Please help!

I would be most Grateful for any comments on this log.

Logfile of HijackThis v1.99.1
Scan saved at 10:42:57, on 2006-7-11
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\VIPTray.exe
C:\Program Files\rygh\vc\smss.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\FixCamera.exe
C:\WINDOWS\vsnpstd.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CaiShow Tech\CaiShow\UpdateManager.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Tencent\QQ\QQ.exe
C:\Program Files\Tencent\QQ\TIMPlatform.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SLU785EN\HijackThis[1].exe

R3 - URLSearchHook: (no name) - {14D0AD72-FD43-4C6D-9ED2-F93C3E8C6771} - C:\WINDOWS\system32\Mdczk.dll (file missing)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: (no name) - {96AFC1D1-8B21-4539-9D9C-11BA2C08C437} - C:\WINDOWS\system32\Jmrknr.dll (file missing)
R3 - URLSearchHook: (no name) - {7D874858-8000-44DC-8F01-C21C4C1A275F} - C:\WINDOWS\system32\Rqtci.dll (file missing)
R3 - URLSearchHook: (no name) - {9CAE4441-BA5E-4902-9334-80155E01BA04} - C:\WINDOWS\system32\Uktp.dll (file missing)
R3 - URLSearchHook: (no name) - {9FDA51BE-1D6B-47C4-8D31-523108D8FFEC} - C:\WINDOWS\system32\Gyaj.dll (file missing)
R3 - URLSearchHook: (no name) - {6B8FDE83-D518-48D5-B27F-08202A22168A} - C:\WINDOWS\system32\Ctvqj.dll (file missing)
R3 - URLSearchHook: (no name) - {72B60FB4-0C20-4B4B-B6F2-6ED8DBD3DB1B} - C:\WINDOWS\system32\Bbty.dll (file missing)
R3 - URLSearchHook: (no name) - {031D599D-B905-498A-A138-9DC3FB7F25E7} - C:\WINDOWS\system32\Kvhteo.dll (file missing)
R3 - URLSearchHook: (no name) - {48C28285-6304-4FC6-9D05-B34B2284041F} - C:\WINDOWS\system32\Mnkox.dll (file missing)
R3 - URLSearchHook: (no name) - {FC271D8A-7A05-43CA-BDF6-004B9A1663DA} - C:\WINDOWS\system32\Yhuu.dll (file missing)
R3 - URLSearchHook: (no name) - {390426FF-D4A9-417C-A5A5-1CF847177EA1} - C:\WINDOWS\system32\Aqirkl.dll (file missing)
R3 - URLSearchHook: (no name) - {B30CFD4A-5B4E-405C-9832-A6317CA7499E} - C:\WINDOWS\system32\Wwxko.dll (file missing)
R3 - URLSearchHook: (no name) - {10B47747-3E64-419B-96E1-0918725C613C} - C:\WINDOWS\system32\Lnltf.dll (file missing)
R3 - URLSearchHook: (no name) - {7B1D2734-D013-4366-ADD9-C26150EE5BBB} - C:\WINDOWS\system32\Info.dll (file missing)
R3 - URLSearchHook: (no name) - {65B32EAA-A316-47AA-9FD4-76EBB12E8323} - C:\WINDOWS\system32\Yulfgp.dll (file missing)
R3 - URLSearchHook: (no name) - {975E27CD-85E4-44E2-B538-8624D809EA1B} - C:\WINDOWS\system32\Eqjoep.dll (file missing)
R3 - URLSearchHook: (no name) - {F25E16FD-D4A5-4A0B-9600-BA66359342C8} - C:\WINDOWS\system32\Fogeai.dll (file missing)
R3 - URLSearchHook: (no name) - {951D54BB-7CE4-4398-98EF-4FDBFCE53001} - C:\WINDOWS\system32\Uzyf.dll (file missing)
R3 - URLSearchHook: (no name) - {784C4719-8C4E-4828-BF00-70AEF71DAA02} - C:\WINDOWS\system32\Qtnmg.dll (file missing)
R3 - URLSearchHook: (no name) - {B246589E-14B7-44AE-9687-8012DCE49DC0} - C:\WINDOWS\system32\Tktui.dll (file missing)
R3 - URLSearchHook: (no name) - {DD6C3489-D9C3-4122-8DF7-BD9B70AEF769} - C:\WINDOWS\system32\Amow.dll (file missing)
R3 - URLSearchHook: (no name) - {E8A1E731-AC7E-42CB-BE99-596A3523DB19} - C:\WINDOWS\system32\Xxhemq.dll (file missing)
R3 - URLSearchHook: (no name) - {17763376-D482-4282-AB4D-C717EDF93A06} - C:\WINDOWS\system32\Bxlqtf.dll (file missing)
R3 - URLSearchHook: (no name) - {190032B8-1D68-4351-BEE1-7E3490C50C41} - C:\WINDOWS\system32\Qrqhg.dll (file missing)
R3 - URLSearchHook: (no name) - {CE22958E-02C7-4680-9D62-973CD3F19D56} - C:\WINDOWS\system32\Adghpz.dll (file missing)
R3 - URLSearchHook: (no name) - {07B114E4-4987-420C-9348-0D87ABB6F481} - C:\WINDOWS\system32\Kwxxk.dll (file missing)
R3 - URLSearchHook: (no name) - {F8FCE4D6-3993-4AC0-AB83-705E780337A0} - C:\WINDOWS\system32\Mqbmzx.dll (file missing)
R3 - URLSearchHook: (no name) - {283E681A-6D4A-45FC-A790-5EDC80265109} - C:\WINDOWS\system32\Wburd.dll (file missing)
R3 - URLSearchHook: (no name) - {87298BA0-57A5-4C5B-AD7F-B79A19A71E98} - C:\WINDOWS\system32\Fhpk.dll (file missing)
R3 - URLSearchHook: (no name) - {66906144-00C1-441A-803D-A0F03822DC88} - C:\WINDOWS\system32\Lgce.dll (file missing)
R3 - URLSearchHook: (no name) - {C1DE3D5A-8A14-4E3F-B2AC-DF60AA808C6B} - C:\WINDOWS\system32\Kjfot.dll (file missing)
R3 - URLSearchHook: (no name) - {C8DF8C70-4CB3-4732-A995-62FD0871C1A9} - C:\WINDOWS\system32\Agjeu.dll (file missing)
R3 - URLSearchHook: (no name) - {E1B49877-1ECD-4AA8-AF15-90E3F43092B7} - C:\WINDOWS\system32\Ylabix.dll (file missing)
R3 - URLSearchHook: (no name) - {EFE8E9BB-FFC4-42C6-98AD-248C0FBEFAB5} - C:\WINDOWS\system32\Ykofo.dll (file missing)
R3 - URLSearchHook: (no name) - {554389B7-771A-464B-B0F3-6DE5DC539834} - C:\WINDOWS\system32\Agknn.dll (file missing)
R3 - URLSearchHook: (no name) - {602BCE06-D44F-4461-ABCE-0C1E1F0975B4} - C:\WINDOWS\system32\Zpun.dll (file missing)
R3 - URLSearchHook: (no name) - {155459FD-CC44-4144-8D82-BF6FD28A1574} - C:\WINDOWS\system32\Dcvw.dll (file missing)
R3 - URLSearchHook: (no name) - {8BD0FBE0-3F3C-43A1-8199-AD5D6940440A} - C:\WINDOWS\system32\Byqimf.dll (file missing)
R3 - URLSearchHook: (no name) - {D5AE91EF-C4E4-4607-B304-A5D5A0D7C6D9} - C:\WINDOWS\system32\Mnuuwq.dll (file missing)
R3 - URLSearchHook: (no name) - {B597EA79-C410-4F92-A3D0-3AF0FD565B5B} - C:\WINDOWS\system32\Adou.dll (file missing)
R3 - URLSearchHook: (no name) - {2A1F0609-D5A2-4281-AF19-261B541CFB48} - C:\WINDOWS\system32\Uxaei.dll (file missing)
R3 - URLSearchHook: (no name) - {993A6079-B0F1-44F1-ABC1-3EF7D2548C0A} - C:\WINDOWS\system32\Ujmhb.dll (file missing)
R3 - URLSearchHook: (no name) - {71F48108-479D-4E5B-8C30-014C800EE9C4} - C:\WINDOWS\system32\Ztvgc.dll (file missing)
R3 - URLSearchHook: (no name) - {B5D9E44E-9C82-4445-872A-33803CD3E688} - C:\WINDOWS\system32\Bkur.dll (file missing)
R3 - URLSearchHook: (no name) - {23CF52F4-8CBD-444D-8FC0-376D2263A186} - C:\WINDOWS\system32\Pecb.dll (file missing)
R3 - URLSearchHook: (no name) - {B75198C9-0498-46CB-870B-04F7C92C730F} - C:\WINDOWS\system32\Jnsew.dll (file missing)
R3 - URLSearchHook: (no name) - {5C8018B0-B194-4424-B265-8FE6DB26F990} - C:\WINDOWS\system32\Rmesut.dll (file missing)
R3 - URLSearchHook: (no name) - {D2E82AAC-FBE4-4153-9890-DDE8F9B433FE} - C:\WINDOWS\system32\Wklun.dll (file missing)
R3 - URLSearchHook: (no name) - {743BF6F6-C87C-4208-BEDC-A1687C7AA437} - C:\WINDOWS\system32\Jssw.dll (file missing)
R3 - URLSearchHook: (no name) - {26D6BC14-0CD6-428A-B992-C0A6A6022A29} - C:\WINDOWS\system32\Ahtesy.dll (file missing)
R3 - URLSearchHook: Tencent SearchHook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\Program Files\TENCENT\Adplus\SSAddr.dll
