redraptor, Hijackthis, Hun

folks,

I'm new to this forum so please bear with me as I learn the protocol of proper posting. Additionally, I am brand spankin' new to the internet with respect to spyware, hijackers, spammers, viruses, etc. Suffice it to say I am goin' nuts because the Hun has reared his ugly head on my system and I cannot even begin to kill it. I need help!!!! I read some initial notes of help TonyKlein provided to swannycan in forum "Another Hun Bites the Dust".
1. I downloaded the registry search tool and found 81 instances of "TheHun"!!!!!

2. I then created the remove.reg with the following text in it:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"YAHOOSubst"=-

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"YAHOOSubst"=-


3. This seemed to whittle it down to 41 instances.

4. I NEED HELP!!!! Need someone to look at my hijackthis log (attached below) and the register search tool log showing the 41 instances "thehun" (also attached below) and show me how to get rid of the hacker stuff that has bogged down my computer!!! Thanks in advance for the help!!



HIJACKTHIS LOG FILE:
Logfile of HijackThis v1.97.3
Scan saved at 9:05:28 PM, on 11/5/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\hpoipm07.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp3\winampa.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet Series 600\Bin\HPOstr05.exe
C:\QUICKENW\QWDLLS.EXE
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet Series 600\bin\HPOVDX05.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\System32\WScript.exe
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchdot.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.searchdot.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.searchdot.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchdot.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchdot.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchdot.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchdot.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchdot.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchdot.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchdot.net
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchv.com/1/search.php?qq=%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.dellnet.com/
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5_1_5_0.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5_1_5_0.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Billminder.lnk = C:\QUICKENW\BILLMIND.EXE
O4 - Global Startup: HP OfficeJet Startup.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet Series 600\Bin\HPOstr05.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: QuickBooks Delivery Agent.lnk = C:\Program Files\Intuit\QuickBooks\Components\QBAgent\QBDAgent.exe
O4 - Global Startup: Quicken Startup.lnk = C:\QUICKENW\QWDLLS.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: MoneySide (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…72/mcinsctl.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://us.games2.yimg.com/download.games.y…ctl_0_0_0_1.ocx
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CAB
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/…/ymmapi_416.dll
O16 - DPF: {A7798D6C-C6B5-4F26-9363-F7CDBBFFA607} (download Class) - http://www.gigex.com/ActiveX/vxpspeeddelivery.dll
O16 - DPF: {AECD14A8-F662-11D1-A395-00805F535788} (Plotwon Control) - http://www.investors.com/member/ocx/plotwon.ocx
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://bin.mcafee.com/molbin/shared/mcgdmg…,15/mcgdmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://officeupdate.microsoft.com/Template…nloads/outc.cab



REGISTER SEARCH TOOL LISTING OF THE 41 INSTANCES WHERE "THEHUN" WAS FOUND:
REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "thehun" 11/5/2003 9:23:04 PM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\GCH\GBL]
"1067920180.0"="thehun.net12029"

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
"YAHOOSubst"="a|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
b|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
c|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
d|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
e|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
f|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
g|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
h|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
i|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
j|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
k|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
l|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
m|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
n|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
o|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
p|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
q|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
r|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
s|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
t|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
u|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
v|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
w|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
x|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
y|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
z|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
1|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
2|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
3|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
4|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
5|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
6|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
7|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
8|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
9|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
0|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\thehun.net]

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\thehun.net\www]

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\thehun.net]

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\thehun.net\www]

BULLDOG:

HERE IS THE HIJACKTHIS LOG:

Logfile of HijackThis v1.97.3
Scan saved at 5:51:42 PM, on 11/7/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp3\winampa.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet Series 600\Bin\HPOstr05.exe
C:\QUICKENW\QWDLLS.EXE
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet Series 600\bin\HPOVDX05.EXE
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\System32\hpoipm07.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchdot.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.searchdot.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.searchdot.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchdot.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchdot.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchdot.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchdot.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchdot.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchdot.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchdot.net
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchv.com/1/search.php?qq=%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.dellnet.com/
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5_1_5_0.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5_1_5_0.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Billminder.lnk = C:\QUICKENW\BILLMIND.EXE
O4 - Global Startup: HP OfficeJet Startup.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet Series 600\Bin\HPOstr05.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: QuickBooks Delivery Agent.lnk = C:\Program Files\Intuit\QuickBooks\Components\QBAgent\QBDAgent.exe
O4 - Global Startup: Quicken Startup.lnk = C:\QUICKENW\QWDLLS.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: MoneySide (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…72/mcinsctl.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://us.games2.yimg.com/download.games.y…ctl_0_0_0_1.ocx
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CAB
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/…/ymmapi_416.dll
O16 - DPF: {A7798D6C-C6B5-4F26-9363-F7CDBBFFA607} (download Class) - http://www.gigex.com/ActiveX/vxpspeeddelivery.dll
O16 - DPF: {AECD14A8-F662-11D1-A395-00805F535788} (Plotwon Control) - http://www.investors.com/member/ocx/plotwon.ocx
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://bin.mcafee.com/molbin/shared/mcgdmg…,15/mcgdmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://officeupdate.microsoft.com/Template…nloads/outc.cab


