windows me hijacked

Hi all. You wewre helpful before, hope it happens again. Just want to know what I should take from here. Notice the /s switch at the end of a lot of the items. What is that? Those same items are in "msconfig" when I run it. Here it is.

Logfile of HijackThis v1.99.1
Scan saved at 4:54:11 PM, on 20/05/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v5.50 (5.50.4134.0600)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMKEYBD.EXE
C:\WINDOWS\ADDPV32.EXE
C:\WINDOWS\SYSTEM\NETYV32.EXE
C:\WINDOWS\ATLGF32.EXE
C:\WINDOWS\SYSTEM\D3UB.EXE
C:\WINDOWS\SYSTEM\APPZP.EXE
C:\WINDOWS\SYSTEM\APIOV32.EXE
C:\WINDOWS\SYSTEM\JAVAHB32.EXE
C:\WINDOWS\SYSTEM\NETFZ32.EXE
C:\WINDOWS\MSJE32.EXE
C:\WINDOWS\ADDGB32.EXE
C:\WINDOWS\D3BW.EXE
C:\WINDOWS\MSNN.EXE
C:\WINDOWS\JAVACE32.EXE
C:\WINDOWS\IPFA.EXE
C:\WINDOWS\SYSTEM\MFCNZ32.EXE
C:\WINDOWS\MSZS32.EXE
C:\WINDOWS\IPYS32.EXE
C:\WINDOWS\NTTK32.EXE
C:\WINDOWS\SYSTEM\NTCO.EXE
C:\WINDOWS\CRUU.EXE
C:\WINDOWS\SYSTEM\D3DZ32.EXE
C:\WINDOWS\SYSTEM\CRUG32.EXE
C:\WINDOWS\MFCOK32.EXE
C:\WINDOWS\SYSTEM\D3TL32.EXE
C:\WINDOWS\APPBI.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\IPUE32.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\KEYBDMGR.EXE
C:\WINDOWS\CRXK.EXE
C:\WINDOWS\IEAI.EXE
C:\WINDOWS\SDKXF.EXE
C:\WINDOWS\SYSTEM\ATLFT32.EXE
C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.EXE
C:\WINDOWS\WINZN.EXE
C:\WINDOWS\SYSTEM\APIMF.EXE
C:\WINDOWS\SYSTEM\NTLV32.EXE
C:\WINDOWS\SYSTEM\MFCPL32.EXE
C:\WINDOWS\MSSB32.EXE
C:\WINDOWS\IEWW32.EXE
C:\WINDOWS\SYSTEM\JAVALX32.EXE
C:\WINDOWS\SYSTEM\D3HQ32.EXE
C:\WINDOWS\SYSTEM\CRNH32.EXE
C:\WINDOWS\SYSTEM\IPKL32.EXE
C:\WINDOWS\SYSMV32.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\IWP\NPFMNTOR.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
C:\WINDOWS\SYSTEM\IPCJ32.EXE
C:\WINDOWS\NETHW.EXE
C:\WINDOWS\SYSTEM\SYSTN32.EXE
C:\WINDOWS\MSEC32.EXE
C:\WINDOWS\NETKP.EXE
C:\WINDOWS\SYSVC.EXE
C:\WINDOWS\JAVADN.EXE
C:\WINDOWS\SYSTEM\APIHT.EXE
C:\WINDOWS\NETTK.EXE
C:\WINDOWS\SYSTEM\NETQD32.EXE
C:\WINDOWS\NTFB.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\JAVACF32.EXE
C:\WINDOWS\IEZD.EXE
C:\WINDOWS\NETXX32.EXE
C:\WINDOWS\NETCK.EXE
C:\WINDOWS\SYSTEM\ATLTO32.EXE
C:\WINDOWS\SYSTEM\MSWB32.EXE
C:\WINDOWS\SYSTEM\D3HK32.EXE
C:\WINDOWS\SYSTEM\JAVAOE.EXE
C:\WINDOWS\SYSTEM\APINJ32.EXE
C:\WINDOWS\SYSTEM\APIEL.EXE
C:\WINDOWS\ADDGE32.EXE
C:\WINDOWS\APIOX.EXE
C:\WINDOWS\IPZG32.EXE
C:\WINDOWS\SYSTEM\IPVP.EXE