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v14.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {031D599D-B905-498A-A138-9DC3FB7F25E7} - C:\WINDOWS\system32\Kvhteo.dll (file missing)
O2 - BHO: (no name) - {07B114E4-4987-420C-9348-0D87ABB6F481} - C:\WINDOWS\system32\Kwxxk.dll (file missing)
O2 - BHO: IEMonitor Class - {08A312BB-5409-49FC-9347-54BB7D069AC6} - C:\Program Files\DeskAdTop\deskipn.dll
O2 - BHO: 搜搜地址栏搜索 - {0C7C23EF-A848-485B-873C-0ED954731014} - C:\Program Files\TENCENT\Adplus\SSAddr.dll
O2 - BHO: CPub Object - {0CA51D02-7739-43EA-8D9A-1E8AD4327B03} - C:\Program Files\P4P\sodaie.dll (file missing)
O2 - BHO: RichSoft Internet Explorer Helper - {0E2F5DD8-5B0D-438F-A618-B0403F62636A} - C:\WINDOWS\system32\reshtm.dll
O2 - BHO: wmpdrm - {0E674588-66B7-4E19-9D0E-2053B800F69F} - C:\WINDOWS\system32\wmpdrm.dll (file missing)
O2 - BHO: (no name) - {10B47747-3E64-419B-96E1-0918725C613C} - C:\WINDOWS\system32\Lnltf.dll (file missing)
O2 - BHO: (no name) - {14D0AD72-FD43-4C6D-9ED2-F93C3E8C6771} - C:\WINDOWS\system32\Mdczk.dll (file missing)
O2 - BHO: (no name) - {155459FD-CC44-4144-8D82-BF6FD28A1574} - C:\WINDOWS\system32\Dcvw.dll (file missing)
O2 - BHO: (no name) - {17763376-D482-4282-AB4D-C717EDF93A06} - C:\WINDOWS\system32\Bxlqtf.dll (file missing)
O2 - BHO: (no name) - {190032B8-1D68-4351-BEE1-7E3490C50C41} - C:\WINDOWS\system32\Qrqhg.dll (file missing)
O2 - BHO: (no name) - {1E53C994-B85C-42A2-80C4-0BCE8A5BC0E2} - C:\WINDOWS\system32\Yujwhi.dll (file missing)
O2 - BHO: (no name) - {23CF52F4-8CBD-444D-8FC0-376D2263A186} - C:\WINDOWS\system32\Pecb.dll (file missing)
O2 - BHO: (no name) - {26D6BC14-0CD6-428A-B992-C0A6A6022A29} - C:\WINDOWS\system32\Ahtesy.dll (file missing)
O2 - BHO: (no name) - {283E681A-6D4A-45FC-A790-5EDC80265109} - C:\WINDOWS\system32\Wburd.dll (file missing)
O2 - BHO: IE Address Browser Helper - {2A0176FE-008B-4706-90F5-BBA532A49731} - C:\Program Files\SearchNet\SNHpr.dll (file missing)
O2 - BHO: (no name) - {2A1F0609-D5A2-4281-AF19-261B541CFB48} - C:\WINDOWS\system32\Uxaei.dll (file missing)
O2 - BHO: BrowserHelper Class - {2D99E8F4-56B7-457B-9A92-61B5D247D263} - C:\WINDOWS\system32\WinDefendor.dll
O2 - BHO: (no name) - {3801018B-1B81-4848-BA8A-153A1050D752} - C:\WINDOWS\system32\Dktelc.dll (file missing)
O2 - BHO: (no name) - {390426FF-D4A9-417C-A5A5-1CF847177EA1} - C:\WINDOWS\system32\Aqirkl.dll (file missing)
O2 - BHO: CaiShowBH Class - {3AF40CB8-B3BA-4E2D-8968-4BF8DB172997} - C:\Program Files\CaiShow Tech\CaiShow\BrowerHelper.dll
O2 - BHO: IE Browser Helper - {3CE496D1-1746-41CD-9489-3C0B93DF10E2} - C:\WINDOWS\Downlo~1\h72.dll
O2 - BHO: (no name) - {433A5305-A3B0-452B-8426-1490D29D2654} - C:\WINDOWS\system32\Siat.dll (file missing)
O2 - BHO: (no name) - {48C28285-6304-4FC6-9D05-B34B2284041F} - C:\WINDOWS\system32\Mnkox.dll (file missing)
O2 - BHO: (no name) - {51A4E8EF-D47F-403F-86A2-AF858D1EA6BC} - C:\WINDOWS\system32\Rhvw.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: QQBrowserHelperObject Class - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: (no name) - {554389B7-771A-464B-B0F3-6DE5DC539834} - C:\WINDOWS\system32\Agknn.dll (file missing)
O2 - BHO: NetAccelerate Class - {5673A7C0-95CC-4646-BB07-3BD71234CEF9} - C:\WINDOWS\system32\MicrosoftNet.dll
O2 - BHO: (no name) - {57AA5B90-861F-4D9D-B9B3-635E6207062E} - C:\WINDOWS\system32\Xxwmsz.dll (file missing)
O2 - BHO: (no name) - {5AC069AB-0F13-44BB-8379-64FFF7F0D50C} - C:\WINDOWS\system32\Yrxwqz.dll (file missing)
O2 - BHO: (no name) - {5C8018B0-B194-4424-B265-8FE6DB26F990} - C:\WINDOWS\system32\Rmesut.dll (file missing)
O2 - BHO: (no name) - {601AC7ED-C9EC-4856-851B-3438EFB63B91} - C:\WINDOWS\system32\Gomac.dll (file missing)
O2 - BHO: (no name) - {602BCE06-D44F-4461-ABCE-0C1E1F0975B4} - C:\WINDOWS\system32\Zpun.dll (file missing)
O2 - BHO: DragSearch BHO - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL (file missing)
O2 - BHO: (no name) - {65B32EAA-A316-47AA-9FD4-76EBB12E8323} - C:\WINDOWS\system32\Yulfgp.dll (file missing)
O2 - BHO: (no name) - {66906144-00C1-441A-803D-A0F03822DC88} - C:\WINDOWS\system32\Lgce.dll (file missing)
O2 - BHO: (no name) - {669751ED-D558-49AE-B01A-3B374CC7910E} - C:\WINDOWS\system32\ssup.dll
O2 - BHO: IHiu Class - {67A06BB1-027B-4E94-8C3D-2DCD5E808A28} - C:\WINDOWS\system32\services.dll
O2 - BHO: (no name) - {6B8FDE83-D518-48D5-B27F-08202A22168A} - C:\WINDOWS\system32\Ctvqj.dll (file missing)
O2 - BHO: (no name) - {71F48108-479D-4E5B-8C30-014C800EE9C4} - C:\WINDOWS\system32\Ztvgc.dll (file missing)
O2 - BHO: (no name) - {72B60FB4-0C20-4B4B-B6F2-6ED8DBD3DB1B} - C:\WINDOWS\system32\Bbty.dll (file missing)
O2 - BHO: (no name) - {743BF6F6-C87C-4208-BEDC-A1687C7AA437} - C:\WINDOWS\system32\Jssw.dll (file missing)
O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\PROGRA~1\baidu\bar\baidubar.dll (file missing)
O2 - BHO: (no name) - {784C4719-8C4E-4828-BF00-70AEF71DAA02} - C:\WINDOWS\system32\Qtnmg.dll (file missing)
O2 - BHO: (no name) - {7B1D2734-D013-4366-ADD9-C26150EE5BBB} - C:\WINDOWS\system32\Info.dll (file missing)
O2 - BHO: (no name) - {7D874858-8000-44DC-8F01-C21C4C1A275F} - C:\WINDOWS\system32\Rqtci.dll (file missing)
O2 - BHO: Router Video 40 - {8465D755-AFE0-40ef-BC5E-2290D2C1F31F} - C:\WINDOWS\System32\rv40.dll (file missing)
O2 - BHO: (no name) - {856874B9-70CB-4B7F-BCA3-64267813F7CB} - C:\WINDOWS\system32\Lbvvqh.dll (file missing)
O2 - BHO: (no name) - {87298BA0-57A5-4C5B-AD7F-B79A19A71E98} - C:\WINDOWS\system32\Fhpk.dll (file missing)
O2 - BHO: (no name) - {8BD0FBE0-3F3C-43A1-8199-AD5D6940440A} - C:\WINDOWS\system32\Byqimf.dll (file missing)
O2 - BHO: (no name) - {951D54BB-7CE4-4398-98EF-4FDBFCE53001} - C:\WINDOWS\system32\Uzyf.dll (file missing)
O2 - BHO: (no name) - {96AFC1D1-8B21-4539-9D9C-11BA2C08C437} - C:\WINDOWS\system32\Jmrknr.dll (file missing)
O2 - BHO: (no name) - {975E27CD-85E4-44E2-B538-8624D809EA1B} - C:\WINDOWS\system32\Eqjoep.dll (file missing)
O2 - BHO: (no name) - {993A6079-B0F1-44F1-ABC1-3EF7D2548C0A} - C:\WINDOWS\system32\Ujmhb.dll (file missing)
O2 - BHO: (no name) - {9CAE4441-BA5E-4902-9334-80155E01BA04} - C:\WINDOWS\system32\Uktp.dll (file missing)
O2 - BHO: (no name) - {9FDA51BE-1D6B-47C4-8D31-523108D8FFEC} - C:\WINDOWS\system32\Gyaj.dll (file missing)
O2 - BHO: (no name) - {A1A6949C-FB6B-4E1F-A1D5-797BE7FB5DE1} - C:\WINDOWS\system32\Rjydn.dll (file missing)
O2 - BHO: (no name) - {B0126EEB-960A-414E-8E45-3F2A4C78EBA8} - C:\WINDOWS\system32\Pmhjcw.dll (file missing)
O2 - BHO: (no name) - {B246589E-14B7-44AE-9687-8012DCE49DC0} - C:\WINDOWS\system32\Tktui.dll (file missing)
O2 - BHO: (no name) - {B30CFD4A-5B4E-405C-9832-A6317CA7499E} - C:\WINDOWS\system32\Wwxko.dll (file missing)
