What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Internet problems, programme problems

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
:(
First of all, great site!
Ok i'm having problems with the internet: the homepage is changing constantly, and i'm not able to view certain web pages (e.g. my hotmail account)
Pop ups are appearing regularly too, and i cannot sign into msn messenger.

This all started this morning when for some reason my norton internet protection and antivirus wouldn't start up, no matter how much i clicked it.
Also my stopzilla has not been opening.

I've downloaded several spyware removal programs such as adaware and microsoft antispyware, but for some reason once istallation has been completed these applications will not open/run.


Here's my hijack log:

Logfile of HijackThis v1.99.0
Scan saved at 15:23:47, on 10/05/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\Program Files\Inventel\Gateway\wlancfg.exe
C:\WINDOWS\Explorer.EXE
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\apps\ABoard\ABoard.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\WScript.exe
C:\Documents and Settings\Ian\Start Menu\Programs\Startup\winupdate34503832[1].exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Ian\Desktop\setup programs\HijackThis.exe
C:\WINDOWS\notepad.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://213.159.117.132/index.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Ian\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Ian\LOCALS~1\Temp\sp.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://213.159.117.132/index.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://213.159.117.132/index.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Ian\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Ian\LOCALS~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://213.159.117.132/index.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Ian\LOCALS~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Ian\LOCALS~1\Temp\sp.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.132/index.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.132/index.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hotmail.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Wanadoo
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {00110011-4B0B-44D5-9718-90C88817369B} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\apps\Adobe\Acrobat 5.1\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {5BCC46EA-5864-4CC1-9872-265E393E777B} - C:\WINDOWS\System32\jfmpmba.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\WINDOWS\System32\SZIEBHO.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [PopUpInspector] C:\Program Files\GIANT Company Software inc\PopUp Inspector\PopUpInspector.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe"
O4 - HKLM\..\Run: [WinAmpAgent] C:\WINDOWS\winagent.exe /i
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Themes Terminal] C:\WINDOWS\System32\mlanseui.exe
O4 - HKLM\..\Run: [BHOZapper] C:\Program Files\BHOZapper\BHOZapper.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [winlogon] c:\windows\winlogon.exe
O4 - HKCU\..\Run: [RealUpdater] C:\WINDOWS\System32\realupd.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [uiytfbi] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [tkwoyhh] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [gopvnbp] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [ywwkgsj] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [jqxqsjh] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [eklicae] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [crfvdto] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [ywfmmxt] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [tuqmbjs] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [wlcjgtu] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [mnebhvy] c:\windows\cprcccp.exe
O4 - HKCU\..\Run: [whqhwui] c:\windows\cprcccp.exe
O4 - HKCU\..\Run: [gdhncqf] c:\windows\ecscjet.exe
O4 - HKCU\..\Run: [qulkioj] c:\windows\ecscjet.exe
O4 - HKCU\..\Run: [blanvhw] c:\windows\ecscjet.exe
O4 - HKCU\..\Run: [gvtxvwt] c:\windows\ecscjet.exe
O4 - HKCU\..\Run: [reevxfu] c:\windows\ecscjet.exe
O4 - HKCU\..\Run: [abibawt] c:\windows\ecscjet.exe
O4 - HKCU\..\Run: [inhbgaa] c:\windows\ecscjet.exe
O4 - HKCU\..\Run: [fswsixp] c:\windows\ecscjet.exe
O4 - HKCU\..\Run: [qdvypfa] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [ouitbye] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [pnpdkan] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [qstabog] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [kibrnso] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [iershro] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [slbdaox] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [lhynvao] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [efsydsk] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [nbghege] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [iksrkhr] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [dhibxia] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [yuqjfsg] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [vlbmgyp] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [lpmcffg] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [wipkijs] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [uwcogys] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [ynyadll] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [fsuvoiq] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [fpdraew] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [mydqvib] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [ehlhmij] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [ochwvqh] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [ujhiard] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [aukulju] c:\windows\hrksoao.exe
O4 - HKCU\..\Run: [haglguh] c:\windows\hrksoao.exe
O4 - HKCU\..\Run: [lhuaoef] c:\windows\hrksoao.exe
O4 - HKCU\..\Run: [uebgjsa] c:\windows\hrksoao.exe
O4 - HKCU\..\Run: [vatmvwv] c:\windows\hrksoao.exe
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Startup: winupdate34503832[1].exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: Search.vbs
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Search with Freeserve - res://C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll/VSearch.htm
O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: Stop popups from this web page - C:\Program Files\GIANT Company Software inc\PopUp Inspector\denysite.htm
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O16 - DPF: {11111111-1111-1111-1111-111111111157} - ms-its:mhtml:file://c:\nosuch.mht!http://super-gals.com/scj/rotation/templates/s/x.chm::/ad.exe
O16 - DPF: {1671869C-25B3-4C80-9446-8AE6111F8765} (MaxisHotDateTeleX Control) - http://thesims.ea.com/teleport/hotdate/MaxisHotDateTeleX.cab
O16 - DPF: {5D1E3FA5-64FF-4387-9418-F1D67AFB2247} (MaxisSuperstarTeleX Control) - http://thesims.ea.com/teleport/superstar/M…erstarTeleX.cab
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://webcam2.bugs.bham.ac.uk/activex/AxisCamControl.ocx
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {A44B714B-EE0F-453E-9300-A69B321FEF6C} (MaxisSimsFamilyTeleX Control) - http://thesims.ea.com/teleport/families/Ma…FamilyTeleX.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
O16 - DPF: {f760cb9e-c60f-4a89-890e-fae8b849493e} -
O18 - Filter: text/html - {30EF38F1-A474-4811-B547-701D9DC8E29B} - C:\WINDOWS\System32\jfmpmba.dll
O18 - Filter: text/plain - {30EF38F1-A474-4811-B547-701D9DC8E29B} - C:\WINDOWS\System32\jfmpmba.dll
O21 - SSODL: VYYywoKpH - {A03B9411-0A91-3EBB-82FD-97F299B3CCDA} - C:\WINDOWS\System32\gd.dll
O21 - SSODL: Access Terminal - {EC9D7088-4C03-49CD-8A44-817E82D85217} - C:\WINDOWS\System32\mscatosa.dll
O23 - Service: Aluria Security Center Spyware Eliminator Service - Unknown - C:\Program Files\Aluria Security Center\ascserv.exe
O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SmartLinkService - Unknown - slserv.exe (file missing)
O23 - Service: Virtual CD v4 Security service (SDK - Version) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Service de lancement de WlanCfg - Unknown - C:\Program Files\Inventel\Gateway\wlancfg.exe

Thanks in advance for your help, i really appreciate it,

Ian
Post #2
Hello funkysole, welcome to the TC.

Download LSPfix here: http://www.cexx.org/lspfix.htm

Start the program and then check the I know what I'm doing box.

Move all instances of flsmngr.dll (and nothing else), to the Remove pane.
Click the Finish Button and reboot.

Find and delete the file c:\windows\system\flsmngr.dll


1. Open My Computer
2. Right click on your hard drive that you wish to clean (C drive, for example)
3. In the context menu that opens, select properties
4. Under the general tab you should select Disk Cleanup
5. Windows will scan your drive which will take a few seconds/minutes
6. A box will display the various files you can remove.
Check all boxes except compress old files
7. Click OK and windows will comply.




Important: Do this before any fix.