C:\WINDOWS\SYSTEM\WINTY.EXE
C:\WINDOWS\SYSTEM\NETFO32.EXE
C:\WINDOWS\SYSTEM\MSMM.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\HPSYSDRV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\OPTIONS\CABS\LOGITECH\HP_FINDER.EXE
C:\WINDOWS\WT\WCMDMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SNDSRVC.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\APINJ32.EXE
C:\WINDOWS\SYSTEM\APINJ32.EXE
C:\WINDOWS\ATLGF32.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\D3IO.EXE
C:\WINDOWS\D3IO.EXE
C:\WINDOWS\CRLF32.EXE
C:\WINDOWS\SYSTEM\APINJ32.EXE
C:\WINDOWS\SDKRR32.EXE
C:\WINDOWS\IEIC32.EXE
C:\WINDOWS\TEMP\TD_0011.DIR\HIJACKTHIS.EXE
C:\WINDOWS\SYSTEM\CRET.EXE
C:\WINDOWS\SYSTEM\MFCPL32.EXE
C:\WINDOWS\ATLGF32.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\svjtn.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\svjtn.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\svjtn.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\svjtn.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\svjtn.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\svjtn.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\svjtn.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R3 - Default URLSearchHook is missing
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Class - {C6D822B4-F61B-D325-66CE-E72F8D1DC8F8} - C:\WINDOWS\SYSTEM\SYSCL32.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPLogiFinder] \WINDOWS\OPTIONS\CABS\LOGITECH\HP_FINDER.EXE
O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\wcmdmgrl.exe -launch
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE /Consumer
O4 - HKLM\..\Run: [CRET.EXE] C:\WINDOWS\SYSTEM\CRET.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [Keyboard Manager] C:\Program Files\Netropa\One-touch Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\RunServices: [ADDPV32.EXE] C:\WINDOWS\ADDPV32.EXE /s
O4 - HKLM\..\RunServices: [NETYV32.EXE] C:\WINDOWS\SYSTEM\NETYV32.EXE /s
O4 - HKLM\..\RunServices: [ATLGF32.EXE] C:\WINDOWS\ATLGF32.EXE /s
O4 - HKLM\..\RunServices: [D3UB.EXE] C:\WINDOWS\SYSTEM\D3UB.EXE /s
O4 - HKLM\..\RunServices: [APPZP.EXE] C:\WINDOWS\SYSTEM\APPZP.EXE /s
O4 - HKLM\..\RunServices: [APIOV32.EXE] C:\WINDOWS\SYSTEM\APIOV32.EXE /s
O4 - HKLM\..\RunServices: [JAVAHB32.EXE] C:\WINDOWS\SYSTEM\JAVAHB32.EXE /s
O4 - HKLM\..\RunServices: [NETFZ32.EXE] C:\WINDOWS\SYSTEM\NETFZ32.EXE /s
O4 - HKLM\..\RunServices: [MSJE32.EXE] C:\WINDOWS\MSJE32.EXE /s
O4 - HKLM\..\RunServices: [ADDGB32.EXE] C:\WINDOWS\ADDGB32.EXE /s
O4 - HKLM\..\RunServices: [D3BW.EXE] C:\WINDOWS\D3BW.EXE /s
O4 - HKLM\..\RunServices: [MSNN.EXE] C:\WINDOWS\MSNN.EXE /s
O4 - HKLM\..\RunServices: [JAVACE32.EXE] C:\WINDOWS\JAVACE32.EXE /s
O4 - HKLM\..\RunServices: [IPFA.EXE] C:\WINDOWS\IPFA.EXE /s
O4 - HKLM\..\RunServices: [MFCNZ32.EXE] C:\WINDOWS\SYSTEM\MFCNZ32.EXE /s
O4 - HKLM\..\RunServices: [MSZS32.EXE] C:\WINDOWS\MSZS32.EXE /s
O4 - HKLM\..\RunServices: [IPYS32.EXE] C:\WINDOWS\IPYS32.EXE /s
O4 - HKLM\..\RunServices: [NTTK32.EXE] C:\WINDOWS\NTTK32.EXE /s
O4 - HKLM\..\RunServices: [NTCO.EXE] C:\WINDOWS\SYSTEM\NTCO.EXE /s
O4 - HKLM\..\RunServices: [CRUU.EXE] C:\WINDOWS\CRUU.EXE /s
O4 - HKLM\..\RunServices: [D3DZ32.EXE] C:\WINDOWS\SYSTEM\D3DZ32.EXE /s
O4 - HKLM\..\RunServices: [CRUG32.EXE] C:\WINDOWS\SYSTEM\CRUG32.EXE /s
O4 - HKLM\..\RunServices: [MFCOK32.EXE] C:\WINDOWS\MFCOK32.EXE /s
O4 - HKLM\..\RunServices: [D3TL32.EXE] C:\WINDOWS\SYSTEM\D3TL32.EXE /s
O4 - HKLM\..\RunServices: [APPBI.EXE] C:\WINDOWS\APPBI.EXE /s
O4 - HKLM\..\RunServices: [IPUE32.EXE] C:\WINDOWS\SYSTEM\IPUE32.EXE /s
O4 - HKLM\..\RunServices: [CRXK.EXE] C:\WINDOWS\CRXK.EXE /s
O4 - HKLM\..\RunServices: [IEAI.EXE] C:\WINDOWS\IEAI.EXE /s
O4 - HKLM\..\RunServices: [SDKXF.EXE] C:\WINDOWS\SDKXF.EXE /s
O4 - HKLM\..\RunServices: [ATLFT32.EXE] C:\WINDOWS\SYSTEM\ATLFT32.EXE /s
O4 - HKLM\..\RunServices: [WINZN.EXE] C:\WINDOWS\WINZN.EXE /s
O4 - HKLM\..\RunServices: [APIMF.EXE] C:\WINDOWS\SYSTEM\APIMF.EXE /s
O4 - HKLM\..\RunServices: [NTLV32.EXE] C:\WINDOWS\SYSTEM\NTLV32.EXE /s
O4 - HKLM\..\RunServices: [MFCPL32.EXE] C:\WINDOWS\SYSTEM\MFCPL32.EXE /s
O4 - HKLM\..\RunServices: [MSSB32.EXE] C:\WINDOWS\MSSB32.EXE /s
O4 - HKLM\..\RunServices: [IEWW32.EXE] C:\WINDOWS\IEWW32.EXE /s
O4 - HKLM\..\RunServices: [JAVALX32.EXE] C:\WINDOWS\SYSTEM\JAVALX32.EXE /s
O4 - HKLM\..\RunServices: [D3HQ32.EXE] C:\WINDOWS\SYSTEM\D3HQ32.EXE /s
O4 - HKLM\..\RunServices: [CRNH32.EXE] C:\WINDOWS\SYSTEM\CRNH32.EXE /s
O4 - HKLM\..\RunServices: [IPKL32.EXE] C:\WINDOWS\SYSTEM\IPKL32.EXE /s
O4 - HKLM\..\RunServices: [SYSMV32.EXE] C:\WINDOWS\SYSMV32.EXE /s
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [NPFMonitor] C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [IPCJ32.EXE] C:\WINDOWS\SYSTEM\IPCJ32.EXE /s
O4 - HKLM\..\RunServices: [NETHW.EXE] C:\WINDOWS\NETHW.EXE /s
O4 - HKLM\..\RunServices: [SYSTN32.EXE] C:\WINDOWS\SYSTEM\SYSTN32.EXE /s
O4 - HKLM\..\RunServices: [MSEC32.EXE] C:\WINDOWS\MSEC32.EXE /s
O4 - HKLM\..\RunServices: [NETKP.EXE] C:\WINDOWS\NETKP.EXE /s
O4 - HKLM\..\RunServices: [SYSVC.EXE] C:\WINDOWS\SYSVC.EXE /s
O4 - HKLM\..\RunServices: [JAVADN.EXE] C:\WINDOWS\JAVADN.EXE /s
O4 - HKLM\..\RunServices: [APIHT.EXE] C:\WINDOWS\SYSTEM\APIHT.EXE /s
O4 - HKLM\..\RunServices: [NETTK.EXE] C:\WINDOWS\NETTK.EXE /s
O4 - HKLM\..\RunServices: [NETQD32.EXE] C:\WINDOWS\SYSTEM\NETQD32.EXE /s
O4 - HKLM\..\RunServices: [NTFB.EXE] C:\WINDOWS\NTFB.EXE /s
O4 - HKLM\..\RunServices: [JAVACF32.EXE] C:\WINDOWS\JAVACF32.EXE /s
O4 - HKLM\..\RunServices: [IEZD.EXE] C:\WINDOWS\IEZD.EXE /s
O4 - HKLM\..\RunServices: [NETXX32.EXE] C:\WINDOWS\NETXX32.EXE /s
O4 - HKLM\..\RunServices: [NETCK.EXE] C:\WINDOWS\NETCK.EXE /s
O4 - HKLM\..\RunServices: [ATLTO32.EXE] C:\WINDOWS\SYSTEM\ATLTO32.EXE /s
O4 - HKLM\..\RunServices: [MSWB32.EXE] C:\WINDOWS\SYSTEM\MSWB32.EXE /s
O4 - HKLM\..\RunServices: [D3HK32.EXE] C:\WINDOWS\SYSTEM\D3HK32.EXE /s
O4 - HKLM\..\RunServices: [JAVAOE.EXE] C:\WINDOWS\SYSTEM\JAVAOE.EXE /s
O4 - HKLM\..\RunServices: [APINJ32.EXE] C:\WINDOWS\SYSTEM\APINJ32.EXE /s
O4 - HKLM\..\RunServices: [APIEL.EXE] C:\WINDOWS\SYSTEM\APIEL.EXE /s
O4 - HKLM\..\RunServices: [ADDGE32.EXE] C:\WINDOWS\ADDGE32.EXE /s
O4 - HKLM\..\RunServices: [APIOX.EXE] C:\WINDOWS\APIOX.EXE /s
O4 - HKLM\..\RunServices: [IPZG32.EXE] C:\WINDOWS\IPZG32.EXE /s
O4 - HKLM\..\RunServices: [IPVP.EXE] C:\WINDOWS\SYSTEM\IPVP.EXE /s
O4 - HKLM\..\RunServices: [WINTY.EXE] C:\WINDOWS\SYSTEM\WINTY.EXE /s
O4 - HKLM\..\RunServices: [NETFO32.EXE] C:\WINDOWS\SYSTEM\NETFO32.EXE /s
O4 - HKLM\..\RunServices: [MSMM.EXE] C:\WINDOWS\SYSTEM\MSMM.EXE /s
O4 - HKLM\..\RunServices: [D3IO.EXE] C:\WINDOWS\D3IO.EXE /s
O4 - HKLM\..\RunServices: [CRLF32.EXE] C:\WINDOWS\CRLF32.EXE /s
O4 - HKLM\..\RunServices: [SDKRR32.EXE] C:\WINDOWS\SDKRR32.EXE /s
O4 - HKLM\..\RunServices: [IEIC32.EXE] C:\WINDOWS\IEIC32.EXE /s
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\RunServices: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - Startup: Northwestel Dial Up Accelerator.lnk = C:\Program Files\Northwestel Dial Up Accelerator\dialupaccel.exe
O12 - Plugin for .swf: C:\PROGRAM FILES\SYMPATICO\COMMUNICATOR\PROGRAM\PLUGINS\npswf32.dll
O16 - DPF: {869F3BBC-A812-4D13-A93B-7B3FC816DCD5} (McAfee.com Updater) - http://download.mcafee.com/molbin/clinic/v…can/mcasupd.cab
O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\sa.exe

Welcome to the forum.

Nice mess you have there.

Please move HJT into its own permanent folder so backups can be made.
example: C:\MyHJT\HJT.exe or C:\MyDocuments\MyHJT\HJT.exe


Please read through the instructions before you start (you may want to print this out).

Please download and install these programs - don't run them yet!!

Please download and unzip
AboutBuster to a folder. Inside the folder is a readme file that has instructions on the use of the program.
AboutBuster MUST be updated before you use it.
Start AboutBuster, click the update button, check for update, drag the box to the side and hit download updates, close the box . Don't run it yet.
AboutBuster Tutorial

Download CW-Shredder at the link below:
http://cwshredder.net/bin/CWShredder.exe

Show hidden files:
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading select Show hidden files and folders.
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.
Click Start, Programs and Accessories and open Windows Explorer.
Select a hard drive from the left hand side of the Windows Explorer window.
Select View the Entire contents of this drive.


Reboot into SafeMode. <—MAKE SURE YOU KNOW HOW TO DO THIS!!

+++++++++++++++++++++++++++++++++++++++++++++++++

Here's the fix:

1. Reboot into Safe Mode

2. Press Control-Alt-Del to enter the Task Manager.
Click on the Processes tab and end the following processes if listed:

ADDPV32.EXE
NETYV32.EXE
ATLGF32.EXE
D3UB.EXE
APPZP.EXE
APIOV32.EXE
CJAVAHB32.EXE
NETFZ32.EXE
MSJE32.EXE
ADDGB32.EXE
D3BW.EXE
MSNN.EXE
JAVACE32.EXE
IPFA.EXE
MFCNZ32.EXE
MSZS32.EXE
IPYS32.EXE
NTTK32.EXE
NTCO.EXE
CRUU.EXE
D3DZ32.EXE
CRUG32.EXE
MFCOK32.EXE
D3TL32.EXE
APPBI.EXE
IPUE32.EXE
CRXK.EXE
IEAI.EXE
SDKXF.EXE
ATLFT32.EXE
WINZN.EXE
APIMF.EXE
NTLV32.EXE
MFCPL32.EXE
MSSB32.EXE
IEWW32.EXE
JAVALX32.EXE
D3HQ32.EXE
CRNH32.EXE
IPKL32.EXE
SYSMV32.EXE
IPCJ32.EXE
NETHW.EXE
SYSTN32.EXE
MSEC32.EXE
NETKP.EXE
SYSVC.EXE
JAVADN.EXE
APIHT.EXE
NETTK.EXE
NETQD32.EXE
NTFB.EXE
JAVACF32.EXE
IEZD.EXE
NETXX32.EXE
NETCK.EXE
ATLTO32.EXE
MSWB32.EXE
D3HK32.EXE
JAVAOE.EXE
APINJ32.EXE
APIEL.EXE
ADDGE32.EXE
APIOX.EXE
IPZG32.EXE
IPVP.EXE
WINTY.EXE
NETFO32.EXE
MSMM.EXE
APINJ32.EXE
APINJ32.EXE
ATLGF32.EXE
D3IO.EXE
D3IO.EXE
CRLF32.EXE
APINJ32.EXE
SDKRR32.EXE
IEIC32.EXE
CRET.EXE
MFCPL32.EXE
ATLGF32.EXE

Exit the Task Manager when finished



3. CLOSE ALL WINDOWS AND BROWSERS Scan with Hijack This and put checks next to all the following, then click "Fix Checked"

