How to remove Worm virus in MSN?

• dinky1409

  12 Apr 07, 21:43

  Originally posted by ndmmxiaomayi:

  It probably didn't hang, it is lagging.
  
  Often, you have to wait a while. Don't click anything.
  
  Find a day when you are free, defrag the hard disk.

  it really hang cos my mouse freezes...
• ndmmxiaomayi

  12 Apr 07, 21:47

  Originally posted by dinky1409:

  it really hang cos my mouse freezes...

  Er... when it lags.... it's like that...
  
  If more than 5 minutes, then confirm hang.
• bijouxrain

  15 Apr 07, 02:19

  Mine? Should be alot of dangers huh
  
  Logfile of HijackThis v1.99.1
  Scan saved at 2:15:22 AM, on 4/15/2007
  Platform: Windows XP SP1 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  c:\acer\KnobService.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\System32\alg.exe
  C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  C:\WINDOWS\System32\CTsvcCDA.EXE
  C:\Program Files\Norton AntiVirus\navapsvc.exe
  C:\Program Files\Norton AntiVirus\SAVScan.exe
  C:\Program Files\Spyware Doctor\sdhelp.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\WINDOWS\System32\wdfmgr.exe
  C:\WINDOWS\System32\MsPMSPSv.exe
  C:\WINDOWS\System32\Rundll32.exe
  C:\Program Files\Aspire\WFTVFM\WFWIZ.exe
  C:\acer\KnobMonitor.exe
  C:\ACER\MPS.EXE
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
  C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
  C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
  C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
  C:\Program Files\specificmail\SPCM.EXE
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\Program Files\Spyware Doctor\swdoctor.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
  C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
  c:\progra~1\intern~1\iexplore.exe
  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
  C:\WINDOWS\System32\wuauclt.exe
  C:\WINDOWS\System32\HPZipm12.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\Windows Media Player\wmplayer.exe
  C:\WINDOWS\System32\taskmgr.exe
  C:\Documents and Settings\Pei Juan\Desktop\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.com.cn
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://seek.3721.com/srchasst.htm
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://seek.3721.com/srchasst.htm
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://seek.3721.com/srchcust.htm
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: (no name) - {46A4E9D9-B30E-452A-8157-DBBEC8573B03} - C:\Program Files\VSAdd-in\VSAdd-in.dll
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
  O2 - BHO: SafeGuard Protect PCShield - {564FFB73-9EEF-4969-92FA-5FC4A92E2C2A} - C:\WINDOWS\System32\sfg_7a05.dll
  O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
  O2 - BHO: (no name) - {6D08B6DA-12AF-42B1-9E82-70BD507ED9B1} - C:\WINDOWS\Config\ctpva.dll (file missing)
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
  O2 - BHO: Popup Blocker Pro - {A44B961C-8C36-470f-8555-EDA0EFC1E710} - C:\Program Files\SafeGuard Pop-up Blocker Pro FREE Edition\popupblocker.dll
  O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\zh-sg\msntb.dll
  O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINDOWS\DOWNLO~1\cnshook.dll
  O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINDOWS\System32\hjcylnuc.dll (file missing)
  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll
  O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\zh-sg\msntb.dll
  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
  O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - C:\Program Files\VSAdd-in\VSAdd-in.dll
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [Aspire Schedule] C:\Program Files\Aspire\WFTVFM\WFWIZ.exe
  O4 - HKLM\..\Run: [KnobMonitor] C:\acer\KnobMonitor.exe
  O4 - HKLM\..\Run: [MPS] C:\ACER\MPS.EXE
  O4 - HKLM\..\Run: [testSchedule] C:\Program Files\Take Vision Breaks\Take Vision Breaks.exe
  O4 - HKLM\..\Run: [hC] C:\documents and settings\acer\local settings\temp\hC.exe
  O4 - HKLM\..\Run: [ImALhyZ] C:\documents and settings\acer\local settings\temp\ImALhyZ.exe
  O4 - HKLM\..\Run: [XSbcAJi] C:\documents and settings\acer\local settings\temp\XSbcAJi.exe
  O4 - HKLM\..\Run: [IxA1] C:\documents and settings\angie\local settings\temp\IxA1.exe
  O4 - HKLM\..\Run: [PCShield] regsvr32 /s "C:\WINDOWS\System32\sfg_7a05.dll"
  O4 - HKLM\..\Run: [6e2122d764f8] C:\WINDOWS\System32\mspmspsv.exe
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [CnsMin] Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32
  O4 - HKLM\..\Run: [YDTMain.exe] C:\PROGRA~1\YDT\YDTMain.exe
  O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
  O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
  O4 - HKLM\..\Run: [NetLimiter] C:\Program Files\NetLimiter\NetLimiter.exe /s
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [TICKREGSBATTEST] C:\Documents and Settings\All Users\Application Data\data bin tick regs\Jugs Defy.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
  O4 - HKCU\..\Run: [SPCM] C:\Program Files\specificmail\SPCM.EXE
  O4 - HKCU\..\Run: [a2rERWcpW] autprn.exe
  O4 - HKCU\..\Run: [PCShield] regsvr32 /s "C:\WINDOWS\System32\sfg_7a05.dll"
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [Spyware Cleaner] "C:\Program Files\Spyware Cleaner\SpywareCleaner.Exe" /boot
  O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
  O4 - HKCU\..\Run: [OnlineCdrom] C:\DOCUME~1\PEIJUA~1\APPLIC~1\ATOMDE~1\32third.exe
  O4 - Startup: Free WebSite Tools.lnk = ?
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O4 - Global Startup: hpoddt01.exe.lnk = ?
  O4 - Global Startup: hp psc 1000 series.lnk = ?
  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
  O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe (file missing)
  O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe (file missing)
  O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  O9 - Extra button: Yahoo 1G mail - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail (file missing)
  O9 - Extra button: E bazar - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://adtaobao.allyes.com/main/adfclick?db=adtaobao&bid=138,140,18&cid=816,8,1&sid=5042&show=ignore&url=http://www.taobao.com/vertical/mall/pro.php?allyesPara=816 (file missing)
  O9 - Extra button: Yahoo Assistant - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing)
  O9 - Extra button: (no name) - {6354ABE6-05F1-49ed-B850-E423120EC338} - http://cn.widget.yahoo.com/index.htm?source=Cns (file missing)
  O9 - Extra button: Voiceglo directory - {C9B8ABB6-1CC3-4957-9CA3-053036B2EE3A} - C:\Documents and Settings\All Users\Desktop\Glophone.lnk (file missing)
  O9 - Extra button: Instant Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
  O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
  O9 - Extra 'Tools' menuitem: Repair Browser - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
  O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
  O9 - Extra 'Tools' menuitem: Clean Internet access record - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
  O11 - Options group: [!CNS] Chinese keywords
  O14 - IERESET.INF: START_PAGE_URL=http://global.acer.com/
  O15 - Trusted Zone: http://www.amaena.com
  O15 - Trusted Zone: http://*.billingnow.com
  O15 - Trusted Zone: http://locator.cdn.imageservr.com
  O15 - Trusted Zone: http://locator1.cdn.imagesrvr.com
  O15 - Trusted Zone: http://*.reliablestats.com
  O15 - Trusted Zone: http://scanner.sysprotect.com
  O15 - Trusted Zone: http://*.systemdoctor.com
  O15 - Trusted Zone: http://*.winantispyware.com
  O15 - Trusted Zone: http://www.winantivirus.com
  O15 - Trusted Zone: http://*.winantivirus.com
  O15 - Trusted Zone: http://www.winantiviruspro.com
  O15 - Trusted Zone: http://*.winantiviruspro.com
  O15 - Trusted Zone: http://*.winfixer.com
  O15 - Trusted Zone: http://*.winnanny.com
  O15 - Trusted Zone: http://download.cdn.winsoftware.com
  O15 - Trusted Zone: http://*.winsoftware.com
  O15 - Trusted IP range: http://202.67.220.225
  O15 - Trusted IP range: http://59.148.220.121
  O15 - Trusted IP range: http://62.4.84.53
  O15 - Trusted IP range: http://82.98.235.58
  O15 - Trusted IP range: http://85.12.25.90
  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
  O16 - DPF: {01234567-1234-1234-1234-012345678921} - http://images.neopets.com/glophone/neopets4.cab
  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
  O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlmanager.akamaitools.com.edgesuite.net/dlmanager/versions/activex/dlm-activex-2.0.2.7.cab
  O16 - DPF: {54771E6F-A5A2-4413-8FB8-7B8F85398174} - http://dl.lygo.com/Sidesearch/en_US/angelfire/Sidesearch.cab
  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
  O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/abarth/us/win/QuickTimeInstaller.exe
  O16 - DPF: {7606693A-C18D-4567-AF85-6194FF70761E} (GomWeb Control) - http://app.ipop.co.kr/gom/GomWeb.cab
  O16 - DPF: {8C4A2492-3FED-41F2-BBAB-34E802844F8D} (IESettings Class) - http://schdnaweb.schooldna.com/schooldna/login/dnaClientIE.CAB
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
  O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?325
  O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O20 - Winlogon Notify: ctpva - C:\WINDOWS\Config\ctpva.dll (file missing)
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
  O20 - Winlogon Notify: tgqgohit - tgqgohit.dll (file missing)
  O20 - Winlogon Notify: tybrmbfu - tybrmbfu.dll (file missing)
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
  O23 - Service: Knob Service (KNOBSERV) - Acer Inc. - c:\acer\KnobService.exe
  O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
  O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
  O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
  O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
  O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe
  O23 - Service: SpywareCleanerService - Unknown owner - C:\Program Files\Spyware Cleaner\SCService.exe (file missing)
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe (file missing)
• ndmmxiaomayi

  15 Apr 07, 14:27

  bijouxrain, you have too much junk there...
  
  During the cleaning process, don't download any other stuffs except the tools given. Also, I need to warn you about having a backdoor in your PC...
  
  Step 1
  
  Your computer has multiple infections, including a backdoor. A backdoor gives intruders complete control of your computer, logs your keystrokes, steal personal information, etc.
  
  You are strongly advised to do the following:
  
  

  [*]Disconnect the computer from the Internet and from any networked computers until it is cleaned.
  [*]Back up all your important data except programs. The programs can be reinstalled back from the orignal disc or from the Net.
  [*]Call all your banks, financial institutions, credit card companies and inform them that you may be a victim of identity theft and put a watch on your accounts. If you don't mind the hassle, change all your account numbers.
  [*]From a clean computer, change all your passwords (ISP login password, your email address(es) passwords, financial accounts, PayPal, eBay, Amazon, online groups and forums and any other online activities you carry out which require a username and password).

  Do NOT change your passwords from this computer as the attacker will be able to get all the new passwords and transaction records.
  
  Due to its backdoor functionality, your computer is very likely to have been compromised and there is no way that it can be trusted again. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be to do a reformat and reinstallation of the operating system (OS). However, if you do not have the resources to reinstall your OS and would like me to attempt to clean your machine, I will be happy to do so.
  
  To help you understand more, please take some time to read the follwing articles:
  
  What are Remote Access Trojans and why are they dangerous
  How do I respond to a possible identity theft and how do I prevent it
  When should do a reformat and reinstallation of my OS
  Where to backup your files
  How to backup your files in Windows XP
  Restoring your backups
  
  If you wish to proceed without reformatting, follow the instructions below:
  
  

  [*]Download SDFix by AndyManchesta and save it to your desktop.
  [*]Double click on SDFix.exe. By default, it will install to C:\.
  [*]Click on Install.

  
  
  Next, boot into Safe Mode.
  
  

  [*]When you see BIOS screen, start pressing F8.
  [*]A boot menu will appear shortly.
  [*]Using the up down arrows, select Safe Mode and press the Enter key.
  [*]Windows will now load.
  [*]Log in to your usual account.
  [*]Navigate to C:\SDfix (if you installed it to the default location, otherwise, locate where you installed it)
  [*]Double click on RunThis.bat
  [*]Type Y to begin the cleanup process.
  [*]It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  [*]Press any key to reboot.
  [*]When the PC restarts the tool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  [*]Once the desktop icons load, the SDFix report will open on screen. You can also find the report in SDFix folder, named Report.txt.

  
  
  Step 2
  
  

  [*]Open up HijackThis.
  [*]Select Open the Misc Tools section.
  [*]Look under System tools.
  [*]Click on the Open Uninstall Manager... button.
  [*]Click on the Save list... button.
  [*]It will prompt you to save. Save this log in a convenient location. By default it's named uninstall_list.txt.
  [*]Notepad will open. Press Ctrl + A to select everything. Press Ctrl + C to copy the text. Come back to this thread, click on the Post Reply button. Press Ctrl + V to paste the contents of this log in.

  
  
  If you can't get HijackThis to produce an uninstall list, please proceed with the following:
  
  

  [*]Please download CCleaner and save it to your desktop.
  [*]Double click to install it. It will install the Yahoo! toolbar as well. If you don't want the Yahoo! toolbar, please uncheck (untick) the box for Yahoo! toolbar during installation of CCleaner.
  [*]Once it's installed, go to Start > All Programs > CCleaner > CCleaner.
  [*]Select Tools on the left hand side. Click on Uninstall.
  [*]Click on Save to text file... button.
  
  
  
  [*]It will prompt you to save. Save this list to a convenient location. By default it's named install.txt and it's saved at C:\Program Files\CCleaner.
  [*]Locate install.txt. Double click to open it.
  [*]Press Ctrl + A to select everything. Press Ctrl + C to copy the text. Come back to this thread, click on the Post Reply button. Press Ctrl + V to paste the contents of this log in.

  
  
  In your next reply, please post back:
  
  

  [*]SDFix report.txt
  [*]Uninstall list
  [*]A new HijackThis log
• bijouxrain

  15 Apr 07, 23:06

  SDFix report:
  Restoring Windows Registry Values
  Restoring Windows Default Hosts File
  
  Rebooting...
  
  Normal Mode:
  Checking Files:
  
  No Trojan Files Found...
  
  Removing Temp Files
  
  ADS Check:
  
  Checking if ADS is attached to system32 Folder
  C:\WINDOWS\system32
  No streams found.
  
  Checking if ADS is attached to svchost.exe
  C:\WINDOWS\system32\svchost.exe
  No streams found.
  
  Final Check:
  
  Remaining Services:
  ------------------
  
  Remaining Files:
  ---------------
  
  Checking For Files with Hidden Attributes:
  
  C:\WINDOWS\system32\NTICDMK32.dll
  C:\WINDOWS\system32\jkkjg.dll
  C:\Documents and Settings\acer\Local Settings\Temp\hc.dll
  C:\Documents and Settings\acer\Local Settings\Temp\imalhyz.dll
  C:\Documents and Settings\acer\Local Settings\Temp\xsbcaji.dll
  C:\Documents and Settings\Angie\Local Settings\Temp\IxA1.dll
  C:\Documents and Settings\acer\Application Data\b??t?g.exe
  C:\WINDOWS\system32\KGyGaAvL.sys
  C:\WINDOWS\system32\75E83C6141.sys
  C:\WINDOWS\system32\rtutv.tmp
  C:\WINDOWS\Config\avptc.tmp
  C:\WINDOWS\LastGood.Tmp\INF\oem37.inf
  C:\WINDOWS\LastGood.Tmp\INF\oem37.PNF
  C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\lock.tmp
  
  Finished
  
  Uninstall list:
  802.11 Wireless LAN
  Ad-Aware SE Personal
  Adobe Acrobat 5.0
  Adobe Photoshop 7.0
  Adobe Photoshop 7.0.1
  Adobe SVG Viewer 3.0
  ANIO Service
  ANIWZCS2 Service
  Askey HSFi V.90(V.92) 56K PCI Modem
  Aspire TV/FM(Application)
  Aspire USB Keyboard Driver Ver1.255
  AVG 7.5
  BitTorrent 3.4.2
  CC_ccStart
  ccCommon
  CGoban 2.6.8
  Chinese keywords
  CoffeeCup Direct FTP
  Creative Jukebox Driver
  Creative MediaSource
  Creative Removable Disk Manager
  Creative System Information
  Creative Zen Micro
  DivX Content Uploader
  DivX Web Player
  GIF Movie Gear 4.1.1
  HijackThis 1.99.1
  HP Extended Capabilities 6.1
  HP Imaging Device Functions 6.1
  HP Memories Disc
  HP Photo and Imaging 2.0 - All-in-One
  HP Photo and Imaging 2.0 - All-in-One Drivers
  HP Photo and Imaging 2.0 - hp psc 1100 series
  HP Photosmart Essential
  HP PSC & OfficeJet 6.1.A
  hp psc 1100 series
  HP Software Update
  HP Solution Center and Imaging Support Tools 6.1
  IE Host
  IE Host
  Intel(R) Extreme Graphics Driver
  J2SE Runtime Environment 5.0 Update 8
  Jasc Additional Picture Tubes Installer
  Jasc Additional Sample Animations Installer
  Jasc WebDraw 1.0 Try and Buy
  LiveReg (Symantec Corporation)
  LiveUpdate 1.90 (Symantec Corporation)
  Macromedia Flash Player 8
  Macromedia Shockwave Player
  MapleStory
  MaxSpeed
  Messenger Plus! Live & Sponsor (CiD)
  Microsoft Office XP Media Content
  Microsoft Office XP Professional
  MissionRisk 3.0
  Mozilla Firefox (1.5.0.11)
  MSN Add-in for Windows Messenger
  MSN Music Assistant
  MSN Toolbar
  MSRedist
  Music Transfer Hard Disk Player Edition
  NetLimiter 1.30 (remove only)
  Network Play System (Patching)
  NJStar Asian Explorer
  NoAdware v5.0
  Nokia Connectivity Cable Driver
  Nokia Lifeblog 2.0
  Nokia PC Suite
  Norton AntiVirus 2004
  Norton AntiVirus 2004 (Symantec Corporation)
  Norton AntiVirus Parent MSI
  Norton AntiVirus SYMLT MSI
  NTI CD/DVD-Maker 6 Gold
  NVIDIA Windows 2000/XP Display Drivers
  Pet Profiles Screen Saver
  Photoshop 7 Advanced & Web Imagery
  PowerDVD
  QuickTime
  RealPlayer
  Realtek AC'97 Audio
  SafeGuard Pop-up Blocker Pro FREE Edition
  Samsung Multimedia Studio 1.0
  Samsung Music Studio
  SEP
  Shockwave
  Softnyx Launcher
  Spike Nick Clickable
  SpongeBob Nick Clickable
  Spybot - Search & Destroy 1.3
  Spyware Doctor 3.2
  Support Software
  Symantec Script Blocking Installer
  SymNet
  The Sims Unleashed
  The Sims Vacation
  Timmy Nick Clickable
  Ulead DVD MovieFactory 2 SE
  VSAdd-in for Internet Explorer
  Windows Installer 3.1 (KB893803)
  Windows Live Messenger
  Windows Live Sign-in Assistant
  Windows Media Format Runtime
  Windows Media Player 10
  Windows Media Player 9 Hotfix [See KB885492 for more information]
  Windows XP Hotfix - KB822603
  Windows XP Hotfix - KB823980
  Windows XP Hotfix - KB824146
  Windows XP Hotfix - KB828741
  Windows XP Hotfix - KB833987
  Windows XP Hotfix - KB835732
  Windows XP Hotfix - KB840987
  Windows XP Hotfix - KB841356
  Windows XP Hotfix - KB841533
  Windows XP Hotfix - KB842773
  Windows XP Hotfix - KB871250
  Windows XP Hotfix - KB873339
  Windows XP Hotfix - KB873376
  Windows XP Hotfix - KB885523
  Windows XP Hotfix - KB885835
  Windows XP Hotfix - KB885836
  Windows XP Hotfix - KB889293
  Windows XP Hotfix - KB890175
  Windows XP Hotfix - KB890859
  Windows XP Hotfix - KB891711
  Windows XP Hotfix (SP2) Q327979
  Windows XP Hotfix (SP2) Q816509
  
  New HijackThis log:
  Logfile of HijackThis v1.99.1
  Scan saved at 11:01:14 PM, on 4/15/2007
  Platform: Windows XP SP1 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  c:\acer\KnobService.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\System32\alg.exe
  C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  C:\WINDOWS\System32\CTsvcCDA.EXE
  C:\Program Files\Norton AntiVirus\navapsvc.exe
  C:\Program Files\Norton AntiVirus\SAVScan.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Spyware Doctor\sdhelp.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\WINDOWS\System32\wdfmgr.exe
  C:\WINDOWS\System32\Rundll32.exe
  C:\WINDOWS\System32\MsPMSPSv.exe
  C:\WINDOWS\system32\notepad.exe
  C:\Program Files\Aspire\WFTVFM\WFWIZ.exe
  C:\acer\KnobMonitor.exe
  C:\ACER\MPS.EXE
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
  C:\WINDOWS\System32\wuauclt.exe
  C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
  C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
  C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
  C:\Program Files\specificmail\SPCM.EXE
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\Program Files\Spyware Cleaner\SpywareCleaner.Exe
  C:\Program Files\Spyware Doctor\swdoctor.exe
  C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
  c:\progra~1\intern~1\iexplore.exe
  c:\progra~1\intern~1\iexplore.exe
  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
  C:\WINDOWS\System32\HPZipm12.exe
  C:\WINDOWS\System32\notepad.exe
  C:\WINDOWS\system32\NOTEPAD.EXE
  C:\Documents and Settings\Pei Juan\Desktop\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.com.cn
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://seek.3721.com/srchasst.htm
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://seek.3721.com/srchasst.htm
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://seek.3721.com/srchcust.htm
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: (no name) - {46A4E9D9-B30E-452A-8157-DBBEC8573B03} - C:\Program Files\VSAdd-in\VSAdd-in.dll
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
  O2 - BHO: SafeGuard Protect PCShield - {564FFB73-9EEF-4969-92FA-5FC4A92E2C2A} - C:\WINDOWS\System32\sfg_7a05.dll
  O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
  O2 - BHO: (no name) - {6D08B6DA-12AF-42B1-9E82-70BD507ED9B1} - C:\WINDOWS\Config\ctpva.dll (file missing)
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
  O2 - BHO: Popup Blocker Pro - {A44B961C-8C36-470f-8555-EDA0EFC1E710} - C:\Program Files\SafeGuard Pop-up Blocker Pro FREE Edition\popupblocker.dll
  O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\zh-sg\msntb.dll
  O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINDOWS\DOWNLO~1\cnshook.dll
  O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINDOWS\System32\hjcylnuc.dll (file missing)
  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll
  O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\zh-sg\msntb.dll
  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
  O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - C:\Program Files\VSAdd-in\VSAdd-in.dll
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [Aspire Schedule] C:\Program Files\Aspire\WFTVFM\WFWIZ.exe
  O4 - HKLM\..\Run: [KnobMonitor] C:\acer\KnobMonitor.exe
  O4 - HKLM\..\Run: [MPS] C:\ACER\MPS.EXE
  O4 - HKLM\..\Run: [testSchedule] C:\Program Files\Take Vision Breaks\Take Vision Breaks.exe
  O4 - HKLM\..\Run: [hC] C:\documents and settings\acer\local settings\temp\hC.exe
  O4 - HKLM\..\Run: [ImALhyZ] C:\documents and settings\acer\local settings\temp\ImALhyZ.exe
  O4 - HKLM\..\Run: [XSbcAJi] C:\documents and settings\acer\local settings\temp\XSbcAJi.exe
  O4 - HKLM\..\Run: [IxA1] C:\documents and settings\angie\local settings\temp\IxA1.exe
  O4 - HKLM\..\Run: [PCShield] regsvr32 /s "C:\WINDOWS\System32\sfg_7a05.dll"
  O4 - HKLM\..\Run: [6e2122d764f8] C:\WINDOWS\System32\mspmspsv.exe
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [CnsMin] Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32
  O4 - HKLM\..\Run: [YDTMain.exe] C:\PROGRA~1\YDT\YDTMain.exe
  O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
  O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
  O4 - HKLM\..\Run: [NetLimiter] C:\Program Files\NetLimiter\NetLimiter.exe /s
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [TICKREGSBATTEST] C:\Documents and Settings\All Users\Application Data\data bin tick regs\Jugs Defy.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
  O4 - HKCU\..\Run: [SPCM] C:\Program Files\specificmail\SPCM.EXE
  O4 - HKCU\..\Run: [a2rERWcpW] autprn.exe
  O4 - HKCU\..\Run: [PCShield] regsvr32 /s "C:\WINDOWS\System32\sfg_7a05.dll"
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [Spyware Cleaner] "C:\Program Files\Spyware Cleaner\SpywareCleaner.Exe" /boot
  O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
  O4 - HKCU\..\Run: [OnlineCdrom] C:\DOCUME~1\PEIJUA~1\APPLIC~1\ATOMDE~1\32third.exe
  O4 - Startup: Free WebSite Tools.lnk = ?
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O4 - Global Startup: hpoddt01.exe.lnk = ?
  O4 - Global Startup: hp psc 1000 series.lnk = ?
  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
  O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe (file missing)
  O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe (file missing)
  O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  O9 - Extra button: Yahoo 1G mail - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail (file missing)
  O9 - Extra button: E bazar - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://adtaobao.allyes.com/main/adfclick?db=adtaobao&bid=138,140,18&cid=816,8,1&sid=5042&show=ignore&url=http://www.taobao.com/vertical/mall/pro.php?allyesPara=816 (file missing)
  O9 - Extra button: Yahoo Assistant - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing)
  O9 - Extra button: (no name) - {6354ABE6-05F1-49ed-B850-E423120EC338} - http://cn.widget.yahoo.com/index.htm?source=Cns (file missing)
  O9 - Extra button: Voiceglo directory - {C9B8ABB6-1CC3-4957-9CA3-053036B2EE3A} - C:\Documents and Settings\All Users\Desktop\Glophone.lnk (file missing)
  O9 - Extra button: Instant Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
  O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
  O9 - Extra 'Tools' menuitem: Repair Browser - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
  O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
  O9 - Extra 'Tools' menuitem: Clean Internet access record - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
  O11 - Options group: [!CNS] Chinese keywords
  O14 - IERESET.INF: START_PAGE_URL=http://global.acer.com/
  O15 - Trusted Zone: http://www.amaena.com
  O15 - Trusted Zone: http://*.billingnow.com
  O15 - Trusted Zone: http://locator.cdn.imageservr.com
  O15 - Trusted Zone: http://locator1.cdn.imagesrvr.com
  O15 - Trusted Zone: http://*.reliablestats.com
  O15 - Trusted Zone: http://scanner.sysprotect.com
  O15 - Trusted Zone: http://*.systemdoctor.com
  O15 - Trusted Zone: http://*.winantispyware.com
  O15 - Trusted Zone: http://www.winantivirus.com
  O15 - Trusted Zone: http://*.winantivirus.com
  O15 - Trusted Zone: http://www.winantiviruspro.com
  O15 - Trusted Zone: http://*.winantiviruspro.com
  O15 - Trusted Zone: http://*.winfixer.com
  O15 - Trusted Zone: http://*.winnanny.com
  O15 - Trusted Zone: http://download.cdn.winsoftware.com
  O15 - Trusted Zone: http://*.winsoftware.com
  O15 - Trusted IP range: http://202.67.220.225
  O15 - Trusted IP range: http://59.148.220.121
  O15 - Trusted IP range: http://62.4.84.53
  O15 - Trusted IP range: http://82.98.235.58
  O15 - Trusted IP range: http://85.12.25.90
  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
  O16 - DPF: {01234567-1234-1234-1234-012345678921} - http://images.neopets.com/glophone/neopets4.cab
  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
  O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlmanager.akamaitools.com.edgesuite.net/dlmanager/versions/activex/dlm-activex-2.0.2.7.cab
  O16 - DPF: {54771E6F-A5A2-4413-8FB8-7B8F85398174} - http://dl.lygo.com/Sidesearch/en_US/angelfire/Sidesearch.cab
  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
  O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/abarth/us/win/QuickTimeInstaller.exe
  O16 - DPF: {7606693A-C18D-4567-AF85-6194FF70761E} (GomWeb Control) - http://app.ipop.co.kr/gom/GomWeb.cab
  O16 - DPF: {8C4A2492-3FED-41F2-BBAB-34E802844F8D} (IESettings Class) - http://schdnaweb.schooldna.com/schooldna/login/dnaClientIE.CAB
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
  O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?325
  O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O20 - Winlogon Notify: ctpva - C:\WINDOWS\Config\ctpva.dll (file missing)
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
  O20 - Winlogon Notify: tgqgohit - tgqgohit.dll (file missing)
  O20 - Winlogon Notify: tybrmbfu - tybrmbfu.dll (file missing)
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
  O23 - Service: Knob Service (KNOBSERV) - Acer Inc. - c:\acer\KnobService.exe
  O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
  O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
  O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
  O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
  O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe
  O23 - Service: SpywareCleanerService - Unknown owner - C:\Program Files\Spyware Cleaner\SCService.exe (file missing)
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe (file missing)
  
  
• ndmmxiaomayi

  16 Apr 07, 08:39

  Uninstall these programs:
  
  Chinese keywords
  IE Host
  Messenger Plus! Live & Sponsor (CiD)
  NoAdware v5.0
  SafeGuard Pop-up Blocker Pro FREE Edition
  VSAdd-in for Internet Explorer
  
  Please download Combofix from Tech Support Forum or Bleeping Computer.
  
  Save it to your desktop. Double click to run it. When done, it will produce a log. Please copy and paste this log in your next reply.
  
  Do not click on Combofix while it's running. It may cause it to stall.
  
  In your next reply, please post:
  
  

  [*]The Combofix log
  [*]A new HijackThis log
• bijouxrain

  16 Apr 07, 18:45

  Combofix log:
  ComboFix 07-04-05.Rev3 - Running from: "C:\Documents and Settings\Pei Juan\Desktop"
  
  ((((((((((((((((((((((((((((((( Files Created from 2007-03-16 to 2007-04-16 ))))))))))))))))))))))))))))))))))
  
  2007-04-16 18:28 155,648 --a------ C:\WINDOWS\system32\igfxres.dll
  2007-04-16 17:27 5 --a------ C:\WINDOWS\ycns.dat
  2007-04-16 17:27 38,400 --a------ C:\WINDOWS\system32\drivers\kfpbsgr.sys
  2007-04-14 20:00 d--hs---- C:\FOUND.268
  2007-04-13 22:00 d--hs---- C:\FOUND.267
  2007-04-12 22:41 32,768 --a------ C:\DOCUME~1\PEIJUA~1\hexhie.exe
  2007-04-12 22:23 32,768 --a------ C:\DOCUME~1\PEIJUA~1\ouzpoa.exe
  2007-04-10 18:17 32,768 --a------ C:\DOCUME~1\PEIJUA~1\mxoleh.exe
  2007-04-10 17:56 32,768 --a------ C:\DOCUME~1\PEIJUA~1\jgmdpd.exe
  2007-04-10 17:39 32,768 --a------ C:\DOCUME~1\PEIJUA~1\hkwwml.exe
  2007-04-07 19:53 d-------- C:\Program Files\NoAdware5.0
  2007-04-02 00:11 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
  2007-04-01 02:16 d--h----- C:\WINDOWS\PIF
  2007-03-25 21:43 d--hs---- C:\FOUND.266
  2007-03-23 14:30 152,833 --a------ C:\WINDOWS\system32\drivers\dump_wmimmc.sys
  2007-03-18 18:42 d-------- C:\Program Files\BannedStory
  2007-03-18 16:00 d--hs---- C:\FOUND.265
  2007-03-17 19:55 d-------- C:\Program Files\GIF Movie Gear
  
  (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
  
  2007-02-02 08:00 11821041 --------- C:\AVG7QT.DAT
  2007-01-23 03:44 109964 --a------ C:\WINDOWS\hpoins08.dat
  2007-01-19 12:53 51056 --a------ C:\WINDOWS\system32\sirenacm.dll
  
  (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
  
  *Note* empty entries & legit default entries are not shown
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
  "SPCM"="C:\\Program Files\\specificmail\\SPCM.EXE"
  "a2rERWcpW"="autprn.exe"
  "PCShield"="regsvr32 /s \"C:\\WINDOWS\\System32\\sfg_7a05.dll\""
  "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
  "Spyware Cleaner"="\"C:\\Program Files\\Spyware Cleaner\\SpywareCleaner.Exe\" /boot"
  "Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
  "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup"
  "nwiz"="nwiz.exe /install"
  "Aspire Schedule"="C:\\Program Files\\Aspire\\WFTVFM\\WFWIZ.exe"
  "KnobMonitor"="C:\\acer\\KnobMonitor.exe"
  "MPS"="C:\\ACER\\MPS.EXE"
  "testSchedule"="C:\\Program Files\\Take Vision Breaks\\Take Vision Breaks.exe"
  "hC"="C:\\documents and settings\\acer\\local settings\\temp\\hC.exe"
  "ImALhyZ"="C:\\documents and settings\\acer\\local settings\\temp\\ImALhyZ.exe"
  "XSbcAJi"="C:\\documents and settings\\acer\\local settings\\temp\\XSbcAJi.exe"
  "IxA1"="C:\\documents and settings\\angie\\local settings\\temp\\IxA1.exe"
  "PCShield"="regsvr32 /s \"C:\\WINDOWS\\System32\\sfg_7a05.dll\""
  "6e2122d764f8"="C:\\WINDOWS\\System32\\mspmspsv.exe"
  "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
  "AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP"
  "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
  "YDTMain.exe"="C:\\PROGRA~1\\YDT\\YDTMain.exe"
  "DataLayer"="C:\\PROGRA~1\\COMMON~1\\PCSuite\\DATALA~1\\DATALA~1.EXE"
  "PCSuiteTrayApplication"="C:\\PROGRA~1\\Nokia\\NOKIAP~1\\TRAYAP~1.EXE"
  "NetLimiter"="C:\\Program Files\\NetLimiter\\NetLimiter.exe /s"
  "HP Software Update"="C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWuSchd2.exe"
  "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_08\\bin\\jusched.exe"
  "IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe"
  "HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
  "Installed"="1"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
  "Installed"="1"
  "NoChange"="1"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
  "Installed"="1"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\a2rERWcpW]
  "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
  "item"="eveit142"
  "hkey"="HKCU"
  "command"="eveit142.exe"
  "inimapping"="0"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANIWZCS2Service]
  "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
  "item"="WZCSLDR2"
  "hkey"="HKLM"
  "command"="C:\\Program Files\\ANI\\ANIWZCS2 Service\\WZCSLDR2.exe"
  "inimapping"="0"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
  "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
  "item"="mHotkey"
  "hkey"="HKLM"
  "command"="mHotkey.exe"
  "inimapping"="0"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ledpointer]
  "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
  "item"="CNYHKey"
  "hkey"="HKLM"
  "command"="CNYHKey.exe"
  "inimapping"="0"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\prutict]
  "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
  "item"="prutict"
  "hkey"="HKCU"
  "command"="C:\\WINDOWS\\System32\\prutict.exe"
  "inimapping"="0"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\r536Q]
  "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
  "item"="exestr10"
  "hkey"="HKLM"
  "command"="exestr10.exe"
  "inimapping"="0"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSER]
  "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
  "item"="sser"
  "hkey"="HKLM"
  "command"="sser.exe"
  "inimapping"="0"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StopHS]
  "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
  "item"="stopHS"
  "hkey"="HKLM"
  "command"="stopHS.bat"
  "inimapping"="0"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Xydcgby]
  "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
  "item"="Xzjn"
  "hkey"="HKLM"
  "command"="C:\\Program Files\\Ytlrz\\Xzjn.exe"
  "inimapping"="0"
  
  [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
  "Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
  
  HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ctpva
  HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tgqgohit
  HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tybrmbfu
  
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
  "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
  
  HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
  Authentication Packages REG_MULTI_SZ msv1_0\0\0
  Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
  Notification Packages REG_MULTI_SZ scecli\0\0
  
  [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
  LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
  NetworkService REG_MULTI_SZ DnsCache\0\0
  rpcss REG_MULTI_SZ RpcSs\0\0
  imgsvc REG_MULTI_SZ StiSvc\0\0
  termsvcs REG_MULTI_SZ TermService\0\0
  
  [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d0bfc0ca-2ec4-11d8-9069-806d6172696f}]
  Shell\AutoRun\command E:\CDSTART.EXE
  
  Contents of the 'Scheduled Tasks' folder
  C:\WINDOWS\tasks\Symantec NetDetect.job
  C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - Pei Juan.job
  C:\WINDOWS\tasks\FRU Task #Hewlett-Packard#hp psc 1100 series#1102301909.job
  
  ********************************************************************
  
  catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006
  http://www.gmer.net
  
  scanning hidden processes ...
  
  scanning hidden services ...
  
  scanning hidden autostart entries ...
  
  scanning hidden files ...
  
  scan completed successfully
  hidden processes: 0
  hidden services: 0
  hidden files: 0
  
  ********************************************************************
  
  Completion time: 07-04-16 18:44:00
  C:\ComboFix-quarantined-files.txt ... 07-04-16 18:44
  
  New HijackThis log:
  Logfile of HijackThis v1.99.1
  Scan saved at 6:45:44 PM, on 4/16/2007
  Platform: Windows XP SP1 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  c:\acer\KnobService.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  C:\WINDOWS\System32\CTsvcCDA.EXE
  C:\Program Files\Norton AntiVirus\navapsvc.exe
  C:\Program Files\Norton AntiVirus\SAVScan.exe
  C:\Program Files\Spyware Doctor\sdhelp.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\WINDOWS\System32\wdfmgr.exe
  C:\WINDOWS\System32\MsPMSPSv.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Aspire\WFTVFM\WFWIZ.exe
  C:\acer\KnobMonitor.exe
  C:\ACER\MPS.EXE
  C:\Program Files\Take Vision Breaks\Take Vision Breaks.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
  C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
  C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
  C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
  C:\WINDOWS\System32\igfxtray.exe
  C:\WINDOWS\System32\hkcmd.exe
  C:\Program Files\specificmail\SPCM.EXE
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\Program Files\Spyware Cleaner\SpywareCleaner.Exe
  C:\Program Files\Spyware Doctor\swdoctor.exe
  C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
  C:\WINDOWS\System32\wuauclt.exe
  C:\WINDOWS\System32\HPZipm12.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\WINDOWS\system32\NOTEPAD.EXE
  C:\Documents and Settings\Pei Juan\Desktop\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://seek.3721.com/srchasst.htm
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
  O2 - BHO: SafeGuard Protect PCShield - {564FFB73-9EEF-4969-92FA-5FC4A92E2C2A} - C:\WINDOWS\System32\sfg_7a05.dll
  O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
  O2 - BHO: (no name) - {6D08B6DA-12AF-42B1-9E82-70BD507ED9B1} - C:\WINDOWS\Config\ctpva.dll (file missing)
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
  O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\zh-sg\msntb.dll
  O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll
  O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\zh-sg\msntb.dll
  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [Aspire Schedule] C:\Program Files\Aspire\WFTVFM\WFWIZ.exe
  O4 - HKLM\..\Run: [KnobMonitor] C:\acer\KnobMonitor.exe
  O4 - HKLM\..\Run: [MPS] C:\ACER\MPS.EXE
  O4 - HKLM\..\Run: [testSchedule] C:\Program Files\Take Vision Breaks\Take Vision Breaks.exe
  O4 - HKLM\..\Run: [hC] C:\documents and settings\acer\local settings\temp\hC.exe
  O4 - HKLM\..\Run: [ImALhyZ] C:\documents and settings\acer\local settings\temp\ImALhyZ.exe
  O4 - HKLM\..\Run: [XSbcAJi] C:\documents and settings\acer\local settings\temp\XSbcAJi.exe
  O4 - HKLM\..\Run: [IxA1] C:\documents and settings\angie\local settings\temp\IxA1.exe
  O4 - HKLM\..\Run: [PCShield] regsvr32 /s "C:\WINDOWS\System32\sfg_7a05.dll"
  O4 - HKLM\..\Run: [6e2122d764f8] C:\WINDOWS\System32\mspmspsv.exe
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [YDTMain.exe] C:\PROGRA~1\YDT\YDTMain.exe
  O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
  O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
  O4 - HKLM\..\Run: [NetLimiter] C:\Program Files\NetLimiter\NetLimiter.exe /s
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
  O4 - HKCU\..\Run: [SPCM] C:\Program Files\specificmail\SPCM.EXE
  O4 - HKCU\..\Run: [a2rERWcpW] autprn.exe
  O4 - HKCU\..\Run: [PCShield] regsvr32 /s "C:\WINDOWS\System32\sfg_7a05.dll"
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [Spyware Cleaner] "C:\Program Files\Spyware Cleaner\SpywareCleaner.Exe" /boot
  O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
  O4 - Startup: Free WebSite Tools.lnk = ?
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O4 - Global Startup: hpoddt01.exe.lnk = ?
  O4 - Global Startup: hp psc 1000 series.lnk = ?
  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
  O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe (file missing)
  O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe (file missing)
  O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  O9 - Extra button: Voiceglo directory - {C9B8ABB6-1CC3-4957-9CA3-053036B2EE3A} - C:\Documents and Settings\All Users\Desktop\Glophone.lnk (file missing)
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
  O14 - IERESET.INF: START_PAGE_URL=http://global.acer.com/
  O15 - Trusted Zone: http://www.amaena.com
  O15 - Trusted Zone: http://*.billingnow.com
  O15 - Trusted Zone: http://locator.cdn.imageservr.com
  O15 - Trusted Zone: http://locator1.cdn.imagesrvr.com
  O15 - Trusted Zone: http://*.reliablestats.com
  O15 - Trusted Zone: http://scanner.sysprotect.com
  O15 - Trusted Zone: http://*.systemdoctor.com
  O15 - Trusted Zone: http://*.winantispyware.com
  O15 - Trusted Zone: http://www.winantivirus.com
  O15 - Trusted Zone: http://*.winantivirus.com
  O15 - Trusted Zone: http://www.winantiviruspro.com
  O15 - Trusted Zone: http://*.winantiviruspro.com
  O15 - Trusted Zone: http://*.winfixer.com
  O15 - Trusted Zone: http://*.winnanny.com
  O15 - Trusted Zone: http://download.cdn.winsoftware.com
  O15 - Trusted Zone: http://*.winsoftware.com
  O15 - Trusted IP range: http://202.67.220.225
  O15 - Trusted IP range: http://59.148.220.121
  O15 - Trusted IP range: http://62.4.84.53
  O15 - Trusted IP range: http://82.98.235.58
  O15 - Trusted IP range: http://85.12.25.90
  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
  O16 - DPF: {01234567-1234-1234-1234-012345678921} - http://images.neopets.com/glophone/neopets4.cab
  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
  O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlmanager.akamaitools.com.edgesuite.net/dlmanager/versions/activex/dlm-activex-2.0.2.7.cab
  O16 - DPF: {54771E6F-A5A2-4413-8FB8-7B8F85398174} - http://dl.lygo.com/Sidesearch/en_US/angelfire/Sidesearch.cab
  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
  O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/abarth/us/win/QuickTimeInstaller.exe
  O16 - DPF: {7606693A-C18D-4567-AF85-6194FF70761E} (GomWeb Control) - http://app.ipop.co.kr/gom/GomWeb.cab
  O16 - DPF: {8C4A2492-3FED-41F2-BBAB-34E802844F8D} (IESettings Class) - http://schdnaweb.schooldna.com/schooldna/login/dnaClientIE.CAB
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
  O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?325
  O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O20 - Winlogon Notify: ctpva - C:\WINDOWS\Config\ctpva.dll (file missing)
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
  O20 - Winlogon Notify: tgqgohit - tgqgohit.dll (file missing)
  O20 - Winlogon Notify: tybrmbfu - tybrmbfu.dll (file missing)
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
  O23 - Service: Knob Service (KNOBSERV) - Acer Inc. - c:\acer\KnobService.exe
  O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
  O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
  O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
  O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
  O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe
  O23 - Service: SpywareCleanerService - Unknown owner - C:\Program Files\Spyware Cleaner\SCService.exe (file missing)
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe (file missing)
  
  
• samtho

  16 Apr 07, 21:50

  To remove virus u need to use regedit to clear the start up sequent; remember to back up register.
• ndmmxiaomayi

  16 Apr 07, 23:21

  bijouxrain, did you uninstall the programs stated?
• ndmmxiaomayi

  16 Apr 07, 23:22

  Originally posted by samtho:

  To remove virus u need to use regedit to clear the start up sequent; remember to back up register.

  No. Not all programs that load at start up are bad. Some are needed at startup.
• bijouxrain

  17 Apr 07, 19:24

  Yup, i delete them using he add or remove programe. Is there a prob?
• ndmmxiaomayi

  18 Apr 07, 01:10

  Yes, your logs showed that it's not removed.
• Dendrite88

  18 Apr 07, 01:55

  Mayi, dont mind helping me check my comp too? thanks alot
• Dendrite88

  18 Apr 07, 01:55

  Logfile of HijackThis v1.99.1
  Scan saved at 1:54:03, on 2007/04/18
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16414)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  C:\Program Files\Norton Internet Security\ISSVC.exe
  C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  C:\WINDOWS\system32\cisvc.exe
  C:\WINDOWS\system32\CTsvcCDA.EXE
  C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  C:\Program Files\HPQ\SHARED\HPQWMI.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\WINDOWS\system32\cidaemon.exe
  C:\WINDOWS\Explorer.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\WINDOWS\system32\igfxtray.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\Program Files\Java\jre1.5.0\bin\jusched.exe
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
  C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
  C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Real\RealPlayer\RealPlay.exe
  C:\Program Files\DAP\DAP.EXE
  C:\Documents and Settings\Owner\My Documents\My Received Files\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com.sg/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=Q305&bd=presario&pf=laptop
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
  O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
  O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Program Files\DAP\DAPIEBar.dll
  O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
  O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
  O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
  O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
  O4 - HKLM\..\Run: [hpWirelessAssistant] "%ProgramFiles%\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe"
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
  O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
  O4 - HKLM\..\Run: [gwiz] C:\WINDOWS\system32\ntsystem.exe
  O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\system32\drvmul.dll,startup
  O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
  O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
  O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [Windows Registry Repair Pro] C:\Program Files\3B Software\Windows Registry Repair Pro\RegistryRepairPro.exe 4
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
  O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
  O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Startup: PowerReg Scheduler V3.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: BTTray.lnk = ?
  O4 - Global Startup: Macro Express 3.lnk = ?
  O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
  O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
  O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
  O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
  O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
  O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
  O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
  O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
  O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
  O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O11 - Options group: [INTERNATIONAL] International*
  O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=Q305&bd=presario&pf=laptop
  O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O20 - Winlogon Notify: winzlo32 - winzlo32.dll (file missing)
  O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
  O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  O23 - Service: COM+ Messages - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e mc-110-12-0000272 (file missing)
  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  O23 - Service: NkPtpEnumP2 - Unknown owner - C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe" -a -d="C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpip.dll (file missing)
  O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
  O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
• ndmmxiaomayi

  18 Apr 07, 12:57

  Dendrite88, I will get back to you at night.
• bijouxrain

  18 Apr 07, 20:25

  Weird..
  But what are the dangers i'm facing now ?
• ndmmxiaomayi

  18 Apr 07, 22:31

  Originally posted by bijouxrain:

  Weird..
  But what are the dangers i'm facing now ?

  A lot. One is a Chinese infection, known to be very stubborn.
  
  Let's try this instead.
  
  Disable Spyware Doctor temporarily
  
  

  [*]Go to Start > All Programs > Spyware Doctor > Spyware Doctor.
  [*]On the left hand side, click on Status.
  [*]On the right hand side, under Select an Action, click on OnGuard Protection is ON. This will turn off Spyware Doctor's real-time protection.

  
  
  Also download ATF Cleaner and save it to your desktop. Do not use it yet.
  
  Open HijackThis and select Do a system scan only.
  
  Put a tick in the boxes beside these lines:
  
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://seek.3721.com/srchasst.htm
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
  O2 - BHO: SafeGuard Protect PCShield - {564FFB73-9EEF-4969-92FA-5FC4A92E2C2A} - C:\WINDOWS\System32\sfg_7a05.dll
  O3 - Toolbar: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll
  O4 - HKLM\..\Run: [IxA1] C:\documents and settings\angie\local settings\temp\IxA1.exe
  O4 - HKLM\..\Run: [PCShield] regsvr32 /s "C:\WINDOWS\System32\sfg_7a05.dll"
  O4 - HKLM\..\Run: [6e2122d764f8] C:\WINDOWS\System32\mspmspsv.exe
  O4 - HKCU\..\Run: [PCShield] regsvr32 /s "C:\WINDOWS\System32\sfg_7a05.dll"
  O4 - HKCU\..\Run: [Spyware Cleaner] "C:\Program Files\Spyware Cleaner\SpywareCleaner.Exe" /boot
  O4 - Startup: Free WebSite Tools.lnk = ?
  O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
  O15 - Trusted Zone: http://www.amaena.com
  O15 - Trusted Zone: http://*.billingnow.com
  O15 - Trusted Zone: http://locator.cdn.imageservr.com
  O15 - Trusted Zone: http://locator1.cdn.imagesrvr.com
  O15 - Trusted Zone: http://*.reliablestats.com
  O15 - Trusted Zone: http://scanner.sysprotect.com
  O15 - Trusted Zone: http://*.systemdoctor.com
  O15 - Trusted Zone: http://*.winantispyware.com
  O15 - Trusted Zone: http://www.winantivirus.com
  O15 - Trusted Zone: http://*.winantivirus.com
  O15 - Trusted Zone: http://www.winantiviruspro.com
  O15 - Trusted Zone: http://*.winantiviruspro.com
  O15 - Trusted Zone: http://*.winfixer.com
  O15 - Trusted Zone: http://*.winnanny.com
  O15 - Trusted Zone: http://download.cdn.winsoftware.com
  O15 - Trusted Zone: http://*.winsoftware.com
  O15 - Trusted IP range: http://202.67.220.225
  O15 - Trusted IP range: http://59.148.220.121
  O15 - Trusted IP range: http://62.4.84.53
  O15 - Trusted IP range: http://82.98.235.58
  O15 - Trusted IP range: http://85.12.25.90
  O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlmanager.akamaitools.com.edgesuite.net/dlmanager/versions/activex/dlm-activex-2.0.2.7.cab
  O16 - DPF: {54771E6F-A5A2-4413-8FB8-7B8F85398174} - http://dl.lygo.com/Sidesearch/en_US/angelfire/Sidesearch.cab
  O16 - DPF: {7606693A-C18D-4567-AF85-6194FF70761E} (GomWeb Control) - http://app.ipop.co.kr/gom/GomWeb.cab
  O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe (file missing)
  O23 - Service: SpywareCleanerService - Unknown owner - C:\Program Files\Spyware Cleaner\SCService.exe (file missing)
  
  Click Fix checked.
  ________________________________
  
  Uninstall these programs if they are found:
  
  Chinese keywords
  IE Host
  Messenger Plus! Live & Sponsor (CiD)
  NoAdware v5.0
  SafeGuard Pop-up Blocker Pro FREE Edition
  VSAdd-in for Internet Explorer
  Spyware Cleaner
  WebRebates (by TopRebates.com)
  Bullseye Network
  Cashback by BargainBuddy
  Navisearch
  
  Reboot into Safe Mode by following the instructions below:
  
  Restart your computer in Safe Mode.
  
  

  [*]When you see BIOS screen, start pressing F8.
  [*]A boot menu will appear shortly.
  [*]Using the up down arrows, select Safe Mode and press the Enter key.
  [*]Windows will now load.
  [*]Log in to your usual account.

  
  
  Show hidden files and folders
  

  [*]Open My Computer.
  [*]Go to Tools > Folder Options.
  [*]Select the View tab.
  [*]Scroll down to Hidden files and folders.
  [*]Select Show hidden files and folders.
  [*]Uncheck (untick) Hide extensions of known file types.
  [*]Uncheck (untick) Hide protected operating system files (Recommended).
  [*]Click Yes when prompted.
  [*]Click OK.
  [*]Close My Computer.

  
  
  Delete the following folders:
  
  C:\Program Files\NoAdware5.0
  C:\Program Files\Spyware Cleaner
  C:\Program Files\Web_Rebates
  C:\Program Files\SEP
  
  Delete the following files:
  
  C:\WINDOWS\SYSTEM32\nvms.dll
  C:\WINDOWS\SYSTEM32\exul.exe
  C:\WINDOWS\SYSTEM32\exdl.exe
  C:\WINDOWS\SYSTEM32\bbchk.exe
  C:\WINDOWS\bbchk.exe
  C:\WINDOWS\SYSTEM32\msbe.dll
  C:\WINDOWS\zeta.exe
  C:\documents and settings\angie\local settings\temp\IxA1.exe
  C:\WINDOWS\System32\sfg_7a05.dll
  C:\WINDOWS\System32\mspmspsv.exe
  
  

  [*]Double-click ATF-Cleaner.exe to run the program.
  [*]Under Main choose: Select All.
  [*]Click the Empty Selected button.

  
  
  If you use Firefox browser
  
  

  [*]Click Firefox at the top and choose: Select All.
  [*]Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.

  
  
  If you use Opera browser
  
  

  [*]Click Opera at the top and choose: Select All.
  [*]Click the Empty Selected button.
  [*]NOTE: If you would like to keep your saved passwords, please click No at the prompt.

  
  
  Re-run Combofix.
  
  Post back the Combofix log and a new HijackThis log.
• ndmmxiaomayi

  18 Apr 07, 22:32

  Originally posted by ndmmxiaomayi:

  Dendrite88, I will get back to you at night.

  Dendrite88, yours will be as follow:
  
  Your computer has multiple infections, including a backdoor. A backdoor gives intruders complete control of your computer, logs your keystrokes, steal personal information, etc.
  
  You are strongly advised to do the following:
  
  

  [*]Disconnect the computer from the Internet and from any networked computers until it is cleaned.
  [*]Back up all your important data except programs. The programs can be reinstalled back from the orignal disc or from the Net.
  [*]Call all your banks, financial institutions, credit card companies and inform them that you may be a victim of identity theft and put a watch on your accounts. If you don't mind the hassle, change all your account numbers.
  [*]From a clean computer, change all your passwords (ISP login password, your email address(es) passwords, financial accounts, PayPal, eBay, Amazon, online groups and forums and any other online activities you carry out which require a username and password).

  Do NOT change your passwords from this computer as the attacker will be able to get all the new passwords and transaction records.
  
  Due to its backdoor functionality, your computer is very likely to have been compromised and there is no way that it can be trusted again. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be to do a reformat and reinstallation of the operating system (OS). However, if you do not have the resources to reinstall your OS and would like me to attempt to clean your machine, I will be happy to do so.
  
  To help you understand more, please take some time to read the follwing articles:
  
  What are Remote Access Trojans and why are they dangerous
  How do I respond to a possible identity theft and how do I prevent it
  When should do a reformat and reinstallation of my OS
  Where to backup your files
  How to backup your files in Windows XP
  Restoring your backups
  
  If you don't want to reformat, let me know...
• Dendrite88

  18 Apr 07, 23:20

  Hey Mayi, thanks for the help.
  
  I would prefer not to reformat if its possible.
• ndmmxiaomayi

  18 Apr 07, 23:25

  [*]Download SDFix by AndyManchesta and save it to your desktop.
  [*]Double click on SDFix.exe. By default, it will install to C:\.
  [*]Click on Install.

  
  
  Next, boot into Safe Mode.
  
  

  [*]When you see BIOS screen, start pressing F8.
  [*]A boot menu will appear shortly.
  [*]Using the up down arrows, select Safe Mode and press the Enter key.
  [*]Windows will now load.
  [*]Log in to your usual account.
  [*]Navigate to C:\SDfix (if you installed it to the default location, otherwise, locate where you installed it)
  [*]Double click on RunThis.bat
  [*]Type Y to begin the cleanup process.
  [*]It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  [*]Press any key to reboot.
  [*]When the PC restarts the tool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  [*]Once the desktop icons load, the SDFix report will open on screen. You can also find the report in SDFix folder, named Report.txt.
• bijouxrain

  19 Apr 07, 15:48

  Originally posted by ndmmxiaomayi:

  Uninstall these programs if they are found:
  
  Chinese keywords
  IE Host
  Messenger Plus! Live & Sponsor (CiD)
  NoAdware v5.0
  SafeGuard Pop-up Blocker Pro FREE Edition
  VSAdd-in for Internet Explorer
  Spyware Cleaner
  WebRebates (by TopRebates.com)
  Bullseye Network
  Cashback by BargainBuddy
  Navisearch
  
  

  These should be deleted using the add or remove programs right?
• bijouxrain

  19 Apr 07, 16:33

  Combofix log:
  ((((((((((((((((((((((((((((((( Files Created from 2007-03-19 to 2007-04-19 ))))))))))))))))))))))))))))))))))
  
  2007-04-16 18:28 155,648 --a------ C:\WINDOWS\system32\igfxres.dll
  2007-04-16 17:27 5 --a------ C:\WINDOWS\ycns.dat
  2007-04-16 17:27 38,400 --a------ C:\WINDOWS\system32\drivers\kfpbsgr.sys
  2007-04-14 20:00 d--hs---- C:\FOUND.268
  2007-04-13 22:00 d--hs---- C:\FOUND.267
  2007-04-12 22:41 32,768 --a------ C:\DOCUME~1\PEIJUA~1\hexhie.exe
  2007-04-12 22:23 32,768 --a------ C:\DOCUME~1\PEIJUA~1\ouzpoa.exe
  2007-04-10 18:17 32,768 --a------ C:\DOCUME~1\PEIJUA~1\mxoleh.exe
  2007-04-10 17:56 32,768 --a------ C:\DOCUME~1\PEIJUA~1\jgmdpd.exe
  2007-04-10 17:39 32,768 --a------ C:\DOCUME~1\PEIJUA~1\hkwwml.exe
  2007-04-02 00:11 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
  2007-04-01 02:16 d--h----- C:\WINDOWS\PIF
  2007-03-25 21:43 d--hs---- C:\FOUND.266
  2007-03-23 14:30 152,833 --a------ C:\WINDOWS\system32\drivers\dump_wmimmc.sys
  
  (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
  
  2007-02-02 08:00 11821041 --------- C:\AVG7QT.DAT
  2007-01-23 03:44 109964 --a------ C:\WINDOWS\hpoins08.dat
  2007-01-19 12:53 51056 --a------ C:\WINDOWS\system32\sirenacm.dll
  
  (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
  
  *Note* empty entries & legit default entries are not shown
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
  "SPCM"="C:\\Program Files\\specificmail\\SPCM.EXE"
  "a2rERWcpW"="autprn.exe"
  "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
  "Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
  "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup"
  "nwiz"="nwiz.exe /install"
  "Aspire Schedule"="C:\\Program Files\\Aspire\\WFTVFM\\WFWIZ.exe"
  "KnobMonitor"="C:\\acer\\KnobMonitor.exe"
  "MPS"="C:\\ACER\\MPS.EXE"
  "testSchedule"="C:\\Program Files\\Take Vision Breaks\\Take Vision Breaks.exe"
  "hC"="C:\\documents and settings\\acer\\local settings\\temp\\hC.exe"
  "ImALhyZ"="C:\\documents and settings\\acer\\local settings\\temp\\ImALhyZ.exe"
  "XSbcAJi"="C:\\documents and settings\\acer\\local settings\\temp\\XSbcAJi.exe"
  "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
  "AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP"
  "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
  "YDTMain.exe"="C:\\PROGRA~1\\YDT\\YDTMain.exe"
  "DataLayer"="C:\\PROGRA~1\\COMMON~1\\PCSuite\\DATALA~1\\DATALA~1.EXE"
  "PCSuiteTrayApplication"="C:\\PROGRA~1\\Nokia\\NOKIAP~1\\TRAYAP~1.EXE"
  "NetLimiter"="C:\\Program Files\\NetLimiter\\NetLimiter.exe /s"
  "HP Software Update"="C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWuSchd2.exe"
  "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_08\\bin\\jusched.exe"
  "IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe"
  "HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
  "Installed"="1"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
  "Installed"="1"
  "NoChange"="1"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
  "Installed"="1"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\a2rERWcpW]
  "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
  "item"="eveit142"
  "hkey"="HKCU"
  "command"="eveit142.exe"
  "inimapping"="0"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANIWZCS2Service]
  "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
  "item"="WZCSLDR2"
  "hkey"="HKLM"
  "command"="C:\\Program Files\\ANI\\ANIWZCS2 Service\\WZCSLDR2.exe"
  "inimapping"="0"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
  "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
  "item"="mHotkey"
  "hkey"="HKLM"
  "command"="mHotkey.exe"
  "inimapping"="0"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ledpointer]
  "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
  "item"="CNYHKey"
  "hkey"="HKLM"
  "command"="CNYHKey.exe"
  "inimapping"="0"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\prutict]
  "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
  "item"="prutict"
  "hkey"="HKCU"
  "command"="C:\\WINDOWS\\System32\\prutict.exe"
  "inimapping"="0"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\r536Q]
  "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
  "item"="exestr10"
  "hkey"="HKLM"
  "command"="exestr10.exe"
  "inimapping"="0"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSER]
  "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
  "item"="sser"
  "hkey"="HKLM"
  "command"="sser.exe"
  "inimapping"="0"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StopHS]
  "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
  "item"="stopHS"
  "hkey"="HKLM"
  "command"="stopHS.bat"
  "inimapping"="0"
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Xydcgby]
  "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
  "item"="Xzjn"
  "hkey"="HKLM"
  "command"="C:\\Program Files\\Ytlrz\\Xzjn.exe"
  "inimapping"="0"
  
  [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
  "Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
  
  HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ctpva
  HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tgqgohit
  HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tybrmbfu
  
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
  "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
  
  HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
  Authentication Packages REG_MULTI_SZ msv1_0\0\0
  Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
  Notification Packages REG_MULTI_SZ scecli\0\0
  
  [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
  LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
  NetworkService REG_MULTI_SZ DnsCache\0\0
  rpcss REG_MULTI_SZ RpcSs\0\0
  imgsvc REG_MULTI_SZ StiSvc\0\0
  termsvcs REG_MULTI_SZ TermService\0\0
  
  Contents of the 'Scheduled Tasks' folder
  C:\WINDOWS\tasks\Symantec NetDetect.job
  C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - Pei Juan.job
  C:\WINDOWS\tasks\FRU Task #Hewlett-Packard#hp psc 1100 series#1102301909.job
  
  ********************************************************************
  
  catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006
  http://www.gmer.net
  
  scanning hidden processes ...
  
  scanning hidden services ...
  
  scanning hidden autostart entries ...
  
  scanning hidden files ...
  
  scan completed successfully
  hidden processes: 0
  hidden services: 0
  hidden files: 0
  
  ********************************************************************
  
  Completion time: 07-04-19 16:30:45
  C:\ComboFix-quarantined-files.txt ... 07-04-19 16:30
  C:\ComboFix2.txt ... 07-04-16 18:44
  
  New HijackThis log:
  Logfile of HijackThis v1.99.1
  Scan saved at 4:31:29 PM, on 4/19/2007
  Platform: Windows XP SP1 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  c:\acer\KnobService.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  C:\WINDOWS\System32\CTsvcCDA.EXE
  C:\Program Files\Norton AntiVirus\navapsvc.exe
  C:\Program Files\Norton AntiVirus\SAVScan.exe
  C:\Program Files\Spyware Doctor\sdhelp.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\WINDOWS\System32\wdfmgr.exe
  C:\WINDOWS\System32\MsPMSPSv.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Aspire\WFTVFM\WFWIZ.exe
  C:\acer\KnobMonitor.exe
  C:\ACER\MPS.EXE
  C:\Program Files\Take Vision Breaks\Take Vision Breaks.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
  C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
  C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
  C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
  C:\WINDOWS\System32\igfxtray.exe
  C:\WINDOWS\System32\hkcmd.exe
  C:\Program Files\specificmail\SPCM.EXE
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\Program Files\Spyware Doctor\swdoctor.exe
  C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
  C:\WINDOWS\System32\wuauclt.exe
  C:\WINDOWS\System32\HPZipm12.exe
  C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
  C:\WINDOWS\system32\NOTEPAD.EXE
  C:\Documents and Settings\Pei Juan\Desktop\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com/
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
  O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
  O2 - BHO: (no name) - {6D08B6DA-12AF-42B1-9E82-70BD507ED9B1} - C:\WINDOWS\Config\ctpva.dll (file missing)
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
  O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\zh-sg\msntb.dll
  O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\zh-sg\msntb.dll
  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [Aspire Schedule] C:\Program Files\Aspire\WFTVFM\WFWIZ.exe
  O4 - HKLM\..\Run: [KnobMonitor] C:\acer\KnobMonitor.exe
  O4 - HKLM\..\Run: [MPS] C:\ACER\MPS.EXE
  O4 - HKLM\..\Run: [testSchedule] C:\Program Files\Take Vision Breaks\Take Vision Breaks.exe
  O4 - HKLM\..\Run: [hC] C:\documents and settings\acer\local settings\temp\hC.exe
  O4 - HKLM\..\Run: [ImALhyZ] C:\documents and settings\acer\local settings\temp\ImALhyZ.exe
  O4 - HKLM\..\Run: [XSbcAJi] C:\documents and settings\acer\local settings\temp\XSbcAJi.exe
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [YDTMain.exe] C:\PROGRA~1\YDT\YDTMain.exe
  O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
  O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
  O4 - HKLM\..\Run: [NetLimiter] C:\Program Files\NetLimiter\NetLimiter.exe /s
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
  O4 - HKCU\..\Run: [SPCM] C:\Program Files\specificmail\SPCM.EXE
  O4 - HKCU\..\Run: [a2rERWcpW] autprn.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O4 - Global Startup: hpoddt01.exe.lnk = ?
  O4 - Global Startup: hp psc 1000 series.lnk = ?
  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
  O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe (file missing)
  O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe (file missing)
  O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  O9 - Extra button: Voiceglo directory - {C9B8ABB6-1CC3-4957-9CA3-053036B2EE3A} - C:\Documents and Settings\All Users\Desktop\Glophone.lnk (file missing)
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
  O14 - IERESET.INF: START_PAGE_URL=http://global.acer.com/
  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
  O16 - DPF: {01234567-1234-1234-1234-012345678921} - http://images.neopets.com/glophone/neopets4.cab
  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
  O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/abarth/us/win/QuickTimeInstaller.exe
  O16 - DPF: {7606693A-C18D-4567-AF85-6194FF70761E} (GomWeb Control) - http://app.ipop.co.kr/gom/GomWeb.cab
  O16 - DPF: {8C4A2492-3FED-41F2-BBAB-34E802844F8D} (IESettings Class) - http://schdnaweb.schooldna.com/schooldna/login/dnaClientIE.CAB
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
  O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?325
  O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O20 - Winlogon Notify: ctpva - C:\WINDOWS\Config\ctpva.dll (file missing)
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
  O20 - Winlogon Notify: tgqgohit - tgqgohit.dll (file missing)
  O20 - Winlogon Notify: tybrmbfu - tybrmbfu.dll (file missing)
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
  O23 - Service: Knob Service (KNOBSERV) - Acer Inc. - c:\acer\KnobService.exe
  O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
  O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
  O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
  O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
  O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  
  
• bijouxrain

  19 Apr 07, 16:38

  Btw, I could not find the following:
  
  [B]Folders:[/b]
  C:\Program Files\Web_Rebates
  
  Files:
  C:\WINDOWS\SYSTEM32\nvms.dll
  C:\WINDOWS\SYSTEM32\exul.exe
  C:\WINDOWS\SYSTEM32\exdl.exe
  C:\WINDOWS\SYSTEM32\bbchk.exe
  C:\WINDOWS\bbchk.exe
  C:\WINDOWS\SYSTEM32\msbe.dll
  C:\WINDOWS\zeta.exe
  C:\documents and settings\angie\local settings\temp\IxA1.exe
  C:\WINDOWS\System32\sfg_7a05.dll
  C:\WINDOWS\System32\mspmspsv.exe
  
  Some of them instead of ___.exe, i can find ____.dll, and vice versa, which isn't what you had intructed me to delete. So i didn't delete those files.
  
• ndmmxiaomayi

  19 Apr 07, 21:18

  Originally posted by bijouxrain:

  These should be deleted using the add or remove programs right?

  Yes.
• ndmmxiaomayi

  19 Apr 07, 21:20

  Originally posted by bijouxrain:
  Btw, I could not find the following:
  
  [B]Folders:
  C:\Program Files\Web_Rebates
  
  Files:
  C:\WINDOWS\SYSTEM32\nvms.dll
  C:\WINDOWS\SYSTEM32\exul.exe
  C:\WINDOWS\SYSTEM32\exdl.exe
  C:\WINDOWS\SYSTEM32\bbchk.exe
  C:\WINDOWS\bbchk.exe
  C:\WINDOWS\SYSTEM32\msbe.dll
  C:\WINDOWS\zeta.exe
  C:\documents and settings\angie\local settings\temp\IxA1.exe
  C:\WINDOWS\System32\sfg_7a05.dll
  C:\WINDOWS\System32\mspmspsv.exe
  
  Some of them instead of ___.exe, i can find ____.dll, and vice versa, which isn't what you had intructed me to delete. So i didn't delete those files.
  [/b]

  Might have been deleted by antivirus or anti-spyware programs.
  
  Download NoLop from one of the links given and save it to your desktop.
  
  From Spyware Edge
  From Spy Killer
  From Greyknight
  From Spyware Times
  
  

  [*]First close any other programs you have running as this will require a reboot.
  [*]Double click NoLop.exe to run it.
  [*]Now click the button labelled Search and Destroy
  <>
  [*]When scanning is finished you will be prompted to reboot only if infected, Click OK.
  [*]Now click the REBOOT Button.
  [*]A Message should popup from NoLop. If not, double click the program again and it will finish. Please Post the contents of C:\NoLop.log along with a fresh HijackThis log.

  If you receive an error, "mscomctl.ocx or one of its dependencies are not correctly registered," please download mscomctl.ocx and save it to your system32 folder then rerun the program.