mljjj.dll

Need help in removing mljjj.dll, thanks

From Hijackthis -

Logfile of HijackThis v1.99.1
Scan saved at 20:28:43, on 18/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Windows Defender\MsMpEng.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\ntl\ntl Netguard\fws.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\taskswitch.exe
E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
E:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
E:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\USBIR\FrontPanelIo.exe
E:\Program Files\VIA\RAID\raid_tool.exe
E:\WINDOWS\SOUNDMAN.EXE
E:\WINDOWS\system32\LVCOMSX.EXE
E:\Program Files\Logitech\Video\LogiTray.exe
E:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
E:\PROGRA~1\RETROS~1\RETROS~1.1\RetroExpress.exe
E:\Program Files\iTunes\iTunesHelper.exe
E:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
E:\Program Files\ntl\ntl Netguard\RPS.exe
E:\Program Files\QuickTime\qttask.exe
E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
E:\Program Files\Windows Defender\MSASCui.exe
E:\Program Files\Instant Messenger Names\IM-svr.EXE
E:\Program Files\D-Link AirPlus\AirPlus.exe
E:\Program Files\FinePixViewer\QuickDCF.exe
E:\Program Files\Logitech\Video\FxSvr2.exe
E:\Program Files\SystemControl\SystemControl\SystemControl.exe
E:\Program Files\Executive Software\Diskeeper\DkService.exe
E:\Program Files\Common Files\Command Software\dvpapi.exe
E:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
E:\WINDOWS\system32\ZoneLabs\vsmon.exe
E:\Program Files\iPod\bin\iPodService.exe
E:\WINDOWS\System32\wbem\wmiapsrv.exe
E:\WINDOWS\system32\wscntfy.exe
E:\PROGRA~1\RETROS~1\RETROS~1.1\retrorun.exe
E:\Program Files\Internet Explorer\iexplore.exe
E:\Temp\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - E:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [CoolSwitch] E:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "E:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [Easy-PrintToolBox] E:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ATIPTA] E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DataLayer] E:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] E:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [USBIR] c:\Program Files\USBIR\FrontPanelIo.exe
O4 - HKLM\..\Run: [RaidTool] E:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LVCOMSX] E:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] E:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] E:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [MaxtorOneTouch] E:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
O4 - HKLM\..\Run: [RetroExpress] E:\PROGRA~1\RETROS~1\RETROS~1.1\RetroExpress.exe /h
O4 - HKLM\..\Run: [iTunesHelper] "E:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ntl Netguard] "E:\Program Files\ntl\ntl Netguard\RPS.exe"
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Zone Labs Client] "E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Windows Defender] "E:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [REGSHAVE] E:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [IMprocess] E:\Program Files\Instant Messenger Names\IM-svr.EXE
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\RunServices: [Windows Recylinder Check] ypqxqtwqxd.exe
O4 - Global Startup: D-Link AirPlus.lnk = ?
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SystemControl.lnk = E:\Program Files\SystemControl\SystemControl\SystemControl.exe
O8 - Extra context menu item: &Google Search - res://E:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://E:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://E:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://E:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://E:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://E:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://E:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://E:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Similar Pages - res://E:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://E:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.amaena.com
O15 - Trusted Zone: http://locator.cdn.imageservr.com
O15 - Trusted Zone: http://locator1.cdn.imagesrvr.com
O15 - Trusted Zone: http://scanner.sysprotect.com
O15 - Trusted Zone: http://*.systemdoctor.com
O15 - Trusted Zone: http://www.winantivirus.com
O15 - Trusted Zone: http://www.winantiviruspro.com
O15 - Trusted Zone: http://download.cdn.winsoftware.com
O15 - Trusted IP range: http://202.67.220.225
O15 - Trusted IP range: http://59.148.220.121
O15 - Trusted IP range: http://62.4.84.53
O15 - Trusted IP range: http://82.98.235.58
O15 - Trusted IP range: http://85.12.25.90
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://downloadcenter.samsung.com/content/…trolLite_EN.cab
O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://www.windowsonecare.com/install/cli/…nSSWebAgent.CAB
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab31267.cab
O16 - DPF: {38D63471-E630-4492-A986-B8C48B79F2F8} (CVideoEgg_ActiveXCtl Object) - http://update.videoegg.com/wintel/VideoEggPublisher.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://bananasarecrazy.spaces.live.com//Ph…ad/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1109626517669
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {A243F6C2-34D2-4549-BCCD-A7BEF759B236} (Seekford Solutions, Inc.'s ssiPictureUploader Control) - http://img.funtigo.com/images/uploader/ssi…ureUploader.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…5/installer.exe
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "E:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: Ati HotKey Poller - Unknown owner - E:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - E:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - E:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: Radialpoint Service (FWS) - Radialpoint Inc. - E:\Program Files\ntl\ntl Netguard\fws.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - E:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MaxSyncService (NTService1) - - E:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: Pml Driver HPZ12 - HP - E:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Retrospect Express HD Launcher (RetroExpLauncher) - EMC Dantz - E:\PROGRA~1\RETROS~1\RETROS~1.1\retrorun.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - E:\WINDOWS\system32\ZoneLabs\vsmon.exe