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\svjtn.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\svjtn.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\svjtn.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\svjtn.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\svjtn.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\svjtn.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\svjtn.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {C6D822B4-F61B-D325-66CE-E72F8D1DC8F8} - C:\WINDOWS\SYSTEM\SYSCL32.DLL
O4 - HKLM\..\Run: [CRET.EXE] C:\WINDOWS\SYSTEM\CRET.EXE
O4 - HKLM\..\RunServices: [ADDPV32.EXE] C:\WINDOWS\ADDPV32.EXE /s
O4 - HKLM\..\RunServices: [NETYV32.EXE] C:\WINDOWS\SYSTEM\NETYV32.EXE /s
O4 - HKLM\..\RunServices: [ATLGF32.EXE] C:\WINDOWS\ATLGF32.EXE /s
O4 - HKLM\..\RunServices: [D3UB.EXE] C:\WINDOWS\SYSTEM\D3UB.EXE /s
O4 - HKLM\..\RunServices: [APPZP.EXE] C:\WINDOWS\SYSTEM\APPZP.EXE /s
O4 - HKLM\..\RunServices: [APIOV32.EXE] C:\WINDOWS\SYSTEM\APIOV32.EXE /s
O4 - HKLM\..\RunServices: [JAVAHB32.EXE] C:\WINDOWS\SYSTEM\JAVAHB32.EXE /s
O4 - HKLM\..\RunServices: [NETFZ32.EXE] C:\WINDOWS\SYSTEM\NETFZ32.EXE /s
O4 - HKLM\..\RunServices: [MSJE32.EXE] C:\WINDOWS\MSJE32.EXE /s
O4 - HKLM\..\RunServices: [ADDGB32.EXE] C:\WINDOWS\ADDGB32.EXE /s
O4 - HKLM\..\RunServices: [D3BW.EXE] C:\WINDOWS\D3BW.EXE /s
O4 - HKLM\..\RunServices: [MSNN.EXE] C:\WINDOWS\MSNN.EXE /s
O4 - HKLM\..\RunServices: [JAVACE32.EXE] C:\WINDOWS\JAVACE32.EXE /s
O4 - HKLM\..\RunServices: [IPFA.EXE] C:\WINDOWS\IPFA.EXE /s
O4 - HKLM\..\RunServices: [MFCNZ32.EXE] C:\WINDOWS\SYSTEM\MFCNZ32.EXE /s
O4 - HKLM\..\RunServices: [MSZS32.EXE] C:\WINDOWS\MSZS32.EXE /s
O4 - HKLM\..\RunServices: [IPYS32.EXE] C:\WINDOWS\IPYS32.EXE /s
O4 - HKLM\..\RunServices: [NTTK32.EXE] C:\WINDOWS\NTTK32.EXE /s
O4 - HKLM\..\RunServices: [NTCO.EXE] C:\WINDOWS\SYSTEM\NTCO.EXE /s
O4 - HKLM\..\RunServices: [CRUU.EXE] C:\WINDOWS\CRUU.EXE /s
O4 - HKLM\..\RunServices: [D3DZ32.EXE] C:\WINDOWS\SYSTEM\D3DZ32.EXE /s
O4 - HKLM\..\RunServices: [CRUG32.EXE] C:\WINDOWS\SYSTEM\CRUG32.EXE /s
O4 - HKLM\..\RunServices: [MFCOK32.EXE] C:\WINDOWS\MFCOK32.EXE /s
O4 - HKLM\..\RunServices: [D3TL32.EXE] C:\WINDOWS\SYSTEM\D3TL32.EXE /s
O4 - HKLM\..\RunServices: [APPBI.EXE] C:\WINDOWS\APPBI.EXE /s
O4 - HKLM\..\RunServices: [IPUE32.EXE] C:\WINDOWS\SYSTEM\IPUE32.EXE /s
O4 - HKLM\..\RunServices: [CRXK.EXE] C:\WINDOWS\CRXK.EXE /s
O4 - HKLM\..\RunServices: [IEAI.EXE] C:\WINDOWS\IEAI.EXE /s
O4 - HKLM\..\RunServices: [SDKXF.EXE] C:\WINDOWS\SDKXF.EXE /s
O4 - HKLM\..\RunServices: [ATLFT32.EXE] C:\WINDOWS\SYSTEM\ATLFT32.EXE /s
O4 - HKLM\..\RunServices: [WINZN.EXE] C:\WINDOWS\WINZN.EXE /s
O4 - HKLM\..\RunServices: [APIMF.EXE] C:\WINDOWS\SYSTEM\APIMF.EXE /s
O4 - HKLM\..\RunServices: [NTLV32.EXE] C:\WINDOWS\SYSTEM\NTLV32.EXE /s
O4 - HKLM\..\RunServices: [MFCPL32.EXE] C:\WINDOWS\SYSTEM\MFCPL32.EXE /s
O4 - HKLM\..\RunServices: [MSSB32.EXE] C:\WINDOWS\MSSB32.EXE /s
O4 - HKLM\..\RunServices: [IEWW32.EXE] C:\WINDOWS\IEWW32.EXE /s
O4 - HKLM\..\RunServices: [JAVALX32.EXE] C:\WINDOWS\SYSTEM\JAVALX32.EXE /s
O4 - HKLM\..\RunServices: [D3HQ32.EXE] C:\WINDOWS\SYSTEM\D3HQ32.EXE /s
O4 - HKLM\..\RunServices: [CRNH32.EXE] C:\WINDOWS\SYSTEM\CRNH32.EXE /s
O4 - HKLM\..\RunServices: [IPKL32.EXE] C:\WINDOWS\SYSTEM\IPKL32.EXE /s
O4 - HKLM\..\RunServices: [SYSMV32.EXE] C:\WINDOWS\SYSMV32.EXE /s
O4 - HKLM\..\RunServices: [IPCJ32.EXE] C:\WINDOWS\SYSTEM\IPCJ32.EXE /s
O4 - HKLM\..\RunServices: [NETHW.EXE] C:\WINDOWS\NETHW.EXE /s
O4 - HKLM\..\RunServices: [SYSTN32.EXE] C:\WINDOWS\SYSTEM\SYSTN32.EXE /s
O4 - HKLM\..\RunServices: [MSEC32.EXE] C:\WINDOWS\MSEC32.EXE /s
O4 - HKLM\..\RunServices: [NETKP.EXE] C:\WINDOWS\NETKP.EXE /s
O4 - HKLM\..\RunServices: [SYSVC.EXE] C:\WINDOWS\SYSVC.EXE /s
O4 - HKLM\..\RunServices: [JAVADN.EXE] C:\WINDOWS\JAVADN.EXE /s
O4 - HKLM\..\RunServices: [APIHT.EXE] C:\WINDOWS\SYSTEM\APIHT.EXE /s
O4 - HKLM\..\RunServices: [NETTK.EXE] C:\WINDOWS\NETTK.EXE /s
O4 - HKLM\..\RunServices: [NETQD32.EXE] C:\WINDOWS\SYSTEM\NETQD32.EXE /s
O4 - HKLM\..\RunServices: [NTFB.EXE] C:\WINDOWS\NTFB.EXE /s
O4 - HKLM\..\RunServices: [JAVACF32.EXE] C:\WINDOWS\JAVACF32.EXE /s
O4 - HKLM\..\RunServices: [IEZD.EXE] C:\WINDOWS\IEZD.EXE /s
O4 - HKLM\..\RunServices: [NETXX32.EXE] C:\WINDOWS\NETXX32.EXE /s
O4 - HKLM\..\RunServices: [NETCK.EXE] C:\WINDOWS\NETCK.EXE /s
O4 - HKLM\..\RunServices: [ATLTO32.EXE] C:\WINDOWS\SYSTEM\ATLTO32.EXE /s
O4 - HKLM\..\RunServices: [MSWB32.EXE] C:\WINDOWS\SYSTEM\MSWB32.EXE /s
O4 - HKLM\..\RunServices: [D3HK32.EXE] C:\WINDOWS\SYSTEM\D3HK32.EXE /s
O4 - HKLM\..\RunServices: [JAVAOE.EXE] C:\WINDOWS\SYSTEM\JAVAOE.EXE /s
O4 - HKLM\..\RunServices: [APINJ32.EXE] C:\WINDOWS\SYSTEM\APINJ32.EXE /s
O4 - HKLM\..\RunServices: [APIEL.EXE] C:\WINDOWS\SYSTEM\APIEL.EXE /s
O4 - HKLM\..\RunServices: [ADDGE32.EXE] C:\WINDOWS\ADDGE32.EXE /s
O4 - HKLM\..\RunServices: [APIOX.EXE] C:\WINDOWS\APIOX.EXE /s
O4 - HKLM\..\RunServices: [IPZG32.EXE] C:\WINDOWS\IPZG32.EXE /s
O4 - HKLM\..\RunServices: [IPVP.EXE] C:\WINDOWS\SYSTEM\IPVP.EXE /s
O4 - HKLM\..\RunServices: [WINTY.EXE] C:\WINDOWS\SYSTEM\WINTY.EXE /s
O4 - HKLM\..\RunServices: [NETFO32.EXE] C:\WINDOWS\SYSTEM\NETFO32.EXE /s
O4 - HKLM\..\RunServices: [MSMM.EXE] C:\WINDOWS\SYSTEM\MSMM.EXE /s
O4 - HKLM\..\RunServices: [D3IO.EXE] C:\WINDOWS\D3IO.EXE /s
O4 - HKLM\..\RunServices: [CRLF32.EXE] C:\WINDOWS\CRLF32.EXE /s
O4 - HKLM\..\RunServices: [SDKRR32.EXE] C:\WINDOWS\SDKRR32.EXE /s
O4 - HKLM\..\RunServices: [IEIC32.EXE] C:\WINDOWS\IEIC32.EXE /s
O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\sa.exe