HERE IS THE IE.TXT FILE AFTER RUNNING THE REGEDIT COMMAND ABOVE:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.EXE NvQTwk,NvCplDaemon initialize"
"BCMSMMSG"="BCMSMMSG.exe"
"diagent"="\"C:\\Program Files\\Creative\\SBLive\\Diagnostics\\diagent.exe\" startup"
"UpdReg"="C:\\WINDOWS\\UpdReg.EXE"
"DVDSentry"="C:\\WINDOWS\\System32\\DSentry.exe"
"MoneyStartUp10.0"="\"C:\\Program Files\\Microsoft Money\\System\\Activation.exe\""
"RealTray"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER"
"MMTray"="C:\\Program Files\\MUSICMATCH\\MUSICMATCH Jukebox\\mm_tray.exe"
"MCAgentExe"="c:\\PROGRA~1\\mcafee.com\\agent\\mcagent.exe files\\mcafee.com\\agent\\mcagent.exe"
"MCUpdateExe"="C:\\PROGRA~1\\mcafee.com\\agent\\McUpdate.exe"
"AdaptecDirectCD"="\"C:\\Program Files\\Roxio\\Easy CD Creator 5\\DirectCD\\DirectCD.exe\""
"VirusScan Online"="\"c:\\PROGRA~1\\mcafee.com\\vso\\mcvsshld.exe\""
"DwlClient"="C:\\Program Files\\Common Files\\Dell\\EUSW\\Support.exe"
"CamMonitor"="C:\\Program Files\\Hewlett-Packard\\Digital Imaging\\Unload\\hpqcmon.exe"
"Share-to-Web Namespace Daemon"="C:\\Program Files\\Hewlett-Packard\\HP Share-to-Web\\hpgs2wnd.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"WinampAgent"="\"C:\\Program Files\\Winamp3\\winampa.exe\""
"sr1exe"="\"C:\\Documents and Settings\\All Users\\Application Data\\Dell\\Alert\\252\\updtSup3.exe\" "
"lar"="C:\\WINDOWS\\System32\\llass.exe"
"MPFExe"="C:\\PROGRA~1\\McAfee.com\\PERSON~1\\MpfTray.exe"
"VSOCheckTask"="\"c:\\PROGRA~1\\mcafee.com\\vso\\mcmnhdlr.exe\" /checktask"
"CMESys"="\"C:\\Program Files\\Common Files\\CMEII\\CMESys.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

CNM, NOT SURE HOW TO DO "GOTO REGIT AND PLACE CURSOR ON HOME, ETC" NEED MORE EXPLANATION HERE. I.E. I COULD NOT FIND "HOME" LAST, THANKS FOR ALL YOUR PATIENCE GUYS!!!

Go to Start > Run > type regedit enter
Navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Right click it and select export. Save as RunKeyBak.reg and save it somewhere you will remember it.
Now find these in the right hand pane , right click and delete them:
"lar"="C:\WINDOWS\System32\llass.exe"
and
"CMESys"="\"C:\\Program Files\\Common Files\\CMEII\\CMESys.exe\""

Now please use the left arrow key on your keyboard to collapse all these open folders. Keep hitting it until you are back to just the My Computer and the five HKEY folders.
Click on My Computer > right click > export. Then as cnm suggests Name it backupbad or something like that. In case of finger slippage, double-clicking backupbad.reg will merge it all back into your registry. If everything goes well here we will be deleting both these exported files later. (RunKeyBak.reg and backupbad.reg )

Now navigate to :
HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\GCH\GBL
find
1067920180.0"="thehun.net12029
in the right hand pane and right click > delete.

Do the same for each of these (navigate to the HKEY and find the value in the right hand pane > delete.

{one more example } for this one:
[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
"YAHOOSubst"="a|http://www.thehun.net|http://www.worldsex.com/

navigate to…HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main
find in right hand pane and delete this entry:
"YAHOOSubst"="a|http://www.thehun.net|http://www.worldsex.com/


Carry on with the rest..

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\GCH\GBL]
"1067920180.0"="thehun.net12029"

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
"YAHOOSubst"="a|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
b|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
c|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
d|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
e|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
f|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
g|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
h|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
i|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
j|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
k|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
l|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
m|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
n|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
o|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
p|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
q|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
r|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
s|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
t|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
u|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
v|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
w|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
x|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
y|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
z|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
1|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
2|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
3|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
4|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
5|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
6|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
7|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
8|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
9|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Internet Explorer\Main]
0|http://www.thehun.net|http://www.worldsex.com/

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\thehun.net]

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\thehun.net\www]

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\thehun.net]

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\thehun.net\www]

Then..
Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchdot.net

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.searchdot.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.searchdot.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchdot.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchdot.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchdot.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchdot.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchdot.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchdot.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchdot.net
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchv.com/1/search.php?qq=%s

Reboot.

- Right-click the Start button, and choose 'Open'.
- Select the Tools menu and click Folder Options.
- Select the View Tab.
- Under the Hidden files and folders heading select "Show hidden files and folders".
- UNcheck the "Hide protected operating system files (recommended)" option.
- UNcheck "Hide file extensions for known file types"
- Click Yes to confirm.
- Click OK.
Now click on the search button at the top of this window.
type or copy / paste
llass.exe (make sure it is double L)
into the file name box.
Then select *browse* at the look in box and navigate to :
C:\WINDOWS\System32\
Then click *more advanced options* and put a check in the first three boxes.
Click search.
If found.. delete it. This may sound silly after all this work, but I doubt you will find this file. I think your AntiVirus program nabbed it already. But we need to be certain.

Then
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
Restart the computer.
Go back to the System Restore tab and UN-Check that same box. This will have cleared all your restore points and any nasties saved there.

Download Ad-Aware at http://lavasoft.element5.com/support/download/
After installing AAW, and before running the program, update by using the Globe icon.
Shut down and restart Ad-Aware.
Now press "Scan Now", "Select drives\folders to scan" and select the active partition (usually C: ), then 'next', and let Ad-Aware scan your drives.
It will find a number of "bad" files and registry keys. Click 'Next' again.
Rightclick in that pane and choose "select all" and click 'next'.
It will ask you whether you'd like to remove all checked items. Click OK.
Finally, close Ad-Aware, and reboot.

Post a new HJT log when done.

BULLDOG, AND OTHERS, THANKS VERRRRY MUCH FOR THE ASSIST!!!!! HAVE A QUESTION, WHILE I WAS FIXING MY COMPUTER, I RAN ACROSS THE FOLLOWING SETS OF TEXT:

1. date-manager.com (not sure, but I think this is a part of the gator package)
2. gator.com (I was on another sight and they said this web page was bad)
3. sextracker.com (this just sounds bad)

I am attaching the following files:

1. hijackthis log file
2. register search log for "date-manager"
3. register search log for "gator.com"
4. register search log for "sextracker.com"

Again, thanks for the help!!


1. hijackthis log file

Logfile of HijackThis v1.97.3
Scan saved at 12:05:12 AM, on 11/8/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp3\winampa.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet Series 600\Bin\HPOstr05.exe
C:\QUICKENW\QWDLLS.EXE
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\Hewlett-Packard\HP OfficeJet Series 600\bin\HPOVDX05.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\System32\hpoipm07.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.dellnet.com/
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5_1_5_0.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5_1_5_0.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Billminder.lnk = C:\QUICKENW\BILLMIND.EXE
O4 - Global Startup: HP OfficeJet Startup.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet Series 600\Bin\HPOstr05.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: QuickBooks Delivery Agent.lnk = C:\Program Files\Intuit\QuickBooks\Components\QBAgent\QBDAgent.exe
O4 - Global Startup: Quicken Startup.lnk = C:\QUICKENW\QWDLLS.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: MoneySide (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…72/mcinsctl.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://us.games2.yimg.com/download.games.y…ctl_0_0_0_1.ocx
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CAB
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/…/ymmapi_416.dll
O16 - DPF: {A7798D6C-C6B5-4F26-9363-F7CDBBFFA607} (download Class) - http://www.gigex.com/ActiveX/vxpspeeddelivery.dll
O16 - DPF: {AECD14A8-F662-11D1-A395-00805F535788} (Plotwon Control) - http://www.investors.com/member/ocx/plotwon.ocx
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://bin.mcafee.com/molbin/shared/mcgdmg…,15/mcgdmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://officeupdate.microsoft.com/Template…nloads/outc.cab


2. register search log for "date-manager"
REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "date-manager" 11/8/2003 12:25:38 AM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\date-manager.com]

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\date-manager.com\www]




3. register search log for "gator.com"
REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "gator.com" 11/8/2003 12:24:45 AM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\AppInfo]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\AppInfo\CME]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\AppInfo\GMT]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\cmeII]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\AutoUpdate]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\EventLog]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\EventLog\Msgs]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\GCH]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\GCH\BD]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\GCH\EL]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\GCH\GBL]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\GCH\_bannerserver]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\GCH\_gatorcme]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\GCH\_gi]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\GCH\_regserver]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\GCH\_rs]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\GCH\_ss]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\GUS]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\GUS\HOL]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\ScriptLoader]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn\Settings]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\stat]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\stat\GMT]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\stat\GMT\Banners]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\stat\GMT\Settings]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\stat\GMT\Sites]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\stat\Users]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\stat\Users\User1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\GInternet]

[HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\GInternet\Proxy]

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\gator.com]

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\gator.com\www]




4. register search log for "sextracker.com"

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "sextracker" 11/8/2003 12:14:20 AM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\sextracker.com]

[HKEY_USERS\S-1-5-21-1524339655-1577346586-2851149738-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\sextracker.com\www]