You need to update your version of HijackThis. Open HJT> Open Misc Tools> Pull the side bar down> Check for update online. If that doesn't work, download it from my signature and remove the hijackThis.exe you have now.

Also please put your HijackThis in it's own folder, (I create a new folder in C:\ named HJT).
You can do a Right Click on any open area on the desktop, New> Folder, then rename the folder HJT.

Go to where your HijackThis is and Right Click on HijackThis.exe, select Cut, then open the new folder you just created (HJT) Right Click in the folder and select paste.


After the above:



This is what I suggest you do.

Download CWShredder from my signature below. Unzip it on the desktop.
Open CWShredder and with ALL other windows closed, click fix.


Go here and run at least one of the online scans, allow them to delete whatever they find:

TrendMicro HouseCall
eTrust AntiVirus Web Scanner
Panda ActiveScan
Note any thing that can't be fixed
Reboot when done.

Next:

Even if you've already run these, make SURE they're up-to-date and run per instructions.

Make sure you have the up-to-date versions of Spybot V 1.3 and Ad-aware SE Build 1.05 . All are free and available below.

Download Spybot, install and update. Then download Ad-aware, install, and update.

Spybot:

Install the program and launch it.

Go to Start > Programs >Spybot > Search & Destroy and choose Spybot S&D

Close ALL windows except Spybot S&D
Click the button to "Search for Updates" and download and install the Updates.
Next click the button "Check for Problems"
When Spybot is complete, it will be showing "RED" (RED) entries "BLACK" entries and "GREEN" (GREEN) entries in the window
Put a check mark beside the RED (RED) entries ONLY.
Choose "Fix Selected Problems" and allow Spybot to fix the RED (RED) entries.

Ad-Aware FULL SCAN:

Install the program and launch it.

First in the main window look in the bottom right corner and click on Check for updates now then click Connect and download the latest reference files.

From main window :Click Start then under Select a scan Mode check Perform full system scan.
Next deselect Search for negligible risk entries.
Now to scan just click the Next button.

When the scan is finished mark everything for removal and get rid of it.(Right-click the window and choose select all from the drop down menu and click Next)

Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.
Post #3
Ok,

I did as requested up to the online scans.
Ran into a problem: I'm now not able to get access to the internet so i couldn't perform the scans, and also i'm not able to open the spybot/adaware set up programs to install them.
The computer is running a bit slower now too.
:rant2:

