load, the SDFix report will open on screen. You can also find the report in SDFix folder, named Report.txt.

  
  _____________________________________________________________
  
  

  [*]Download CCleaner and install it.
  [*]Click on Tools at the left hand side.
  [*]You will see a list of installed programs. Click on Save to text file.... See screenshot below, boxed up in red.
  
  
  
  [*]By default, it is named install.txt and is saved to where you installed CCleaner.
  [*]Click on Save.

  
  _____________________________________________________________
  
  In your next post, please post
  
  

  [*]A new HijackThis log
  [*]Report.txt (from SDFix)
  [*]List of installed programs (can be found in CCleaner folder)

  
  
  

  What wrong with HijackThis? everytime i try to do a scan it closes by itself.

  You have viruses that close it each time you try to run it.
• vertmonyet

  10 Mar 07, 11:51

  those tips are very useful.
  however, i find it quite confusinng. i guess i'll try to figure it out bit by bit.
  
  a very great help.
• ndmmxiaomayi

  11 Mar 07, 16:40

  Oops... missed this thread...
  
  Which part you don't understand? If it's on reformatting, it's all right. You can go ahead with the fix.
  
  If it's with the fix, ask away.