O2 - BHO: (no name) - {B597EA79-C410-4F92-A3D0-3AF0FD565B5B} - C:\WINDOWS\system32\Adou.dll (file missing)
O2 - BHO: (no name) - {B5D9E44E-9C82-4445-872A-33803CD3E688} - C:\WINDOWS\system32\Bkur.dll (file missing)
O2 - BHO: (no name) - {B75198C9-0498-46CB-870B-04F7C92C730F} - C:\WINDOWS\system32\Jnsew.dll (file missing)
O2 - BHO: (no name) - {C1DE3D5A-8A14-4E3F-B2AC-DF60AA808C6B} - C:\WINDOWS\system32\Kjfot.dll (file missing)
O2 - BHO: (no name) - {C8DF8C70-4CB3-4732-A995-62FD0871C1A9} - C:\WINDOWS\system32\Agjeu.dll (file missing)
O2 - BHO: Webacc Class - {CAC068F3-A608-406B-8581-458788A67694} - C:\WINDOWS\system32\svchost.dll
O2 - BHO: (no name) - {CE22958E-02C7-4680-9D62-973CD3F19D56} - C:\WINDOWS\system32\Adghpz.dll (file missing)
O2 - BHO: (no name) - {CF55CB7A-A63E-4605-862C-5B61C4ABF463} - C:\WINDOWS\system32\Xbyn.dll (file missing)
O2 - BHO: (no name) - {D1E2F5EB-A18A-4D73-9111-48C879DC0D43} - C:\WINDOWS\system32\Ocrsa.dll (file missing)
O2 - BHO: (no name) - {D2E82AAC-FBE4-4153-9890-DDE8F9B433FE} - C:\WINDOWS\system32\Wklun.dll (file missing)
O2 - BHO: (no name) - {D5AE91EF-C4E4-4607-B304-A5D5A0D7C6D9} - C:\WINDOWS\system32\Mnuuwq.dll (file missing)
O2 - BHO: (no name) - {DD6C3489-D9C3-4122-8DF7-BD9B70AEF769} - C:\WINDOWS\system32\Amow.dll (file missing)
O2 - BHO: (no name) - {DD78E264-A10B-4BAB-97B5-712D1F40264E} - C:\WINDOWS\system32\Bgfsle.dll (file missing)
O2 - BHO: (no name) - {E1B49877-1ECD-4AA8-AF15-90E3F43092B7} - C:\WINDOWS\system32\Ylabix.dll (file missing)
O2 - BHO: (no name) - {E3B2BE74-15B1-4097-98CE-1BA1F61D9868} - C:\WINDOWS\system32\Kswkg.dll (file missing)
O2 - BHO: (no name) - {E8A1E731-AC7E-42CB-BE99-596A3523DB19} - C:\WINDOWS\system32\Xxhemq.dll (file missing)
O2 - BHO: (no name) - {EBB9DD07-3F6F-4993-A6F5-475BC3E4D68C} - C:\WINDOWS\system32\Kccmm.dll (file missing)
O2 - BHO: (no name) - {EBBB4D07-28AA-4B1C-87F2-F88477536A6D} - C:\WINDOWS\system32\Lkrx.dll (file missing)
O2 - BHO: (no name) - {EFE8E9BB-FFC4-42C6-98AD-248C0FBEFAB5} - C:\WINDOWS\system32\Ykofo.dll (file missing)
O2 - BHO: Letscool System Helper - {F0C15012-7DBD-4068-95A2-0A82DB03AC35} - C:\WINDOWS\system32\CoolBho.dll
O2 - BHO: (no name) - {F25E16FD-D4A5-4A0B-9600-BA66359342C8} - C:\WINDOWS\system32\Fogeai.dll (file missing)
O2 - BHO: (no name) - {F8FCE4D6-3993-4AC0-AB83-705E780337A0} - C:\WINDOWS\system32\Mqbmzx.dll (file missing)
O2 - BHO: (no name) - {FC271D8A-7A05-43CA-BDF6-004B9A1663DA} - C:\WINDOWS\system32\Yhuu.dll (file missing)
O3 - Toolbar: (no name) - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - (no file)
O3 - Toolbar: 系统标准按钮(&E) - {6B2455FD-3669-4555-8DF8-69FD5BC846F8} - C:\WINDOWS\system32\SystemToolbar.dll (file missing)
O3 - Toolbar: IE标准栏 - {954F618B-0DEC-4D1A-9317-E0FC96F87865} - C:\WINDOWS\system32\amstreamxb.dll (file missing)
O3 - Toolbar: Alexa - {3CEFF6CD-6F08-4e4d-BCCD-FF7415288C3B} - C:\WINDOWS\system32\SHDOCVW.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Thunder] "C:\Program Files\Thunder Network\Thunder\ThunderShell.exe" /s
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [systeme] C:\WINDOWS\systeme.exe
O4 - HKLM\..\Run: [ryq431] RunDll32 "C:\WINDOWS\Downlo~1\ryq431.dll",Run
O4 - HKLM\..\Run: [SearchNet_Up] "C:\Program Files\SearchNet\ServeUp.exe"
O4 - HKLM\..\Run: [VFW] C:\Program Files\rygh\fw\vfw.exe
O4 - HKLM\..\Run: [Desktop] C:\WINDOWS\system32\rundll32.exe "C:\Program Files\DeskAdTop\Run.dll" ,Rundll
O4 - HKLM\..\Run: [stup.exe] C:\PROGRA~1\TENCENT\Adplus\stup.exe
O4 - HKLM\..\RunOnce: [{9D0351F9-8E49-4ed1-BBCE-0795F5B9F240}] C:\WINDOWS\system32\richnotify.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [bgswitch] C:\WINDOWS\system32\bgswitch.exe
O4 - HKCU\..\Run: [LetsCool] C:\Program Files\LetsCool\LetsCool.exe
O4 - HKCU\..\Run: [caidiysetup] C:\Documents and Settings\Administrator\diynetsetupuni.exe
O4 - HKCU\..\Run: [MyShares] c:\program Files\易虎\MyShares.exe /tray
O4 - HKCU\..\Run: [LocalSystem] C:\WINDOWS\system\svchost.exe
O4 - HKCU\..\Run: [caishowmanage] C:\Program Files\CaiShow Tech\CaiShow\UpdateManager.EXE
O4 - HKCU\..\Run: [Luobooshow] C:\Program Files\luobooshow\luobooshow.exe
O4 - HKCU\..\Run: [sys1] Rundll32.exe C:\WINDOWS\system32\Upsrv.dll,Run
O4 - Startup: 腾讯QQ.lnk = C:\Program Files\Tencent\QQ\QQ.exe
O4 - Global Startup: IE-BAR.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: >> 彩信发送 << - res://C:\PROGRA~1\MMSASS~1\Mmsass~1.dll/mms.htm
O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\getallurl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm
O8 - Extra context menu item: 用炫彩图铃发送该图片 - C:\Program Files\CaiShow Tech\CaiShow\SendMMS.htm
O8 - Extra context menu item: 访问通用网址 - C:\Program Files\CNNIC\Cdn\cnnic.htm
O9 - Extra button: 免费精彩视频超流畅在线观看 - {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com (file missing)
O9 - Extra 'Tools' menuitem: 播霸电视 - {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com (file missing)
O9 - Extra button: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.tomatolei.com (file missing)
O9 - Extra 'Tools' menuitem: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.tomatolei.com (file missing)
O9 - Extra button: 中国最大小区互动平台 - {bf80e5ce-44f9-4954-9ec9-ca5bb86346cd} - http://www.hiu.cn (file missing)
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O10 - Unknown file in Winsock LSP: c:\program files\rygh\vc\mailmon.dll
O10 - Unknown file in Winsock LSP: c:\program files\rygh\vc\mailmon.dll
O11 - Options group: [CDNCLIENT] 中文上网
O11 - Options group: [TBH] 搜搜地址栏搜索
O14 - IERESET.INF: START_PAGE_URL=http://www.tomatolei.com
O16 - DPF: {29710C4C-4F0F-4A36-8312-CB5614829804} (DriverDetectiveNonMembers.nonmembers) - http://www.drivershq.com/files/cab/nonmemb…etective-nm.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1139452948525
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} (pCastPanel Class) - http://cache10.itv.mop.com/pCastCtl-1.0.0.88_signed.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2F28C5A2-B5EB-4568-B53A-16C19A33CD39}: NameServer = 61.136.241.34 202.103.0.117
O17 - HKLM\System\CCS\Services\Tcpip\..\{FEED7082-94DC-46E2-A71D-5D28B77F4880}: NameServer = 202.103.0.117,61.136.241.34
O17 - HKLM\System\CS1\Services\Tcpip\..\{2F28C5A2-B5EB-4568-B53A-16C19A33CD39}: NameServer = 61.136.241.34 202.103.0.117
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Remote Log - Unknown owner - C:\WINDOWS\system32\ServeHost.exe (file missing)
O23 - Service: Sample NT Service (SampleService) - Unknown owner - C:\WINDOWS\NTService.exe (file missing)
O23 - Service: VIPTray - Unknown owner - C:\WINDOWS\System32\VIPTray.exe
O23 - Service: Virus Clean Service - 北京日月光华软件有限责任公司 - C:\Program Files\rygh\vc\smss.exe