Here's my new hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 15:32:45, on 15/05/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\Program Files\Inventel\Gateway\wlancfg.exe
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\apps\ABoard\ABoard.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\windows\tbuyqmu.exe
C:\WINDOWS\System32\WScript.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w-find.com/index.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/index.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hotmail.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Wanadoo
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {00110011-4B0B-44D5-9718-90C88817369B} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\apps\Adobe\Acrobat 5.1\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\WINDOWS\System32\SZIEBHO.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [PopUpInspector] C:\Program Files\GIANT Company Software inc\PopUp Inspector\PopUpInspector.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe"
O4 - HKLM\..\Run: [WinAmpAgent] C:\WINDOWS\winagent.exe /i
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Themes Terminal] C:\WINDOWS\System32\mlanseui.exe
O4 - HKLM\..\Run: [BHOZapper] C:\Program Files\BHOZapper\BHOZapper.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [winlogon] c:\windows\winlogon.exe
O4 - HKCU\..\Run: [RealUpdater] C:\WINDOWS\System32\realupd.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [uiytfbi] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [tkwoyhh] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [gopvnbp] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [ywwkgsj] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [jqxqsjh] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [eklicae] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [crfvdto] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [ywfmmxt] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [tuqmbjs] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [wlcjgtu] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [mnebhvy] c:\windows\cprcccp.exe
O4 - HKCU\..\Run: [whqhwui] c:\windows\cprcccp.exe
O4 - HKCU\..\Run: [gdhncqf] c:\windows\ecscjet.exe
O4 - HKCU\..\Run: [qulkioj] c:\windows\ecscjet.exe
O4 - HKCU\..\Run: [blanvhw] c:\windows\ecscjet.exe
O4 - HKCU\..\Run: [gvtxvwt] c:\windows\ecscjet.exe
O4 - HKCU\..\Run: [reevxfu] c:\windows\ecscjet.exe
O4 - HKCU\..\Run: [abibawt] c:\windows\ecscjet.exe
O4 - HKCU\..\Run: [inhbgaa] c:\windows\ecscjet.exe
O4 - HKCU\..\Run: [fswsixp] c:\windows\ecscjet.exe
O4 - HKCU\..\Run: [qdvypfa] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [ouitbye] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [pnpdkan] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [qstabog] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [kibrnso] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [iershro] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [slbdaox] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [lhynvao] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [efsydsk] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [nbghege] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [iksrkhr] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [dhibxia] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [yuqjfsg] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [vlbmgyp] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [lpmcffg] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [wipkijs] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [uwcogys] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [ynyadll] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [fsuvoiq] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [fpdraew] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [mydqvib] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [ehlhmij] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [ochwvqh] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [ujhiard] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [aukulju] c:\windows\hrksoao.exe
O4 - HKCU\..\Run: [haglguh] c:\windows\hrksoao.exe
O4 - HKCU\..\Run: [lhuaoef] c:\windows\hrksoao.exe
O4 - HKCU\..\Run: [uebgjsa] c:\windows\hrksoao.exe
O4 - HKCU\..\Run: [vatmvwv] c:\windows\hrksoao.exe
O4 - HKCU\..\Run: [qteotoy] c:\windows\fuefdkx.exe
O4 - HKCU\..\Run: [bgwwnay] c:\windows\fuefdkx.exe
O4 - HKCU\..\Run: [bewwgqa] c:\windows\gotjyri.exe
O4 - HKCU\..\Run: [omsxecv] c:\windows\gotjyri.exe
O4 - HKCU\..\Run: [jjsevfs] c:\windows\doedwra.exe
O4 - HKCU\..\Run: [alsanmk] c:\windows\doedwra.exe
O4 - HKCU\..\Run: [vecajry] c:\windows\doedwra.exe
O4 - HKCU\..\Run: [cstscxn] c:\windows\btakljs.exe
O4 - HKCU\..\Run: [xqplhun] c:\windows\btakljs.exe
O4 - HKCU\..\Run: [hfnelir] c:\windows\btakljs.exe
O4 - HKCU\..\Run: [euoggkq] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [glepsuo] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [tegdhna] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [kactntx] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [mespofd] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [hmlgecx] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [dbuthyr] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [acosxob] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [fftlaap] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [hmixeel] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [xvuuvdw] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [efcyurt] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [sqetqnf] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [ghmjvrn] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [cyvjnim] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [nmjccqc] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [rktugwr] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [wkwgwlg] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [xgmjoys] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [bknorfh] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [lwpbyqf] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [eiyvcio] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [sysedil] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [sxvdpex] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [nevprci] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [olirqng] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [yejcxeq] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [snyupxv] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [xbtanhx] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [qmsjsvo] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [dtrimou] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [crrinla] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [sjrabkd] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [mpeausp] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [swloqhl] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [btubwok] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [keudaxg] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [bmqhcpx] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [btwodxk] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [jkgmabc] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [jxihops] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [rtescym] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [khoysco] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [cqxywwd] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [foftxwe] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [nwssxpv] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [qwkxypu] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [oapmfmk] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [kwfolbb] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [xpebvuv] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [rvlvjsa] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [hyxhbsr] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [onvjnjw] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [yaemqlo] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [spcycfb] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [ytjnfkm] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [xigyoea] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [treuahm] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [wqtfeqo] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [hwbbtcc] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [tkcfuhr] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [abicbfd] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [mawsyoa] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [cevagnj] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [ykpnocu] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [ljjqueg] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [qhypvqo] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [ayemlvt] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [ernppnb] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [dbpqnqm] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [rvkqgxb] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [tgykmri] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [pkygvsq] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [buyufqr] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [jamxmwy] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [rytyogn] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [dwiumsn] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [lpwgcla] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [mnayvuc] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [pxligfr] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [dkfcbxt] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [fkwymyg] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [xuxxytu] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [snesncx] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [cfvcmcr] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [tcdgppk] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ssjmlar] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [vmmvnur] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [tcthkgq] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [camultv] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [khdmlyd] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [sdolncn] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [prcvset] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [kdyaing] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [dunwusg] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [dkqfavo] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [qpusqcy] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ldqfqod] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ogfgxes] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [vuudubg] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [qnsenei] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [rejhndr] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [kwxcitl] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [clrvmnx] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [lvtakyb] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [nvicqtl] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [jiyinmb] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ltfffgr] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [xwdjxqa] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [kgrtqow] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [llbtkxt] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [hpdphwv] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [lqnwrxm] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [btokdyf] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [akangdb] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [sexobyv] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [uufghvt] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [qdjecpy] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [dlijcjh] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [awfxhuv] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [oqknrvy] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [yfscvis] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [pxajvkl] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [qksphih] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ecgshpq] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [tdbfkew] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [keddkgv] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [mntsbdv] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [fmfeccm] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [qchfogg] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [nophyxs] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [bbdhmjw] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [moaayjy] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [mhqqfss] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [khtadva] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [qvmloph] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [jofmtrd] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [qybrhra] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [bmgjciy] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [psjbrxb] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [uxtpqhf] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [xgfgedi] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [fxntvsy] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [jjqaosb] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ribjbjh] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ycwpwve] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [qenmljc] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [uhjupuq] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [uqeibdc] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [jgatcms] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [cmpxbks] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [hrhwecm] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [iyxxmmn] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [xgyylkv] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [tpwhfyn] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [xpsdnty] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [rhjdehm] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [pgoatmq] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [iwftasw] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [vpddgbh] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [brlpayo] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [capvdjd] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ccrehfp] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [evtxhhu] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [gdwiiuo] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [quouecy] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [gjliunt] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [janeevu] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [elravmk] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [mlihdfc] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [egijljg] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [lfnsgxh] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [vjvmejp] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [wcvygqk] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [jnlkjwm] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [aysbwqp] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [pgcepge] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [jiwjssq] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [vgcthsd] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [pcsomyd] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [kfqlrid] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [xaoidys] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [fmgomxt] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [sqmhwnx] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [vwrgefg] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [hdfgidt] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [wmhcguo] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [fyuanrl] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [mphhgqu] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [wyysxdo] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [jotfsyb] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [hkiyjkh] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ycwruuf] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [gvmyiaj] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [fxcvngq] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [umxcngu] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [fmeimxq] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [cdpcxtn] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [nrbknnm] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [jrnpaeu] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [pkohaiu] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [mfbrhkh] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [utsghud] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [pmwifpf] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [gqcfikr] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ehdgjuf] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [lyybdda] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [jdahalw] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ajaysob] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [pnlntrh] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [rrghjll] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [tvfxxte] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [vtkvdah] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [fumdsnd] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [yaisooc] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [omlqhyn] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [xibcexc] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [nukrmpd] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [arutnft] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [erfjmnn] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [vlwjmgb] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [mtsqkrt] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [bwyxtsc] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [bqetfde] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [tovdvoi] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [mqxjein] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [agkgjga] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [qfuvlnt] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [qcqejho] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [qvgtakn] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [qvrtlow] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [uqehvkp] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [mgewrgi] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [bhfrsle] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [xebygys] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [tspxukq] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [idlycxw] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [simjceu] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [wtdefhf] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [nqhisbf] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [pldmvhx] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [dqnwyvp] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [eqpajuf] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [yubveqn] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [jtirgqd] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [bgfmkwy] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [wtyvjel] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [wyynbgq] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [hchevsb] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ahnfyxl] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ehbgukj] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [lbdftpb] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ydxntnp] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [geicsuh] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [xjwifrq] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [fbhdnbg] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [earppgx] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [eixvskf] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [kdfglmy] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [jfpgjom] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [vhfaxhw] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [hjxdxqa] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [gnjtskq] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [uoftmlp] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [nxwpgey] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [nqsclji] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [omvkyai] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ogyoiqm] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [idrwijs] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [lrkrxki] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [hpaeubv] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [segqvhv] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [gltihks] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [irdfjjg] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [hftvxap] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [uekloxc] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [hmgcwrb] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ksfsspj] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [nhgjdln] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [vtrmahp] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [bkpqpga] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [yyykcca] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [ickgtcx] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [hptwcjq] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [egvfyni] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [wwrytsw] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [yjojvjk] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [ykcrqhu] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [exfxpnn] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [fcyeole] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [vkpdwcd] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [grxsiln] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [jlfapjl] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [iwfyqgf] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [tqdpvqh] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [uivkytp] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [sjufsud] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [bmugsgf] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [bcjlqov] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [cjfpyhy] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [qsbxcxc] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [nvpybop] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [jwwceyc] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [jakyhrb] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [ypgmivy] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [dghmnqr] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [xfrceix] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [rdnbhbe] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [uvnghhq] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [ncuoiit] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [duwxebl] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [tyolvoc] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [rtivfjy] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [mkxseiu] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [rrbpnjj] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [wxcaedj] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [gtsjkhc] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [vungaxu] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [nvroexj] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [adlcrds] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [jcymmav] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [nycmatf] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [raocrjn] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [kekrdcs] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [botrbwi] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [iifeqkk] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [geihffy] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [elgtrex] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [nwlsvjq] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [cpqmdxl] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [nrgotbo] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [hgxeuqg] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [wosfqot] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [mbtyecl] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [xtkfslb] c:\windows\iuhpqmb.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Startup: winupdate34503832[1].exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: Search.vbs
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Search with Freeserve - res://C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll/VSearch.htm
O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: Stop popups from this web page - C:\Program Files\GIANT Company Software inc\PopUp Inspector\denysite.htm
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {11111111-1111-1111-1111-111111111157} - ms-its:mhtml:file://c:\nosuch.mht!http://super-gals.com/scj/rotation/templates/s/x.chm::/ad.exe
O16 - DPF: {1671869C-25B3-4C80-9446-8AE6111F8765} (MaxisHotDateTeleX Control) - http://thesims.ea.com/teleport/hotdate/MaxisHotDateTeleX.cab
O16 - DPF: {5D1E3FA5-64FF-4387-9418-F1D67AFB2247} (MaxisSuperstarTeleX Control) - http://thesims.ea.com/teleport/superstar/M…erstarTeleX.cab
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://webcam2.bugs.bham.ac.uk/activex/AxisCamControl.ocx
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {A44B714B-EE0F-453E-9300-A69B321FEF6C} (MaxisSimsFamilyTeleX Control) - http://thesims.ea.com/teleport/families/Ma…FamilyTeleX.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
O16 - DPF: {f760cb9e-c60f-4a89-890e-fae8b849493e} -
O21 - SSODL: VYYywoKpH - {A03B9411-0A91-3EBB-82FD-97F299B3CCDA} - C:\WINDOWS\System32\gd.dll
O21 - SSODL: Access Terminal - {EC9D7088-4C03-49CD-8A44-817E82D85217} - C:\WINDOWS\System32\mscatosa.dll
O23 - Service: Aluria Security Center Spyware Eliminator Service (ASCService) - Unknown owner - C:\Program Files\Aluria Security Center\ascserv.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Unknown owner - C:\WINDOWS\system32\ZoneLabs\vsmon.exe (file missing)
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\Program Files\Inventel\Gateway\wlancfg.exe

Thanks for your help!

Ian
Post #4
I suggest you do this:


Disable SpywareGuard:

Right click the running icon of Spywareguard, it will open the program.
Then go to Menu, file, exit.
Then confirm the program is closed.

Use ALT/CTRL/DEL and end the process for: SpySub.exe



Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/index.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w-find.com/index.htm

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/index.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {00110011-4B0B-44D5-9718-90C88817369B} - (no file)

O4 - HKCU\..\Run: [winlogon] c:\windows\winlogon.exe
O4 - HKCU\..\Run: [uiytfbi] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [tkwoyhh] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [gopvnbp] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [ywwkgsj] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [jqxqsjh] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [eklicae] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [crfvdto] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [ywfmmxt] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [tuqmbjs] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [wlcjgtu] c:\windows\tbuyqmu.exe
O4 - HKCU\..\Run: [mnebhvy] c:\windows\cprcccp.exe
O4 - HKCU\..\Run: [whqhwui] c:\windows\cprcccp.exe
O4 - HKCU\..\Run: [gdhncqf] c:\windows\ecscjet.exe
O4 - HKCU\..\Run: [qulkioj] c:\windows\ecscjet.exe
O4 - HKCU\..\Run: [blanvhw] c:\windows\ecscjet.exe
O4 - HKCU\..\Run: [gvtxvwt] c:\windows\ecscjet.exe
O4 - HKCU\..\Run: [reevxfu] c:\windows\ecscjet.exe
O4 - HKCU\..\Run: [abibawt] c:\windows\ecscjet.exe
O4 - HKCU\..\Run: [inhbgaa] c:\windows\ecscjet.exe
O4 - HKCU\..\Run: [fswsixp] c:\windows\ecscjet.exe
O4 - HKCU\..\Run: [qdvypfa] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [ouitbye] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [pnpdkan] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [qstabog] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [kibrnso] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [iershro] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [slbdaox] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [lhynvao] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [efsydsk] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [nbghege] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [iksrkhr] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [dhibxia] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [yuqjfsg] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [vlbmgyp] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [lpmcffg] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [wipkijs] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [uwcogys] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [ynyadll] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [fsuvoiq] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [fpdraew] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [mydqvib] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [ehlhmij] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [ochwvqh] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [ujhiard] c:\windows\tvxsrhj.exe
O4 - HKCU\..\Run: [aukulju] c:\windows\hrksoao.exe
O4 - HKCU\..\Run: [haglguh] c:\windows\hrksoao.exe
O4 - HKCU\..\Run: [lhuaoef] c:\windows\hrksoao.exe
O4 - HKCU\..\Run: [uebgjsa] c:\windows\hrksoao.exe
O4 - HKCU\..\Run: [vatmvwv] c:\windows\hrksoao.exe
O4 - HKCU\..\Run: [qteotoy] c:\windows\fuefdkx.exe
O4 - HKCU\..\Run: [bgwwnay] c:\windows\fuefdkx.exe
O4 - HKCU\..\Run: [bewwgqa] c:\windows\gotjyri.exe
O4 - HKCU\..\Run: [omsxecv] c:\windows\gotjyri.exe
O4 - HKCU\..\Run: [jjsevfs] c:\windows\doedwra.exe
O4 - HKCU\..\Run: [alsanmk] c:\windows\doedwra.exe
O4 - HKCU\..\Run: [vecajry] c:\windows\doedwra.exe
O4 - HKCU\..\Run: [cstscxn] c:\windows\btakljs.exe
O4 - HKCU\..\Run: [xqplhun] c:\windows\btakljs.exe
O4 - HKCU\..\Run: [hfnelir] c:\windows\btakljs.exe
O4 - HKCU\..\Run: [euoggkq] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [glepsuo] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [tegdhna] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [kactntx] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [mespofd] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [hmlgecx] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [dbuthyr] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [acosxob] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [fftlaap] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [hmixeel] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [xvuuvdw] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [efcyurt] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [sqetqnf] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [ghmjvrn] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [cyvjnim] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [nmjccqc] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [rktugwr] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [wkwgwlg] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [xgmjoys] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [bknorfh] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [lwpbyqf] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [eiyvcio] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [sysedil] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [sxvdpex] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [nevprci] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [olirqng] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [yejcxeq] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [snyupxv] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [xbtanhx] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [qmsjsvo] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [dtrimou] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [crrinla] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [sjrabkd] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [mpeausp] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [swloqhl] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [btubwok] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [keudaxg] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [bmqhcpx] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [btwodxk] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [jkgmabc] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [jxihops] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [rtescym] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [khoysco] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [cqxywwd] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [foftxwe] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [nwssxpv] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [qwkxypu] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [oapmfmk] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [kwfolbb] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [xpebvuv] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [rvlvjsa] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [hyxhbsr] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [onvjnjw] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [yaemqlo] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [spcycfb] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [ytjnfkm] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [xigyoea] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [treuahm] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [wqtfeqo] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [hwbbtcc] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [tkcfuhr] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [abicbfd] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [mawsyoa] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [cevagnj] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [ykpnocu] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [ljjqueg] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [qhypvqo] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [ayemlvt] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [ernppnb] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [dbpqnqm] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [rvkqgxb] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [tgykmri] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [pkygvsq] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [buyufqr] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [jamxmwy] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [rytyogn] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [dwiumsn] c:\windows\pewicce.exe
O4 - HKCU\..\Run: [lpwgcla] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [mnayvuc] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [pxligfr] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [dkfcbxt] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [fkwymyg] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [xuxxytu] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [snesncx] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [cfvcmcr] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [tcdgppk] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ssjmlar] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [vmmvnur] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [tcthkgq] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [camultv] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [khdmlyd] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [sdolncn] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [prcvset] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [kdyaing] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [dunwusg] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [dkqfavo] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [qpusqcy] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ldqfqod] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ogfgxes] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [vuudubg] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [qnsenei] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [rejhndr] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [kwxcitl] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [clrvmnx] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [lvtakyb] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [nvicqtl] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [jiyinmb] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ltfffgr] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [xwdjxqa] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [kgrtqow] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [llbtkxt] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [hpdphwv] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [lqnwrxm] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [btokdyf] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [akangdb] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [sexobyv] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [uufghvt] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [qdjecpy] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [dlijcjh] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [awfxhuv] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [oqknrvy] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [yfscvis] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [pxajvkl] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [qksphih] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ecgshpq] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [tdbfkew] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [keddkgv] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [mntsbdv] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [fmfeccm] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [qchfogg] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [nophyxs] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [bbdhmjw] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [moaayjy] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [mhqqfss] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [khtadva] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [qvmloph] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [jofmtrd] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [qybrhra] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [bmgjciy] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [psjbrxb] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [uxtpqhf] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [xgfgedi] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [fxntvsy] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [jjqaosb] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ribjbjh] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ycwpwve] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [qenmljc] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [uhjupuq] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [uqeibdc] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [jgatcms] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [cmpxbks] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [hrhwecm] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [iyxxmmn] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [xgyylkv] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [tpwhfyn] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [xpsdnty] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [rhjdehm] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [pgoatmq] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [iwftasw] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [vpddgbh] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [brlpayo] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [capvdjd] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ccrehfp] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [evtxhhu] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [gdwiiuo] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [quouecy] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [gjliunt] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [janeevu] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [elravmk] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [mlihdfc] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [egijljg] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [lfnsgxh] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [vjvmejp] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [wcvygqk] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [jnlkjwm] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [aysbwqp] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [pgcepge] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [jiwjssq] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [vgcthsd] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [pcsomyd] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [kfqlrid] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [xaoidys] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [fmgomxt] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [sqmhwnx] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [vwrgefg] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [hdfgidt] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [wmhcguo] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [fyuanrl] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [mphhgqu] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [wyysxdo] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [jotfsyb] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [hkiyjkh] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ycwruuf] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [gvmyiaj] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [fxcvngq] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [umxcngu] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [fmeimxq] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [cdpcxtn] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [nrbknnm] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [jrnpaeu] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [pkohaiu] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [mfbrhkh] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [utsghud] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [pmwifpf] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [gqcfikr] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ehdgjuf] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [lyybdda] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [jdahalw] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ajaysob] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [pnlntrh] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [rrghjll] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [tvfxxte] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [vtkvdah] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [fumdsnd] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [yaisooc] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [omlqhyn] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [xibcexc] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [nukrmpd] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [arutnft] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [erfjmnn] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [vlwjmgb] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [mtsqkrt] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [bwyxtsc] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [bqetfde] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [tovdvoi] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [mqxjein] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [agkgjga] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [qfuvlnt] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [qcqejho] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [qvgtakn] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [qvrtlow] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [uqehvkp] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [mgewrgi] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [bhfrsle] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [xebygys] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [tspxukq] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [idlycxw] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [simjceu] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [wtdefhf] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [nqhisbf] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [pldmvhx] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [dqnwyvp] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [eqpajuf] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [yubveqn] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [jtirgqd] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [bgfmkwy] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [wtyvjel] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [wyynbgq] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [hchevsb] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ahnfyxl] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ehbgukj] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [lbdftpb] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ydxntnp] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [geicsuh] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [xjwifrq] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [fbhdnbg] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [earppgx] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [eixvskf] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [kdfglmy] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [jfpgjom] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [vhfaxhw] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [hjxdxqa] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [gnjtskq] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [uoftmlp] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [nxwpgey] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [nqsclji] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [omvkyai] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ogyoiqm] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [idrwijs] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [lrkrxki] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [hpaeubv] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [segqvhv] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [gltihks] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [irdfjjg] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [hftvxap] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [uekloxc] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [hmgcwrb] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [ksfsspj] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [nhgjdln] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [vtrmahp] c:\windows\tobvrvd.exe
O4 - HKCU\..\Run: [bkpqpga] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [yyykcca] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [ickgtcx] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [hptwcjq] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [egvfyni] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [wwrytsw] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [yjojvjk] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [ykcrqhu] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [exfxpnn] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [fcyeole] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [vkpdwcd] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [grxsiln] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [jlfapjl] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [iwfyqgf] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [tqdpvqh] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [uivkytp] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [sjufsud] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [bmugsgf] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [bcjlqov] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [cjfpyhy] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [qsbxcxc] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [nvpybop] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [jwwceyc] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [jakyhrb] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [ypgmivy] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [dghmnqr] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [xfrceix] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [rdnbhbe] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [uvnghhq] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [ncuoiit] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [duwxebl] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [tyolvoc] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [rtivfjy] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [mkxseiu] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [rrbpnjj] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [wxcaedj] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [gtsjkhc] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [vungaxu] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [nvroexj] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [adlcrds] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [jcymmav] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [nycmatf] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [raocrjn] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [kekrdcs] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [botrbwi] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [iifeqkk] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [geihffy] c:\windows\kygrecd.exe
O4 - HKCU\..\Run: [elgtrex] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [nwlsvjq] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [cpqmdxl] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [nrgotbo] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [hgxeuqg] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [wosfqot] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [mbtyecl] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [xtkfslb] c:\windows\iuhpqmb.exe

