oOoo. so many spyware. any advice to help me remove it

• hiphop2009

  12 May 07, 00:53

  this is the log. mayi or anyone please help!
  
  Logfile of HijackThis v1.99.1
  Scan saved at 12:41:22 AM, on 5/12/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
  C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
  C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  C:\Program Files\HP\QuickPlay\QPService.exe
  C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
  C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\WINDOWS\system32\wdfmgr.exe
  C:\WINDOWS\csrss.exe
  C:\Program Files\Hello\Hello.exe
  C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
  C:\WINDOWS\system32\wbem\wmiprvse.exe
  C:\WINDOWS\System32\alg.exe
  C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Documents and Settings\Owner\Desktop\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.qmi8.com
  
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=Q106&bd=presario&pf=laptop
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=Q106&bd=presario&pf=laptop
  F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
  O1 - Hosts: 59.54.54.84 www.spbo.com
  O1 - Hosts: 59.54.54.84 spbo.com
  O1 - Hosts: 59.54.54.84 www.bet007.com
  O1 - Hosts: 59.54.54.84 bet007.com
  O1 - Hosts: 59.54.54.84 www.bet007.net
  O1 - Hosts: 59.54.54.84 bet007.net
  O1 - Hosts: 59.54.54.84 www.zqzz.com
  O1 - Hosts: 59.54.54.84 zqzz.com
  O1 - Hosts: 59.54.54.84 www.bostars.com
  O1 - Hosts: 59.54.54.84 bostars.com
  O1 - Hosts: 59.54.54.84 www.629.cc
  O1 - Hosts: 59.54.54.84 629.cc
  O1 - Hosts: 59.54.54.84 live.netsh.com
  O1 - Hosts: 59.54.54.84 www.8bo8.com
  O1 - Hosts: 59.54.54.84 live.8bo8.com
  O1 - Hosts: 59.54.54.84 www.gooooal.com
  O1 - Hosts: 59.54.54.84 gooooal.com
  O1 - Hosts: 59.54.54.84 www.16838.com
  O1 - Hosts: 59.54.54.84 16838.com
  O1 - Hosts: 59.54.54.84 www.90ko.com
  O1 - Hosts: 59.54.54.84 90ko.com
  O1 - Hosts: 59.54.54.84 live.bb868.com
  O1 - Hosts: 59.54.54.84 live.sportscn.com
  O1 - Hosts: 59.54.54.84 www.scorecn.com
  O1 - Hosts: 59.54.54.84 www.66813.com
  O1 - Hosts: 59.54.54.84 66813.com
  O1 - Hosts: 59.54.54.84 www.bostars.com
  O1 - Hosts: 59.54.54.84 bostars.com
  O1 - Hosts: 59.54.54.84 www.zuqiuye.com
  O1 - Hosts: 59.54.54.84 zuqiuye.com
  O1 - Hosts: 59.54.54.84 live.netsh.com
  O1 - Hosts: 59.54.54.84 live.fly.com.cn
  O1 - Hosts: 59.54.54.84 www.16892.com
  O1 - Hosts: 59.54.54.84 www.588k.com
  O1 - Hosts: 59.54.54.84 www.118g.com
  O1 - Hosts: 59.54.54.84 www.7m.cn
  O1 - Hosts: 59.54.54.84 7m.cn
  O1 - Hosts: 59.54.54.84 www.begoal.com
  O1 - Hosts: 59.54.54.84 www.p8y8.com
  O1 - Hosts: 59.54.54.84 live.miqiu.com
  O1 - Hosts: 59.54.54.84 www.gobooo.com
  O1 - Hosts: 59.54.54.84 live.bet007.com
  O1 - Hosts: 59.54.54.84 live.xunying.com
  O1 - Hosts: 59.54.54.84 hgoal.com
  O1 - Hosts: 59.54.54.84 live.sportbl.com
  O1 - Hosts: 59.54.54.84 www.soccerpage.com
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
  O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
  O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
  O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
  O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
  O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [csrss] C:\WINDOWS\csrss.exe
  O4 - HKLM\..\Run: [PicasaNet] "C:\Program Files\Hello\Hello.exe" -b
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [userinit] C:\WINDOWS\system32\ntos.exe
  O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
  O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
  O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
  O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
  O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
  O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
  O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
  O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=Q106&bd=presario&pf=laptop
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O23 - Service: GrayPigeonServer - Unknown owner - C:\WINDOWS\windosnwa.exe (file missing)
  O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe
  O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  O23 - Service: Remote Procedure Call System(RPCS) (RpcS) - Unknown owner - C:\WINDOWS\system32\Windox.exe (file missing)
  
  
• ndmmxiaomayi

  12 May 07, 08:33

  Download HostXpert from Funkytoad and save it to your desktop.
  
  

  [*]Right click on HostsXpert.zip and select Extract All....
  [*]Click Next on seeing the Welcome to the Compressed (zipped) Folders Extraction Wizard.
  [*]Click on the Browse button. Click on Desktop. Then click OK.
  [*]Tick the Show extracted files box.
  [*]Once extracted, HostsXpert folder will open.
  [*]Double click on HostsXpert.exe to start it.
  [*]On your right hand side, you will see Backup and Restore.
  [*]Click on Restore Microsoft Hosts File (see screenshot below, boxed up in red).
  
  
  
  [*]Exit HostsXpert.

  
  
  Please post back a new HijackThis log.
• hiphop2009

  12 May 07, 10:34

  can i safely say dat the spyware has been removed from the com? or i need to run avg anti spyware again? coz it has been popping up now n den telling me dat there are spyware. and the blue screen of death and memory dumping thing keep coming up, causing the com to restart....
  
  Logfile of HijackThis v1.99.1
  Scan saved at 10:30:05 AM, on 5/12/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\savedump.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\ctfmon.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  C:\WINDOWS\system32\wdfmgr.exe
  C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
  C:\WINDOWS\system32\wbem\wmiprvse.exe
  C:\WINDOWS\System32\alg.exe
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
  C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
  C:\Program Files\HP\QuickPlay\QPService.exe
  C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
  C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\WINDOWS\csrss.exe
  C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
  C:\Program Files\Hello\Hello.exe
  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Documents and Settings\Owner\Desktop\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.qmi8.com
  
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=Q106&bd=presario&pf=laptop
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=Q106&bd=presario&pf=laptop
  F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
  O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
  O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
  O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
  O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
  O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [csrss] C:\WINDOWS\csrss.exe
  O4 - HKLM\..\Run: [PicasaNet] "C:\Program Files\Hello\Hello.exe" -b
  O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [userinit] C:\WINDOWS\system32\ntos.exe
  O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
  O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
  O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
  O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
  O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
  O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
  O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
  O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=Q106&bd=presario&pf=laptop
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O23 - Service: GrayPigeonServer - Unknown owner - C:\WINDOWS\windosnwa.exe (file missing)
  O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe
  O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  O23 - Service: Remote Procedure Call System(RPCS) (RpcS) - Unknown owner - C:\WINDOWS\system32\Windox.exe (file missing)
  
  
• HyuugaNeji

  12 May 07, 10:46

  download spybot from download.com to get rid of most of the spywares.
• ndmmxiaomayi

  12 May 07, 10:52

  can i safely say dat the spyware has been removed from the com?

  Nope. I've just fixed your internet connections only.
  
  Step 1
  
  Download Itty Bitty Process Manager by Merijn from one the links below:
  
  Merijn
  DKnoppix
  Bleeping Computer
  Unite The Cows
  Major Geeks
  CastleCops
  SpywareInfo
  
  

  [*]Locate the ibprocman.zip that you've downloaded earlier.
  [*]Right click on ibprocman.zip and select Extract All....
  [*]Click Next on seeing the Welcome to the Compressed (zipped) Folders Extraction Wizard.
  [*]Click on the Browse button. Click on Desktop. Then click OK.
  [*]Check (tick) the Show extracted files box.
  [*]Double click on IBProcMan.exe to start it.
  [*]Locate C:\WINDOWS\csrss.exe. Click once to select it. Click on the Kill Process button to end it.

  Note: Be very careful when killing this process. There's a legitimate csrss.exe which is located in C:\Windows\system32. The fake one is in C:\Windows.
  
  Step 2
  
  Next, open HijackThis and select Do a system scan only.
  
  Check (tick) these lines:
  
  F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
  O4 - HKLM\..\Run: [csrss] C:\WINDOWS\csrss.exe
  O4 - HKCU\..\Run: [userinit] C:\WINDOWS\system32\ntos.exe
  O23 - Service: Remote Procedure Call System(RPCS) (RpcS) - Unknown owner - C:\WINDOWS\system32\Windox.exe (file missing)
  
  Click on Fix checked button.
  
  Step 3
  
  Go to C:\Windows\system32 and locate Windox.exe. Zipped up this file and email me. My email address is in my profile.
  
  Step 4
  
  Show hidden files and folders
  

  [*]Open My Computer.
  [*]Go to Tools > Folder Options.
  [*]Select the View tab.
  [*]Scroll down to Hidden files and folders.
  [*]Select Show hidden files and folders.
  [*]Uncheck (untick) Hide extensions of known file types.
  [*]Uncheck (untick) Hide protected operating system files (Recommended).
  [*]Click Yes when prompted.
  [*]Click OK.
  [*]Close My Computer.

  
  
  Step 5
  
  Restart your computer in Safe Mode.
  
  

  [*]When you see BIOS screen, start pressing F8.
  [*]A boot menu will appear shortly.
  [*]Using the up down arrows, select Safe Mode and press the Enter key.
  [*]Windows will now load.
  [*]Log in to your usual account.

  
  
  Delete these files.
  
  C:\WINDOWS\system32\ntos.exe
  C:\WINDOWS\csrss.exe
  C:\WINDOWS\system32\Windox.exe
  
  Reboot into Normal Mode and post back a new HijackThis log.
• hiphop2009

  12 May 07, 11:26

  i think avg anti spyware has removed the fake csrss.exe file for me liao. cant find it anywhere. i think i post it tonight and continue to remove. coz i going out soon. thanks mayi!
• ndmmxiaomayi

  12 May 07, 11:30

  Originally posted by hiphop2009:

  i think avg anti spyware has removed the fake csrss.exe file for me liao. cant find it anywhere. i think i post it tonight and continue to remove. coz i going out soon. thanks mayi!

  Good to hear about it. That leaves just the registry for fixing, of which HijackThis will do the job.
  
  See you at night!
• hiphop2009

  12 May 07, 17:28

  Originally posted by ndmmxiaomayi:

  Good to hear about it. That leaves just the registry for fixing, of which HijackThis will do the job.
  
  See you at night!

  hohoho. think i screwed up the com. everytime i wan to post something on sgforum den dat com will hav blue screen of death and restart. hmm...
• hiphop2009

  12 May 07, 18:54

  Originally posted by ndmmxiaomayi:
  
  
  Nope. I've just fixed your internet connections only.
  
  [b]Step 1
  
  Download Itty Bitty Process Manager by Merijn from one the links below:
  
  Merijn
  DKnoppix
  Bleeping Computer
  Unite The Cows
  Major Geeks
  CastleCops
  SpywareInfo
  
  

  [*]Locate the ibprocman.zip that you've downloaded earlier.
  [*]Right click on ibprocman.zip and select Extract All....
  [*]Click Next on seeing the Welcome to the Compressed (zipped) Folders Extraction Wizard.
  [*]Click on the Browse button. Click on Desktop. Then click OK.
  [*]Check (tick) the Show extracted files box.
  [*]Double click on IBProcMan.exe to start it.
  [*]Locate C:\WINDOWS\csrss.exe. Click once to select it. Click on the Kill Process button to end it.

  Note: Be very careful when killing this process. There's a legitimate csrss.exe which is located in C:\Windows\system32. The fake one is in C:\Windows.
  
  Step 2
  
  Next, open HijackThis and select Do a system scan only.
  
  Check (tick) these lines:
  
  F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
  O4 - HKLM\..\Run: [csrss] C:\WINDOWS\csrss.exe
  O4 - HKCU\..\Run: [userinit] C:\WINDOWS\system32\ntos.exe
  O23 - Service: Remote Procedure Call System(RPCS) (RpcS) - Unknown owner - C:\WINDOWS\system32\Windox.exe (file missing)
  
  Click on Fix checked button.
  
  Step 3
  
  Go to C:\Windows\system32 and locate Windox.exe. Zipped up this file and email me. My email address is in my profile.
  
  Step 4
  
  Show hidden files and folders
  

  [*]Open My Computer.
  [*]Go to Tools > Folder Options.
  [*]Select the View tab.
  [*]Scroll down to Hidden files and folders.
  [*]Select Show hidden files and folders.
  [*]Uncheck (untick) Hide extensions of known file types.
  [*]Uncheck (untick) Hide protected operating system files (Recommended).
  [*]Click Yes when prompted.
  [*]Click OK.
  [*]Close My Computer.

  
  
  Step 5
  
  Restart your computer in Safe Mode.
  
  

  [*]When you see BIOS screen, start pressing F8.
  [*]A boot menu will appear shortly.
  [*]Using the up down arrows, select Safe Mode and press the Enter key.
  [*]Windows will now load.
  [*]Log in to your usual account.

  
  
  Delete these files.
  
  C:\WINDOWS\system32\ntos.exe
  C:\WINDOWS\csrss.exe
  C:\WINDOWS\system32\Windox.exe
  
  Reboot into Normal Mode and post back a new HijackThis log.[/b]

  i cant delete ntos.exe. it says it is being used by another program. anyway to help?
• ndmmxiaomayi

  12 May 07, 19:01

  Originally posted by hiphop2009:

  hohoho. think i screwed up the com. everytime i wan to post something on sgforum den dat com will hav blue screen of death and restart. hmm...

  Right click on My Computer, select Properties.
  
  Select the Advanced tab.
  
  Under Startup and Recovery, click on the Settings button.
  
  Under System Failure, untick Automatically Restart box.
  
  Click OK.
  
  That will prevent it from restarting each time a blue screen of death happens.
  
  Take that time to note down the errors.
  
  

  Originally posted by hiphop2009:

  i cant delete ntos.exe. it says it is being used by another program. anyway to help?

  Did you fix the line with HijackThis first, then attempt to delete the file? Otherwise, the registry traces will prevent it from being deleted.
• hiphop2009

  12 May 07, 20:06

  Originally posted by ndmmxiaomayi:

  Did you fix the line with HijackThis first, then attempt to delete the file? Otherwise, the registry traces will prevent it from being deleted.

  when i use hijiackthis to delete this:
  
  F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
  
  after dat i scan again, still have. how come?
  
  edit: i go straight into the registry to remove but still cant remove when i access the system 32 file...
• hiphop2009

  12 May 07, 21:45

  latest logfile:
  
  Logfile of HijackThis v1.99.1
  Scan saved at 9:28:31 PM, on 5/12/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\ctfmon.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
  C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
  C:\Program Files\HP\QuickPlay\QPService.exe
  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
  C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  C:\WINDOWS\system32\wdfmgr.exe
  C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\WINDOWS\system32\wbem\wmiprvse.exe
  C:\WINDOWS\System32\alg.exe
  C:\PROGRA~1\HPQ\SHARED\HPQTOA~1.EXE
  C:\Documents and Settings\Owner\Desktop\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=Q106&bd=presario&pf=laptop
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=Q106&bd=presario&pf=laptop
  F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\system32\ntos.exe,
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
  O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
  O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
  O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
  O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
  O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [PicasaNet] "C:\Program Files\Hello\Hello.exe" -b
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [userinit] C:\WINDOWS\system32\ntos.exe
  O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
  O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
  O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
  O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
  O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
  O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
  O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=Q106&bd=presario&pf=laptop
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1178968153109
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1178968141453
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O23 - Service: GrayPigeonServer - Unknown owner - C:\WINDOWS\windosnwa.exe (file missing)
  O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe
  O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  O23 - Service: Remote Procedure Call System(RPCS) (RpcS) - Unknown owner - C:\WINDOWS\system32\Windox.exe (file missing)
  
  
• ndmmxiaomayi

  12 May 07, 23:04

  Download KillBox by Option^Explicit. Save it to your desktop.
  
  Locate these two files and zipped them up. Email them to me.
  
  C:\WINDOWS\windosnwa.exe
  C:\WINDOWS\system32\Windox.exe
  
  Open HijackThis, select Do a system scan only.
  
  Put a tick for these lines:
  
  F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\system32\ntos.exe,
  O4 - HKCU\..\Run: [userinit] C:\WINDOWS\system32\ntos.exe
  O23 - Service: GrayPigeonServer - Unknown owner - C:\WINDOWS\windosnwa.exe (file missing)
  O23 - Service: Remote Procedure Call System(RPCS) (RpcS) - Unknown owner - C:\WINDOWS\system32\Windox.exe (file missing)
  
  Click Fix checked.
  
  Next, start KillBox.
  
  Select Delete on Reboot button. Copy the bolded files below.
  
  C:\WINDOWS\system32\ntos.exe
  C:\WINDOWS\windosnwa.exe
  C:\WINDOWS\system32\Windox.exe
  
  Go to KillBox, select File > Paste From Clipboard.
  
  Then click on the red button with a white X
  
  Your computer will reboot, if it doesn't, just reboot manually.
  
  KillBox will delete these files on reboot, so your system might take some time to start.
  
  Post a new HijackThis log.
• soulwinner

  12 May 07, 23:07

  Turn off all you interent access..
  install with the latest anti-virus software and scan and repair according..
• hiphop2009

  13 May 07, 20:01

  Originally posted by ndmmxiaomayi:
  Download KillBox by Option^Explicit. Save it to your desktop.
  
  Locate these two files and zipped them up. Email them to me.
  
  [b]C:\WINDOWS\windosnwa.exe
  C:\WINDOWS\system32\Windox.exe
  
  Open HijackThis, select Do a system scan only.
  
  Put a tick for these lines:
  
  F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\system32\ntos.exe,
  O4 - HKCU\..\Run: [userinit] C:\WINDOWS\system32\ntos.exe
  O23 - Service: GrayPigeonServer - Unknown owner - C:\WINDOWS\windosnwa.exe (file missing)
  O23 - Service: Remote Procedure Call System(RPCS) (RpcS) - Unknown owner - C:\WINDOWS\system32\Windox.exe (file missing)
  
  Click Fix checked.
  
  Next, start KillBox.
  
  Select Delete on Reboot button. Copy the bolded files below.
  
  C:\WINDOWS\system32\ntos.exe
  C:\WINDOWS\windosnwa.exe
  C:\WINDOWS\system32\Windox.exe
  
  Go to KillBox, select File > Paste From Clipboard.
  
  Then click on the red button with a white X
  
  Your computer will reboot, if it doesn't, just reboot manually.
  
  KillBox will delete these files on reboot, so your system might take some time to start.
  
  Post a new HijackThis log.[/b]

  hais. thanks mayi, but i think i screwed the com. when i start, it says windows cannot load coz system 32.hal.dll file is missing. i use xubuntu to start n realise the harddisk's file inside the system 32 file missing. muz be i use the compaq recovery thing den halfway den i juz switched it off. haiss. i only got one win XP CD with me though....how how how? i use xubuntu but i cant seems to copy the system 32 files (which i copied from another computers into my external harddisk) to the harddrive. help mayi help!
• ndmmxiaomayi

  13 May 07, 20:46

  Originally posted by hiphop2009:

  hais. thanks mayi, but i think i screwed the com. when i start, it says windows cannot load coz system 32.hal.dll file is missing. i use xubuntu to start n realise the harddisk's file inside the system 32 file missing. muz be i use the compaq recovery thing den halfway den i juz switched it off. haiss. i only got one win XP CD with me though....how how how? i use xubuntu but i cant seems to copy the system 32 files (which i copied from another computers into my external harddisk) to the harddrive. help mayi help!

  Wah, just nice I was researching about your error and about to write a guide on it.
  
  But since it's a recovery CD, I don't know if it works.
  
  Boot up the XP Recovery CD, type R to use the Recovery Console
  
  Then enter the administrator's password to log in.
  
  In the Command Line, type in the following line by line. After each line, press Enter.
  
  cd C:\WINDOWS\ServicePackFiles\i386
  copy hal.dll c:\Windows\System32
  
  By the way, to use the Linux method, you need to use Knoppix, not Xubuntu. Xubuntu can't do the job.
• hiphop2009

  13 May 07, 23:01

  Originally posted by ndmmxiaomayi:
  
  
  Wah, just nice I was researching about your error and about to write a guide on it.
  
  But since it's a recovery CD, I don't know if it works.
  
  Boot up the XP Recovery CD, type R to use the Recovery Console
  
  Then enter the administrator's password to log in.
  
  In the Command Line, type in the following line by line. After each line, press Enter.
  
  [b]cd C:\WINDOWS\ServicePackFiles\i386
  copy hal.dll c:\Windows\System32
  
  By the way, to use the Linux method, you need to use Knoppix, not Xubuntu. Xubuntu can't do the job.[/b]

  haha. hmm. i think nvm, i juz return dat com back to compaq to service bah. nt feeling well. n lots of quizz and test coming up. sianx.....
  
  hmm, when i run knoppix, it seems to be stuck lehz. dunnoe why. hmm....
  
  nvm, thanks a million for the trouble mayi!. so pai seh lehz.....
• ltachi

  13 May 07, 23:20

  dont fret.first of all go to www.download.com
  search for 'AD-AWARE SE PERSONAL'.download it.then do a scan.removed all of my spyware.good stuff man
• hiphop2009

  13 May 07, 23:21

  Originally posted by ltachi:

  dont fret.first of all go to www.download.com
  search for 'AD-AWARE SE PERSONAL'.download it.then do a scan.removed all of my spyware.good stuff man

  did dat. lol. anyway. thanx! i am off to bed liao. =)
• ndmmxiaomayi

  13 May 07, 23:22

  Originally posted by hiphop2009:

  haha. hmm. i think nvm, i juz return dat com back to compaq to service bah. nt feeling well. n lots of quizz and test coming up. sianx.....
  
  hmm, when i run knoppix, it seems to be stuck lehz. dunnoe why. hmm....
  
  nvm, thanks a million for the trouble mayi!. so pai seh lehz.....

  Running via CD right? If yes, it will get stuck for a while. CD reading speeds are slower.
• hiphop2009

  12 Jun 07, 20:29

  mayi! i need ur help again. with another com:
  any prob with the com? coz kind of lagged. den sometimes wireless cannot startup. i tried to see the prob myself but apparently i nt expert enough. hmmm.....
  
  here is the hijackthis logfile:
  
  Logfile of HijackThis v1.99.1
  Scan saved at 8:27:34 PM, on 6/12/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\ibmpmsvc.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
  C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\IPSSVC.EXE
  C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
  C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
  C:\Program Files\Symantec AntiVirus\DefWatch.exe
  C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
  C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
  C:\Program Files\Symantec AntiVirus\SavRoam.exe
  c:\program files\lenovo\system update\suservice.exe
  C:\Program Files\Symantec AntiVirus\Rtvscan.exe
  C:\WINDOWS\System32\TPHDEXLG.EXE
  C:\WINDOWS\system32\TpKmpSVC.exe
  C:\Program Files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe
  C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
  C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\WINDOWS\system32\TpShocks.exe
  C:\WINDOWS\system32\igfxtray.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\WINDOWS\system32\igfxpers.exe
  C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
  C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
  C:\Program Files\Analog Devices\Core\smax4pnp.exe
  C:\PROGRA~1\THINKV~2\PrdCtr\LPMGR.exe
  C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
  C:\WINDOWS\System32\DLA\DLACTRLW.EXE
  C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
  C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
  C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
  C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
  C:\WINDOWS\system32\rundll32.exe
  C:\Program Files\IBM ThinkVantage\Client Security Solution\cssauth.exe
  C:\Program Files\IBM ThinkVantage\SafeGuard PrivateDisk\pdservice.exe
  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
  C:\PROGRA~1\SYMANT~1\VPTray.exe
  C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
  C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe
  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
  C:\Program Files\Digital Line Detect\DLG.exe
  C:\Program Files\PC Connectivity Solution\NclBTHandler.exe
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
  C:\DOCUME~1\Xin\LOCALS~1\Temp\Rar$EX00.234\IBProcMan.exe
  
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://cache.np.edu.sg/proxy.pac
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
  O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
  O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
  O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
  O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
  O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
  O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
  O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
  O4 - HKLM\..\Run: [LPManager] C:\PROGRA~1\THINKV~2\PrdCtr\LPMGR.exe
  O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
  O4 - HKLM\..\Run: [ISUSPM Startup] c:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
  O4 - HKLM\..\Run: [ISUSScheduler] "c:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
  O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
  O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
  O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
  O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
  O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
  O4 - HKLM\..\Run: [cssauth] "C:\Program Files\IBM ThinkVantage\Client Security Solution\cssauth.exe" silent
  O4 - HKLM\..\Run: [PDService.exe] "C:\Program Files\IBM ThinkVantage\SafeGuard PrivateDisk\pdservice.exe"
  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
  O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [IBM Warranty Notification] "C:\Program Files\IBM\acp\ERTS0749\ERTS0749.exe /nointro"
  O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
  O4 - HKCU\..\Run: [SRS Audio Sandbox] "C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe" /hideme
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Bluetooth.lnk = ?
  O4 - Global Startup: Digital Line Detect.lnk = ?
  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java142\jre\bin\NPJPI142.dll
  O9 - Extra 'Tools' menuitem: IBM Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java142\jre\bin\NPJPI142.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O11 - Options group: [JAVA_IBM] Java (IBM)
  O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-SG/a-UNO1/GAME_UNO1.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1176186026437
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1176301311640
  O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://www.shockwave.com/content/dinerdashfloonthego/sis/ddfotg.1.0.0.33.cab
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {E008A543-CEFB-4559-912F-C27C2B89F13B} (Domino Web Access 7 Control) - https://npsdmail2.np.edu.sg/dwa7W.cab
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing)
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
  O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
  O20 - Winlogon Notify: psfus - C:\WINDOWS\SYSTEM32\psqlpwd.dll
  O20 - Winlogon Notify: tpfnf2 - C:\WINDOWS\SYSTEM32\notifyf2.dll
  O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
  O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
  O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
  O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
  O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
  O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
  O23 - Service: IPS Core Service (IPSSVC) - Lenovo Group Limited - C:\WINDOWS\system32\IPSSVC.EXE
  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
  O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
  O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
  O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  O23 - Service: System Update (SUService) - Lenovo Group Limited - c:\program files\lenovo\system update\suservice.exe
  O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
  O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXE
  O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
  O23 - Service: TSS Core Service (TSSCoreService) - IBM - C:\Program Files\IBM ThinkVantage\Client Security Solution\ibmtcsd.exe
  O23 - Service: TVT Backup Service - Unknown owner - C:\Program Files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe
  O23 - Service: TVT Scheduler - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
  
  
• hiphop2009

  12 Jun 07, 20:46

  mayi help!
• ndmmxiaomayi

  12 Jun 07, 20:54

  It's lagging because it has so many things running.
  
  And why is Itty Bitty Process Manager running directly via WinRAR?
• hiphop2009

  12 Jun 07, 21:14

  Originally posted by ndmmxiaomayi:

  It's lagging because it has so many things running.
  
  And why is Itty Bitty Process Manager running directly via WinRAR?

  coz, the thing is, wireless connection got prob. den windows say firewall cannot be started and all those crap.
  
  IBM laptop, den hav all those thinkvantage stuff. dats why a lot of processes. but it isnt laggy, the prob is, wireless cant connect.....hmm....
• ndmmxiaomayi

  12 Jun 07, 21:39

  Originally posted by hiphop2009:

  coz, the thing is, wireless connection got prob. den windows say firewall cannot be started and all those crap.
  
  IBM laptop, den hav all those thinkvantage stuff. dats why a lot of processes. but it isnt laggy, the prob is, wireless cant connect.....hmm....

  Windows Firewall can't start... I think it's related to school... because the homepage is a school website.
  
  As for wireless... IBM is handling the wireless... if for some issues can't connect, either repair IBM wireless or disable the IBM wireless and let Windows handle...