Hello! Thank you so much for helping. My problem is when i start my computer after windows show up, i get this message: PROBLEM.C:\ WINDOWS\System32\Upsrv.dll. and i more thing i can not update the windows. and also many of pop up coming when i open IE. appreciate your help!


Logfile of HijackThis v1.99.1
Scan saved at 20:13:58, on 2006-7-20
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\VIPTray.exe
C:\WINDOWS\System32\VIPTray.exe
C:\Program Files\rygh\vc\smss.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\FixCamera.exe
C:\WINDOWS\vsnpstd.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CaiShow Tech\CaiShow\UpdateManager.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX06.506\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: (no name) - {D2E82AAC-FBE4-4153-9890-DDE8F9B433FE} - C:\WINDOWS\system32\Wklun.dll (file missing)
R3 - URLSearchHook: (no name) - {743BF6F6-C87C-4208-BEDC-A1687C7AA437} - C:\WINDOWS\system32\Jssw.dll (file missing)
R3 - URLSearchHook: (no name) - {26D6BC14-0CD6-428A-B992-C0A6A6022A29} - C:\WINDOWS\system32\Ahtesy.dll (file missing)
R3 - URLSearchHook: Tencent SearchHook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\Program Files\TENCENT\Adplus\SSAddr.dll
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v14.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: IEMonitor Class - {08A312BB-5409-49FC-9347-54BB7D069AC6} - C:\Program Files\DeskAdTop\deskipn.dll
O2 - BHO: 搜搜地址栏搜索 - {0C7C23EF-A848-485B-873C-0ED954731014} - C:\Program Files\TENCENT\Adplus\SSAddr.dll
O2 - BHO: RichSoft Internet Explorer Helper - {0E2F5DD8-5B0D-438F-A618-B0403F62636A} - C:\WINDOWS\system32\reshtm.dll
O2 - BHO: wmpdrm - {0E674588-66B7-4E19-9D0E-2053B800F69F} - C:\WINDOWS\system32\wmpdrm.dll (file missing)
O2 - BHO: (no name) - {10B47747-3E64-419B-96E1-0918725C613C} - C:\WINDOWS\system32\Lnltf.dll (file missing)
O2 - BHO: (no name) - {14D0AD72-FD43-4C6D-9ED2-F93C3E8C6771} - C:\WINDOWS\system32\Mdczk.dll (file missing)
O2 - BHO: (no name) - {155459FD-CC44-4144-8D82-BF6FD28A1574} - C:\WINDOWS\system32\Dcvw.dll (file missing)
O2 - BHO: (no name) - {17763376-D482-4282-AB4D-C717EDF93A06} - C:\WINDOWS\system32\Bxlqtf.dll (file missing)
O2 - BHO: (no name) - {190032B8-1D68-4351-BEE1-7E3490C50C41} - C:\WINDOWS\system32\Qrqhg.dll (file missing)
O2 - BHO: (no name) - {1E53C994-B85C-42A2-80C4-0BCE8A5BC0E2} - C:\WINDOWS\system32\Yujwhi.dll (file missing)
O2 - BHO: (no name) - {23CF52F4-8CBD-444D-8FC0-376D2263A186} - C:\WINDOWS\system32\Pecb.dll (file missing)
O2 - BHO: (no name) - {26D6BC14-0CD6-428A-B992-C0A6A6022A29} - C:\WINDOWS\system32\Ahtesy.dll (file missing)
O2 - BHO: (no name) - {283E681A-6D4A-45FC-A790-5EDC80265109} - C:\WINDOWS\system32\Wburd.dll (file missing)
O2 - BHO: (no name) - {2A1F0609-D5A2-4281-AF19-261B541CFB48} - C:\WINDOWS\system32\Uxaei.dll (file missing)
O2 - BHO: BrowserHelper Class - {2D99E8F4-56B7-457B-9A92-61B5D247D263} - C:\WINDOWS\system32\WinDefendor.dll
O2 - BHO: (no name) - {3801018B-1B81-4848-BA8A-153A1050D752} - C:\WINDOWS\system32\Dktelc.dll (file missing)
O2 - BHO: (no name) - {390426FF-D4A9-417C-A5A5-1CF847177EA1} - C:\WINDOWS\system32\Aqirkl.dll (file missing)
O2 - BHO: CaiShowBH Class - {3AF40CB8-B3BA-4E2D-8968-4BF8DB172997} - C:\Program Files\CaiShow Tech\CaiShow\BrowerHelper.dll
O2 - BHO: IE Browser Helper - {3CE496D1-1746-41CD-9489-3C0B93DF10E2} - C:\WINDOWS\Downlo~1\h72.dll
O2 - BHO: (no name) - {433A5305-A3B0-452B-8426-1490D29D2654} - C:\WINDOWS\system32\Siat.dll (file missing)
O2 - BHO: (no name) - {48C28285-6304-4FC6-9D05-B34B2284041F} - C:\WINDOWS\system32\Mnkox.dll (file missing)
O2 - BHO: (no name) - {51A4E8EF-D47F-403F-86A2-AF858D1EA6BC} - C:\WINDOWS\system32\Rhvw.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: QQBrowserHelperObject Class - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: (no name) - {554389B7-771A-464B-B0F3-6DE5DC539834} - C:\WINDOWS\system32\Agknn.dll (file missing)
O2 - BHO: NetAccelerate Class - {5673A7C0-95CC-4646-BB07-3BD71234CEF9} - C:\WINDOWS\system32\MicrosoftNet.dll (file missing)
O2 - BHO: (no name) - {57AA5B90-861F-4D9D-B9B3-635E6207062E} - C:\WINDOWS\system32\Xxwmsz.dll (file missing)
O2 - BHO: (no name) - {5AC069AB-0F13-44BB-8379-64FFF7F0D50C} - C:\WINDOWS\system32\Yrxwqz.dll (file missing)
O2 - BHO: (no name) - {5C8018B0-B194-4424-B265-8FE6DB26F990} - C:\WINDOWS\system32\Rmesut.dll (file missing)
O2 - BHO: (no name) - {601AC7ED-C9EC-4856-851B-3438EFB63B91} - C:\WINDOWS\system32\Gomac.dll (file missing)
O2 - BHO: (no name) - {602BCE06-D44F-4461-ABCE-0C1E1F0975B4} - C:\WINDOWS\system32\Zpun.dll (file missing)
O2 - BHO: DragSearch BHO - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL (file missing)
O2 - BHO: (no name) - {65B32EAA-A316-47AA-9FD4-76EBB12E8323} - C:\WINDOWS\system32\Yulfgp.dll (file missing)
O2 - BHO: (no name) - {66906144-00C1-441A-803D-A0F03822DC88} - C:\WINDOWS\system32\Lgce.dll (file missing)
O2 - BHO: (no name) - {669751ED-D558-49AE-B01A-3B374CC7910E} - C:\WINDOWS\system32\ssup.dll
O2 - BHO: IHiu Class - {67A06BB1-027B-4E94-8C3D-2DCD5E808A28} - C:\WINDOWS\system32\services.dll
O2 - BHO: (no name) - {6B8FDE83-D518-48D5-B27F-08202A22168A} - C:\WINDOWS\system32\Ctvqj.dll (file missing)
O2 - BHO: (no name) - {71F48108-479D-4E5B-8C30-014C800EE9C4} - C:\WINDOWS\system32\Ztvgc.dll (file missing)
O2 - BHO: (no name) - {72B60FB4-0C20-4B4B-B6F2-6ED8DBD3DB1B} - C:\WINDOWS\system32\Bbty.dll (file missing)
O2 - BHO: (no name) - {743BF6F6-C87C-4208-BEDC-A1687C7AA437} - C:\WINDOWS\system32\Jssw.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\PROGRA~1\baidu\bar\baidubar.dll (file missing)
O2 - BHO: (no name) - {784C4719-8C4E-4828-BF00-70AEF71DAA02} - C:\WINDOWS\system32\Qtnmg.dll (file missing)
O2 - BHO: (no name) - {7B1D2734-D013-4366-ADD9-C26150EE5BBB} - C:\WINDOWS\system32\Info.dll (file missing)
O2 - BHO: (no name) - {7D874858-8000-44DC-8F01-C21C4C1A275F} - C:\WINDOWS\system32\Rqtci.dll (file missing)
O2 - BHO: Router Video 40 - {8465D755-AFE0-40ef-BC5E-2290D2C1F31F} - C:\WINDOWS\System32\rv40.dll (file missing)
O2 - BHO: (no name) - {856874B9-70CB-4B7F-BCA3-64267813F7CB} - C:\WINDOWS\system32\Lbvvqh.dll (file missing)
O2 - BHO: (no name) - {87298BA0-57A5-4C5B-AD7F-B79A19A71E98} - C:\WINDOWS\system32\Fhpk.dll (file missing)
O2 - BHO: (no name) - {8BD0FBE0-3F3C-43A1-8199-AD5D6940440A} - C:\WINDOWS\system32\Byqimf.dll (file missing)
O2 - BHO: (no name) - {951D54BB-7CE4-4398-98EF-4FDBFCE53001} - C:\WINDOWS\system32\Uzyf.dll (file missing)
O2 - BHO: (no name) - {96AFC1D1-8B21-4539-9D9C-11BA2C08C437} - C:\WINDOWS\system32\Jmrknr.dll (file missing)
O2 - BHO: (no name) - {975E27CD-85E4-44E2-B538-8624D809EA1B} - C:\WINDOWS\system32\Eqjoep.dll (file missing)
O2 - BHO: (no name) - {993A6079-B0F1-44F1-ABC1-3EF7D2548C0A} - C:\WINDOWS\system32\Ujmhb.dll (file missing)
O2 - BHO: (no name) - {9CAE4441-BA5E-4902-9334-80155E01BA04} - C:\WINDOWS\system32\Uktp.dll (file missing)