O4 - Startup: winupdate34503832[1].exe

O4 - Global Startup: Search.vbs

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

ALL 016's. They'll come back if needed,

O21 - SSODL: VYYywoKpH - {A03B9411-0A91-3EBB-82FD-97F299B3CCDA} - C:\WINDOWS\System32\gd.dll

O21 - SSODL: Access Terminal - {EC9D7088-4C03-49CD-8A44-817E82D85217} - C:\WINDOWS\System32\mscatosa.dll


Close ALL windows and browsers except HijackThis and click "Fix checked"


Use Add/Remove Programs and remove:




Restart in Safe Mode:
Restart your computer.

If you don't know how to start in Safe Mode, clink HERE



We also need to "Show hidden files and folders." click HERE to learn how to:




Search for and delete these files if listed:
Search.vbs
c:\windows\winlogon.exe
c:\windows\tbuyqmu.exe
c:\windows\cprcccp.exe
c:\windows\ecscjet.exe
c:\windows\tvxsrhj.exe
c:\windows\hrksoao.exe
c:\windows\fuefdkx.exe
c:\windows\gotjyri.exe
c:\windows\doedwra.exe
c:\windows\btakljs.exe
c:\windows\pewicce.exe
c:\windows\tobvrvd.exe
c:\windows\kygrecd.exe
c:\windows\iuhpqmb.exe
C:\WINDOWS\System32\gd.dll
C:\WINDOWS\System32\mscatosa.dll



Open C:\Windows\Prefetch\ Delete ALL files in this folder.


Do this also if these Temp Folders are part of your OS.

Also in safe mode navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.


Next navigate to the C:\Documents and Settings\(EVERY LISTED USER)\Local Settings\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.


Empty the Recycle Bin

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #5
Did everything you told me to,

Here's the new highjackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 18:03:56, on 15/05/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\Program Files\Inventel\Gateway\wlancfg.exe
C:\WINDOWS\Explorer.EXE
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\apps\ABoard\ABoard.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\windows\xvoskvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\WINDOWS\webshots.scr
C:\Program Files\SpywareGuard\sgbhp.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w-find.com/index.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/index.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hotmail.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Wanadoo
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\apps\Adobe\Acrobat 5.1\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\WINDOWS\System32\SZIEBHO.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [PopUpInspector] C:\Program Files\GIANT Company Software inc\PopUp Inspector\PopUpInspector.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe"
O4 - HKLM\..\Run: [WinAmpAgent] C:\WINDOWS\winagent.exe /i
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Themes Terminal] C:\WINDOWS\System32\mlanseui.exe
O4 - HKLM\..\Run: [BHOZapper] C:\Program Files\BHOZapper\BHOZapper.exe
O4 - HKCU\..\Run: [RealUpdater] C:\WINDOWS\System32\realupd.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [mmylyll] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [mymfxtt] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [prtyyvs] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [ucrldwm] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [fqrtrif] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [onygcmt] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [tfspkpq] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [iffugll] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [elsqtfn] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [cugphsx] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [gqemmjh] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [ldhiqpg] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [uwaekho] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [tlsqnry] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [reldwye] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [ypyygdr] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [kcenmvc] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [hbykuwv] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [bcqiysw] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [ycpqruf] c:\windows\xvoskvc.exe
O4 - HKCU\..\Run: [rsyxxxr] c:\windows\xvoskvc.exe
O4 - HKCU\..\Run: [wqdbxec] c:\windows\xvoskvc.exe
O4 - HKCU\..\Run: [lpkmgen] c:\windows\xvoskvc.exe
O4 - HKCU\..\Run: [wysujrb] c:\windows\pleuaio.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Startup: winupdate34503832[1].exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Search with Freeserve - res://C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll/VSearch.htm
O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: Stop popups from this web page - C:\Program Files\GIANT Company Software inc\PopUp Inspector\denysite.htm
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O21 - SSODL: VYYywoKpH - {A03B9411-0A91-3EBB-82FD-97F299B3CCDA} - C:\WINDOWS\System32\gd.dll (file missing)
O21 - SSODL: Access Terminal - {5EF16AA8-17D3-4530-98D7-447D86509F00} - C:\WINDOWS\System32\mscatosa.dll (file missing)
O23 - Service: Aluria Security Center Spyware Eliminator Service (ASCService) - Unknown owner - C:\Program Files\Aluria Security Center\ascserv.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\Program Files\Inventel\Gateway\wlancfg.exe

Internet access is restored, but i still can't access my hotmail account and homepage is still changing.
Computer is still running a bit slower than usual.

Thanks,

Ian
Post #6
Restart your computer in Safe Mode.

Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.

Use ALT/CTRL/DEL and end the process for these:
sgmain.exe
SpySub.exe



Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/index.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w-find.com/index.htm

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/index.htm

O4 - HKCU\..\Run: [mmylyll] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [mymfxtt] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [prtyyvs] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [ucrldwm] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [fqrtrif] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [onygcmt] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [tfspkpq] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [iffugll] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [elsqtfn] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [cugphsx] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [gqemmjh] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [ldhiqpg] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [uwaekho] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [tlsqnry] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [reldwye] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [ypyygdr] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [kcenmvc] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [hbykuwv] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [bcqiysw] c:\windows\iuhpqmb.exe
O4 - HKCU\..\Run: [ycpqruf] c:\windows\xvoskvc.exe
O4 - HKCU\..\Run: [rsyxxxr] c:\windows\xvoskvc.exe
O4 - HKCU\..\Run: [wqdbxec] c:\windows\xvoskvc.exe
O4 - HKCU\..\Run: [lpkmgen] c:\windows\xvoskvc.exe
O4 - HKCU\..\Run: [wysujrb] c:\windows\pleuaio.exe

O4 - Startup: winupdate34503832[1].exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

O21 - SSODL: VYYywoKpH - {A03B9411-0A91-3EBB-82FD-97F299B3CCDA} - C:\WINDOWS\System32\gd.dll (file missing)

O21 - SSODL: Access Terminal - {5EF16AA8-17D3-4530-98D7-447D86509F00} - C:\WINDOWS\System32\mscatosa.dll (file missing)

O23 - Service: Aluria Security Center Spyware Eliminator Service (ASCService) - Unknown owner - C:\Program Files\Aluria Security Center\ascserv.exe

Close ALL windows and browsers except HijackThis and click "Fix checked"


use Add/Remove Programs and remove:
Aluria Security Center

Delete these files:
winupdate34503832[1].exe
c:\windows\iuhpqmb.exe
c:\windows\xvoskvc.exe
c:\windows\pleuaio.exe


Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.
Post #7
Did as requested,

Here's the new log:

Logfile of HijackThis v1.99.1
Scan saved at 23:53:35, on 15/05/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\Program Files\Inventel\Gateway\wlancfg.exe
C:\WINDOWS\Explorer.EXE
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\apps\ABoard\ABoard.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hotmail.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Wanadoo
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\apps\Adobe\Acrobat 5.1\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\WINDOWS\System32\SZIEBHO.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [PopUpInspector] C:\Program Files\GIANT Company Software inc\PopUp Inspector\PopUpInspector.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe"
O4 - HKLM\..\Run: [WinAmpAgent] C:\WINDOWS\winagent.exe /i
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Themes Terminal] C:\WINDOWS\System32\mlanseui.exe
O4 - HKLM\..\Run: [BHOZapper] C:\Program Files\BHOZapper\BHOZapper.exe
O4 - HKCU\..\Run: [RealUpdater] C:\WINDOWS\System32\realupd.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [cfpcxlg] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [grmygxm] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ucqhrgl] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [fayploy] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [cyuejmh] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ofhxiax] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [bhyiovd] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [svvnfbi] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [bhkhcjj] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [amktrqm] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [gyvfvvt] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [dbxpvdi] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [bnykrxa] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [fkfxiha] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ktfhiur] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [tcfrclq] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [xkvpqhr] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ixogbsm] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [tnjwxrm] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [etgnrkl] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [giiufeh] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [omytehy] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [lnfjykb] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [xqiqmxv] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [pdxuckd] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [xotxhjy] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ebkuedw] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ejpernv] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [tdoibkd] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [wakguxq] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [xtoebtf] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ijobxfr] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [wwptrlc] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [cnlkuxv] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [rcnbwkg] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [yatsokw] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [plggciy] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [cdacook] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [cuhufvg] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [hgmcuvq] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [nwonmqs] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [wlqalbh] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [bkojrvx] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [vwoqyrt] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [vpuwxgx] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [vkvvitt] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [nlqemsj] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [iftgndc] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [fakfcsp] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [dlxbnss] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [hctdjsk] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [cfxantm] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [irksvvq] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ncmaigq] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [kogqamt] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [dfckldf] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [pymdxax] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [eglsuca] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [clqjxlf] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ifuctxw] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ymejtml] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [etfyjdi] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [hjaibgu] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [phfvuqy] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [jhbrbfn] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [gxxcnpi] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ldbsnha] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [hchofar] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [qpxokwc] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [nqrypsi] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [rvbicjl] c:\windows\fioseyg.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html
O8 - Extra context menu item: Search with Freeserve - res://C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll/VSearch.htm
O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: Stop popups from this web page - C:\Program Files\GIANT Company Software inc\PopUp Inspector\denysite.htm
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O21 - SSODL: Access Terminal - {6593DD0D-2262-4529-9B18-C06932886F53} - C:\WINDOWS\System32\mscatosa.dll (file missing)
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\Program Files\Inventel\Gateway\wlancfg.exe

Still no access to hotmail account and msn messenger, but computer is running slightly faster now.
Homepage is now about:blank.

Ian
Post #8
Let's see if you can do these now. If Ad-Aware and Spybot won't run, then restart in Safe Mode and then run them.

Go here and run at least one of the online scans, allow them to delete whatever they find:

TrendMicro HouseCall
eTrust AntiVirus Web Scanner
Panda ActiveScan
Note any thing that can't be fixed
Reboot when done.

Next:

Even if you've already run these, make SURE they're up-to-date and run per instructions.

Make sure you have the up-to-date versions of Spybot V 1.3 and Ad-aware SE Build 1.05 . All are free and available below.

Download Spybot, install and update. Then download Ad-aware, install, and update.

Spybot:

Install the program and launch it.

Go to Start > Programs >Spybot > Search & Destroy and choose Spybot S&D

Close ALL windows except Spybot S&D
Click the button to "Search for Updates" and download and install the Updates.
Next click the button "Check for Problems"
When Spybot is complete, it will be showing "RED" (RED) entries "BLACK" entries and "GREEN" (GREEN) entries in the window
Put a check mark beside the RED (RED) entries ONLY.
Choose "Fix Selected Problems" and allow Spybot to fix the RED (RED) entries.