Click on Fix Checked and exit HijackThis.


4. Delete the following files if present:

C:\WINDOWS\SYSTEM\SYSCL32.DLL <—typical
C:\WINDOWS\SYSTEM\CRET.EXE
C:\WINDOWS\ADDPV32.EXE
C:\WINDOWS\SYSTEM\NETYV32.EXE
C:\WINDOWS\ATLGF32.EXE /s
C:\WINDOWS\SYSTEM\D3UB.EXE /s
C:\WINDOWS\SYSTEM\APPZP.EXE /s
C:\WINDOWS\SYSTEM\APIOV32.EXE /s
C:\WINDOWS\SYSTEM\JAVAHB32.EXE /s
C:\WINDOWS\SYSTEM\NETFZ32.EXE /s
C:\WINDOWS\MSJE32.EXE /s
C:\WINDOWS\ADDGB32.EXE /s
C:\WINDOWS\D3BW.EXE /s
C:\WINDOWS\MSNN.EXE /s
C:\WINDOWS\JAVACE32.EXE /s
C:\WINDOWS\IPFA.EXE /s
C:\WINDOWS\SYSTEM\MFCNZ32.EXE /s
C:\WINDOWS\MSZS32.EXE /s
C:\WINDOWS\IPYS32.EXE /s
C:\WINDOWS\NTTK32.EXE /s
C:\WINDOWS\SYSTEM\NTCO.EXE /s
C:\WINDOWS\CRUU.EXE /s
C:\WINDOWS\svjtn.dll
C:\WINDOWS\SYSTEM\D3DZ32.EXE /s
C:\WINDOWS\SYSTEM\CRUG32.EXE /s
C:\WINDOWS\MFCOK32.EXE /s
C:\WINDOWS\SYSTEM\D3TL32.EXE /s
C:\WINDOWS\APPBI.EXE /s
C:\WINDOWS\SYSTEM\IPUE32.EXE /s
C:\WINDOWS\CRXK.EXE /s
C:\WINDOWS\IEAI.EXE /s
C:\WINDOWS\SDKXF.EXE /s
C:\WINDOWS\SYSTEM\ATLFT32.EXE /s
C:\WINDOWS\WINZN.EXE /s
C:\WINDOWS\SYSTEM\APIMF.EXE /s
C:\WINDOWS\SYSTEM\NTLV32.EXE /s
C:\WINDOWS\SYSTEM\MFCPL32.EXE /s
C:\WINDOWS\MSSB32.EXE /s
C:\WINDOWS\IEWW32.EXE /s
C:\WINDOWS\SYSTEM\JAVALX32.EXE /s
C:\WINDOWS\SYSTEM\D3HQ32.EXE /s
C:\WINDOWS\SYSTEM\CRNH32.EXE /s
C:\WINDOWS\SYSTEM\IPKL32.EXE /s
C:\WINDOWS\SYSMV32.EXE /s
C:\WINDOWS\SYSTEM\IPCJ32.EXE /s
C:\WINDOWS\NETHW.EXE /s
C:\WINDOWS\SYSTEM\SYSTN32.EXE /s
C:\WINDOWS\MSEC32.EXE /s
C:\WINDOWS\NETKP.EXE /s
C:\WINDOWS\SYSVC.EXE /s
C:\WINDOWS\JAVADN.EXE /s
C:\WINDOWS\SYSTEM\APIHT.EXE /s
C:\WINDOWS\NETTK.EXE /s
C:\WINDOWS\SYSTEM\NETQD32.EXE /s
C:\WINDOWS\NTFB.EXE /s
C:\WINDOWS\JAVACF32.EXE /s
C:\WINDOWS\IEZD.EXE /s
C:\WINDOWS\NETXX32.EXE /s
C:\WINDOWS\NETCK.EXE /s
C:\WINDOWS\SYSTEM\ATLTO32.EXE /s
C:\WINDOWS\SYSTEM\MSWB32.EXE /s
C:\WINDOWS\SYSTEM\D3HK32.EXE /s
C:\WINDOWS\SYSTEM\JAVAOE.EXE /s
C:\WINDOWS\SYSTEM\APINJ32.EXE /s
C:\WINDOWS\SYSTEM\APIEL.EXE /s
C:\WINDOWS\ADDGE32.EXE /s
C:\WINDOWS\APIOX.EXE /s
OC:\WINDOWS\IPZG32.EXE /s
C:\WINDOWS\SYSTEM\IPVP.EXE /s
C:\WINDOWS\SYSTEM\WINTY.EXE /s
C:\WINDOWS\SYSTEM\NETFO32.EXE /s
C:\WINDOWS\SYSTEM\MSMM.EXE /s
C:\WINDOWS\D3IO.EXE /s
C:\WINDOWS\CRLF32.EXE /s
C:\WINDOWS\SDKRR32.EXE /s
C:\WINDOWS\IEIC32.EXE /s
C:\Program Files\Internet Explorer\sa.exe


(and any other files with the same name that end in .dll, .exe or .dat, you may find them right next to each other, example - appsw.exe, appsw.dll, appsw.dat)
If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. if it is uncheck it and try again.


5. Run AboutBuster . This will scan your computer for the bad files and delete them. It will ask to scan the system again, let it. Save the report (copy and paste into notepad or wordpad and save as a .txt file) and post a copy back here when you are done with all the steps.

6. Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure these 3 are checked and then press *ok* to remove:

Temporary Files
Temporary Internet Files
Recycle Bin


7. Run CW-Shredder - Hit the FIX button - let it run and fix what it finds.

8. Reboot into normal mode.

9. Download and run this online virus scan:<—Important
http://housecall.trendmicro.com/housecall/start_corp.asp
Make sure you check "AutoClean"

10. Reboot and post a fresh HJT log back here by using the add reply button below, and lets see how we did, MrC