O2 - BHO: (no name) - {9FDA51BE-1D6B-47C4-8D31-523108D8FFEC} - C:\WINDOWS\system32\Gyaj.dll (file missing)
O2 - BHO: (no name) - {A1A6949C-FB6B-4E1F-A1D5-797BE7FB5DE1} - C:\WINDOWS\system32\Rjydn.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {B0126EEB-960A-414E-8E45-3F2A4C78EBA8} - C:\WINDOWS\system32\Pmhjcw.dll (file missing)
O2 - BHO: (no name) - {B246589E-14B7-44AE-9687-8012DCE49DC0} - C:\WINDOWS\system32\Tktui.dll (file missing)
O2 - BHO: (no name) - {B30CFD4A-5B4E-405C-9832-A6317CA7499E} - C:\WINDOWS\system32\Wwxko.dll (file missing)
O2 - BHO: (no name) - {B597EA79-C410-4F92-A3D0-3AF0FD565B5B} - C:\WINDOWS\system32\Adou.dll (file missing)
O2 - BHO: (no name) - {B5D9E44E-9C82-4445-872A-33803CD3E688} - C:\WINDOWS\system32\Bkur.dll (file missing)
O2 - BHO: (no name) - {B75198C9-0498-46CB-870B-04F7C92C730F} - C:\WINDOWS\system32\Jnsew.dll (file missing)
O2 - BHO: (no name) - {C1DE3D5A-8A14-4E3F-B2AC-DF60AA808C6B} - C:\WINDOWS\system32\Kjfot.dll (file missing)
O2 - BHO: (no name) - {C8DF8C70-4CB3-4732-A995-62FD0871C1A9} - C:\WINDOWS\system32\Agjeu.dll (file missing)
O2 - BHO: Webacc Class - {CAC068F3-A608-406B-8581-458788A67694} - C:\WINDOWS\system32\svchost.dll (file missing)
O2 - BHO: (no name) - {CE22958E-02C7-4680-9D62-973CD3F19D56} - C:\WINDOWS\system32\Adghpz.dll (file missing)
O2 - BHO: (no name) - {CF55CB7A-A63E-4605-862C-5B61C4ABF463} - C:\WINDOWS\system32\Xbyn.dll (file missing)
O2 - BHO: (no name) - {D1E2F5EB-A18A-4D73-9111-48C879DC0D43} - C:\WINDOWS\system32\Ocrsa.dll (file missing)
O2 - BHO: (no name) - {D2E82AAC-FBE4-4153-9890-DDE8F9B433FE} - C:\WINDOWS\system32\Wklun.dll (file missing)
O2 - BHO: (no name) - {D5AE91EF-C4E4-4607-B304-A5D5A0D7C6D9} - C:\WINDOWS\system32\Mnuuwq.dll (file missing)
O2 - BHO: (no name) - {DD6C3489-D9C3-4122-8DF7-BD9B70AEF769} - C:\WINDOWS\system32\Amow.dll (file missing)
O2 - BHO: (no name) - {DD78E264-A10B-4BAB-97B5-712D1F40264E} - C:\WINDOWS\system32\Bgfsle.dll (file missing)
O2 - BHO: (no name) - {E1B49877-1ECD-4AA8-AF15-90E3F43092B7} - C:\WINDOWS\system32\Ylabix.dll (file missing)
O2 - BHO: (no name) - {E3B2BE74-15B1-4097-98CE-1BA1F61D9868} - C:\WINDOWS\system32\Kswkg.dll (file missing)
O2 - BHO: (no name) - {E8A1E731-AC7E-42CB-BE99-596A3523DB19} - C:\WINDOWS\system32\Xxhemq.dll (file missing)
O2 - BHO: (no name) - {EBB9DD07-3F6F-4993-A6F5-475BC3E4D68C} - C:\WINDOWS\system32\Kccmm.dll (file missing)
O2 - BHO: (no name) - {EBBB4D07-28AA-4B1C-87F2-F88477536A6D} - C:\WINDOWS\system32\Lkrx.dll (file missing)
O2 - BHO: (no name) - {EFE8E9BB-FFC4-42C6-98AD-248C0FBEFAB5} - C:\WINDOWS\system32\Ykofo.dll (file missing)
O2 - BHO: (no name) - {F25E16FD-D4A5-4A0B-9600-BA66359342C8} - C:\WINDOWS\system32\Fogeai.dll (file missing)
O2 - BHO: (no name) - {F8FCE4D6-3993-4AC0-AB83-705E780337A0} - C:\WINDOWS\system32\Mqbmzx.dll (file missing)
O2 - BHO: (no name) - {FC271D8A-7A05-43CA-BDF6-004B9A1663DA} - C:\WINDOWS\system32\Yhuu.dll (file missing)
O3 - Toolbar: (no name) - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - (no file)
O3 - Toolbar: 系统标准按钮(&E) - {6B2455FD-3669-4555-8DF8-69FD5BC846F8} - C:\WINDOWS\system32\SystemToolbar.dll (file missing)
O3 - Toolbar: IE标准栏 - {954F618B-0DEC-4D1A-9317-E0FC96F87865} - C:\WINDOWS\system32\amstreamxb.dll (file missing)
O3 - Toolbar: Alexa - {3CEFF6CD-6F08-4e4d-BCCD-FF7415288C3B} - C:\WINDOWS\system32\SHDOCVW.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Thunder] "C:\Program Files\Thunder Network\Thunder\ThunderShell.exe" /s
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [systeme] C:\WINDOWS\systeme.exe
O4 - HKLM\..\Run: [ryq431] RunDll32 "C:\WINDOWS\Downlo~1\ryq431.dll",Run
O4 - HKLM\..\Run: [SearchNet_Up] "C:\Program Files\SearchNet\ServeUp.exe"
O4 - HKLM\..\Run: [VFW] C:\Program Files\rygh\fw\vfw.exe
O4 - HKLM\..\Run: [Desktop] "C:\WINDOWS\system32\rundll32.exe" "C:\Program Files\DeskAdTop\Run.dll" ,Rundll
O4 - HKLM\..\Run: [stup.exe] C:\PROGRA~1\TENCENT\Adplus\stup.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [bgswitch] C:\WINDOWS\system32\bgswitch.exe
O4 - HKCU\..\Run: [MyShares] c:\program Files\易虎\MyShares.exe /tray
O4 - HKCU\..\Run: [LocalSystem] C:\WINDOWS\system\svchost.exe
O4 - HKCU\..\Run: [caishowmanage] "C:\Program Files\CaiShow Tech\CaiShow\UpdateManager.EXE"
O4 - HKCU\..\Run: [sys1] "Rundll32.exe" C:\WINDOWS\system32\Upsrv.dll,Run
O4 - Startup: 腾讯QQ.lnk = C:\Program Files\Tencent\QQ\QQ.exe
O4 - Global Startup: IE-BAR.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: >> 彩信发送 << - res://C:\PROGRA~1\MMSASS~1\Mmsass~1.dll/mms.htm
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\getallurl.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm
O8 - Extra context menu item: 用炫彩图铃发送该图片 - C:\Program Files\CaiShow Tech\CaiShow\SendMMS.htm
O8 - Extra context menu item: 访问通用网址 - C:\Program Files\CNNIC\Cdn\cnnic.htm
O9 - Extra button: 免费精彩视频超流畅在线观看 - {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com (file missing)
O9 - Extra 'Tools' menuitem: 播霸电视 - {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java 控制台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.tomatolei.com (file missing)
O9 - Extra 'Tools' menuitem: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.tomatolei.com (file missing)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: 中国最大小区互动平台 - {bf80e5ce-44f9-4954-9ec9-ca5bb86346cd} - http://www.hiu.cn (file missing)
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O10 - Unknown file in Winsock LSP: c:\program files\rygh\vc\mailmon.dll
O10 - Unknown file in Winsock LSP: c:\program files\rygh\vc\mailmon.dll
O11 - Options group: [CDNCLIENT] 中文上网
O11 - Options group: [TBH] 搜搜地址栏搜索
O14 - IERESET.INF: START_PAGE_URL=http://www.tomatolei.com
O16 - DPF: {29710C4C-4F0F-4A36-8312-CB5614829804} (DriverDetectiveNonMembers.nonmembers) - http://www.drivershq.com/files/cab/nonmemb…etective-nm.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1139452948525
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} (pCastPanel Class) - http://cache10.itv.mop.com/pCastCtl-1.0.0.88_signed.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2F28C5A2-B5EB-4568-B53A-16C19A33CD39}: NameServer = 61.136.241.34 202.103.0.117
O17 - HKLM\System\CCS\Services\Tcpip\..\{FEED7082-94DC-46E2-A71D-5D28B77F4880}: NameServer = 202.103.0.117,61.136.241.34
O17 - HKLM\System\CS1\Services\Tcpip\..\{2F28C5A2-B5EB-4568-B53A-16C19A33CD39}: NameServer = 61.136.241.34 202.103.0.117
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Remote Log - Unknown owner - C:\WINDOWS\system32\ServeHost.exe (file missing)
O23 - Service: Sample NT Service (SampleService) - Unknown owner - C:\WINDOWS\NTService.exe (file missing)
O23 - Service: Te1net - Unknown owner - C:\WINDOWS\System32\VIPTray.exe
O23 - Service: VIPTray - Unknown owner - C:\WINDOWS\System32\VIPTray.exe
O23 - Service: Virus Clean Service - 北京日月光华软件有限责任公司 - C:\Program Files\rygh\vc\smss.exe