Ad-Aware FULL SCAN:

Install the program and launch it.

First in the main window look in the bottom right corner and click on Check for updates now then click Connect and download the latest reference files.

From main window :Click Start then under Select a scan Mode check Perform full system scan.
Next deselect Search for negligible risk entries.
Now to scan just click the Next button.

When the scan is finished mark everything for removal and get rid of it.(Right-click the window and choose select all from the drop down menu and click Next)

Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.
Post #9
Here's the new log:

Logfile of HijackThis v1.99.1
Scan saved at 01:15:32, on 16/05/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\Program Files\Inventel\Gateway\wlancfg.exe
C:\WINDOWS\Explorer.EXE
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\apps\ABoard\ABoard.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w-find.com/index.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/index.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hotmail.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Wanadoo
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\apps\Adobe\Acrobat 5.1\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\WINDOWS\System32\SZIEBHO.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [PopUpInspector] C:\Program Files\GIANT Company Software inc\PopUp Inspector\PopUpInspector.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe"
O4 - HKLM\..\Run: [WinAmpAgent] C:\WINDOWS\winagent.exe /i
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Themes Terminal] C:\WINDOWS\System32\mlanseui.exe
O4 - HKLM\..\Run: [BHOZapper] C:\Program Files\BHOZapper\BHOZapper.exe
O4 - HKCU\..\Run: [RealUpdater] C:\WINDOWS\System32\realupd.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [cfpcxlg] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [grmygxm] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ucqhrgl] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [fayploy] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [cyuejmh] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ofhxiax] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [bhyiovd] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [svvnfbi] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [bhkhcjj] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [amktrqm] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [gyvfvvt] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [dbxpvdi] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [bnykrxa] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [fkfxiha] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ktfhiur] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [tcfrclq] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [xkvpqhr] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ixogbsm] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [tnjwxrm] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [etgnrkl] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [giiufeh] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [omytehy] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [lnfjykb] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [xqiqmxv] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [pdxuckd] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [xotxhjy] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ebkuedw] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ejpernv] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [tdoibkd] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [wakguxq] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [xtoebtf] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ijobxfr] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [wwptrlc] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [cnlkuxv] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [rcnbwkg] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [yatsokw] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [plggciy] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [cdacook] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [cuhufvg] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [hgmcuvq] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [nwonmqs] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [wlqalbh] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [bkojrvx] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [vwoqyrt] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [vpuwxgx] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [vkvvitt] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [nlqemsj] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [iftgndc] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [fakfcsp] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [dlxbnss] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [hctdjsk] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [cfxantm] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [irksvvq] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ncmaigq] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [kogqamt] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [dfckldf] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [pymdxax] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [eglsuca] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [clqjxlf] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ifuctxw] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ymejtml] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [etfyjdi] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [hjaibgu] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [phfvuqy] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [jhbrbfn] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [gxxcnpi] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ldbsnha] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [hchofar] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [qpxokwc] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [nqrypsi] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [rvbicjl] c:\windows\fioseyg.exe
O4 - HKCU\..\Run: [covmbbc] c:\windows\bhvudhc.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html
O8 - Extra context menu item: Search with Freeserve - res://C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll/VSearch.htm
O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: Stop popups from this web page - C:\Program Files\GIANT Company Software inc\PopUp Inspector\denysite.htm
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O21 - SSODL: Access Terminal - {6593DD0D-2262-4529-9B18-C06932886F53} - C:\WINDOWS\System32\mscatosa.dll (file missing)
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\Program Files\Inventel\Gateway\wlancfg.exe

Same problems still occuring i'm afraid.
These 2 couldn't be removed from the online scan:

mlanseui.exe
thun32.dll

Ian
Post #12
Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Please do NOT run a scan yet.


Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.com/support/safemode.shtml


Please run Ewido security suite, and perform a full scan. Remove anything found, and please save the logfile from the scan, because I will ask you to post it here for me later.

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.
Post #13
New HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 10:54:21, on 16/05/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\Program Files\Inventel\Gateway\wlancfg.exe
C:\WINDOWS\Explorer.EXE
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\apps\ABoard\ABoard.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\WINDOWS\webshots.scr
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w-find.com/index.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/index.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hotmail.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Wanadoo
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\apps\Adobe\Acrobat 5.1\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\WINDOWS\System32\SZIEBHO.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [PopUpInspector] C:\Program Files\GIANT Company Software inc\PopUp Inspector\PopUpInspector.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe"
O4 - HKLM\..\Run: [WinAmpAgent] C:\WINDOWS\winagent.exe /i
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Themes Terminal] C:\WINDOWS\System32\mlanseui.exe
O4 - HKLM\..\Run: [BHOZapper] C:\Program Files\BHOZapper\BHOZapper.exe
O4 - HKCU\..\Run: [RealUpdater] C:\WINDOWS\System32\realupd.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [cfpcxlg] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [grmygxm] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ucqhrgl] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [fayploy] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [cyuejmh] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ofhxiax] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [bhyiovd] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [svvnfbi] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [bhkhcjj] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [amktrqm] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [gyvfvvt] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [dbxpvdi] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [bnykrxa] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [fkfxiha] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ktfhiur] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [tcfrclq] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [xkvpqhr] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ixogbsm] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [tnjwxrm] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [etgnrkl] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [giiufeh] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [omytehy] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [lnfjykb] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [xqiqmxv] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [pdxuckd] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [xotxhjy] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ebkuedw] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ejpernv] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [tdoibkd] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [wakguxq] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [xtoebtf] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ijobxfr] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [wwptrlc] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [cnlkuxv] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [rcnbwkg] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [yatsokw] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [plggciy] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [cdacook] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [cuhufvg] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [hgmcuvq] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [nwonmqs] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [wlqalbh] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [bkojrvx] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [vwoqyrt] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [vpuwxgx] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [vkvvitt] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [nlqemsj] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [iftgndc] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [fakfcsp] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [dlxbnss] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [hctdjsk] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [cfxantm] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [irksvvq] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ncmaigq] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [kogqamt] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [dfckldf] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [pymdxax] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [eglsuca] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [clqjxlf] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ifuctxw] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ymejtml] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [etfyjdi] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [hjaibgu] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [phfvuqy] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [jhbrbfn] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [gxxcnpi] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ldbsnha] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [hchofar] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [qpxokwc] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [nqrypsi] c:\windows\pleuaio.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html
O8 - Extra context menu item: Search with Freeserve - res://C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll/VSearch.htm
O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: Stop popups from this web page - C:\Program Files\GIANT Company Software inc\PopUp Inspector\denysite.htm
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O21 - SSODL: Access Terminal - {6593DD0D-2262-4529-9B18-C06932886F53} - C:\WINDOWS\System32\mscatosa.dll (file missing)
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\Program Files\Inventel\Gateway\wlancfg.exe


Ewido log:

ewido security suite - Scan report
———————————————————

+ Created on: 10:47:04, 16/05/2005
+ Report-Checksum: BB78F32A

+ Date of database: 16/05/2005
+ Version of scan engine: v3.0

+ Duration: 60 min
+ Scanned Files: 63130
+ Speed: 17.33 Files/Second
+ Infected files: 52
+ Removed files: 52
+ Files put in quarantine: 52
+ Files that could not be opened: 0
+ Files that could not be cleaned: 0