From ewido in safe mode

wido anti-spyware - Scan Report
———————————————————

+ Created at: 22:06:24 18/08/2006

+ Scan result:



E:\WINDOWS\system32\anmmnhet.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : No action taken.
E:\WINDOWS\system32\assgqaub.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : No action taken.
E:\WINDOWS\system32\tgnydnfm.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : No action taken.
E:\Program Files\Common Files\PestPatrol\Quarantine\ZQ13.tmp -> TrackingCookie.247realmedia : No action taken.
E:\Program Files\Common Files\PestPatrol\Quarantine\ZQ15E.tmp -> TrackingCookie.2o7 : No action taken.
E:\Program Files\Common Files\PestPatrol\Quarantine\ZQ162.tmp -> TrackingCookie.2o7 : No action taken.
E:\Program Files\Common Files\PestPatrol\Quarantine\ZQ231.tmp -> TrackingCookie.2o7 : No action taken.
E:\Program Files\Common Files\PestPatrol\Quarantine\ZQ32.tmp -> TrackingCookie.2o7 : No action taken.
E:\Program Files\Common Files\PestPatrol\Quarantine\ZQ55.tmp -> TrackingCookie.2o7 : No action taken.
E:\Program Files\Common Files\PestPatrol\Quarantine\ZQ8F.tmp -> TrackingCookie.2o7 : No action taken.
E:\Program Files\Common Files\PestPatrol\Quarantine\ZQ90.tmp -> TrackingCookie.2o7 : No action taken.
E:\Program Files\Common Files\PestPatrol\Quarantine\ZQB3.tmp -> TrackingCookie.2o7 : No action taken.
E:\Program Files\Common Files\PestPatrol\Quarantine\ZQD7.tmp -> TrackingCookie.2o7 : No action taken.
E:\Program Files\Common Files\PestPatrol\Quarantine\ZQD8.tmp -> TrackingCookie.Clickbank : No action taken.
E:\Program Files\Common Files\PestPatrol\Quarantine\ZQD9.tmp -> TrackingCookie.Com : No action taken.
E:\Documents and Settings\Black\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : No action taken.
E:\Program Files\Common Files\PestPatrol\Quarantine\ZQ2B.tmp -> TrackingCookie.Tradedoubler : No action taken.
E:\Program Files\Common Files\PestPatrol\Quarantine\ZQ34E.tmp -> TrackingCookie.Tradedoubler : No action taken.
E:\Program Files\Common Files\PestPatrol\Quarantine\ZQ539.tmp -> TrackingCookie.Tradedoubler : No action taken.
E:\Program Files\Common Files\PestPatrol\Quarantine\ZQDB.tmp -> TrackingCookie.Tradedoubler : No action taken.


::Report end

Still think I have a problem, when I rebooted in safe mode could not see ypqxqtwqxd.exe even after showing hidden files. I have cut a pasted the restults from "foolyou.exe" -

Logfile of HijackThis v1.99.1
Scan saved at 18:31:43, on 23/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Windows Defender\MsMpEng.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\ntl\ntl Netguard\fws.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\taskswitch.exe
E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
E:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
E:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\USBIR\FrontPanelIo.exe
E:\Program Files\VIA\RAID\raid_tool.exe
E:\WINDOWS\SOUNDMAN.EXE
E:\WINDOWS\system32\LVCOMSX.EXE
E:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
E:\Program Files\Logitech\Video\LogiTray.exe
E:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
E:\PROGRA~1\RETROS~1\RETROS~1.1\RetroExpress.exe
E:\Program Files\iTunes\iTunesHelper.exe
E:\Program Files\ntl\ntl Netguard\RPS.exe
E:\Program Files\QuickTime\qttask.exe
E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
E:\Program Files\Windows Defender\MSASCui.exe
E:\Program Files\Instant Messenger Names\IM-svr.EXE
E:\Program Files\ewido anti-spyware 4.0\ewido.exe
E:\Program Files\D-Link AirPlus\AirPlus.exe
E:\Program Files\Logitech\Video\FxSvr2.exe
E:\Program Files\FinePixViewer\QuickDCF.exe
E:\Program Files\SystemControl\SystemControl\SystemControl.exe
E:\Program Files\Executive Software\Diskeeper\DkService.exe
E:\Program Files\Common Files\Command Software\dvpapi.exe
E:\Program Files\ewido anti-spyware 4.0\guard.exe
E:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
E:\WINDOWS\system32\ZoneLabs\vsmon.exe
E:\Program Files\iPod\bin\iPodService.exe
E:\WINDOWS\System32\wbem\wmiapsrv.exe
E:\WINDOWS\system32\wscntfy.exe
E:\PROGRA~1\RETROS~1\RETROS~1.1\retrorun.exe
E:\Temp\hijackthis\FoolYou.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - E:\Program Files\ntl\ntl Netguard\pkR.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Form Filler BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - E:\Program Files\ntl\ntl Netguard\FBHR.dll
O2 - BHO: (no name) - {6B548D04-F1A9-45EA-80C4-DB5A4D6EF03A} - E:\WINDOWS\system32\mljjj.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - E:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [CoolSwitch] E:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "E:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [Easy-PrintToolBox] E:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ATIPTA] E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DataLayer] E:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] E:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [USBIR] c:\Program Files\USBIR\FrontPanelIo.exe
O4 - HKLM\..\Run: [RaidTool] E:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LVCOMSX] E:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] E:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] E:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [MaxtorOneTouch] E:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
O4 - HKLM\..\Run: [RetroExpress] E:\PROGRA~1\RETROS~1\RETROS~1.1\RetroExpress.exe /h
O4 - HKLM\..\Run: [iTunesHelper] "E:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ntl Netguard] "E:\Program Files\ntl\ntl Netguard\RPS.exe"
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Zone Labs Client] "E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Windows Defender] "E:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [REGSHAVE] E:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [IMprocess] E:\Program Files\Instant Messenger Names\IM-svr.EXE
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [!ewido] "E:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - Global Startup: D-Link AirPlus.lnk = ?
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SystemControl.lnk = E:\Program Files\SystemControl\SystemControl\SystemControl.exe
O8 - Extra context menu item: &Google Search - res://e:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://e:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://e:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://e:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://E:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://E:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://E:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://E:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Similar Pages - res://e:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://e:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://downloadcenter.samsung.com/content/…trolLite_EN.cab
O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://www.windowsonecare.com/install/cli/…nSSWebAgent.CAB
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab31267.cab
O16 - DPF: {38D63471-E630-4492-A986-B8C48B79F2F8} (CVideoEgg_ActiveXCtl Object) - http://update.videoegg.com/wintel/VideoEggPublisher.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://bananasarecrazy.spaces.live.com//Ph…ad/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1109626517669
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {A243F6C2-34D2-4549-BCCD-A7BEF759B236} (Seekford Solutions, Inc.'s ssiPictureUploader Control) - http://img.funtigo.com/images/uploader/ssi…ureUploader.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…5/installer.exe
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "E:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: mljjj - E:\WINDOWS\system32\mljjj.dll
O20 - Winlogon Notify: WgaLogon - E:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - E:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - E:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - E:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - E:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Radialpoint Service (FWS) - Radialpoint Inc. - E:\Program Files\ntl\ntl Netguard\fws.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - E:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MaxSyncService (NTService1) - - E:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: Pml Driver HPZ12 - HP - E:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Retrospect Express HD Launcher (RetroExpLauncher) - EMC Dantz - E:\PROGRA~1\RETROS~1\RETROS~1.1\retrorun.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - E:\WINDOWS\system32\ZoneLabs\vsmon.exe