Important: Do this before any fix.

Please put your HijackThis in it's own folder, (I create a new folder in C:\ named HJT).
You can do a Right Click on any open area on the desktop, New> Folder, then rename the folder HJT.

Go to where your HijackThis is and Right Click on HijackThis.exe, select Cut, then open the new folder you just created (HJT) Right Click in the folder and select paste.

The reason we do this is Hijackthis creates backup files just in case you'd need to restore one and we'll be cleaning out the temp files.



After the above:

I suggest you do this:

Please print this out.


Very Important:
The infection you have can cause you to lose your internet connection.
Get a copy of winsockxpfix.exe in case that happens.You just run it and
things should work OK after it reboots your system.

http://www.snapfiles.com/get/winsockxpfix.html


After the above:

Download LSPfix here: http://www.cexx.org/lspfix.htm

Start the program and then check the I know what I'm doing box.

Move all instances of mailmon.dll (and nothing else), to the Remove pane.
Click the Finish Button and reboot.

Find and delete the file c:\windows\system\mailmon.dll





Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.


1.Click Start > Settings > Control Panel.
2.Next, open Add/Remove Programs and remove if listed:
TENCENT\Adplus
CaiShow Tech\CaiShow
Tencent\QQ
Thunder Network
Thunder
SearchNet



Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

R3 - URLSearchHook: (no name) - {D2E82AAC-FBE4-4153-9890-DDE8F9B433FE} - C:\WINDOWS\system32\Wklun.dll (file missing)

R3 - URLSearchHook: (no name) - {743BF6F6-C87C-4208-BEDC-A1687C7AA437} - C:\WINDOWS\system32\Jssw.dll (file missing)

R3 - URLSearchHook: (no name) - {26D6BC14-0CD6-428A-B992-C0A6A6022A29} - C:\WINDOWS\system32\Ahtesy.dll (file missing)

R3 - URLSearchHook: Tencent SearchHook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\Program Files\TENCENT\Adplus\SSAddr.dll

O2 - BHO: 搜搜地址栏搜索 - {0C7C23EF-A848-485B-873C-0ED954731014} - C:\Program Files\TENCENT\Adplus\SSAddr.dll

O2 - BHO: RichSoft Internet Explorer Helper - {0E2F5DD8-5B0D-438F-A618-B0403F62636A} - C:\WINDOWS\system32\reshtm.dll

O2 - BHO: wmpdrm - {0E674588-66B7-4E19-9D0E-2053B800F69F} - C:\WINDOWS\system32\wmpdrm.dll (file missing)

O2 - BHO: (no name) - {10B47747-3E64-419B-96E1-0918725C613C} - C:\WINDOWS\system32\Lnltf.dll (file missing)

O2 - BHO: (no name) - {14D0AD72-FD43-4C6D-9ED2-F93C3E8C6771} - C:\WINDOWS\system32\Mdczk.dll (file missing)

O2 - BHO: (no name) - {155459FD-CC44-4144-8D82-BF6FD28A1574} - C:\WINDOWS\system32\Dcvw.dll (file missing)

O2 - BHO: (no name) - {17763376-D482-4282-AB4D-C717EDF93A06} - C:\WINDOWS\system32\Bxlqtf.dll (file missing)

O2 - BHO: (no name) - {190032B8-1D68-4351-BEE1-7E3490C50C41} - C:\WINDOWS\system32\Qrqhg.dll (file missing)

O2 - BHO: (no name) - {1E53C994-B85C-42A2-80C4-0BCE8A5BC0E2} - C:\WINDOWS\system32\Yujwhi.dll (file missing)

O2 - BHO: (no name) - {23CF52F4-8CBD-444D-8FC0-376D2263A186} - C:\WINDOWS\system32\Pecb.dll (file missing)

O2 - BHO: (no name) - {26D6BC14-0CD6-428A-B992-C0A6A6022A29} - C:\WINDOWS\system32\Ahtesy.dll (file missing)

O2 - BHO: (no name) - {283E681A-6D4A-45FC-A790-5EDC80265109} - C:\WINDOWS\system32\Wburd.dll (file missing)

O2 - BHO: (no name) - {2A1F0609-D5A2-4281-AF19-261B541CFB48} - C:\WINDOWS\system32\Uxaei.dll (file missing)

O2 - BHO: (no name) - {3801018B-1B81-4848-BA8A-153A1050D752} - C:\WINDOWS\system32\Dktelc.dll (file missing)

O2 - BHO: (no name) - {390426FF-D4A9-417C-A5A5-1CF847177EA1} - C:\WINDOWS\system32\Aqirkl.dll (file missing)

O2 - BHO: CaiShowBH Class - {3AF40CB8-B3BA-4E2D-8968-4BF8DB172997} - C:\Program Files\CaiShow Tech\CaiShow\BrowerHelper.dll

O2 - BHO: IE Browser Helper - {3CE496D1-1746-41CD-9489-3C0B93DF10E2} - C:\WINDOWS\Downlo~1\h72.dll

O2 - BHO: (no name) - {433A5305-A3B0-452B-8426-1490D29D2654} - C:\WINDOWS\system32\Siat.dll (file missing)

O2 - BHO: (no name) - {48C28285-6304-4FC6-9D05-B34B2284041F} - C:\WINDOWS\system32\Mnkox.dll (file missing)

O2 - BHO: (no name) - {51A4E8EF-D47F-403F-86A2-AF858D1EA6BC} - C:\WINDOWS\system32\Rhvw.dll (file missing)

O2 - BHO: QQBrowserHelperObject Class - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\QQ\QQIEHelper.dll

O2 - BHO: (no name) - {554389B7-771A-464B-B0F3-6DE5DC539834} - C:\WINDOWS\system32\Agknn.dll (file missing)

O2 - BHO: NetAccelerate Class - {5673A7C0-95CC-4646-BB07-3BD71234CEF9} - C:\WINDOWS\system32\MicrosoftNet.dll (file missing)

O2 - BHO: (no name) - {57AA5B90-861F-4D9D-B9B3-635E6207062E} - C:\WINDOWS\system32\Xxwmsz.dll (file missing)

O2 - BHO: (no name) - {5AC069AB-0F13-44BB-8379-64FFF7F0D50C} - C:\WINDOWS\system32\Yrxwqz.dll (file missing)

O2 - BHO: (no name) - {5C8018B0-B194-4424-B265-8FE6DB26F990} - C:\WINDOWS\system32\Rmesut.dll (file missing)

O2 - BHO: (no name) - {601AC7ED-C9EC-4856-851B-3438EFB63B91} - C:\WINDOWS\system32\Gomac.dll (file missing)

O2 - BHO: (no name) - {602BCE06-D44F-4461-ABCE-0C1E1F0975B4} - C:\WINDOWS\system32\Zpun.dll (file missing)

O2 - BHO: (no name) - {65B32EAA-A316-47AA-9FD4-76EBB12E8323} - C:\WINDOWS\system32\Yulfgp.dll (file missing)

O2 - BHO: (no name) - {66906144-00C1-441A-803D-A0F03822DC88} - C:\WINDOWS\system32\Lgce.dll (file missing)

O2 - BHO: (no name) - {669751ED-D558-49AE-B01A-3B374CC7910E} - C:\WINDOWS\system32\ssup.dll

O2 - BHO: IHiu Class - {67A06BB1-027B-4E94-8C3D-2DCD5E808A28} - C:\WINDOWS\system32\services.dll

O2 - BHO: (no name) - {6B8FDE83-D518-48D5-B27F-08202A22168A} - C:\WINDOWS\system32\Ctvqj.dll (file missing)

O2 - BHO: (no name) - {71F48108-479D-4E5B-8C30-014C800EE9C4} - C:\WINDOWS\system32\Ztvgc.dll (file missing)

O2 - BHO: (no name) - {72B60FB4-0C20-4B4B-B6F2-6ED8DBD3DB1B} - C:\WINDOWS\system32\Bbty.dll (file missing)

O2 - BHO: (no name) - {743BF6F6-C87C-4208-BEDC-A1687C7AA437} - C:\WINDOWS\system32\Jssw.dll (file missing)

O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\PROGRA~1\baidu\bar\baidubar.dll (file missing)

O2 - BHO: (no name) - {784C4719-8C4E-4828-BF00-70AEF71DAA02} - C:\WINDOWS\system32\Qtnmg.dll (file missing)

O2 - BHO: (no name) - {7B1D2734-D013-4366-ADD9-C26150EE5BBB} - C:\WINDOWS\system32\Info.dll (file missing)

O2 - BHO: (no name) - {7D874858-8000-44DC-8F01-C21C4C1A275F} - C:\WINDOWS\system32\Rqtci.dll (file missing)

O2 - BHO: Router Video 40 - {8465D755-AFE0-40ef-BC5E-2290D2C1F31F} - C:\WINDOWS\System32\rv40.dll (file missing)

O2 - BHO: (no name) - {856874B9-70CB-4B7F-BCA3-64267813F7CB} - C:\WINDOWS\system32\Lbvvqh.dll (file missing)

O2 - BHO: (no name) - {87298BA0-57A5-4C5B-AD7F-B79A19A71E98} - C:\WINDOWS\system32\Fhpk.dll (file missing)

O2 - BHO: (no name) - {8BD0FBE0-3F3C-43A1-8199-AD5D6940440A} - C:\WINDOWS\system32\Byqimf.dll (file missing)

O2 - BHO: (no name) - {951D54BB-7CE4-4398-98EF-4FDBFCE53001} - C:\WINDOWS\system32\Uzyf.dll (file missing)

O2 - BHO: (no name) - {96AFC1D1-8B21-4539-9D9C-11BA2C08C437} - C:\WINDOWS\system32\Jmrknr.dll (file missing)

O2 - BHO: (no name) - {975E27CD-85E4-44E2-B538-8624D809EA1B} - C:\WINDOWS\system32\Eqjoep.dll (file missing)

O2 - BHO: (no name) - {993A6079-B0F1-44F1-ABC1-3EF7D2548C0A} - C:\WINDOWS\system32\Ujmhb.dll (file missing)

O2 - BHO: (no name) - {9CAE4441-BA5E-4902-9334-80155E01BA04} - C:\WINDOWS\system32\Uktp.dll (file missing)

O2 - BHO: (no name) - {9FDA51BE-1D6B-47C4-8D31-523108D8FFEC} - C:\WINDOWS\system32\Gyaj.dll (file missing)

O2 - BHO: (no name) - {A1A6949C-FB6B-4E1F-A1D5-797BE7FB5DE1} - C:\WINDOWS\system32\Rjydn.dll (file missing)

O2 - BHO: (no name) - {B0126EEB-960A-414E-8E45-3F2A4C78EBA8} - C:\WINDOWS\system32\Pmhjcw.dll (file missing)

O2 - BHO: (no name) - {B246589E-14B7-44AE-9687-8012DCE49DC0} - C:\WINDOWS\system32\Tktui.dll (file missing)

O2 - BHO: (no name) - {B30CFD4A-5B4E-405C-9832-A6317CA7499E} - C:\WINDOWS\system32\Wwxko.dll (file missing)

O2 - BHO: (no name) - {B597EA79-C410-4F92-A3D0-3AF0FD565B5B} - C:\WINDOWS\system32\Adou.dll (file missing)

O2 - BHO: (no name) - {B5D9E44E-9C82-4445-872A-33803CD3E688} - C:\WINDOWS\system32\Bkur.dll (file missing)

O2 - BHO: (no name) - {B75198C9-0498-46CB-870B-04F7C92C730F} - C:\WINDOWS\system32\Jnsew.dll (file missing)

O2 - BHO: (no name) - {C1DE3D5A-8A14-4E3F-B2AC-DF60AA808C6B} - C:\WINDOWS\system32\Kjfot.dll (file missing)

O2 - BHO: (no name) - {C8DF8C70-4CB3-4732-A995-62FD0871C1A9} - C:\WINDOWS\system32\Agjeu.dll (file missing)

O2 - BHO: Webacc Class - {CAC068F3-A608-406B-8581-458788A67694} - C:\WINDOWS\system32\svchost.dll (file missing)

O2 - BHO: (no name) - {CE22958E-02C7-4680-9D62-973CD3F19D56} - C:\WINDOWS\system32\Adghpz.dll (file missing)

O2 - BHO: (no name) - {CF55CB7A-A63E-4605-862C-5B61C4ABF463} - C:\WINDOWS\system32\Xbyn.dll (file missing)

O2 - BHO: (no name) - {D1E2F5EB-A18A-4D73-9111-48C879DC0D43} - C:\WINDOWS\system32\Ocrsa.dll (file missing)

O2 - BHO: (no name) - {D2E82AAC-FBE4-4153-9890-DDE8F9B433FE} - C:\WINDOWS\system32\Wklun.dll (file missing)

O2 - BHO: (no name) - {D5AE91EF-C4E4-4607-B304-A5D5A0D7C6D9} - C:\WINDOWS\system32\Mnuuwq.dll (file missing)

O2 - BHO: (no name) - {DD6C3489-D9C3-4122-8DF7-BD9B70AEF769} - C:\WINDOWS\system32\Amow.dll (file missing)

O2 - BHO: (no name) - {DD78E264-A10B-4BAB-97B5-712D1F40264E} - C:\WINDOWS\system32\Bgfsle.dll (file missing)

O2 - BHO: (no name) - {E1B49877-1ECD-4AA8-AF15-90E3F43092B7} - C:\WINDOWS\system32\Ylabix.dll (file missing)

O2 - BHO: (no name) - {E3B2BE74-15B1-4097-98CE-1BA1F61D9868} - C:\WINDOWS\system32\Kswkg.dll (file missing)

O2 - BHO: (no name) - {E8A1E731-AC7E-42CB-BE99-596A3523DB19} - C:\WINDOWS\system32\Xxhemq.dll (file missing)

O2 - BHO: (no name) - {EBB9DD07-3F6F-4993-A6F5-475BC3E4D68C} - C:\WINDOWS\system32\Kccmm.dll (file missing)

O2 - BHO: (no name) - {EBBB4D07-28AA-4B1C-87F2-F88477536A6D} - C:\WINDOWS\system32\Lkrx.dll (file missing)

O2 - BHO: (no name) - {EFE8E9BB-FFC4-42C6-98AD-248C0FBEFAB5} - C:\WINDOWS\system32\Ykofo.dll (file missing)

O2 - BHO: (no name) - {F25E16FD-D4A5-4A0B-9600-BA66359342C8} - C:\WINDOWS\system32\Fogeai.dll (file missing)

O2 - BHO: (no name) - {F8FCE4D6-3993-4AC0-AB83-705E780337A0} - C:\WINDOWS\system32\Mqbmzx.dll (file missing)

O2 - BHO: (no name) - {FC271D8A-7A05-43CA-BDF6-004B9A1663DA} - C:\WINDOWS\system32\Yhuu.dll (file missing)

O3 - Toolbar: (no name) - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - (no file)

O3 - Toolbar: 系统标准按钮(&E) - {6B2455FD-3669-4555-8DF8-69FD5BC846F8} - C:\WINDOWS\system32\SystemToolbar.dll (file missing)

O3 - Toolbar: IE标准栏 - {954F618B-0DEC-4D1A-9317-E0FC96F87865} - C:\WINDOWS\system32\amstreamxb.dll (file missing)

O4 - HKLM\..\Run: [Thunder] "C:\Program Files\Thunder Network\Thunder\ThunderShell.exe" /s

O4 - HKLM\..\Run: [systeme] C:\WINDOWS\systeme.exe

O4 - HKLM\..\Run: [ryq431] RunDll32 "C:\WINDOWS\Downlo~1\ryq431.dll",Run

O4 - HKLM\..\Run: [SearchNet_Up] "C:\Program Files\SearchNet\ServeUp.exe"

O4 - HKLM\..\Run: [VFW] C:\Program Files\rygh\fw\vfw.exe

O4 - HKLM\..\Run: [Desktop] "C:\WINDOWS\system32\rundll32.exe" "C:\Program Files\DeskAdTop\Run.dll" ,Rundll

O4 - HKLM\..\Run: [stup.exe] C:\Program Files\TENCENT\Adplus\stup.exe

O4 - HKCU\..\Run: [MyShares] c:\program Files\易虎\MyShares.exe /tray

O4 - HKCU\..\Run: [LocalSystem] C:\WINDOWS\system\svchost.exe

O4 - HKCU\..\Run: [caishowmanage] "C:\Program Files\CaiShow Tech\CaiShow\UpdateManager.EXE"

O4 - HKCU\..\Run: [sys1] "Rundll32.exe" C:\WINDOWS\system32\Upsrv.dll,Run

O4 - Startup: 腾讯QQ.lnk = C:\Program Files\Tencent\QQ\QQ.exe

O4 - Global Startup: IE-BAR.lnk = ?

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: >> 彩信发送 << - res://C:\PROGRA~1\MMSASS~1\Mmsass~1.dll/mms.htm

O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\geturl.htm

O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\getallurl.htm

O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm

O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm

O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm

O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm

O8 - Extra context menu item: 用炫彩图铃发送该图片 - C:\Program Files\CaiShow Tech\CaiShow\SendMMS.htm

O8 - Extra context menu item: 访问通用网址 - C:\Program Files\CNNIC\Cdn\cnnic.htm

O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE

O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE

O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll

O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll

O23 - Service: Sample NT Service (SampleService) - Unknown owner - C:\WINDOWS\NTService.exe (file missing)

O23 - Service: Remote Log - Unknown owner - C:\WINDOWS\system32\ServeHost.exe (file missing)

O23 - Service: Virus Clean Service - 北京日月光华软件有限责任公司 - C:\Program Files\rygh\vc\smss.exe

Close ALL windows and browsers except HijackThis and click "Fix checked"




Delete these Files if listed:
C:\Program Files\TENCENT\Adplus\SSAddr.dll
C:\WINDOWS\system32\reshtm.dll
C:\WINDOWS\Downlo~1\h72.dll
C:\WINDOWS\Downlo~1\ryq431.dll
C:\WINDOWS\system32\ssup.dll
C:\WINDOWS\system32\services.dll
C:\Program Files\Thunder Network\Thunder\ThunderShell.exe
C:\WINDOWS\systeme.exe <–Be careful, look at the spelling.
C:\Program Files\SearchNet\ServeUp.exe
C:\Program Files\rygh\fw\vfw.exe
C:\Program Files\DeskAdTop\Run.dll <–Only from this location
C:\Program Files\TENCENT\Adplus\stup.exe
c:\program Files\易虎\MyShares.exe
C:\WINDOWS\system32\Upsrv.dl



Delete these folders if listed:
C:\Program Files\rygh
C:\Program Files\SearchNet
C:\Program Files\Thunder Network
C:\Program Files\DeskAdTop
C:\Program Files\TENCENT\Adplus
C:\Program Files\Tencent\QQ
C:\Program Files\TENCENT




Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
This program is for XP and Windows 2000 only
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.


Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

Hello, I followed your instruction, after hajack this remover, I got this message: UNEXPECTED ERROR OCURRED!

Error #52 (Bad file name or number) in Sub GetlongPath(?.exe)

Please send report to [removed], mentioning what you were doing, and what version of windows you have.
This message has been copied to your clipboard.
Second: when I try to deleted folders C:\program files\rygh, i got this message: problem verm.dll

when i start computer before i have message:problem. C:\windows\system32\upsrv.dll, now this message is gone. i send you new hijack log, thank you so much!
Logfile of HijackThis v1.99.1
Scan saved at 18:21:45, on 2006-7-21
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\FixCamera.exe
C:\WINDOWS\vsnpstd.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\VIPTray.exe
C:\WINDOWS\System32\VIPTray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.138\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v14.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: IEMonitor Class - {08A312BB-5409-49FC-9347-54BB7D069AC6} - C:\Program Files\DeskAdTop\deskipn.dll
O2 - BHO: BrowserHelper Class - {2D99E8F4-56B7-457B-9A92-61B5D247D263} - C:\WINDOWS\system32\WinDefendor.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DragSearch BHO - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Alexa - {3CEFF6CD-6F08-4e4d-BCCD-FF7415288C3B} - C:\WINDOWS\system32\SHDOCVW.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [bgswitch] C:\WINDOWS\system32\bgswitch.exe
O4 - Global Startup: IE-BAR.lnk = C:\WINDOWS\system32\rundll32.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm
O9 - Extra button: 免费精彩视频超流畅在线观看 - {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com (file missing)
O9 - Extra 'Tools' menuitem: 播霸电视 - {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java 控制台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.tomatolei.com (file missing)
O9 - Extra 'Tools' menuitem: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.tomatolei.com (file missing)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: 中国最大小区互动平台 - {bf80e5ce-44f9-4954-9ec9-ca5bb86346cd} - http://www.hiu.cn (file missing)
O11 - Options group: [CDNCLIENT] 中文上网
O14 - IERESET.INF: START_PAGE_URL=http://www.tomatolei.com
O16 - DPF: {29710C4C-4F0F-4A36-8312-CB5614829804} (DriverDetectiveNonMembers.nonmembers) - http://www.drivershq.com/files/cab/nonmemb…etective-nm.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1139452948525
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} (pCastPanel Class) - http://cache10.itv.mop.com/pCastCtl-1.0.0.88_signed.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2F28C5A2-B5EB-4568-B53A-16C19A33CD39}: NameServer = 61.136.241.34 202.103.0.117
O17 - HKLM\System\CS1\Services\Tcpip\..\{2F28C5A2-B5EB-4568-B53A-16C19A33CD39}: NameServer = 61.136.241.34 202.103.0.117
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Sample NT Service (SampleService) - Unknown owner - C:\WINDOWS\NTService.exe (file missing)
O23 - Service: Te1net - Unknown owner - C:\WINDOWS\System32\VIPTray.exe
O23 - Service: VIPTray - Unknown owner - C:\WINDOWS\System32\VIPTray.exe

Hello! After i followed your instruction, my computer working much better now. appreciate your help!
This is my new hijack this log, thank you from China!


Logfile of HijackThis v1.99.1
Scan saved at 10:49:09, on 2006-7-22
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\FixCamera.exe
C:\WINDOWS\vsnpstd.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\VIPTray.exe
C:\WINDOWS\System32\VIPTray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Windows NT\Pinball\PINBALL.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.984\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v14.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DragSearch BHO - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [bgswitch] C:\WINDOWS\system32\bgswitch.exe
O4 - Global Startup: IE-BAR.lnk = C:\WINDOWS\system32\rundll32.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: 免费精彩视频超流畅在线观看 - {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com (file missing)
O9 - Extra 'Tools' menuitem: 播霸电视 - {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java 控制台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.tomatolei.com (file missing)
O9 - Extra 'Tools' menuitem: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.tomatolei.com (file missing)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: 中国最大小区互动平台 - {bf80e5ce-44f9-4954-9ec9-ca5bb86346cd} - http://www.hiu.cn (file missing)
O11 - Options group: [CDNCLIENT] 中文上网
O14 - IERESET.INF: START_PAGE_URL=http://www.tomatolei.com
O16 - DPF: {29710C4C-4F0F-4A36-8312-CB5614829804} (DriverDetectiveNonMembers.nonmembers) - http://www.drivershq.com/files/cab/nonmemb…etective-nm.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1139452948525
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} (pCastPanel Class) - http://cache10.itv.mop.com/pCastCtl-1.0.0.88_signed.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2F28C5A2-B5EB-4568-B53A-16C19A33CD39}: NameServer = 61.136.241.34 202.103.0.117
O17 - HKLM\System\CS1\Services\Tcpip\..\{2F28C5A2-B5EB-4568-B53A-16C19A33CD39}: NameServer = 61.136.241.34 202.103.0.117
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Sample NT Service (SampleService) - Unknown owner - C:\WINDOWS\NTService.exe (file missing)
O23 - Service: Te1net - Unknown owner - C:\WINDOWS\System32\VIPTray.exe
O23 - Service: VIPTray - Unknown owner - C:\WINDOWS\System32\VIPTray.exe

Hello! after i run AVG, he found one Trojan in VIP Tray.exe, can you tell me what VIP Tray is? if i need it or should deleted? Thank you so much!!!!!!!!!!!!

Here is my HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 10:46:55, on 2006-7-23
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\FixCamera.exe
C:\WINDOWS\vsnpstd.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\Sogou PXP\p2psvr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.219\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v14.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: BrowserHelper Class - {2D99E8F4-56B7-457B-9A92-61B5D247D263} - C:\WINDOWS\system32\WinDefendor.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DragSearch BHO - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [bgswitch] C:\WINDOWS\system32\bgswitch.exe
O4 - Global Startup: IE-BAR.lnk = C:\WINDOWS\system32\rundll32.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: 免费精彩视频超流畅在线观看 - {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com (file missing)
O9 - Extra 'Tools' menuitem: 播霸电视 - {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java 控制台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.tomatolei.com (file missing)
O9 - Extra 'Tools' menuitem: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.tomatolei.com (file missing)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: 中国最大小区互动平台 - {bf80e5ce-44f9-4954-9ec9-ca5bb86346cd} - http://www.hiu.cn (file missing)
O11 - Options group: [CDNCLIENT] 中文上网
O14 - IERESET.INF: START_PAGE_URL=http://www.tomatolei.com
O16 - DPF: {05C1004E-2596-48E5-8E26-39362985EEB9} (MMCPlayer Class) - http://p3p.sogou.com/MMCShell.cab
O16 - DPF: {29710C4C-4F0F-4A36-8312-CB5614829804} (DriverDetectiveNonMembers.nonmembers) - http://www.drivershq.com/files/cab/nonmemb…etective-nm.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1139452948525
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} (pCastPanel Class) - http://cache10.itv.mop.com/pCastCtl-1.0.0.88_signed.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2F28C5A2-B5EB-4568-B53A-16C19A33CD39}: NameServer = 61.136.241.34 202.103.0.117
O17 - HKLM\System\CS1\Services\Tcpip\..\{2F28C5A2-B5EB-4568-B53A-16C19A33CD39}: NameServer = 61.136.241.34 202.103.0.117
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: P4P Service - Sohu.com Inc. - C:\Program Files\Common Files\Sogou PXP\p2psvr.exe
O23 - Service: Te1net - Unknown owner - C:\WINDOWS\System32\VIPTray.exe (file missing)
O23 - Service: VIPTray - Unknown owner - C:\WINDOWS\System32\VIPTray.exe (file missing)

Hello! My only problem now is i can not transfer the web from address bar except i type in. and sometimes i open several windows when i want close one of them but all windows been shut down. Thanks so much for help me!

Here is my HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 11:51:25, on 2006-7-24
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\FixCamera.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\vsnpstd.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX19.594\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: BrowserHelper Class - {2D99E8F4-56B7-457B-9A92-61B5D247D263} - C:\WINDOWS\system32\WinDefendor.dll
O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll
O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINDOWS\DOWNLO~1\CnsHook.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [YLive.exe] C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - HKLM\..\Run: [CnsMin] Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32
O4 - HKLM\..\Run: [helper.dll] C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [yassistse] "C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [bgswitch] C:\WINDOWS\system32\bgswitch.exe
O4 - Global Startup: IE-BAR.lnk = C:\WINDOWS\system32\rundll32.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE (file missing)
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE (file missing)
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.zs.yahoo.com/cnsbutton.htm?sourc…mp;btn=yahoomsg (file missing)
O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?sourc…&btn=repair (file missing)
O9 - Extra 'Tools' menuitem: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?sourc…&btn=repair (file missing)
O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?sourc…s&btn=clean (file missing)
O9 - Extra 'Tools' menuitem: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?sourc…s&btn=clean (file missing)
O11 - Options group: [!CNS] 网络实名
O11 - Options group: [CDNCLIENT] 中文上网
O16 - DPF: {05C1004E-2596-48E5-8E26-39362985EEB9} (MMCPlayer Class) - http://p3p.sogou.com/MMCShell.cab
O16 - DPF: {29710C4C-4F0F-4A36-8312-CB5614829804} (DriverDetectiveNonMembers.nonmembers) - http://www.drivershq.com/files/cab/nonmemb…etective-nm.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1139452948525
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} (pCastPanel Class) - http://cache10.itv.mop.com/pCastCtl-1.0.0.88_signed.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2F28C5A2-B5EB-4568-B53A-16C19A33CD39}: NameServer = 61.136.241.34 202.103.0.117
O17 - HKLM\System\CS1\Services\Tcpip\..\{2F28C5A2-B5EB-4568-B53A-16C19A33CD39}: NameServer = 61.136.241.34 202.103.0.117
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

Hello! After i followed your instruction, but i still can't transit the website from my homepage in the past website address( no respones). but when i type in , is very fast coming up. second problem: I lost the volume icon at the right down corner so that i can't adjust volume easily. Thanks for helping!!!!!!!!!!

This is new HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 22:32:54, on 2006-7-24
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\FixCamera.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\vsnpstd.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.193\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll
O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINDOWS\DOWNLO~1\CnsHook.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [YLive.exe] C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - HKLM\..\Run: [CnsMin] Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32
O4 - HKLM\..\Run: [yassistse] "C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [bgswitch] C:\WINDOWS\system32\bgswitch.exe
O8 - Extra context menu item: 添加到雅虎收藏+ - http://myweb.cn.yahoo.com/post.html?F=D2_A
O9 - Extra button: Yahoo 3.5G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.zs.yahoo.com/cnsbutton.htm?sourc…p;btn=yahoomail (file missing)
O9 - Extra button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://cn.zs.yahoo.com/cnsbutton.htm?sourc…&btn=taobao (file missing)
O9 - Extra button: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://cn.zs.yahoo.com/cnsbutton.htm?sourc…amp;btn=yassist (file missing)
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.zs.yahoo.com/cnsbutton.htm?sourc…mp;btn=yahoomsg (file missing)
O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?sourc…&btn=repair (file missing)
O9 - Extra 'Tools' menuitem: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?sourc…&btn=repair (file missing)
O16 - DPF: {05C1004E-2596-48E5-8E26-39362985EEB9} (MMCPlayer Class) - http://p3p.sogou.com/MMCShell.cab
O16 - DPF: {29710C4C-4F0F-4A36-8312-CB5614829804} (DriverDetectiveNonMembers.nonmembers) - http://www.drivershq.com/files/cab/nonmemb…etective-nm.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1139452948525
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} (pCastPanel Class) - http://cache10.itv.mop.com/pCastCtl-1.0.0.88_signed.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2F28C5A2-B5EB-4568-B53A-16C19A33CD39}: NameServer = 61.136.241.34 202.103.0.117
O17 - HKLM\System\CS1\Services\Tcpip\..\{2F28C5A2-B5EB-4568-B53A-16C19A33CD39}: NameServer = 61.136.241.34 202.103.0.117
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: cdl - {3DD53D40-7B8B-11D0-B013-00AA0059CE02} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll
O18 - Protocol: file - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ftp - {79EAC9E3-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: gopher - {79EAC9E4-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: http - {79EAC9E2-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: https - {79EAC9E5-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ipp - (no CLSID) - (no file)
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: local - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: mailto - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: mhtml - {05300401-BCBC-11D0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll
O18 - Protocol: mk - {79EAC9E6-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll
O18 - Protocol: msdaipp - (no CLSID) - (no file)
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe