How to remove Worm virus in MSN?

• NewAge

  8 Apr 07, 10:34

  Logfile of HijackThis v1.99.1
  Scan saved at 10:34:57 AM, on 4/8/2007
  Platform: Windows XP (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 (6.00.2600.0000)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  C:\Program Files\WinPoET Broadband Connection\winpppoverethernet.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
  C:\WINDOWS\system32\dla\tfswctrl.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
  C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
  C:\PPSmtGrd\ppsmtgrd.exe
  C:\Program Files\Ulead Systems\Ulead Photo Express 5 SE\calcheck.exe
  C:\WINDOWS\vsnpstd.exe
  C:\WINDOWS\System32\WService.EXE
  C:\WINDOWS\System32\rundll32.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3S2.EXE
  C:\Program Files\FlashGet\FlashGet.exe
  C:\WINDOWS\System32\ctfmon.exe
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
  C:\WINDOWS\System32\DRIVERS\WtSrv.exe
  C:\PPENSB\Win32\PPSHLMON.EXE
  C:\WINDOWS\System32\conime.exe
  C:\WINDOWS\System32\wuauclt.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Documents and Settings\Josh\Desktop\HijackThis.exe
  
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
  R3 - URLSearchHook: (no name) - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - (no file)
  F3 - REG:win.ini: load=C:\WINDOWS\System32\kefocy\winlogon.exe
  F3 - REG:win.ini: run=C:\WINDOWS\System32\kefocy\winlogon.exe
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
  O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_48.dll
  O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
  O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
  O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
  O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
  O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
  O3 - Toolbar: ?ì3μ(FlashGet) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll
  O4 - HKLM\..\Run: [a-winpoet-service] "C:\Program Files\WinPoET Broadband Connection\winpppoverethernet.exe"
  O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
  O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
  O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
  O4 - HKLM\..\Run: [navapp] C:\Program Files\NavExcel\NavHelper\v2.0.4d\navapp.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
  O4 - HKLM\..\Run: [WService] WService.EXE
  O4 - HKLM\..\Run: [PPSmartGuard] c:\PPSmtGrd\ppsmtgrd.exe
  O4 - HKLM\..\Run: [Ulead Photo Express Calendar Checker] C:\Program Files\Ulead Systems\Ulead Photo Express 5 SE\calcheck.exe
  O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
  O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [Kiwi Alpha] "C:\Program Files\Kiwi Alpha\KiwiAlpha.exe" /minimize
  O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,ClientStartup -s
  O4 - HKLM\..\Run: [stup.exe] C:\PROGRA~1\TENCENT\Adplus\stup.exe
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [EPSON Stylus C65 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3S2.EXE /P23 "EPSON Stylus C65 Series" /O5 "LPT1:" /M "Stylus C65"
  O4 - HKLM\..\Run: [FlashGet] C:\Program Files\FlashGet\FlashGet.exe /min
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
  O4 - HKCU\..\Run: [Utopia Angel] "C:\Utopia\Angel\Angel.exe"
  O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
  O4 - HKCU\..\RunOnce: [FFTI] C:\Documents and Settings\Josh\Application Data\Mozilla\Firefox\Profiles\slly4mzi.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\ffti.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /DestPath="C:\Documents and Settings\Josh\Application Data\Mozilla\Firefox\Profiles/slly4mzi.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}"
  O4 - Startup: PowerReg Scheduler V3.exe
  O4 - Startup: winlogon.lnk = ?
  O4 - Global Startup: 蒙恬快速启动.lnk = ?
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
  O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
  O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-sg\msntabres.dll.mui/229?55bf1a278f0246adbc19208e41b880d1
  O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-sg\msntabres.dll.mui/230?55bf1a278f0246adbc19208e41b880d1
  O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
  O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
  O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE (file missing)
  O9 - Extra 'Tools' menuitem: ìú??QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE (file missing)
  O9 - Extra button: ?ì3μ - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
  O9 - Extra 'Tools' menuitem: ?ì3μ(FlashGet) - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
  O16 - DPF: {0FC64BDC-D14D-4F04-802D-4B9104DF16FB} (SystemCheck Class) - http://www.singnet.com.sg/technical/helptools/pc-check/media/ALTControl.cab
  O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
  O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.playqames.com/default.cab?uid=54&id=60912&1s&ex&ppd=4
  O16 - DPF: {CD79C574-4775-4A42-A66B-D7071AE095AF} (SlideViewerOcx Control) - http://web1.njc.edu.sg/aculearn-idm/dlls/SlideViewer.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{2DBC6F76-A987-4443-9340-53CB0BB7E602}: NameServer = 165.21.100.88 165.21.83.88
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\System32\DRIVERS\WtSrv.exe
  
  
• ndmmxiaomayi

  8 Apr 07, 15:07

  Originally posted by arieth:

  both method needs Windows CD and i cant seem to find mine.

  http://www.microsoft.com/windows/products/winfamily/ie/default.mspx
• ndmmxiaomayi

  8 Apr 07, 15:36

  Hi NewAge,
  
  Please print out this set of instructions in case your internet connections are damaged.
  
  Please go to Start > Control Panel > Add/Remove Programs
  
  Locate New.Net, NewDotNet or anything that sounds like New Dot Net and remove it.
  
  If you can't find NewDotNet anywhere in Add/Remove Programs, follow this site instructions.
  
  Please also download Winsock XP Fix in case removing NewDotNet damages your internet connection. [color=red]Only use Winsock XP Fix if you can't access the Net after removing NewDotNet.
  
  Also, you will need to uninstall Flashget as it's infected with spyware. Details.
  
  Open HijackThis and select Do a system scan only.
  
  Locate these lines and put a tick in the box beside them:
  
  F3 - REG:win.ini: load=C:\WINDOWS\System32\kefocy\winlogon.exe
  F3 - REG:win.ini: run=C:\WINDOWS\System32\kefocy\winlogon.exe
  O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
  O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_48.dll
  O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
  O3 - Toolbar: ?ì3μ(FlashGet) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll
  O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,ClientStartup -s
  O4 - HKLM\..\Run: [FlashGet] C:\Program Files\FlashGet\FlashGet.exe /min
  O4 - Startup: winlogon.lnk = ?
  
  Click Fix checked.
  
  Reboot into Safe Mode.
  
  

  [*]When you see BIOS screen, start pressing F8.
  [*]A boot menu will appear shortly.
  [*]Using the up down arrows, select Safe Mode and press the Enter key.
  [*]Windows will now load.
  [*]Log in to your usual account.

  
  
  Show hidden files and folders
  

  [*]Open My Computer.
  [*]Go to Tools > Folder Options.
  [*]Select the View tab.
  [*]Scroll down to Hidden files and folders.
  [*]Select Show hidden files and folders.
  [*]Uncheck (untick) Hide extensions of known file types.
  [*]Uncheck (untick) Hide protected operating system files (Recommended).
  [*]Click Yes when prompted.
  [*]Click OK.
  [*]Close My Computer.

  
  
  Locate and delete this file in bold: C:\WINDOWS\System32\kefocy\winlogon.exe
  
  Blue part: folder name is random. Don't delete the winlogon.exe in C:\Windows\system32 folder. The winlogon.exe that needs to be deleted is in another random named folder inside system32 folder.
  
  Locate and delete this folders in bold: C:\Program Files\FlashGet
  C:\Program Files\NewDotNet
  
  Reboot back to Normal Mode. Check if you can access the Net. If you can't, please run Winsock XP Fix.
• NewAge

  8 Apr 07, 17:52

  wah so many things need to do sia. NewAge quickly run to get a printer to print out instructions.
• arieth

  8 Apr 07, 22:05

  Mayi, can you tell me where to download ActiveX? I Downloaded IE already but i cant do the scam cause of ActiveX. Thanks
• ndmmxiaomayi

  8 Apr 07, 22:35

  Originally posted by arieth:

  Mayi, can you tell me where to download ActiveX? I Downloaded IE already but i cant do the scam cause of ActiveX. Thanks

  There will be a yellow bar that prompts you. Just below those arrow buttons (back forward buttons)
• arieth

  9 Apr 07, 18:55

  An error has occurred downloading Panda ActiveScan. Please repeat the process. If the error occurs again, restart your system and try againPossible causes of this error are:
  
  Not allowing the application's ActiveX control to be downloaded.
  
  Problems with the Internet connection.
  
  The error could be due to a download error or an installation error due to lack of hard disk space, privileges etc....
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
  C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  C:\WINDOWS\System32\CTSvcCDA.EXE
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\MsPMSPSv.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\AGRSMMSG.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
  C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\D-Link\D-Link Air Utility\Utility.exe
  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
  C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
  C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
  C:\Documents and Settings\chan chee kwong\Desktop\HijackThis.exe
  
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.hotbar.com/dyn/hotbar/3.0/sb_searchPageHome.htm
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by SingNet
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [2wSysTray] C:\Program Files\2Wire\2PortalMon.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  O4 - HKLM\..\Run: [BO1HelperStartUp] C:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
  O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
  O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: D-Link Air Utility.lnk = C:\Program Files\D-Link\D-Link Air Utility\Utility.exe
  O4 - Global Startup: hp psc 1000 series.lnk = ?
  O4 - Global Startup: hpoddt01.exe.lnk = ?
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
  O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
  O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
  O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
  O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
  O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
  O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
  O11 - Options group: [INTERNATIONAL] International*
  O14 - IERESET.INF: START_PAGE_URL=http://www.singnet.com.sg
  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {2B866353-E598-4403-8E4D-B871AB30DC55} (Speed Class) - http://www.singnet.com.sg/technical/helptools/media/SpeedCtrl.cab
  O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
  O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
  O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040427/qtinstall.info.apple.com/saba/us/win/QuickTimeInstaller.exe
  O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1129651735156
  O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
  O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
  O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
  O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  
  Erm Mayi, please help me check this log if i still have any dangerous viruses in my computer. Thanks
  
  p.s. I am a computer idiot
• MrSotong

  9 Apr 07, 21:30

  1) Run your anti-virus to see if your computer is being infected by other kind of virus because this kind of virus tend to install other kind of viruses.
  
  2) Windows Update , Windows Cursor Flaw just discovered [FYI : ALL WINDOWS !]
  
  3) Be Genuine ! Use original Windows , as a MVSP, "Crack" programs does send infor abt your comp to the owner,FYI the person which make this may seem to be harmless but when it is being pass on to other user and to other user they may be actually add stuff in it and upload it to d net ,Rapidshare and so on and they can actually bypass your firewall
  
  4) Erm I'm not sure if this works hopefully Uninstall your Messenger and install it again .
  
  5) Be sure to have a restore point or before you download that virus thingy you may actually revert back to the other date ^_^
  
  That's all I can help you
  
  *https://mvp.support.microsoft.com/profile/Ai Chung.Chong
  
  s6 TR64B3ES60E +p
  So troublesome =/=
  
  Gd Luk @
• ndmmxiaomayi

  10 Apr 07, 00:14

  Hi arieth, your log is now clean.
• ndmmxiaomayi

  10 Apr 07, 00:14

  MVSP

  Your profile?
• arieth

  10 Apr 07, 16:48

  Yay!
  
  So is it ok to download msn back?
  
  Thanks mayi!
• MrSotong

  10 Apr 07, 17:27

  Yoz .....
  
  Verii busy flirting Jk
  
  Be sure to update your comp this few days as MS had plan for 5 Security Patches, 4 for Windows + the Malicious Software Removal Tool .
  
  Hmm Win Vista user : Beware of the firewall
  
  After reading this article from my mailbox i feel like sharing this infor to you all
  
  Long Passage [warning ]
  
  Quite long , tired to edit it
  
  [Extracted]
  
  The Internet Engineering Task Force recently held its 68th meeting in the beautiful-but-cloudy city of Prague. At that meeting, Dave Thaler, who works at Microsoft and is a member of the IETF's architecture board, the IAB, talked about what Microsoft ran into when revising the Windows TCP/IP stack for Vista. The result: Network connectivity may fail when you try to use Windows Vista behind a firewall device (Microsoft Knowledge Base article 934430).
  
  What's this all about? There are actually two issues at play.
  
  After XP shipped, Microsoft wanted to take the opportunity to add some new TCP features to Longhorn/Vista's IP stack. The most troublesome new feature is ECN, or Explicit Congestion Notification. ECN is specified in RFC 3168, published shortly after Windows XP's release in 2001. The idea is that when there is congestion on the network because too much traffic wants to flow through a certain connection, it would be good if the router would tell the hosts sending all this traffic that there's congestion so they can slow down a bit.
  
  ECN uses two otherwise-unused bits in the IP header to do its work. Without ECN, both of these bits are always set to zero. It turns out that some firewalls do not like it when bits that are generally set to zero suddenly are not zero. So the Vista team really didn't have any other option than to turn off ECN because otherwise, a good number of communication sessions would never get off the ground because firewalls don't allow the packets through. One model of home gateway would even reboot after encountering a packet with the ECN bits set.
  
  The Knowledge Base article only talks about the RFC 1323 window scale option, though. This RFC is from 1992, and it's widely implemented. The "window" is a central notion in TCP, a number that determines how many bytes the sender may send before it has to wait for the receiver to acknowledge the reception of earlier data. The maximum window is 64KB. However, in modern networks sending 64KB worth of data takes only a few milliseconds, but due to the speed of light in fiber, it can easily take a tenth of a second for the first acknowledgment to come back. So for communication sessions between systems with high-speed internet connections that are far away from each other, the data transfer bottleneck is the size of the TCP window.
  
  Rather than completely redesign TCP to allow for bigger windows, RFC 1323 introduces a "window scale" option that works as a multiplier for the window size. So with a window scale of 4, a 64KB window is really a 256KB window. Many systems have implemented this mechanism. So far so good.
  
  It turns out that even though the window scale option, which is exchanged at the start of a TCP session, is very common, it almost always holds a value of 1, meaning "I'll do larger windows if you want them, but I don't need them myself." The reason for this is that the operating system must reserve large buffers to accommodate the contents of the send and receive windows, which generally only happens when applications specifically ask for them, which applications typically don't do. Enter Windows Vista:
  
  By default, the Receive Window Auto-Tuning feature in Windows Vista uses a Window Scaling factor of 8 for non-HTTP connections. This issue does not occur when you try to make an HTTP connection.
  
  (I guess this means that downloading over FTP is a lot faster than downloading over HTTP with Vista.)
  
  And lo and behold: many firewalls, including expensive, commercial ones, don't look at the window scale option. When they find that the resulting TCP behavior deviates from the original specification, they filter the packets involved. According to the article, (some) products from the following vendors can be problematic: NetApp, Cisco, Sonicwall, and Checkpoint. I do remember seeing problems with Linux/UNIX firewalling packages as well, though. See the article for workarounds on Vista. On Linux and BSD, you may have to look for related sysctl settings if you experience this problem.
  
  It is quite long And I'm too tired to edit the passage hence I juz copied out the whole thing
  
  So remember: if you buy a firewall, chances are, it will block packets. This may or may not be a good thing.
  
  Stay safe , Be safe
  
  
• ndmmxiaomayi

  10 Apr 07, 19:23

  Originally posted by arieth:

  Yay!
  
  So is it ok to download msn back?
  
  Thanks mayi!

  Yup. Don't download Messenger Plus.
• ndmmxiaomayi

  10 Apr 07, 19:25

  Err... no link?
  
  The support for Vista here is very poor, I don't see much about posting it here.
  
  MS Update will be tomorrow, after converting US time to SG time.
• arieth

  10 Apr 07, 20:08

  Ok. Thanks Mayi!
• MrSotong

  10 Apr 07, 22:26

  Hmmm Vista is quite buggy to me some program does not work or crash
  
  May we should have a topic on : Vista Help
  
  I'm sure kind a number of ppl will post this question :
  
  What's the difference between the RTM version and the Retail As I had seen it in d other forum
  
  Ans : No different at all maybe they add a few more wallpapers and maybe some updates b4 the release ;P
  
  The 3/4/07 update ready cause some problem liao ... Alway got an error :80070020
  
  Solution : Close your bitdefender anti-virus , this is the solution I got .
  
  So I suggest ppl not to get Vista till hmmm SP1 this late 07 ?
• ndmmxiaomayi

  10 Apr 07, 22:38

  I will still say Vista is not buggy, but is the compatibility that it lacks.
  
  Vista is a complete overhaul of XP, although it's still an NT-based system.
  
  Vista also completely overhauled the naming convention. I don't believe you still see the Start button named Start. Rather, it's just that Windows logo.
  
  Right click and select Properties. Properties? What properties?
  
  Start > Control Panel > Add/Remove Programs. Err... where?
  
  All these questions are commonly asked. In previous versions of Windows, more or less everything remains the same. For Vista, no.
  
  Just as the transition from Windows ME to Windows 2000 is great, the same logic applies here.
  
  The reason why 2000 programs are compatible with XP is because only some parts are re-written. XP also lives up to its name of being a great OS to use. The drivers detection rate is good, with most needing no drivers after installing XP. For better performance or if problems arises, drivers are then recommended.
  
  Vista is a totally different game. Drivers support are poor, even with compatible drivers, it still BSOD or crashes. Programs support are still poor as well.
• ndmmxiaomayi

  10 Apr 07, 22:40

  The 3/4/07 update ready cause some problem liao ... Alway got an error :80070020
  
  Solution : Close your bitdefender anti-virus , this is the solution I got

  Contact MS already? They need to update their guides.
• MrSotong

  10 Apr 07, 23:23

  Soon I will contact MS abt the guides and maybe contact da Bitdefender live support repz abt the problem
  
  Driver support maybe limited but who can't blame MS for it .
  Eg : Epson printers may not come out with a driver yet because Vista is new it is out in 30/1 or 1/2 in S'pore you can't expect them to come out driver for all the printers right ? TIME is what "vista" need . UAC is quite annoying but a small checker game or program can take control of your comp if you allow it hence the disadvantage .
  
  MS also come out with Windows Liveonecare it is badly done as it fail some of tests others conducted
  
  Winxp may also be quite buggy at first and remember Windows ME it is the worst OS ever .
  
  Though the desgin maybe nice it also have great features that m$ dun want to advertise ~!!! Eg: Readyboost etc ......
  
  Although DOT ban Vista for a moment it does not means that vista is bad
  Drivers is needed to run the hardware but if the hardware is too old it maybe as good as useless so we can't actually blame M$ [ In my own opinion ]
  
  
• photo_seeker

  11 Apr 07, 20:34

  My friend suspecting him com to be infected with virus as it's very laggy without any virus found using LiveOneCare. Mayi, can help to check?
  
  Logfile of HijackThis v1.99.1
  Scan saved at 8:24:53 PM, on 4/11/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16414)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\brsvc01a.exe
  C:\WINDOWS\system32\brss01a.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
  C:\Acer\eManager\anbmServ.exe
  C:\WINDOWS\system32\CTsvcCDA.exe
  C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
  C:\WINDOWS\system32\MsPMSPSv.exe
  C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
  C:\Program Files\Microsoft Windows OneCare Live\winss.exe
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\WINDOWS\system32\rundll32.exe
  C:\acer\epm\epm-dm.exe
  C:\Program Files\Launch Manager\QtZgAcer.EXE
  C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
  C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
  C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe
  C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
  C:\Program Files\Creative\USB SBAudigy2 NX\DVDAudio\CTDVDDet.EXE
  C:\Program Files\Creative\USB SBAudigy2 NX\Surround Mixer\CTSysVol.exe
  C:\WINDOWS\system32\RunDll32.exe
  C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
  C:\WINDOWS\system32\igfxtray.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\WINDOWS\system32\igfxpers.exe
  C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
  C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
  C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe
  C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Documents and Settings\Tony Ong\My Documents\My Received Files\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sg.yahoo.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O4 - HKLM\..\Run: [LaunchApp] Alaunch
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
  O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
  O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKLM\..\Run: [Acronis True Image Monitor] "C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe"
  O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
  O4 - HKLM\..\Run: [Samsung Common SM] "C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe" /autorun
  O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
  O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
  O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
  O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\USB SBAudigy2 NX\DVDAudio\CTDVDDet.EXE
  O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\USB SBAudigy2 NX\Surround Mixer\CTSysVol.exe /r
  O4 - HKLM\..\Run: [SbUsb AudCtrl] RunDll32 sbusbdll.dll,RCMonitor
  O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
  O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
  O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
  O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
  O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
  O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
  O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe" autostart
  O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O11 - Options group: [INTERNATIONAL] International*
  O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/yinst/yinst_current.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1169486271277
  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1169486671532
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
  O16 - DPF: {DD583921-A9E9-4FBF-9266-8DC2AB5EA0AF} (HGPlugin10USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin10USA.cab
  O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
  O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
  O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
  O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
  O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
  
  
• ndmmxiaomayi

  11 Apr 07, 20:40

  Your friend has too many programs running at startup, that's why it's so slow.
  
  Programs like Java Update, MSN Messenger, Nero don't need to run at startup.
  
  If he knows how to use msconfig utility, remove unnecessary startup programs from there.
  
  If he doesn't know how to, use Starter to manage the Startup programs.
• dinky1409

  12 Apr 07, 02:41

  Hey people..
  
  Why is it that my windows live messenger lately cause my whole laptop to freeze and hang.. Have to manually restart.. This occurs quite randomly, not quite sure what was the cause from MSN.. Please advice/help. Thanks a bunch in advance! =)
• ndmmxiaomayi

  12 Apr 07, 02:44

  Immediately after you signed in/out?
• dinky1409

  12 Apr 07, 04:52

  Originally posted by ndmmxiaomayi:

  Immediately after you signed in/out?

  no in the midst of it.. like Im doing work then I open my msn window and it hang.. or when was chatting chatting then my fren chat me in a new window it hang..
• ndmmxiaomayi

  12 Apr 07, 17:02

  Originally posted by dinky1409:

  no in the midst of it.. like Im doing work then I open my msn window and it hang.. or when was chatting chatting then my fren chat me in a new window it hang..

  It probably didn't hang, it is lagging.
  
  Often, you have to wait a while. Don't click anything.
  
  Find a day when you are free, defrag the hard disk.