from Security Task Manager I have -

Security Task Manager
——————————————————————————–
Computer STEVEN, Benutzer Black, 23/08/2006 18:47:45
Name Rating PID CPU Memory Active File Type Start Title, Description Manufacturer : product
mljjj.dll 100% E:\WINDOWS\system32\mljjj.dll Internet when Internet Explorer starts (Browser Extension) -
Logitech QuickCam Startup Application 71% E:\Program Files\Logitech\Video\ISStart.exe Program when Windows starts, Registry: Machine\Run LogitechVideoRepair (not active) Logitech Inc. : Logitech QuickCam
Java™ 2 Platform Standard Edition binary 66% E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll Internet when Internet Explorer starts SSVHelper Class (Browser Extension) Sun Microsystems, Inc. : Java™ 2 Platform Standard Edition 5.0 Update 6
FrontPanelIo.exe 64% 1104 2.3 MB C:\Program Files\USBIR\FrontPanelIo.exe Program 18:16:54 when Windows starts, Registry: Machine\Run FrontPanelIo -
Messenger Plus! Process Monitor 60% E:\WINDOWS\system32\MsgPlusLoader.dll DLL when Windows starts, Registry: Machine\AppInit_DLLs Patchou : Messenger Plus! 3. Note: this DLL does nothing but wait for a MSN Messenger (7.5 or below) or Windows Messenger window to be opened in the current process. It is loaded automatically by Windows in every process that creates at least one window.

Thanks for your help
LVCom Server 60% 1128 4.3 MB E:\WINDOWS\system32\LVCOMSX.EXE Program 18:16:55 when Windows starts, Registry: Machine\Run LVComSXWnd Logitech Inc. : Logitech QuickCam
GoogleToolbar 52% e:\program files\google\googletoolbar2.dll Internet when Internet Explorer starts Google IE Client Toolbar - Google Toolbar Helper (Browser Extension) Google Inc. : Google Toolbar for IE
{BDF3E430-B101-42AD-A544-FADC6B084872} 52% Internet when Internet Explorer starts (Browser Extension) -
ImageStudio Tray Application 49% 1208 7.5 MB E:\Program Files\Logitech\Video\LogiTray.exe Program 18:16:55 when Windows starts, Registry: Machine\Run medusa_callbackpostmessage_579D20BC-1CFA-46b9-8A42-9D244829ABB5 Logitech Inc. : Logitech QuickCam
Instant Messenger Names 49% 244 2.5 MB E:\Program Files\Instant Messenger Names\IM-svr.EXE Program 18:16:57 when Windows starts, Registry: Machine\Run Instant Messenger Names Instant Messenger Names : Instant Messenger Names
Diskeeper Professional Edition 44% 2344 6.6 MB E:\Program Files\Executive Software\Diskeeper\DkService.exe Program 18:17:04 from Services and Controller app DKSERVICE.EXE Executive Software International, Inc. : Diskeeper ™ Disk Defragmenter
QuickCam Framework Server 42% 688 4.5 MB E:\Program Files\Logitech\Video\FxSvr2.exe Program 18:16:57 from Generic Host Process for Win32 Services medusa_callbackpostmessage_579D20BC-1CFA-46b9-8A42-9D244829ABB5 Logitech Inc. : Logitech QuickCam
ewido anti-spyware guard 42% 2472 8.3 MB 0:08 E:\Program Files\ewido anti-spyware 4.0\guard.exe Program 18:17:05 from Services and Controller app Anti-Malware Development a.s. : ewido anti-spyware
ULCDRSvr 42% 2836 0.9 MB E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe Program 18:17:05 from Services and Controller app Ulead Systems, Inc. : Ulead Systems ULCDRSvr
Alt-Tab Task Switcher Powertoy for Windows XP 40% 1016 1.9 MB E:\WINDOWS\system32\taskswitch.exe Program 18:16:54 when Windows starts, Registry: Machine\Run Lou Amadio :
ntl Netguard 39% E:\Program Files\ntl\ntl Netguard\pkR.dll Internet when Internet Explorer starts Radialpoint 5.2.0 - Pop-Up Blocker BHO · Pk.PopKill.1 (Browser Extension) Radialpoint Inc. : Radialpoint Security Services 5.2.0
ntl Netguard 39% E:\Program Files\ntl\ntl Netguard\FBHR.dll Internet when Internet Explorer starts Radialpoint 5.2.0 - Form Filler BHO · FreeBHO.ZKBho.1 (Browser Extension) Radialpoint Inc. : Radialpoint Security Services 5.2.0
"%1" /s 39% "%1" /s Program Starts when programs are launched (*.scr), Registry: Machine\scrfile\command (Starts when programs are launched!) (not active) -
Nokia PC Suite 34% 1068 6.8 MB E:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe Program 18:16:54 when Windows starts, Registry: Machine\Run DataLayer 2.0 Module Nokia Mobile Phones Ltd. : Nokia PC Suite
Maxtor OneTouch III 34% 1228 3.9 MB 0:02 E:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe Program 18:16:55 when Windows starts, Registry: Machine\Run Maxtor OneTouch Detection Maxtor Corporation : Maxtor OneTouch II
iTunes 34% 1800 3.8 MB E:\Program Files\iTunes\iTunesHelper.exe Program 18:16:55 when Windows starts, Registry: Machine\Run iTunesHelper Module - iTunes Helper Apple Computer, Inc. : iTunes
Adobe Reader 7.0.8 32% E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll Internet when Internet Explorer starts Adobe Acrobat IE Helper Version 7.0 for ActiveX - AcroIEHelper.AcroIEHlprObj.1 (Browser Extension) Adobe Systems, Incorporated : AcroIEHelper Library
Spybot - Search & Destroy 32% E:\Program Files\Spybot - Search & Destroy\SDHelper.dll Internet when Internet Explorer starts Bad download blocker - Blocks URLs that could install spyware, malware etc. (Browser Extension) Safer Networking Ltd. : Spybot - Search & Destroy
Maxtor OneTouch III 32% 2568 2.6 MB E:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe Program 18:17:05 from Services and Controller app SyncServices : SyncServices
ntl Netguard 27% 1684 5.1 MB E:\Program Files\ntl\ntl Netguard\fws.exe Program 18:16:48 from Services and Controller app Radialpoint 5.2.0 Radialpoint Inc. : Radialpoint Security Services 5.2.0
Nokia PC Suite 27% 1172 5.1 MB E:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe Program 18:16:55 from Generic Host Process for Win32 Services ServiceLayer Module - USB Media Module Nokia. : Nokia Connectivity Library
iPod for Windows 2006-03-23 27% 3444 3.7 MB 0:01 E:\Program Files\iPod\bin\iPodService.exe Program 18:17:20 from Services and Controller app iPodService Module Apple Computer, Inc. : iTunes
Retrospect Express HD 1.1 27% 2664 E:\Program Files\Retrospect\Retrospect Express HD 1.1\retrorun.exe Program 18:18:10 from Services and Controller app Retro SMART Class EMC Dantz : Retrospect Express HD
Realtek Sound Manager 21% 1120 2.4 MB E:\WINDOWS\SOUNDMAN.EXE Taskicon 18:16:54 when Windows starts, Registry: Machine\Run ALSMTray, Sound Effect - Realtek AC97 Audio Sound Manager Realtek Semiconductor Corp. : Realtek Sound Manager
BJPSMAIN 21% E:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE Program when Windows starts, Registry: Machine\Run Easy-PrintToolBox (not active) CANON INC. : BJPSMAIN.EXE
NeroCheck 21% E:\WINDOWS\system32\NeroCheck.exe Program when Windows starts, Registry: Machine\Run NeroFilterCheck - Now create the LowerFilter entry if does not exist. (not active) Ahead Software Gmbh : Ahead Software Gmbh NeroCheck
Shaving Registry 21% E:\Program Files\REGSHAVE\REGSHAVE.EXE Program when Windows starts, Registry: Machine\Run REGSHAVE (not active) FUJI PHOTO FILM CO., LTD. : Registry Shaver
CmiCnfg DLL 21% E:\WINDOWS\system\cmicnfg.cpl Program when Windows starts, Registry: Machine\Run Cmaudio (not active) C-Media Corporation : CmiCnfg Dynamic Link Library
Windows Defender 21% 1600 12.9 MB 0:04 E:\Program Files\Windows Defender\MsMpEng.exe Program 18:16:48 from Services and Controller app Service Executable Microsoft Corporation : Windows Defender
ATI Desktop Control Panel 16% 1064 4.0 MB E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe Taskicon 18:16:54 when Windows starts, Registry: Machine\Run ATI Tray Icon Application, Screen: 1024 x 768, Color: 32 bpp ATI Technologies, Inc. : ATI Desktop Component
VIA RAID Tool 16% 1112 3.4 MB E:\Program Files\VIA\RAID\raid_tool.exe Taskicon 18:16:54 when Windows starts, Registry: Machine\Run VIA Technologies : VIA RAID Tool
QuickTime Task 16% 1980 E:\Program Files\QuickTime\qttask.exe Taskicon 18:16:56 when Windows starts, Registry: Machine\Run QTPlayer Tray Icon, QuickTime Apple Computer, Inc. : QuickTime
ewido anti-spyware 16% 344 0:02 E:\Program Files\ewido anti-spyware 4.0\ewido.exe Taskicon 18:16:57 when Windows starts, Registry: Machine\Run ewido anti-spyware 4.0 Anti-Malware Development a.s. : ewido anti-spyware
WLAN Adapter Utility 16% 116 E:\Program Files\D-Link AirPlus\AirPlus.exe Taskicon 18:16:57 when Windows starts, Registry: Machine\Common Startup D-Link AirPlus 22 Mbps Wireless LAN Monitor, D-Link AirPlus, Signal Strength : Good D-Link : D-Link AirPlus
Exif Launcher 16% 724 E:\Program Files\FinePixViewer\QuickDCF.exe Taskicon 18:16:58 when Windows starts, Registry: Machine\Common Startup TrayIconHandler, Exif Launcher FUJI PHOTO FILM CO., LTD. : FinePixViewer
SystemControl Utility 16% 920 E:\Program Files\SystemControl\SystemControl\SystemControl.exe Taskicon 18:16:58 when Windows starts, Registry: Machine\Common Startup BIOSTAR System Control Utility BIOSTAR MICROTECH INT'L CORP. : SystemControl Utility
Windows User Mode Driver Manager 16% 2856 E:\WINDOWS\system32\wdfmgr.exe Program 18:17:06 from Services and Controller app Microsoft Corporation : Microsoft® Windows® Operating System
Authentium 13% 2364 0:01 E:\Program Files\Common Files\Command Software\dvpapi.exe Program 18:17:04 from Services and Controller app Authentium, Inc. : Command AntiVirus for Windows
Retrospect Express HD 1.1 11% 1740 0:02 E:\Program Files\Retrospect\Retrospect Express HD 1.1\RetroExpress.exe Taskicon 18:16:55 when Windows starts, Registry: Machine\Run - GDI+ Window, Retrospect Express HD will back up selected files on Data (C… EMC Dantz Development Corporation : Retrospect Express HD
ZoneAlarm 8% 2892 0:09 E:\WINDOWS\system32\ZoneLabs\vsmon.exe Program 18:17:06 from Services and Controller app TrueVector Service Check Point Software Technologies Inc. : TrueVector Service
ntl Netguard 6% 1940 0:13 E:\Program Files\ntl\ntl Netguard\RPS.exe Taskicon 18:16:56 when Windows starts, Registry: Machine\Run {B99BDC50-EC0E-4005-96D9-EA7E481B3466}, ntl Netguard ntl : ntl Netguard
Diskeeper Professional Edition 6% E:\Program Files\Executive Software\Diskeeper\DkIcon.exe Program when Windows starts, Registry: Machine\Run DKICON.EXE - DiskeeperSystray (not active) Executive Software International, Inc. : Diskeeper ™ Disk Defragmenter
LSA Shell (Export Version) 6% 1324 1.7 MB 0:01 E:\WINDOWS\system32\lsass.exe Program 18:16:47 from Windows NT Logon Application Microsoft Corporation : Microsoft® Windows® Operating System
Generic Host Process for Win32 Services 6% 1560 4.3 MB E:\WINDOWS\system32\svchost.exe Program 18:16:48 from Services and Controller app Microsoft Corporation : Microsoft® Windows® Operating System
Generic Host Process for Win32 Services 6% 1640 22.7 MB 0:05 E:\WINDOWS\System32\svchost.exe Program 18:16:48 from Services and Controller app Microsoft Corporation : Microsoft® Windows® Operating System
Generic Host Process for Win32 Services 6% 1728 4.6 MB 0:01 E:\WINDOWS\System32\svchost.exe Program 18:16:48 from Services and Controller app Microsoft Corporation : Microsoft® Windows® Operating System
Generic Host Process for Win32 Services 6% 1860 4.3 MB E:\WINDOWS\System32\svchost.exe Program 18:16:49 from Services and Controller app Microsoft Corporation : Microsoft® Windows® Operating System
Application Layer Gateway Service 6% 1884 E:\WINDOWS\System32\alg.exe Program 18:17:26 from Services and Controller app Microsoft Corporation : Microsoft® Windows® Operating System
Microsoft Office 2000 SR-1 Professional 5% E:\Program Files\Microsoft Office\Office\OSA9.EXE Program when Windows starts, Registry: Machine\Common Startup Microsoft Office 2000 component (not active) Microsoft Corporation : Microsoft Office 2000
Windows NT Session Manager 3% 1160 0.4 MB E:\WINDOWS\System32\smss.exe Program 18:16:40 from System Microsoft Corporation : Microsoft® Windows® Operating System
Client Server Runtime Process 3% 1244 3.8 MB 0:04 E:\WINDOWS\system32\csrss.exe Program 18:16:45 from Windows NT Session Manager Microsoft Corporation : Microsoft® Windows® Operating System
Windows NT Logon Application 3% 1268 4.8 MB 0:03 E:\WINDOWS\system32\winlogon.exe Program 18:16:46 from Windows NT Session Manager Microsoft Corporation : Microsoft® Windows® Operating System
Services and Controller app 3% 1312 4.2 MB 0:07 E:\WINDOWS\system32\services.exe Program 18:16:47 from Windows NT Logon Application Microsoft Corporation : Microsoft® Windows® Operating System
Generic Host Process for Win32 Services 3% 1504 4.7 MB E:\WINDOWS\system32\svchost.exe Program 18:16:47 from Services and Controller app Microsoft Corporation : Microsoft® Windows® Operating System
Spooler SubSystem App 3% 404 4.8 MB E:\WINDOWS\system32\spoolsv.exe Program 18:16:50 from Services and Controller app Microsoft Corporation : Microsoft® Windows® Operating System
Generic Host Process for Win32 Services 3% 2792 E:\WINDOWS\System32\svchost.exe Program 18:17:05 from Services and Controller app Microsoft Corporation : Microsoft® Windows® Operating System
WMI Performance Adapter Service 3% 3544 E:\WINDOWS\System32\wbem\wmiapsrv.exe Program 18:17:21 from Services and Controller app Microsoft Corporation : Microsoft® Windows® Operating System
System 2% 4 0.2 MB 0:08 System Program Windows system process Microsoft : Windows
Nokia PC Suite 1% 1072 10.3 MB 0:01 E:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe Taskicon 18:16:54 when Windows starts, Registry: Machine\Run Launch Application Nokia : Launch Application
System idle 0% System idle Program Windows idle process Microsoft : Windows
Windows Defender 0% 2032 0:02 E:\Program Files\Windows Defender\MSASCui.exe Taskicon 18:16:56 when Windows starts, Registry: Machine\Run Windows Defender User Interface - Windows Defender (Beta 2), Windows Defender Microsoft Corporation : Windows Defender
ZoneAlarm 0% 2020 0:01 E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe Taskicon 18:16:56 when Windows starts, Registry: Machine\Run Zone Labs Client Check Point Software Technologies Inc. : Zone Labs Client
Security Task Manager 0% 3564 0:05 E:\Program Files\Security Task Manager\TaskMan.exe Program 18:32:40 from Windows Explorer Security Task Manager A. & M. Neuber Software : Security Task Manager
Windows Security Center Notification App 0% 3704 E:\WINDOWS\system32\wscntfy.exe Taskicon 18:17:22 from Generic Host Process for Win32 Services Windows Security Alerts Microsoft Corporation : Microsoft® Windows® Operating System
Windows Explorer 0% 836 39.0 MB 3:20 E:\WINDOWS\Explorer.EXE Program 18:16:53 hijackthis, Microsoft Corporation : Microsoft® Windows® Operating System
Notepad 0% 3792 E:\WINDOWS\system32\NOTEPAD.EXE Program 18:31:43 hijackthis - Notepad Microsoft Corporation : Microsoft® Windows® Operating System

Removed some files, but it is still there


VundoFix V6.0.1

Checking Java version…

Java version is 1.5.0.3

Java version is 1.5.0.6

Scan started at 21:07:44 23/08/2006

Listing files found while scanning….

No infected files were found.


Beginning removal…

VundoFix V6.1.2

Checking Java version…

Java version is 1.5.0.3

Java version is 1.5.0.6

Scan started at 21:10:04 23/08/2006

Listing files found while scanning….

E:\WINDOWS\system32\awtqnkh.dll
E:\WINDOWS\system32\mljhgdc.dll
E:\WINDOWS\system32\mljjj.dll
E:\WINDOWS\system32\jjjlm.ini
E:\WINDOWS\system32\jjjlm.bak1
E:\WINDOWS\system32\jjjlm.bak2
E:\WINDOWS\system32\wvutqpq.dll
E:\WINDOWS\system32\gctqdtje.exe

Beginning removal…

Attempting to delete E:\WINDOWS\system32\awtqnkh.dll
E:\WINDOWS\system32\awtqnkh.dll Has been deleted!

Attempting to delete E:\WINDOWS\system32\mljhgdc.dll
E:\WINDOWS\system32\mljhgdc.dll Has been deleted!

Attempting to delete E:\WINDOWS\system32\mljjj.dll
E:\WINDOWS\system32\mljjj.dll Has been deleted!

Attempting to delete E:\WINDOWS\system32\jjjlm.ini
E:\WINDOWS\system32\jjjlm.ini Has been deleted!

Attempting to delete E:\WINDOWS\system32\jjjlm.bak1
E:\WINDOWS\system32\jjjlm.bak1 Has been deleted!

Attempting to delete E:\WINDOWS\system32\jjjlm.bak2
E:\WINDOWS\system32\jjjlm.bak2 Has been deleted!

Attempting to delete E:\WINDOWS\system32\wvutqpq.dll
E:\WINDOWS\system32\wvutqpq.dll Has been deleted!

Attempting to delete E:\WINDOWS\system32\gctqdtje.exe
E:\WINDOWS\system32\gctqdtje.exe Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.1.2

Checking Java version…

Java version is 1.5.0.3

Java version is 1.5.0.6

Scan started at 21:22:04 23/08/2006

Listing files found while scanning….

No infected files were found.


Beginning removal…

Beginning removal…

Beginning removal…

Hijack this -

Logfile of HijackThis v1.99.1
Scan saved at 21:34:23, on 23/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\csrss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Windows Defender\MsMpEng.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\ntl\ntl Netguard\fws.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\taskswitch.exe
E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
E:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
E:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\USBIR\FrontPanelIo.exe
E:\Program Files\VIA\RAID\raid_tool.exe
E:\WINDOWS\SOUNDMAN.EXE
E:\WINDOWS\system32\LVCOMSX.EXE
E:\Program Files\Logitech\Video\LogiTray.exe
E:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
E:\PROGRA~1\RETROS~1\RETROS~1.1\RetroExpress.exe
E:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
E:\Program Files\iTunes\iTunesHelper.exe
E:\Program Files\ntl\ntl Netguard\RPS.exe
E:\Program Files\QuickTime\qttask.exe
E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
E:\Program Files\Windows Defender\MSASCui.exe
E:\Program Files\Instant Messenger Names\IM-svr.EXE
E:\Program Files\ewido anti-spyware 4.0\ewido.exe
E:\Program Files\D-Link AirPlus\AirPlus.exe
E:\Program Files\FinePixViewer\QuickDCF.exe
E:\Program Files\Logitech\Video\FxSvr2.exe
E:\Program Files\SystemControl\SystemControl\SystemControl.exe
E:\Program Files\Executive Software\Diskeeper\DkService.exe
E:\Program Files\Common Files\Command Software\dvpapi.exe
E:\Program Files\ewido anti-spyware 4.0\guard.exe
E:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
E:\WINDOWS\system32\wdfmgr.exe
E:\WINDOWS\system32\ZoneLabs\vsmon.exe
E:\Program Files\iPod\bin\iPodService.exe
E:\WINDOWS\System32\wbem\wmiapsrv.exe
E:\WINDOWS\system32\wscntfy.exe
E:\WINDOWS\System32\alg.exe
E:\PROGRA~1\RETROS~1\RETROS~1.1\retrorun.exe
E:\Program Files\Messenger\msmsgs.exe
E:\Program Files\Internet Explorer\iexplore.exe
E:\Temp\hijackthis\FoolYou.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - E:\Program Files\ntl\ntl Netguard\pkR.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Form Filler BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - E:\Program Files\ntl\ntl Netguard\FBHR.dll
O2 - BHO: (no name) - {6B548D04-F1A9-45EA-80C4-DB5A4D6EF03A} - E:\WINDOWS\system32\mljjj.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - E:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [CoolSwitch] E:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "E:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [Easy-PrintToolBox] E:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ATIPTA] E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DataLayer] E:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] E:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [USBIR] c:\Program Files\USBIR\FrontPanelIo.exe
O4 - HKLM\..\Run: [RaidTool] E:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LVCOMSX] E:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] E:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] E:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [MaxtorOneTouch] E:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
O4 - HKLM\..\Run: [RetroExpress] E:\PROGRA~1\RETROS~1\RETROS~1.1\RetroExpress.exe /h
O4 - HKLM\..\Run: [iTunesHelper] "E:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ntl Netguard] "E:\Program Files\ntl\ntl Netguard\RPS.exe"
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Zone Labs Client] "E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Windows Defender] "E:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [REGSHAVE] E:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [IMprocess] E:\Program Files\Instant Messenger Names\IM-svr.EXE
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [!ewido] "E:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - Global Startup: D-Link AirPlus.lnk = ?
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SystemControl.lnk = E:\Program Files\SystemControl\SystemControl\SystemControl.exe
O8 - Extra context menu item: &Google Search - res://e:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://e:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://e:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://e:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://E:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://E:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://E:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://E:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Similar Pages - res://e:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://e:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://downloadcenter.samsung.com/content/…trolLite_EN.cab
O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://www.windowsonecare.com/install/cli/…nSSWebAgent.CAB
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab31267.cab
O16 - DPF: {38D63471-E630-4492-A986-B8C48B79F2F8} (CVideoEgg_ActiveXCtl Object) - http://update.videoegg.com/wintel/VideoEggPublisher.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://bananasarecrazy.spaces.live.com//Ph…ad/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1109626517669
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {A243F6C2-34D2-4549-BCCD-A7BEF759B236} (Seekford Solutions, Inc.'s ssiPictureUploader Control) - http://img.funtigo.com/images/uploader/ssi…ureUploader.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…5/installer.exe
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "E:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: WgaLogon - E:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - E:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - E:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - E:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - E:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Radialpoint Service (FWS) - Radialpoint Inc. - E:\Program Files\ntl\ntl Netguard\fws.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - E:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MaxSyncService (NTService1) - - E:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: Pml Driver HPZ12 - HP - E:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Retrospect Express HD Launcher (RetroExpLauncher) - EMC Dantz - E:\PROGRA~1\RETROS~1\RETROS~1.1\retrorun.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - E:\WINDOWS\system32\ZoneLabs\vsmon.exe

Success I think -

Logfile of HijackThis v1.99.1
Scan saved at 22:37:34, on 23/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Windows Defender\MsMpEng.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\ntl\ntl Netguard\fws.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\taskswitch.exe
E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
E:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
E:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\USBIR\FrontPanelIo.exe
E:\Program Files\VIA\RAID\raid_tool.exe
E:\WINDOWS\SOUNDMAN.EXE
E:\WINDOWS\system32\LVCOMSX.EXE
E:\Program Files\Logitech\Video\LogiTray.exe
E:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
E:\PROGRA~1\RETROS~1\RETROS~1.1\RetroExpress.exe
E:\Program Files\iTunes\iTunesHelper.exe
E:\Program Files\ntl\ntl Netguard\RPS.exe
E:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
E:\Program Files\QuickTime\qttask.exe
E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
E:\Program Files\Windows Defender\MSASCui.exe
E:\Program Files\Instant Messenger Names\IM-svr.EXE
E:\Program Files\ewido anti-spyware 4.0\ewido.exe
E:\Program Files\D-Link AirPlus\AirPlus.exe
E:\Program Files\FinePixViewer\QuickDCF.exe
E:\Program Files\SystemControl\SystemControl\SystemControl.exe
E:\Program Files\Logitech\Video\FxSvr2.exe
E:\Program Files\Executive Software\Diskeeper\DkService.exe
E:\Program Files\Common Files\Command Software\dvpapi.exe
E:\Program Files\ewido anti-spyware 4.0\guard.exe
E:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
E:\WINDOWS\system32\ZoneLabs\vsmon.exe
E:\Program Files\iPod\bin\iPodService.exe
E:\WINDOWS\System32\wbem\wmiapsrv.exe
E:\WINDOWS\system32\wscntfy.exe
E:\PROGRA~1\RETROS~1\RETROS~1.1\retrorun.exe
E:\Temp\hijackthis\FoolYou.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - E:\Program Files\ntl\ntl Netguard\pkR.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Form Filler BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - E:\Program Files\ntl\ntl Netguard\FBHR.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar2.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - E:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [CoolSwitch] E:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "E:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [Easy-PrintToolBox] E:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ATIPTA] E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DataLayer] E:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] E:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [USBIR] c:\Program Files\USBIR\FrontPanelIo.exe
O4 - HKLM\..\Run: [RaidTool] E:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LVCOMSX] E:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] E:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] E:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [MaxtorOneTouch] E:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
O4 - HKLM\..\Run: [RetroExpress] E:\PROGRA~1\RETROS~1\RETROS~1.1\RetroExpress.exe /h
O4 - HKLM\..\Run: [iTunesHelper] "E:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ntl Netguard] "E:\Program Files\ntl\ntl Netguard\RPS.exe"
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Zone Labs Client] "E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Windows Defender] "E:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [REGSHAVE] E:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [IMprocess] E:\Program Files\Instant Messenger Names\IM-svr.EXE
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [!ewido] "E:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - Global Startup: D-Link AirPlus.lnk = ?
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SystemControl.lnk = E:\Program Files\SystemControl\SystemControl\SystemControl.exe
O8 - Extra context menu item: &Google Search - res://e:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://e:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://e:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://e:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://E:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://E:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://E:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://E:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Similar Pages - res://e:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://e:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://downloadcenter.samsung.com/content/…trolLite_EN.cab
O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://www.windowsonecare.com/install/cli/…nSSWebAgent.CAB
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab31267.cab
O16 - DPF: {38D63471-E630-4492-A986-B8C48B79F2F8} (CVideoEgg_ActiveXCtl Object) - http://update.videoegg.com/wintel/VideoEggPublisher.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://bananasarecrazy.spaces.live.com//Ph…ad/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1109626517669
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {A243F6C2-34D2-4549-BCCD-A7BEF759B236} (Seekford Solutions, Inc.'s ssiPictureUploader Control) - http://img.funtigo.com/images/uploader/ssi…ureUploader.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…5/installer.exe
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "E:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: WgaLogon - E:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - E:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - E:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - E:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - E:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Radialpoint Service (FWS) - Radialpoint Inc. - E:\Program Files\ntl\ntl Netguard\fws.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - E:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MaxSyncService (NTService1) - - E:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: Pml Driver HPZ12 - HP - E:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Retrospect Express HD Launcher (RetroExpLauncher) - EMC Dantz - E:\PROGRA~1\RETROS~1\RETROS~1.1\retrorun.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - E:\WINDOWS\system32\ZoneLabs\vsmon.exe

Thanks for your help