+ Binder: Yes
+ Crypter: Yes
+ Archives: Yes

+ Scanned items:
C:\

+ Scan result:
C:\Documents and Settings\Ian\Cookies\ian@a[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Ian\Cookies\ian@real[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\hijackthis\backups\backup-20050515-173919-194-Search.vbs -> Spyware.Krepper -> Cleaned with backup
C:\Program Files\Windows Media Player\wmplayer.exe.tmp -> TrojanDownloader.Femad.n -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP327\A0038070.exe -> TrojanDownloader.Small.mh -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP340\A0039510.exe -> Dialer.Generic -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP340\A0039511.exe -> TrojanDownloader.Small.le -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP340\A0039515.exe -> TrojanDownloader.Small.vg -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP340\A0039521.dll -> TrojanDownloader.Small.qr -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP341\A0042897.vbs -> Spyware.Krepper -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP341\A0042902.exe -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP341\A0042903.exe -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP341\A0042904.exe -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP341\A0042905.exe -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP341\A0042906.exe -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP341\A0042907.exe -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP341\A0042908.exe -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP341\A0042909.exe -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP341\A0042910.exe -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP341\A0042911.exe -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP341\A0042912.exe -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP341\A0042913.exe -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP341\A0042914.exe -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP342\A0042982.exe -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP342\A0042983.exe -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP342\A0042984.exe -> TrojanDropper.Small.ue -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP342\A0043016.exe -> TrojanDownloader.Small.ew -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP342\A0043018.exe -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP342\A0043019.exe -> TrojanDropper.Small.wv -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP342\A0043020.exe -> TrojanDropper.Agent.ii -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP342\A0043022.dll -> TrojanDownloader.Small.zk -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP342\A0043023.exe -> Spyware.FindSpy.e -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP342\A0043024.dll -> TrojanDownloader.Adload.g -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP342\A0043026.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP342\A0043027.dll -> Trojan.Small.m -> Cleaned with backup
C:\System Volume Information\_restore{98E46F0A-9DA1-4258-92C4-7CCAE5D21E6E}\RP342\A0043050.dll -> TrojanSpy.Briss.h -> Cleaned with backup
C:\WINDOWS\bhvudhc.exe -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\corelsys.dll -> TrojanDownloader.Agent.ba -> Cleaned with backup
C:\WINDOWS\dl0001.exe -> Dialer.Generic -> Cleaned with backup
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\on-line.exe -> Dialer.Generic -> Cleaned with backup
C:\WINDOWS\Downloaded Program Files\load.exe -> TrojanDownloader.Small.mh -> Cleaned with backup
C:\WINDOWS\Downloaded Program Files\on-line.exe -> Dialer.Generic -> Cleaned with backup
C:\WINDOWS\drfyxet.exe -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\Explor.exe -> Dialer.Generic -> Cleaned with backup
C:\WINDOWS\fioseyg.exe -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\LastGood\notepad.exe -> TrojanDropper.Small.ja -> Cleaned with backup
C:\WINDOWS\loadnew.exe -> TrojanDownloader.Small.vg -> Cleaned with backup
C:\WINDOWS\svchst.exe -> Backdoor.Webdor.g -> Cleaned with backup
C:\WINDOWS\system32\corelsys.dll -> TrojanDownloader.Agent.ba -> Cleaned with backup
C:\WINDOWS\system32\drivers\etc\hosts -> Trojan.Qhost.m -> Cleaned with backup
C:\WINDOWS\system32\thun32.dll -> TrojanProxy.Small.bk -> Cleaned with backup
C:\WINDOWS\system32\vbjhrjlm.exe -> Spyware.Hijacker.Generic -> Cleaned with backup


::Report End


Ian
Post #14
Download SystemSecUk from this site: http://home9.inet.tele.dk/le01/Sikkerhed.htm

Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following: (They may or may not be there)
pleuaio.exe


Please go offline

Run SystemSecUk file

Then run Hijackthis and place a check beside each of the following. Once you have checked them, click fix checked.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/index.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w-find.com/index.htm

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/index.htm

O4 - HKCU\..\Run: [cfpcxlg] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [grmygxm] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ucqhrgl] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [fayploy] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [cyuejmh] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ofhxiax] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [bhyiovd] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [svvnfbi] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [bhkhcjj] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [amktrqm] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [gyvfvvt] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [dbxpvdi] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [bnykrxa] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [fkfxiha] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ktfhiur] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [tcfrclq] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [xkvpqhr] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ixogbsm] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [tnjwxrm] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [etgnrkl] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [giiufeh] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [omytehy] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [lnfjykb] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [xqiqmxv] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [pdxuckd] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [xotxhjy] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ebkuedw] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ejpernv] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [tdoibkd] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [wakguxq] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [xtoebtf] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ijobxfr] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [wwptrlc] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [cnlkuxv] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [rcnbwkg] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [yatsokw] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [plggciy] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [cdacook] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [cuhufvg] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [hgmcuvq] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [nwonmqs] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [wlqalbh] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [bkojrvx] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [vwoqyrt] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [vpuwxgx] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [vkvvitt] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [nlqemsj] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [iftgndc] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [fakfcsp] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [dlxbnss] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [hctdjsk] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [cfxantm] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [irksvvq] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ncmaigq] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [kogqamt] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [dfckldf] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [pymdxax] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [eglsuca] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [clqjxlf] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ifuctxw] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ymejtml] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [etfyjdi] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [hjaibgu] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [phfvuqy] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [jhbrbfn] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [gxxcnpi] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [ldbsnha] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [hchofar] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [qpxokwc] c:\windows\pleuaio.exe
O4 - HKCU\..\Run: [nqrypsi] c:\windows\pleuaio.exe



Reboot into Safe Mode - Hit F8 key untill menu shows up

Delete the following files or folders (delete item in bold). Please do not be concerned if
any of the items are not found as they may have been automatically removed by actions I had
you take earlier in the cleaning process.
c:\windows\pleuaio.exe


Reboot and post new log
Post #15
Here's the new log:

Logfile of HijackThis v1.99.1
Scan saved at 15:17:02, on 16/05/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\Program Files\Inventel\Gateway\wlancfg.exe
C:\WINDOWS\Explorer.EXE
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\apps\ABoard\ABoard.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\WINDOWS\webshots.scr
C:\Program Files\SpywareGuard\sgbhp.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hotmail.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Wanadoo
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\apps\Adobe\Acrobat 5.1\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\WINDOWS\System32\SZIEBHO.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [PopUpInspector] C:\Program Files\GIANT Company Software inc\PopUp Inspector\PopUpInspector.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe"
O4 - HKLM\..\Run: [WinAmpAgent] C:\WINDOWS\winagent.exe /i
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Themes Terminal] C:\WINDOWS\System32\mlanseui.exe
O4 - HKLM\..\Run: [BHOZapper] C:\Program Files\BHOZapper\BHOZapper.exe
O4 - HKCU\..\Run: [RealUpdater] C:\WINDOWS\System32\realupd.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html
O8 - Extra context menu item: Search with Freeserve - res://C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll/VSearch.htm
O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: Stop popups from this web page - C:\Program Files\GIANT Company Software inc\PopUp Inspector\denysite.htm
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O21 - SSODL: Access Terminal - {6593DD0D-2262-4529-9B18-C06932886F53} - C:\WINDOWS\System32\mscatosa.dll (file missing)
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Inventel - C:\Program Files\Inventel\Gateway\wlancfg.exe

Homepage is now about:blank, still can't access hotmail account.

Ian

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI