Carol43's Hijackthis Log

Can you help?

Logfile of HijackThis v1.98.0
Scan saved at 9:13:07 PM, on 7/15/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\apimh32.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\PROGRA~1\mcafee.com\agent\McAgent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Optimum Online\Netsurf.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\WINDOWS\system32\ietm32.exe
C:\WINDOWS\System32\hphmon04.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\System32\HPHipm11.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\America Online 8.0\aoltray.exe
C:\Palm\HOTSYNC.EXE
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\Registration\vssw.exe
C:\Program Files\McAfee\McAfee Privacy Service\GuardDog.exe
C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\CAROL\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Microsoft Works\MSWorks.exe
C:\Documents and Settings\CAROL\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.optonline.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\iuiyt.dll/sp.html#28129
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://iuiyt.dll/index.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://iuiyt.dll/index.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\iuiyt.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\iuiyt.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://iuiyt.dll/index.html#28129
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {73C994D2-169A-3A21-18CA-289B70E63DA3} - C:\WINDOWS\sdklb32.dll
O2 - BHO: McAfee Privacy Service - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Program Files\McAfee\McAfee Privacy Service\GDIEHELP.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Optimum Online] C:\Program Files\Optimum Online\Netsurf.exe -tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ntbu.exe] C:\WINDOWS\system32\ntbu.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [MPFTray] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [McAfee Guardian] C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe /SU
O4 - HKLM\..\Run: [ietm32.exe] C:\WINDOWS\system32\ietm32.exe
O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [addyv.exe] C:\WINDOWS\system32\addyv.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [vssw] C:\WINDOWS\Registration\vssw.exe
O4 - HKLM\..\Run: [d3ki32.exe] C:\WINDOWS\system32\d3ki32.exe
O4 - HKLM\..\Run: [mfcey.exe] C:\WINDOWS\system32\mfcey.exe
O4 - HKLM\..\RunOnce: [iprx32.exe] C:\WINDOWS\iprx32.exe
O4 - HKLM\..\RunOnce: [crga32.exe] C:\WINDOWS\system32\crga32.exe
O4 - HKLM\..\RunOnce: [apimh32.exe] C:\WINDOWS\apimh32.exe
O4 - HKLM\..\RunOnce: [addha.exe] C:\WINDOWS\system32\addha.exe
O4 - HKLM\..\RunOnce: [apiaz.exe] C:\WINDOWS\apiaz.exe
O4 - HKLM\..\RunOnce: [sdkxq32.exe] C:\WINDOWS\sdkxq32.exe
O4 - HKLM\..\RunOnce: [netnv.exe] C:\WINDOWS\system32\netnv.exe
O4 - HKLM\..\RunOnce: [msda.exe] C:\WINDOWS\system32\msda.exe
O4 - HKLM\..\RunOnce: [javamp.exe] C:\WINDOWS\system32\javamp.exe
O4 - HKLM\..\RunOnce: [javast32.exe] C:\WINDOWS\system32\javast32.exe
O4 - HKLM\..\RunOnce: [sysaa32.exe] C:\WINDOWS\sysaa32.exe
O4 - HKLM\..\RunOnce: [winwd32.exe] C:\WINDOWS\winwd32.exe
O4 - HKLM\..\RunOnce: [addat.exe] C:\WINDOWS\system32\addat.exe
O4 - HKLM\..\RunOnce: [ipzl.exe] C:\WINDOWS\ipzl.exe
O4 - HKLM\..\RunOnce: [apiqc.exe] C:\WINDOWS\system32\apiqc.exe
O4 - HKLM\..\RunOnce: [netkw32.exe] C:\WINDOWS\netkw32.exe
O4 - HKLM\..\RunOnce: [apisr.exe] C:\WINDOWS\apisr.exe
O4 - HKLM\..\RunOnce: [javagu.exe] C:\WINDOWS\system32\javagu.exe
O4 - HKLM\..\RunOnce: [sysao.exe] C:\WINDOWS\system32\sysao.exe
O4 - HKLM\..\RunOnce: [appyq.exe] C:\WINDOWS\appyq.exe
O4 - HKLM\..\RunOnce: [ieie32.exe] C:\WINDOWS\system32\ieie32.exe
O4 - HKLM\..\RunOnce: [msgu32.exe] C:\WINDOWS\msgu32.exe
O4 - HKLM\..\RunOnce: [winqs.exe] C:\WINDOWS\winqs.exe
O4 - HKLM\..\RunOnce: [atleq32.exe] C:\WINDOWS\system32\atleq32.exe
O4 - HKLM\..\RunOnce: [addgq.exe] C:\WINDOWS\system32\addgq.exe
O4 - HKLM\..\RunOnce: [iess32.exe] C:\WINDOWS\iess32.exe
O4 - HKLM\..\RunOnce: [ipbw32.exe] C:\WINDOWS\system32\ipbw32.exe
O4 - HKLM\..\RunOnce: [addhy.exe] C:\WINDOWS\addhy.exe
O4 - HKLM\..\RunOnce: [crun.exe] C:\WINDOWS\crun.exe
O4 - HKLM\..\RunOnce: [appnd32.exe] C:\WINDOWS\appnd32.exe
O4 - HKLM\..\RunOnce: [addxh32.exe] C:\WINDOWS\system32\addxh32.exe
O4 - HKLM\..\RunOnce: [netid32.exe] C:\WINDOWS\netid32.exe
O4 - HKLM\..\RunOnce: [sdkon.exe] C:\WINDOWS\sdkon.exe
O4 - HKLM\..\RunOnce: [ieaq.exe] C:\WINDOWS\ieaq.exe
O4 - HKLM\..\RunOnce: [nethk32.exe] C:\WINDOWS\system32\nethk32.exe
O4 - HKLM\..\RunOnce: [crsg.exe] C:\WINDOWS\system32\crsg.exe
O4 - HKLM\..\RunOnce: [javaxr32.exe] C:\WINDOWS\system32\javaxr32.exe
O4 - HKLM\..\RunOnce: [sysio32.exe] C:\WINDOWS\sysio32.exe
O4 - HKLM\..\RunOnce: [ntfm.exe] C:\WINDOWS\system32\ntfm.exe
O4 - HKLM\..\RunOnce: [mspi.exe] C:\WINDOWS\mspi.exe
O4 - HKLM\..\RunOnce: [msjo.exe] C:\WINDOWS\system32\msjo.exe
O4 - HKLM\..\RunOnce: [ntrt32.exe] C:\WINDOWS\system32\ntrt32.exe
O4 - HKLM\..\RunOnce: [apicy.exe] C:\WINDOWS\apicy.exe
O4 - HKLM\..\RunOnce: [winno32.exe] C:\WINDOWS\winno32.exe
O4 - HKLM\..\RunOnce: [crsm32.exe] C:\WINDOWS\system32\crsm32.exe
O4 - HKLM\..\RunOnce: [ntlm32.exe] C:\WINDOWS\system32\ntlm32.exe
O4 - HKLM\..\RunOnce: [iewj.exe] C:\WINDOWS\iewj.exe
O4 - HKLM\..\RunOnce: [iprf.exe] C:\WINDOWS\iprf.exe
O4 - HKLM\..\RunOnce: [addsr32.exe] C:\WINDOWS\addsr32.exe
O4 - HKLM\..\RunOnce: [syssq.exe] C:\WINDOWS\system32\syssq.exe
O4 - HKLM\..\RunOnce: [ienk32.exe] C:\WINDOWS\system32\ienk32.exe
O4 - HKLM\..\RunOnce: [winrd32.exe] C:\WINDOWS\system32\winrd32.exe
O4 - HKLM\..\RunOnce: [javapv32.exe] C:\WINDOWS\system32\javapv32.exe
O4 - HKLM\..\RunOnce: [javaya.exe] C:\WINDOWS\javaya.exe
O4 - HKLM\..\RunOnce: [addpq.exe] C:\WINDOWS\system32\addpq.exe
O4 - HKLM\..\RunOnce: [winae.exe] C:\WINDOWS\system32\winae.exe
O4 - HKLM\..\RunOnce: [syskc.exe] C:\WINDOWS\system32\syskc.exe
O4 - HKLM\..\RunOnce: [ntyw32.exe] C:\WINDOWS\ntyw32.exe
O4 - HKLM\..\RunOnce: [ntdi32.exe] C:\WINDOWS\system32\ntdi32.exe
O4 - HKLM\..\RunOnce: [sdkvp32.exe] C:\WINDOWS\system32\sdkvp32.exe
O4 - HKLM\..\RunOnce: [iefg.exe] C:\WINDOWS\iefg.exe
O4 - HKLM\..\RunOnce: [ipoc32.exe] C:\WINDOWS\ipoc32.exe
O4 - HKLM\..\RunOnce: [netzh32.exe] C:\WINDOWS\netzh32.exe
O4 - HKLM\..\RunOnce: [javavd32.exe] C:\WINDOWS\javavd32.exe
O4 - HKLM\..\RunOnce: [sysfa.exe] C:\WINDOWS\system32\sysfa.exe
O4 - HKLM\..\RunOnce: [atlln32.exe] C:\WINDOWS\atlln32.exe
O4 - HKLM\..\RunOnce: [ntwo32.exe] C:\WINDOWS\ntwo32.exe
O4 - HKLM\..\RunOnce: [atlgb.exe] C:\WINDOWS\atlgb.exe
O4 - HKLM\..\RunOnce: [mstt32.exe] C:\WINDOWS\mstt32.exe
O4 - HKLM\..\RunOnce: [apiql.exe] C:\WINDOWS\apiql.exe
O4 - HKLM\..\RunOnce: [ntuw32.exe] C:\WINDOWS\ntuw32.exe
O4 - HKLM\..\RunOnce: [ieur32.exe] C:\WINDOWS\ieur32.exe
O4 - HKLM\..\RunOnce: [atlip32.exe] C:\WINDOWS\system32\atlip32.exe
O4 - HKLM\..\RunOnce: [ntqq.exe] C:\WINDOWS\system32\ntqq.exe
O4 - HKLM\..\RunOnce: [winxk32.exe] C:\WINDOWS\system32\winxk32.exe
O4 - HKLM\..\RunOnce: [mfcpb32.exe] C:\WINDOWS\mfcpb32.exe
O4 - HKLM\..\RunOnce: [ieyl.exe] C:\WINDOWS\ieyl.exe
O4 - HKCU\..\Run: [SB Audigy 2 Startup Menu] /L:ENG
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Privacy Bar - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Program Files\McAfee\McAfee Privacy Service\GDIEHELP.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O16 - DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} (CustomerCtrl Class) - https://cs7b.instantservice.com/jars/customerxsigned42.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab

Welcome to the forum.

Please put Hijackthis into it's own folder C:\HJT for example. This will allow it to make back ups.

Please download AboutBuster from here and unzip it to your desktop but don't run it yet: www.downloads.subratam.org/AboutBuster.. http://www.downloads.subratam.org/AboutBuster.zip

Please also download and install Ad-Aware from here if you haven't already: http://www.lavasoftusa.com/software/adaware/ Once installed or if you already had it installed, while online start Ad-Aware, click on the "Check for Updates Now" link at the bottom right, then click "Connect". After it updates, click "Finish". Close Ad-Aware.

Follow the instructions here to enable viewing of hidden/system files: http://www.xtra.co.nz/help/0,,4155-1916458,00.html

Next, go to Start->Run and type Services.msc then click ok. On the screen that comes up, scroll down to the service called "Network Security Service" and double-click on it. On the next screen, click the stop button, then in the Startup Type drop-down, change it to Disabled and click Apply then Ok.

Please print out the remainder of these directions, as you'll have to proceed in Safe mode and won't want to open IE again until they're complete.

Reboot to Safe Mode. Tap f8 while bios loads

In Safe Mode, scan with Hijack This, put checks next to all of these entries and then click "Fix Checked":

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\iuiyt.dll/sp.html#28129
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://iuiyt.dll/index.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://iuiyt.dll/index.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\iuiyt.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\iuiyt.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://iuiyt.dll/index.html#28129
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe

R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {73C994D2-169A-3A21-18CA-289B70E63DA3} - C:\WINDOWS\sdklb32.dll

O4 - HKLM\..\Run: [ntbu.exe] C:\WINDOWS\system32\ntbu.exe
O4 - HKLM\..\Run: [ietm32.exe] C:\WINDOWS\system32\ietm32.exe
O4 - HKLM\..\Run: [addyv.exe] C:\WINDOWS\system32\addyv.exe
O4 - HKLM\..\Run: [vssw] C:\WINDOWS\Registration\vssw.exe
O4 - HKLM\..\Run: [d3ki32.exe] C:\WINDOWS\system32\d3ki32.exe
O4 - HKLM\..\Run: [mfcey.exe] C:\WINDOWS\system32\mfcey.exe
O4 - HKLM\..\RunOnce: [iprx32.exe] C:\WINDOWS\iprx32.exe
O4 - HKLM\..\RunOnce: [crga32.exe] C:\WINDOWS\system32\crga32.exe
O4 - HKLM\..\RunOnce: [apimh32.exe] C:\WINDOWS\apimh32.exe
O4 - HKLM\..\RunOnce: [addha.exe] C:\WINDOWS\system32\addha.exe
O4 - HKLM\..\RunOnce: [apiaz.exe] C:\WINDOWS\apiaz.exe
O4 - HKLM\..\RunOnce: [sdkxq32.exe] C:\WINDOWS\sdkxq32.exe
O4 - HKLM\..\RunOnce: [netnv.exe] C:\WINDOWS\system32\netnv.exe
O4 - HKLM\..\RunOnce: [msda.exe] C:\WINDOWS\system32\msda.exe
O4 - HKLM\..\RunOnce: [javamp.exe] C:\WINDOWS\system32\javamp.exe
O4 - HKLM\..\RunOnce: [javast32.exe] C:\WINDOWS\system32\javast32.exe
O4 - HKLM\..\RunOnce: [sysaa32.exe] C:\WINDOWS\sysaa32.exe
O4 - HKLM\..\RunOnce: [winwd32.exe] C:\WINDOWS\winwd32.exe
O4 - HKLM\..\RunOnce: [addat.exe] C:\WINDOWS\system32\addat.exe
O4 - HKLM\..\RunOnce: [ipzl.exe] C:\WINDOWS\ipzl.exe
O4 - HKLM\..\RunOnce: [apiqc.exe] C:\WINDOWS\system32\apiqc.exe
O4 - HKLM\..\RunOnce: [netkw32.exe] C:\WINDOWS\netkw32.exe
O4 - HKLM\..\RunOnce: [apisr.exe] C:\WINDOWS\apisr.exe
O4 - HKLM\..\RunOnce: [javagu.exe] C:\WINDOWS\system32\javagu.exe
O4 - HKLM\..\RunOnce: [sysao.exe] C:\WINDOWS\system32\sysao.exe
O4 - HKLM\..\RunOnce: [appyq.exe] C:\WINDOWS\appyq.exe
O4 - HKLM\..\RunOnce: [ieie32.exe] C:\WINDOWS\system32\ieie32.exe
O4 - HKLM\..\RunOnce: [msgu32.exe] C:\WINDOWS\msgu32.exe
O4 - HKLM\..\RunOnce: [winqs.exe] C:\WINDOWS\winqs.exe
O4 - HKLM\..\RunOnce: [atleq32.exe] C:\WINDOWS\system32\atleq32.exe
O4 - HKLM\..\RunOnce: [addgq.exe] C:\WINDOWS\system32\addgq.exe
O4 - HKLM\..\RunOnce: [iess32.exe] C:\WINDOWS\iess32.exe
O4 - HKLM\..\RunOnce: [ipbw32.exe] C:\WINDOWS\system32\ipbw32.exe
O4 - HKLM\..\RunOnce: [addhy.exe] C:\WINDOWS\addhy.exe
O4 - HKLM\..\RunOnce: [crun.exe] C:\WINDOWS\crun.exe
O4 - HKLM\..\RunOnce: [appnd32.exe] C:\WINDOWS\appnd32.exe
O4 - HKLM\..\RunOnce: [addxh32.exe] C:\WINDOWS\system32\addxh32.exe
O4 - HKLM\..\RunOnce: [netid32.exe] C:\WINDOWS\netid32.exe
O4 - HKLM\..\RunOnce: [sdkon.exe] C:\WINDOWS\sdkon.exe
O4 - HKLM\..\RunOnce: [ieaq.exe] C:\WINDOWS\ieaq.exe
O4 - HKLM\..\RunOnce: [nethk32.exe] C:\WINDOWS\system32\nethk32.exe
O4 - HKLM\..\RunOnce: [crsg.exe] C:\WINDOWS\system32\crsg.exe
O4 - HKLM\..\RunOnce: [javaxr32.exe] C:\WINDOWS\system32\javaxr32.exe
O4 - HKLM\..\RunOnce: [sysio32.exe] C:\WINDOWS\sysio32.exe
O4 - HKLM\..\RunOnce: [ntfm.exe] C:\WINDOWS\system32\ntfm.exe
O4 - HKLM\..\RunOnce: [mspi.exe] C:\WINDOWS\mspi.exe
O4 - HKLM\..\RunOnce: [msjo.exe] C:\WINDOWS\system32\msjo.exe
O4 - HKLM\..\RunOnce: [ntrt32.exe] C:\WINDOWS\system32\ntrt32.exe
O4 - HKLM\..\RunOnce: [apicy.exe] C:\WINDOWS\apicy.exe
O4 - HKLM\..\RunOnce: [winno32.exe] C:\WINDOWS\winno32.exe
O4 - HKLM\..\RunOnce: [crsm32.exe] C:\WINDOWS\system32\crsm32.exe
O4 - HKLM\..\RunOnce: [ntlm32.exe] C:\WINDOWS\system32\ntlm32.exe
O4 - HKLM\..\RunOnce: [iewj.exe] C:\WINDOWS\iewj.exe
O4 - HKLM\..\RunOnce: [iprf.exe] C:\WINDOWS\iprf.exe
O4 - HKLM\..\RunOnce: [addsr32.exe] C:\WINDOWS\addsr32.exe
O4 - HKLM\..\RunOnce: [syssq.exe] C:\WINDOWS\system32\syssq.exe
O4 - HKLM\..\RunOnce: [ienk32.exe] C:\WINDOWS\system32\ienk32.exe
O4 - HKLM\..\RunOnce: [winrd32.exe] C:\WINDOWS\system32\winrd32.exe
O4 - HKLM\..\RunOnce: [javapv32.exe] C:\WINDOWS\system32\javapv32.exe
O4 - HKLM\..\RunOnce: [javaya.exe] C:\WINDOWS\javaya.exe
O4 - HKLM\..\RunOnce: [addpq.exe] C:\WINDOWS\system32\addpq.exe
O4 - HKLM\..\RunOnce: [winae.exe] C:\WINDOWS\system32\winae.exe
O4 - HKLM\..\RunOnce: [syskc.exe] C:\WINDOWS\system32\syskc.exe
O4 - HKLM\..\RunOnce: [ntyw32.exe] C:\WINDOWS\ntyw32.exe
O4 - HKLM\..\RunOnce: [ntdi32.exe] C:\WINDOWS\system32\ntdi32.exe
O4 - HKLM\..\RunOnce: [sdkvp32.exe] C:\WINDOWS\system32\sdkvp32.exe
O4 - HKLM\..\RunOnce: [iefg.exe] C:\WINDOWS\iefg.exe
O4 - HKLM\..\RunOnce: [ipoc32.exe] C:\WINDOWS\ipoc32.exe
O4 - HKLM\..\RunOnce: [netzh32.exe] C:\WINDOWS\netzh32.exe
O4 - HKLM\..\RunOnce: [javavd32.exe] C:\WINDOWS\javavd32.exe
O4 - HKLM\..\RunOnce: [sysfa.exe] C:\WINDOWS\system32\sysfa.exe
O4 - HKLM\..\RunOnce: [atlln32.exe] C:\WINDOWS\atlln32.exe
O4 - HKLM\..\RunOnce: [ntwo32.exe] C:\WINDOWS\ntwo32.exe
O4 - HKLM\..\RunOnce: [atlgb.exe] C:\WINDOWS\atlgb.exe
O4 - HKLM\..\RunOnce: [mstt32.exe] C:\WINDOWS\mstt32.exe
O4 - HKLM\..\RunOnce: [apiql.exe] C:\WINDOWS\apiql.exe
O4 - HKLM\..\RunOnce: [ntuw32.exe] C:\WINDOWS\ntuw32.exe
O4 - HKLM\..\RunOnce: [ieur32.exe] C:\WINDOWS\ieur32.exe
O4 - HKLM\..\RunOnce: [atlip32.exe] C:\WINDOWS\system32\atlip32.exe
O4 - HKLM\..\RunOnce: [ntqq.exe] C:\WINDOWS\system32\ntqq.exe
O4 - HKLM\..\RunOnce: [winxk32.exe] C:\WINDOWS\system32\winxk32.exe
O4 - HKLM\..\RunOnce: [mfcpb32.exe] C:\WINDOWS\mfcpb32.exe
O4 - HKLM\..\RunOnce: [ieyl.exe] C:\WINDOWS\ieyl.exe

Next, still in Safe-Mode, delete any of the following files that are present:

C:\WINDOWS\sdklb32.dll
C:\WINDOWS\system32\ntbu.exe
C:\WINDOWS\system32\ietm32.exe
C:\WINDOWS\system32\addyv.exe
C:\WINDOWS\Registration\vssw.exe
C:\WINDOWS\system32\d3ki32.exe
C:\WINDOWS\system32\mfcey.exe
C:\WINDOWS\iprx32.exe
C:\WINDOWS\system32\crga32.exe
C:\WINDOWS\apimh32.exe
C:\WINDOWS\system32\addha.exe
C:\WINDOWS\apiaz.exe
C:\WINDOWS\system32\netnv.exe
C:\WINDOWS\system32\msda.exe
C:\WINDOWS\system32\javamp.exe
C:\WINDOWS\system32\javast32.exe
C:\WINDOWS\sysaa32.exe
C:\WINDOWS\winwd32.exe
C:\WINDOWS\system32\addat.exe
C:\WINDOWS\ipzl.exe
C:\WINDOWS\system32\apiqc.exe
C:\WINDOWS\netkw32.exe
C:\WINDOWS\apisr.exe
C:\WINDOWS\system32\javagu.exe
C:\WINDOWS\system32\sysao.exe
C:\WINDOWS\appyq.exe
C:\WINDOWS\system32\ieie32.exe
C:\WINDOWS\msgu32.exe
C:\WINDOWS\winqs.exe
C:\WINDOWS\system32\atleq32.exe
C:\WINDOWS\system32\addgq.exe
C:\WINDOWS\iess32.exe
C:\WINDOWS\system32\ipbw32.exe
C:\WINDOWS\addhy.exe
C:\WINDOWS\crun.exe
C:\WINDOWS\appnd32.exe
C:\WINDOWS\system32\addxh32.exe
C:\WINDOWS\netid32.exe
C:\WINDOWS\sdkon.exe
C:\WINDOWS\ieaq.exe
C:\WINDOWS\system32\nethk32.exe
C:\WINDOWS\system32\crsg.exe
C:\WINDOWS\system32\javaxr32.exe
C:\WINDOWS\sysio32.exe
C:\WINDOWS\system32\ntfm.exe
C:\WINDOWS\mspi.exe
C:\WINDOWS\system32\msjo.exe
C:\WINDOWS\system32\ntrt32.exe
C:\WINDOWS\apicy.exe
C:\WINDOWS\winno32.exe
C:\WINDOWS\system32\crsm32.exe
C:\WINDOWS\system32\ntlm32.exe
C:\WINDOWS\iewj.exe
C:\WINDOWS\iprf.exe
C:\WINDOWS\addsr32.exe
C:\WINDOWS\system32\syssq.exe
C:\WINDOWS\system32\ienk32.exe
C:\WINDOWS\system32\winrd32.exe
C:\WINDOWS\system32\javapv32.exe
C:\WINDOWS\javaya.exe
C:\WINDOWS\system32\addpq.exe
C:\WINDOWS\system32\winae.exe
C:\WINDOWS\system32\syskc.exe
C:\WINDOWS\ntyw32.exe
C:\WINDOWS\system32\ntdi32.exe
C:\WINDOWS\system32\sdkvp32.exe
C:\WINDOWS\iefg.exe
C:\WINDOWS\ipoc32.exe
C:\WINDOWS\netzh32.exe
C:\WINDOWS\javavd32.exe
C:\WINDOWS\system32\sysfa.exe
C:\WINDOWS\atlln32.exe
C:\WINDOWS\ntwo32.exe
C:\WINDOWS\atlgb.exe
C:\WINDOWS\mstt32.exe
C:\WINDOWS\apiql.exe
C:\WINDOWS\ntuw32.exe
C:\WINDOWS\ieur32.exe
C:\WINDOWS\system32\atlip32.exe
C:\WINDOWS\system32\ntqq.exe
C:\WINDOWS\system32\winxk32.exe
C:\WINDOWS\mfcpb32.exe
C:\WINDOWS\ieyl.exe

Double click the AboutBuster.exe file that you downloaded earlier. Click OK, click Start, then click OK. This will scan your computer for the bad files and delete them. Save the report it creates (copy and paste it into notepad or wordpad and save as a .txt file).

Finally, still in Safe Mode, scan with Ad-Aware and let it remove anything it finds. Instructions on how to run Adaware. http://www.cjwd.demon.co.uk/spybot-adaware.html

Reboot to normal mode, rescan with Hijack This and post a new log here along with the log you saved from AboutBuster.

It's been so long since i sent you my first log. I could not fine a lot of what you told me to check. I'll post my new log here and not use the computer until i hear back from you. i also could not fine "Network Security Service" in the Services.msc link. I hope to hear from back you and go on from here. Thanks again - you guys are great

Logfile of HijackThis v1.97.7
Scan saved at 9:07:00 PM, on 7/18/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\apimh32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Optimum Online\Netsurf.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\WINDOWS\system32\ietm32.exe
C:\WINDOWS\System32\hphmon04.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\HPHipm11.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\America Online 8.0\aoltray.exe
C:\Palm\HOTSYNC.EXE
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\Registration\vssw.exe
C:\Documents and Settings\CAROL\Local Settings\Temp\Temporary Directory 1 for hijackthis1977.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\xknoo.dll/sp.html#28129
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.optonline.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.optonline.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://cvntp.dll/index.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\cvntp.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://cvntp.dll/index.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\cvntp.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = wmplayer.exe
O2 - BHO: (no name) - {1EB7F227-90B7-4538-37FD-ABD78516A5E3} - C:\WINDOWS\adddq.dll
O2 - BHO: (no name) - {3992E43C-90AD-C12F-64B3-9DB04D6F78C7} - C:\WINDOWS\system32\winac.dll
O2 - BHO: McAfee Privacy Service - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Program Files\McAfee\McAfee Privacy Service\GDIEHELP.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Optimum Online] C:\Program Files\Optimum Online\Netsurf.exe -tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ntbu.exe] C:\WINDOWS\system32\ntbu.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [MPFTray] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [McAfee Guardian] C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe /SU
O4 - HKLM\..\Run: [ietm32.exe] C:\WINDOWS\system32\ietm32.exe
O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [addyv.exe] C:\WINDOWS\system32\addyv.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [vssw] C:\WINDOWS\Registration\vssw.exe
O4 - HKLM\..\Run: [d3ki32.exe] C:\WINDOWS\system32\d3ki32.exe
O4 - HKLM\..\Run: [mfcey.exe] C:\WINDOWS\system32\mfcey.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [McRegWiz] C:\PROGRA~1\McAfee.com\Agent\McRegWiz.exe /autorun
O4 - HKCU\..\Run: [SB Audigy 2 Startup Menu] /L:ENG
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKLM\..\RunOnce: [iprx32.exe] C:\WINDOWS\iprx32.exe
O4 - HKLM\..\RunOnce: [crga32.exe] C:\WINDOWS\system32\crga32.exe
O4 - HKLM\..\RunOnce: [apimh32.exe] C:\WINDOWS\apimh32.exe
O4 - HKLM\..\RunOnce: [addha.exe] C:\WINDOWS\system32\addha.exe
O4 - HKLM\..\RunOnce: [apiaz.exe] C:\WINDOWS\apiaz.exe
O4 - HKLM\..\RunOnce: [sdkxq32.exe] C:\WINDOWS\sdkxq32.exe
O4 - HKLM\..\RunOnce: [netnv.exe] C:\WINDOWS\system32\netnv.exe
O4 - HKLM\..\RunOnce: [msda.exe] C:\WINDOWS\system32\msda.exe
O4 - HKLM\..\RunOnce: [javamp.exe] C:\WINDOWS\system32\javamp.exe
O4 - HKLM\..\RunOnce: [javast32.exe] C:\WINDOWS\system32\javast32.exe
O4 - HKLM\..\RunOnce: [sysaa32.exe] C:\WINDOWS\sysaa32.exe
O4 - HKLM\..\RunOnce: [winwd32.exe] C:\WINDOWS\winwd32.exe
O4 - HKLM\..\RunOnce: [addat.exe] C:\WINDOWS\system32\addat.exe
O4 - HKLM\..\RunOnce: [ipzl.exe] C:\WINDOWS\ipzl.exe
O4 - HKLM\..\RunOnce: [apiqc.exe] C:\WINDOWS\system32\apiqc.exe
O4 - HKLM\..\RunOnce: [netkw32.exe] C:\WINDOWS\netkw32.exe
O4 - HKLM\..\RunOnce: [apisr.exe] C:\WINDOWS\apisr.exe
O4 - HKLM\..\RunOnce: [javagu.exe] C:\WINDOWS\system32\javagu.exe
O4 - HKLM\..\RunOnce: [sysao.exe] C:\WINDOWS\system32\sysao.exe
O4 - HKLM\..\RunOnce: [appyq.exe] C:\WINDOWS\appyq.exe
O4 - HKLM\..\RunOnce: [ieie32.exe] C:\WINDOWS\system32\ieie32.exe
O4 - HKLM\..\RunOnce: [msgu32.exe] C:\WINDOWS\msgu32.exe
O4 - HKLM\..\RunOnce: [winqs.exe] C:\WINDOWS\winqs.exe
O4 - HKLM\..\RunOnce: [atleq32.exe] C:\WINDOWS\system32\atleq32.exe
O4 - HKLM\..\RunOnce: [addgq.exe] C:\WINDOWS\system32\addgq.exe
O4 - HKLM\..\RunOnce: [iess32.exe] C:\WINDOWS\iess32.exe
O4 - HKLM\..\RunOnce: [ipbw32.exe] C:\WINDOWS\system32\ipbw32.exe
O4 - HKLM\..\RunOnce: [addhy.exe] C:\WINDOWS\addhy.exe
O4 - HKLM\..\RunOnce: [crun.exe] C:\WINDOWS\crun.exe
O4 - HKLM\..\RunOnce: [appnd32.exe] C:\WINDOWS\appnd32.exe
O4 - HKLM\..\RunOnce: [addxh32.exe] C:\WINDOWS\system32\addxh32.exe
O4 - HKLM\..\RunOnce: [netid32.exe] C:\WINDOWS\netid32.exe
O4 - HKLM\..\RunOnce: [sdkon.exe] C:\WINDOWS\sdkon.exe
O4 - HKLM\..\RunOnce: [ieaq.exe] C:\WINDOWS\ieaq.exe
O4 - HKLM\..\RunOnce: [nethk32.exe] C:\WINDOWS\system32\nethk32.exe
O4 - HKLM\..\RunOnce: [crsg.exe] C:\WINDOWS\system32\crsg.exe
O4 - HKLM\..\RunOnce: [javaxr32.exe] C:\WINDOWS\system32\javaxr32.exe
O4 - HKLM\..\RunOnce: [sysio32.exe] C:\WINDOWS\sysio32.exe
O4 - HKLM\..\RunOnce: [ntfm.exe] C:\WINDOWS\system32\ntfm.exe
O4 - HKLM\..\RunOnce: [mspi.exe] C:\WINDOWS\mspi.exe
O4 - HKLM\..\RunOnce: [msjo.exe] C:\WINDOWS\system32\msjo.exe
O4 - HKLM\..\RunOnce: [ntrt32.exe] C:\WINDOWS\system32\ntrt32.exe
O4 - HKLM\..\RunOnce: [apicy.exe] C:\WINDOWS\apicy.exe
O4 - HKLM\..\RunOnce: [winno32.exe] C:\WINDOWS\winno32.exe
O4 - HKLM\..\RunOnce: [crsm32.exe] C:\WINDOWS\system32\crsm32.exe
O4 - HKLM\..\RunOnce: [ntlm32.exe] C:\WINDOWS\system32\ntlm32.exe
O4 - HKLM\..\RunOnce: [iewj.exe] C:\WINDOWS\iewj.exe
O4 - HKLM\..\RunOnce: [iprf.exe] C:\WINDOWS\iprf.exe
O4 - HKLM\..\RunOnce: [addsr32.exe] C:\WINDOWS\addsr32.exe
O4 - HKLM\..\RunOnce: [syssq.exe] C:\WINDOWS\system32\syssq.exe
O4 - HKLM\..\RunOnce: [ienk32.exe] C:\WINDOWS\system32\ienk32.exe
O4 - HKLM\..\RunOnce: [winrd32.exe] C:\WINDOWS\system32\winrd32.exe
O4 - HKLM\..\RunOnce: [javapv32.exe] C:\WINDOWS\system32\javapv32.exe
O4 - HKLM\..\RunOnce: [javaya.exe] C:\WINDOWS\javaya.exe
O4 - HKLM\..\RunOnce: [addpq.exe] C:\WINDOWS\system32\addpq.exe
O4 - HKLM\..\RunOnce: [winae.exe] C:\WINDOWS\system32\winae.exe
O4 - HKLM\..\RunOnce: [syskc.exe] C:\WINDOWS\system32\syskc.exe
O4 - HKLM\..\RunOnce: [ntyw32.exe] C:\WINDOWS\ntyw32.exe
O4 - HKLM\..\RunOnce: [ntdi32.exe] C:\WINDOWS\system32\ntdi32.exe
O4 - HKLM\..\RunOnce: [sdkvp32.exe] C:\WINDOWS\system32\sdkvp32.exe
O4 - HKLM\..\RunOnce: [iefg.exe] C:\WINDOWS\iefg.exe
O4 - HKLM\..\RunOnce: [ipoc32.exe] C:\WINDOWS\ipoc32.exe
O4 - HKLM\..\RunOnce: [netzh32.exe] C:\WINDOWS\netzh32.exe
O4 - HKLM\..\RunOnce: [javavd32.exe] C:\WINDOWS\javavd32.exe
O4 - HKLM\..\RunOnce: [sysfa.exe] C:\WINDOWS\system32\sysfa.exe
O4 - HKLM\..\RunOnce: [atlln32.exe] C:\WINDOWS\atlln32.exe
O4 - HKLM\..\RunOnce: [ntwo32.exe] C:\WINDOWS\ntwo32.exe
O4 - HKLM\..\RunOnce: [atlgb.exe] C:\WINDOWS\atlgb.exe
O4 - HKLM\..\RunOnce: [mstt32.exe] C:\WINDOWS\mstt32.exe
O4 - HKLM\..\RunOnce: [apiql.exe] C:\WINDOWS\apiql.exe
O4 - HKLM\..\RunOnce: [ntuw32.exe] C:\WINDOWS\ntuw32.exe
O4 - HKLM\..\RunOnce: [ieur32.exe] C:\WINDOWS\ieur32.exe
O4 - HKLM\..\RunOnce: [atlip32.exe] C:\WINDOWS\system32\atlip32.exe
O4 - HKLM\..\RunOnce: [ntqq.exe] C:\WINDOWS\system32\ntqq.exe
O4 - HKLM\..\RunOnce: [winxk32.exe] C:\WINDOWS\system32\winxk32.exe
O4 - HKLM\..\RunOnce: [mfcpb32.exe] C:\WINDOWS\mfcpb32.exe
O4 - HKLM\..\RunOnce: [ieyl.exe] C:\WINDOWS\ieyl.exe
O4 - HKLM\..\RunOnce: [d3hy.exe] C:\WINDOWS\system32\d3hy.exe
O4 - HKLM\..\RunOnce: [ipzz32.exe] C:\WINDOWS\ipzz32.exe
O4 - HKLM\..\RunOnce: [ntui.exe] C:\WINDOWS\ntui.exe
O4 - HKLM\..\RunOnce: [ntyy32.exe] C:\WINDOWS\system32\ntyy32.exe
O4 - HKLM\..\RunOnce: [netbh.exe] C:\WINDOWS\netbh.exe
O4 - HKLM\..\RunOnce: [winvr32.exe] C:\WINDOWS\system32\winvr32.exe
O4 - HKLM\..\RunOnce: [javasn32.exe] C:\WINDOWS\javasn32.exe
O4 - HKLM\..\RunOnce: [sysba.exe] C:\WINDOWS\sysba.exe
O4 - HKLM\..\RunOnce: [netnn.exe] C:\WINDOWS\netnn.exe
O4 - HKLM\..\RunOnce: [ntak32.exe] C:\WINDOWS\ntak32.exe
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Privacy Bar (HKLM)
O9 - Extra button: MoneySide (HKLM)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O16 - DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} (CustomerCtrl Class) - https://cs7b.instantservice.com/jars/customerxsigned42.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…7856.3835300926
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab

Please put Hijackthis into it's own folder C:\HJT for example. This will allow it to make back ups. Temp directories are not good as the back ups may be lost.

Please download AboutBuster from here and unzip it to your desktop but don't run it yet: www.downloads.subratam.org/AboutBuster.. http://www.downloads.subratam.org/AboutBuster.zip

Please also download and install Ad-Aware from here if you haven't already: http://www.lavasoftusa.com/software/adaware/ Once installed or if you already had it installed, while online start Ad-Aware, click on the "Check for Updates Now" link at the bottom right, then click "Connect". After it updates, click "Finish". Close Ad-Aware.

Follow the instructions here to enable viewing of hidden/system files: http://www.xtra.co.nz/help/0,,4155-1916458,00.html

Next, go to Start->Run and type Services.msc then click ok. On the screen that comes up, scroll down to the service called "Network Security Service" and double-click on it. On the next screen, click the stop button, then in the Startup Type drop-down, change it to Disabled and click Apply then Ok.

Please print out the remainder of these directions, as you'll have to proceed in Safe mode and won't want to open IE again until they're complete.

Reboot to Safe Mode. Tap f8 while bios loads

In Safe Mode, scan with Hijack This, put checks next to all of these entries and then click "Fix Checked":

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\xknoo.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://cvntp.dll/index.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\cvntp.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://cvntp.dll/index.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\cvntp.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = wmplayer.exe

O2 - BHO: (no name) - {1EB7F227-90B7-4538-37FD-ABD78516A5E3} - C:\WINDOWS\adddq.dll
O2 - BHO: (no name) - {3992E43C-90AD-C12F-64B3-9DB04D6F78C7} - C:\WINDOWS\system32\winac.dll

O4 - HKLM\..\Run: [ntbu.exe] C:\WINDOWS\system32\ntbu.exe
O4 - HKLM\..\Run: [ietm32.exe] C:\WINDOWS\system32\ietm32.exe
O4 - HKLM\..\Run: [addyv.exe] C:\WINDOWS\system32\addyv.exe
O4 - HKLM\..\Run: [vssw] C:\WINDOWS\Registration\vssw.exe
O4 - HKLM\..\Run: [d3ki32.exe] C:\WINDOWS\system32\d3ki32.exe
O4 - HKLM\..\Run: [mfcey.exe] C:\WINDOWS\system32\mfcey.exe
O4 - HKLM\..\RunOnce: [iprx32.exe] C:\WINDOWS\iprx32.exe
O4 - HKLM\..\RunOnce: [crga32.exe] C:\WINDOWS\system32\crga32.exe
O4 - HKLM\..\RunOnce: [apimh32.exe] C:\WINDOWS\apimh32.exe
O4 - HKLM\..\RunOnce: [addha.exe] C:\WINDOWS\system32\addha.exe
O4 - HKLM\..\RunOnce: [apiaz.exe] C:\WINDOWS\apiaz.exe
O4 - HKLM\..\RunOnce: [sdkxq32.exe] C:\WINDOWS\sdkxq32.exe
O4 - HKLM\..\RunOnce: [netnv.exe] C:\WINDOWS\system32\netnv.exe
O4 - HKLM\..\RunOnce: [msda.exe] C:\WINDOWS\system32\msda.exe
O4 - HKLM\..\RunOnce: [javamp.exe] C:\WINDOWS\system32\javamp.exe
O4 - HKLM\..\RunOnce: [javast32.exe] C:\WINDOWS\system32\javast32.exe
O4 - HKLM\..\RunOnce: [sysaa32.exe] C:\WINDOWS\sysaa32.exe
O4 - HKLM\..\RunOnce: [winwd32.exe] C:\WINDOWS\winwd32.exe
O4 - HKLM\..\RunOnce: [addat.exe] C:\WINDOWS\system32\addat.exe
O4 - HKLM\..\RunOnce: [ipzl.exe] C:\WINDOWS\ipzl.exe
O4 - HKLM\..\RunOnce: [apiqc.exe] C:\WINDOWS\system32\apiqc.exe
O4 - HKLM\..\RunOnce: [netkw32.exe] C:\WINDOWS\netkw32.exe
O4 - HKLM\..\RunOnce: [apisr.exe] C:\WINDOWS\apisr.exe
O4 - HKLM\..\RunOnce: [javagu.exe] C:\WINDOWS\system32\javagu.exe
O4 - HKLM\..\RunOnce: [sysao.exe] C:\WINDOWS\system32\sysao.exe
O4 - HKLM\..\RunOnce: [appyq.exe] C:\WINDOWS\appyq.exe
O4 - HKLM\..\RunOnce: [ieie32.exe] C:\WINDOWS\system32\ieie32.exe
O4 - HKLM\..\RunOnce: [msgu32.exe] C:\WINDOWS\msgu32.exe
O4 - HKLM\..\RunOnce: [winqs.exe] C:\WINDOWS\winqs.exe
O4 - HKLM\..\RunOnce: [atleq32.exe] C:\WINDOWS\system32\atleq32.exe
O4 - HKLM\..\RunOnce: [addgq.exe] C:\WINDOWS\system32\addgq.exe
O4 - HKLM\..\RunOnce: [iess32.exe] C:\WINDOWS\iess32.exe
O4 - HKLM\..\RunOnce: [ipbw32.exe] C:\WINDOWS\system32\ipbw32.exe
O4 - HKLM\..\RunOnce: [addhy.exe] C:\WINDOWS\addhy.exe
O4 - HKLM\..\RunOnce: [crun.exe] C:\WINDOWS\crun.exe
O4 - HKLM\..\RunOnce: [appnd32.exe] C:\WINDOWS\appnd32.exe
O4 - HKLM\..\RunOnce: [addxh32.exe] C:\WINDOWS\system32\addxh32.exe
O4 - HKLM\..\RunOnce: [netid32.exe] C:\WINDOWS\netid32.exe
O4 - HKLM\..\RunOnce: [sdkon.exe] C:\WINDOWS\sdkon.exe
O4 - HKLM\..\RunOnce: [ieaq.exe] C:\WINDOWS\ieaq.exe
O4 - HKLM\..\RunOnce: [nethk32.exe] C:\WINDOWS\system32\nethk32.exe
O4 - HKLM\..\RunOnce: [crsg.exe] C:\WINDOWS\system32\crsg.exe
O4 - HKLM\..\RunOnce: [javaxr32.exe] C:\WINDOWS\system32\javaxr32.exe
O4 - HKLM\..\RunOnce: [sysio32.exe] C:\WINDOWS\sysio32.exe
O4 - HKLM\..\RunOnce: [ntfm.exe] C:\WINDOWS\system32\ntfm.exe
O4 - HKLM\..\RunOnce: [mspi.exe] C:\WINDOWS\mspi.exe
O4 - HKLM\..\RunOnce: [msjo.exe] C:\WINDOWS\system32\msjo.exe
O4 - HKLM\..\RunOnce: [ntrt32.exe] C:\WINDOWS\system32\ntrt32.exe
O4 - HKLM\..\RunOnce: [apicy.exe] C:\WINDOWS\apicy.exe
O4 - HKLM\..\RunOnce: [winno32.exe] C:\WINDOWS\winno32.exe
O4 - HKLM\..\RunOnce: [crsm32.exe] C:\WINDOWS\system32\crsm32.exe
O4 - HKLM\..\RunOnce: [ntlm32.exe] C:\WINDOWS\system32\ntlm32.exe
O4 - HKLM\..\RunOnce: [iewj.exe] C:\WINDOWS\iewj.exe
O4 - HKLM\..\RunOnce: [iprf.exe] C:\WINDOWS\iprf.exe
O4 - HKLM\..\RunOnce: [addsr32.exe] C:\WINDOWS\addsr32.exe
O4 - HKLM\..\RunOnce: [syssq.exe] C:\WINDOWS\system32\syssq.exe
O4 - HKLM\..\RunOnce: [ienk32.exe] C:\WINDOWS\system32\ienk32.exe
O4 - HKLM\..\RunOnce: [winrd32.exe] C:\WINDOWS\system32\winrd32.exe
O4 - HKLM\..\RunOnce: [javapv32.exe] C:\WINDOWS\system32\javapv32.exe
O4 - HKLM\..\RunOnce: [javaya.exe] C:\WINDOWS\javaya.exe
O4 - HKLM\..\RunOnce: [addpq.exe] C:\WINDOWS\system32\addpq.exe
O4 - HKLM\..\RunOnce: [winae.exe] C:\WINDOWS\system32\winae.exe
O4 - HKLM\..\RunOnce: [syskc.exe] C:\WINDOWS\system32\syskc.exe
O4 - HKLM\..\RunOnce: [ntyw32.exe] C:\WINDOWS\ntyw32.exe
O4 - HKLM\..\RunOnce: [ntdi32.exe] C:\WINDOWS\system32\ntdi32.exe
O4 - HKLM\..\RunOnce: [sdkvp32.exe] C:\WINDOWS\system32\sdkvp32.exe
O4 - HKLM\..\RunOnce: [iefg.exe] C:\WINDOWS\iefg.exe
O4 - HKLM\..\RunOnce: [ipoc32.exe] C:\WINDOWS\ipoc32.exe
O4 - HKLM\..\RunOnce: [netzh32.exe] C:\WINDOWS\netzh32.exe
O4 - HKLM\..\RunOnce: [javavd32.exe] C:\WINDOWS\javavd32.exe
O4 - HKLM\..\RunOnce: [sysfa.exe] C:\WINDOWS\system32\sysfa.exe
O4 - HKLM\..\RunOnce: [atlln32.exe] C:\WINDOWS\atlln32.exe
O4 - HKLM\..\RunOnce: [ntwo32.exe] C:\WINDOWS\ntwo32.exe
O4 - HKLM\..\RunOnce: [atlgb.exe] C:\WINDOWS\atlgb.exe
O4 - HKLM\..\RunOnce: [mstt32.exe] C:\WINDOWS\mstt32.exe
O4 - HKLM\..\RunOnce: [apiql.exe] C:\WINDOWS\apiql.exe
O4 - HKLM\..\RunOnce: [ntuw32.exe] C:\WINDOWS\ntuw32.exe
O4 - HKLM\..\RunOnce: [ieur32.exe] C:\WINDOWS\ieur32.exe
O4 - HKLM\..\RunOnce: [atlip32.exe] C:\WINDOWS\system32\atlip32.exe
O4 - HKLM\..\RunOnce: [ntqq.exe] C:\WINDOWS\system32\ntqq.exe
O4 - HKLM\..\RunOnce: [winxk32.exe] C:\WINDOWS\system32\winxk32.exe
O4 - HKLM\..\RunOnce: [mfcpb32.exe] C:\WINDOWS\mfcpb32.exe
O4 - HKLM\..\RunOnce: [ieyl.exe] C:\WINDOWS\ieyl.exe
O4 - HKLM\..\RunOnce: [d3hy.exe] C:\WINDOWS\system32\d3hy.exe
O4 - HKLM\..\RunOnce: [ipzz32.exe] C:\WINDOWS\ipzz32.exe
O4 - HKLM\..\RunOnce: [ntui.exe] C:\WINDOWS\ntui.exe
O4 - HKLM\..\RunOnce: [ntyy32.exe] C:\WINDOWS\system32\ntyy32.exe
O4 - HKLM\..\RunOnce: [netbh.exe] C:\WINDOWS\netbh.exe
O4 - HKLM\..\RunOnce: [winvr32.exe] C:\WINDOWS\system32\winvr32.exe
O4 - HKLM\..\RunOnce: [javasn32.exe] C:\WINDOWS\javasn32.exe
O4 - HKLM\..\RunOnce: [sysba.exe] C:\WINDOWS\sysba.exe
O4 - HKLM\..\RunOnce: [netnn.exe] C:\WINDOWS\netnn.exe
O4 - HKLM\..\RunOnce: [ntak32.exe] C:\WINDOWS\ntak32.exe

Also put a check beside all the 016 files. They are active x files and will be reloaded when and if you visit those sites again.

Next, still in Safe-Mode, delete any of the following files that are present:

C:\WINDOWS\adddq.dll
C:\WINDOWS\system32\winac.dll
C:\WINDOWS\system32\ntbu.exe
C:\WINDOWS\system32\ietm32.exe
C:\WINDOWS\system32\addyv.exe
C:\WINDOWS\Registration\vssw.exe
C:\WINDOWS\system32\d3ki32.exe
C:\WINDOWS\system32\mfcey.exe
C:\WINDOWS\iprx32.exe
C:\WINDOWS\crga32.exe
C:\WINDOWS\apimh32.exe
C:\WINDOWS\system32\addha.exe
C:\WINDOWS\apiaz.exe
C:\WINDOWS\sdkxq32.exe
C:\WINDOWS\system32\netnv.exe
C:\WINDOWS\system32\msda.exe
C:\WINDOWS\system32\javamp.exe
C:\WINDOWS\system32\javast32.exe
C:\WINDOWS\sysaa32.exe
C:\WINDOWS\winwd32.exe
C:\WINDOWS\system32\addat.exe
C:\WINDOWS\ipzl.exe
C:\WINDOWS\system32\apiqc.exe
C:\WINDOWS\netkw32.exe
C:\WINDOWS\apisr.exe
C:\WINDOWS\system32\javagu.exe
C:\WINDOWS\system32\sysao.exe
C:\WINDOWS\appyq.exe
C:\WINDOWS\system32\ieie32.exe
C:\WINDOWS\msgu32.exe
C:\WINDOWS\winqs.exe
C:\WINDOWS\system32\atleq32.exe
C:\WINDOWS\system32\addgq.exe
C:\WINDOWS\iess32.exe
C:\WINDOWS\system32\ipbw32.exe
C:\WINDOWS\addhy.exe
C:\WINDOWS\crun.exe
C:\WINDOWS\appnd32.exe
C:\WINDOWS\system32\addxh32.exe
C:\WINDOWS\netid32.exe
C:\WINDOWS\sdkon.exe
C:\WINDOWS\ieaq.exe
C:\WINDOWS\system32\nethk32.exe
C:\WINDOWS\system32\crsg.exe
C:\WINDOWS\system32\javaxr32.exe
C:\WINDOWS\sysio32.exe
C:\WINDOWS\system32\ntfm.exe
C:\WINDOWS\mspi.exe
C:\WINDOWS\system32\msjo.exe
C:\WINDOWS\system32\ntrt32.exe
C:\WINDOWS\apicy.exe
C:\WINDOWS\winno32.exe
C:\WINDOWS\system32\crsm32.exe
C:\WINDOWS\ntlm32.exe
C:\WINDOWS\iewj.exe
C:\WINDOWS\iprf.exe
C:\WINDOWS\addsr32.exe
C:\WINDOWS\system32\syssq.exe
C:\WINDOWS\system32\ienk32.exe
C:\WINDOWS\system32\winrd32.exe
C:\WINDOWS\system32\javapv32.exe
C:\WINDOWS\javaya.exe
C:\WINDOWS\system32\addpq.exe
C:\WINDOWS\system32\winae.exe
C:\WINDOWS\system32\syskc.exe
C:\WINDOWS\ntyw32.exe
C:\WINDOWS\system32\ntdi32.exe
C:\WINDOWS\system32\sdkvp32.exe
C:\WINDOWS\iefg.exe
C:\WINDOWS\ipoc32.exe
C:\WINDOWS\netzh32.exe
C:\WINDOWS\javavd32.exe
C:\WINDOWS\system32\sysfa.exe
C:\WINDOWS\atlln32.exe
C:\WINDOWS\ntwo32.exe
C:\WINDOWS\atlgb.exe
C:\WINDOWS\mstt32.exe
C:\WINDOWS\apiql.exe
C:\WINDOWS\ntuw32.exe
C:\WINDOWS\ieur32.exe
C:\WINDOWS\system32\atlip32.exe
C:\WINDOWS\system32\ntqq.exe
C:\WINDOWS\system32\winxk32.exe
C:\WINDOWS\mfcpb32.exe
C:\WINDOWS\ieyl.exe
C:\WINDOWS\system32\d3hy.exe
C:\WINDOWS\ipzz32.exe
C:\WINDOWS\ntui.exe
C:\WINDOWS\system32\ntyy32.exe
C:\WINDOWS\netbh.exe
C:\WINDOWS\system32\winvr32.exe
C:\WINDOWS\javasn32.exe
C:\WINDOWS\sysba.exe
C:\WINDOWS\netnn.exe
C:\WINDOWS\ntak32.exe


Double click the AboutBuster.exe file that you downloaded earlier. Click OK, click Start, then click OK. This will scan your computer for the bad files and delete them. Save the report it creates (copy and paste it into notepad or wordpad and save as a .txt file).

Finally, still in Safe Mode, scan with Ad-Aware and let it remove anything it finds. Instructions on how to run Adaware. http://www.cjwd.demon.co.uk/spybot-adaware.html

Reboot to normal mode, rescan with Hijack This and post a new log here along with the log you saved from AboutBuster.

Did everything you suggested - except forgot to put the AboutBuster log in - Still have problems with home page redirecting and pop-ups - what now???

Logfile of HijackThis v1.97.7
Scan saved at 9:55:58 PM, on 7/20/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Optimum Online\Netsurf.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\System32\hphmon04.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\PROGRA~1\McAfee.com\Agent\McRegWiz.exe
c:\program files\mcafee.com\shared\mghtml.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\System32\HPHipm11.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\America Online 8.0\aoltray.exe
C:\Palm\HOTSYNC.EXE
C:\WINDOWS\sysxt.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Documents and Settings\CAROL\Local Settings\Temp\Temporary Directory 3 for hijackthis1977.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\rcsqq.dll/sp.html#28129
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.optonline.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.optonline.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://rcsqq.dll/index.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\rcsqq.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://rcsqq.dll/index.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\rcsqq.dll/sp.html#28129
O2 - BHO: (no name) - {60CF4492-119D-A24C-4318-B79E3CA3AE85} - C:\WINDOWS\atljg32.dll
O2 - BHO: McAfee Privacy Service - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Program Files\McAfee\McAfee Privacy Service\GDIEHELP.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [Optimum Online] C:\Program Files\Optimum Online\Netsurf.exe -tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [MPFTray] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [McAfee Guardian] C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe /SU
O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [McRegWiz] C:\PROGRA~1\McAfee.com\Agent\McRegWiz.exe /autorun
O4 - HKCU\..\Run: [SB Audigy 2 Startup Menu] /L:ENG
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKLM\..\RunOnce: [sysxt.exe] C:\WINDOWS\sysxt.exe
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Privacy Bar (HKLM)
O9 - Extra button: MoneySide (HKLM)

Things seem to running ok…i thought i did have hijackthis in a c:/ file - i'll get some help making sure i put it in the right place -

Here is new hijack this file

Logfile of HijackThis v1.97.7
Scan saved at 9:44:45 PM, on 7/21/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\svchost.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Optimum Online\Netsurf.exe
C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\WINDOWS\System32\hphmon04.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\System32\HPHipm11.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\America Online 8.0\aoltray.exe
C:\Palm\HOTSYNC.EXE
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.optonline.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.optonline.net
O2 - BHO: McAfee Privacy Service - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Program Files\McAfee\McAfee Privacy Service\GDIEHELP.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [Optimum Online] C:\Program Files\Optimum Online\Netsurf.exe -tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [MPFTray] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [McAfee Guardian] C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe /SU
O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKCU\..\Run: [SB Audigy 2 Startup Menu] /L:ENG
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Privacy Bar (HKLM)
O9 - Extra button: MoneySide (HKLM)
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab

And the Aboutbuster log:

– Scan 1 ——–
About:Buster Version 1.30
Removed! : C:\WINDOWS\rcsqq.dll
Removed! : C:\WINDOWS\sysxt.exe
Removed! : C:\WINDOWS\yavar.dat
Removed! : C:\WINDOWS\System32\zjnwo.dat
Attempted Clean Of Temp folder.
Removed Uninstall Key (HSA)
Removed Uninstall Key (SE)
Removed Uninstall Key (SW)
Pages Reset… Done!

I'm hoping we resolved it…should i start to celebrate???

Still having trouble saving Hijack this to the proper location - can you advise on that? Did the things you suggested and here is the new log. The computer is behaving - i believe…do i have more to do??? And Thank You - Thank You - I can't thank you enough.

Logfile of HijackThis v1.98.0
Scan saved at 8:24:54 PM, on 7/22/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\svchost.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Optimum Online\Netsurf.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\WINDOWS\System32\hphmon04.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\HPHipm11.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\America Online 8.0\aoltray.exe
C:\Palm\HOTSYNC.EXE
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\Program Files\McAfee\McAfee Privacy Service\GuardDog.exe
C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\CAROL\Local Settings\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.optonline.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.optonline.net/
R3 - Default URLSearchHook is missing
O2 - BHO: McAfee Privacy Service - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Program Files\McAfee\McAfee Privacy Service\GDIEHELP.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [Optimum Online] C:\Program Files\Optimum Online\Netsurf.exe -tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [MPFTray] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [McAfee Guardian] C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe /SU
O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKCU\..\Run: [SB Audigy 2 Startup Menu] /L:ENG
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Privacy Bar - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Program Files\McAfee\McAfee Privacy Service\GDIEHELP.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab