My IE was hijacked

Hi, Welcome to Tom Coyote! I'm Angelfire777 and it'll be my pleasure to assist you in your problem. Reasearching Hijackthis logs could take sometime so please, be patient while I research a fix for you. Also, I have to let experts check my fixes first before bringing them to you. Please hold on.

Download combofix.exe

1. Double click combofix.exe & follow the prompts.
2. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

Thanks. Here is the log: Administrator - 06-11-09 7:06:52.35 Service Pack 2 ComboFix 06.11.9 - Running from: "C:\Documents and Settings\Administrator\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\wtssvtr.exe ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\QooBox\Purity\Program Files\Common Files\ECURIT~1 ((((((((((((((((((((((((((((((( Files Created from 2006-10-09 to 2006-11-09 )))))))))))))))))))))))))))))))))) 2006-11-08 22:30 7,520 –ahs—- C:\WINDOWS\system32\KGyGaAvL.sys 2006-11-08 21:23 816,672 –a—— C:\WINDOWS\system32\drivers\avg7core.sys 2006-11-08 21:23 4,224 –a—— C:\WINDOWS\system32\drivers\avg7rsw.sys 2006-11-08 21:23 3,968 –a—— C:\WINDOWS\system32\drivers\avgclean.sys 2006-11-08 21:23 28,416 –a—— C:\WINDOWS\system32\drivers\avg7rsxp.sys 2006-11-08 21:23 18,240 –a—— C:\WINDOWS\system32\drivers\avgmfx86.sys 2006-11-08 18:16 11,648 –a—— C:\WINDOWS\system32\drivers\pxscrmbl.sys 2006-11-07 15:40 8,464 –a—— C:\WINDOWS\system32\sporder.dll 2006-11-07 15:40 20,480 –a—— C:\WINDOWS\stub_mm3.exe 2006-11-07 15:40 178,306 –a—— C:\WINDOWS\ac3_0008.exe 2006-11-07 15:40 142 –a—— C:\WINDOWS\xxitq.dll 2006-11-07 15:39 1,126,400 –a—— C:\WINDOWS\system32\rnnypbw.exe 2006-11-02 11:52 520,192 ——— C:\WINDOWS\system32\ati2sgag.exe 2006-10-24 00:10 79,360 –a—— C:\WINDOWS\system32\lfeps13s.dll 2006-10-24 00:10 74,752 –a—— C:\WINDOWS\system32\lfgif13s.dll 2006-10-24 00:10 466,624 –a—— C:\WINDOWS\system32\LTRPR13n.DLL 2006-10-24 00:10 401,408 –a—— C:\WINDOWS\system32\pvmjpg30.dll 2006-10-24 00:10 194,248 –a—— C:\WINDOWS\system32\LTRFD13n.DLL 2006-10-24 00:10 185,856 –a—— C:\WINDOWS\system32\lfpng13s.dll 2006-10-24 00:09 930,992 ——— C:\WINDOWS\system32\Ltr13n.dll 2006-10-24 00:09 884,736 ——— C:\WINDOWS\system32\LMUIRes.dll 2006-10-24 00:09 80,896 ——— C:\WINDOWS\system32\lfwmf13s.dll 2006-10-24 00:09 70,144 ——— C:\WINDOWS\system32\lfbmp13s.dll 2006-10-24 00:09 65,536 ——— C:\WINDOWS\system32\lfpcx13s.dll 2006-10-24 00:09 64,512 ——— C:\WINDOWS\system32\lftga13s.dll 2006-10-24 00:09 59,904 ——— C:\WINDOWS\system32\lfpcd13s.dll 2006-10-24 00:09 409,600 ——— C:\WINDOWS\system32\LFCMP13s.DLL 2006-10-24 00:09 306,352 ——— C:\WINDOWS\system32\Ltrio13n.dll 2006-10-24 00:09 283,648 ——— C:\WINDOWS\system32\LFJ2K13s.dll 2006-10-24 00:09 2,079,232 ——— C:\WINDOWS\system32\LTCLR13s.dll 2006-10-24 00:09 167,936 ——— C:\WINDOWS\system32\lftif13s.dll 2006-10-24 00:09 12,288 ——— C:\WINDOWS\system32\LMLRes.dll 2006-10-24 00:09 116,224 ——— C:\WINDOWS\system32\lffax13s.dll 2006-10-24 00:09 110,080 ——— C:\WINDOWS\system32\lfpsd13s.dll 2006-10-24 00:09 105,984 ——— C:\WINDOWS\system32\lfpct13s.dll 2006-10-24 00:09 1,013,248 ——— C:\WINDOWS\system32\Ltwvc13n.dll 2006-10-24 00:05 33,340 –a—— C:\WINDOWS\system32\dbmsqlgc.dll 2006-10-24 00:05 24,576 –a—— C:\WINDOWS\system32\dbmsgnet.dll 2006-10-24 00:01 765,952 ——— C:\WINDOWS\system32\msvcp71d.dll 2006-10-24 00:01 544,768 ——— C:\WINDOWS\system32\msvcr71d.dll 2006-10-23 23:16 57,856 –a—— C:\WINDOWS\system32\masd32.dll 2006-10-23 23:16 27,648 –a—— C:\WINDOWS\system32\ma32.dll 2006-10-23 23:16 196,096 –a—— C:\WINDOWS\system32\macd32.dll 2006-10-23 23:16 138,752 –a—— C:\WINDOWS\system32\mase32.dll 2006-10-23 23:16 136,192 –a—— C:\WINDOWS\system32\mamc32.dll 2006-10-23 23:15 41,219 –a—— C:\WINDOWS\RSETPATH.exe 2006-10-21 19:57 45,056 –a—— C:\WINDOWS\system32\WNASPI32.DLL 2006-10-21 19:57 16,512 –a—— C:\WINDOWS\system32\drivers\ASPI32.SYS 2006-10-15 21:56 98,304 –a—— C:\WINDOWS\system32\LGUICOM.DLL 2006-10-15 21:56 3,568 –a—— C:\WINDOWS\system32\LMOUSE16.DLL 2006-10-15 21:56 16,896 –a—— C:\WINDOWS\system32\LMOUSE32.DLL 2006-10-15 21:56 104,960 –a—— C:\WINDOWS\system32\COMNCTR.DLL 2006-10-15 21:55 73,134 –a—— C:\WINDOWS\system32\drivers\LMouFlt2.Sys 2006-10-15 21:55 53,870 ——— C:\WINDOWS\system32\drivers\L8042PR2.SYS 2006-10-15 21:55 37,804 –a—— C:\WINDOWS\system32\drivers\LHidUsb.sys 2006-10-15 21:55 25,214 –a—— C:\WINDOWS\system32\drivers\LHidFlt2.Sys 2006-10-15 21:55 23,372 ——— C:\WINDOWS\system32\LCOINST.DLL 2006-10-15 21:55 19,968 ——— C:\WINDOWS\LOGI_MWX.EXE 2006-10-15 21:55 152,064 ——— C:\WINDOWS\system32\lmoufrc.dll 2006-10-15 21:55 14,348 ——— C:\WINDOWS\system32\drivers\LCCFLTR.SYS 2006-10-09 12:52 32,000 -ra—— C:\WINDOWS\system32\drivers\pixmcvc.sys 2006-10-09 12:48 27,961 -ra—— C:\WINDOWS\system32\drivers\pixmcva.sys 2006-10-09 12:47 98,304 -ra—— C:\WINDOWS\system32\MpvpxSSE.dll 2006-10-09 12:47 20,953 -ra—— C:\WINDOWS\system32\drivers\pixmcvv.sys 2006-10-09 12:47 102,400 -ra—— C:\WINDOWS\system32\MpvpxX86.dll 2006-10-09 12:47 102,400 -ra—— C:\WINDOWS\system32\MpvpxMMX.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-11-09 07:12 ——– d——– C:\Program Files\Common Files 2006-11-08 21:25 ——– d——– C:\Documents and Settings\Administrator\Application Data\AVG7 2006-11-08 18:41 ——– d——– C:\Program Files\TrojanHunter 4.6 2006-11-08 14:45 ——– d——– C:\Program Files\SnapStream Media 2006-11-08 14:45 ——– d——– C:\Program Files\Common Files\SnapStream 2006-11-08 12:45 ——– d——– C:\Program Files\Grisoft 2006-11-08 12:42 ——– d——– C:\Program Files\Common Files\Symantec Shared 2006-11-08 12:31 ——– d——– C:\Program Files\Norton AntiVirus 2006-11-08 11:59 ——– d——– C:\Program Files\Enigma Software Group 2006-11-08 10:23 ——– d——– C:\Program Files\Security Stronghold 2006-11-08 00:36 ——– d——– C:\Program Files\Hijackthis 2006-11-08 00:32 ——– d——– C:\Program Files\Symantec 2006-11-07 22:11 ——– d——– C:\Program Files\CleanCache 3.0 2006-11-07 21:21 ——– d——– C:\Documents and Settings\Administrator\Application Data\Uniblue 2006-11-07 17:02 ——– d——– C:\Documents and Settings\Administrator\Application Data\TrojanHunter 2006-11-07 16:21 ——– d——– C:\Program Files\InterMute 2006-11-07 15:36 ——– d——– C:\Documents and Settings\Administrator\Application Data\ATI MMC 2006-11-07 11:39 ——– d——– C:\Documents and Settings\Administrator\Application Data\uTorrent 2006-11-07 10:50 ——– d——– C:\Documents and Settings\Administrator\Application Data\Skype 2006-11-02 12:38 ——– d–h—– C:\Program Files\InstallShield Installation Information 2006-11-02 12:37 ——– d——– C:\Program Files\TitanTV 2006-11-02 12:04 ——– d——– C:\Program Files\Common Files\ATI 2006-11-02 12:04 ——– d——– C:\Program Files\ATI Multimedia 2006-11-02 12:00 ——– d——– C:\Program Files\msaccrt 2006-11-02 11:57 ——– d——– C:\Documents and Settings\Administrator\Application Data\ATI 2006-11-02 11:53 ——– d——– C:\Program Files\ATI Technologies 2006-10-31 21:00 ——– d——– C:\Program Files\Babylon 2006-10-29 10:45 ——– d——– C:\Documents and Settings\Administrator\Application Data\Pinnacle Systems 2006-10-24 01:54 ——– d——– C:\Program Files\DivX 2006-10-24 00:39 ——– d——– C:\Documents and Settings\Administrator\Application Data\InstallShield 2006-10-24 00:09 ——– d——– C:\Program Files\Pinnacle 2006-10-24 00:03 ——– d——– C:\Program Files\Microsoft SQL Server 2006-10-23 23:45 ——– d——– C:\Program Files\SmartSound Software 2006-10-23 23:42 95 –a—— C:\AUTOEXEC.BAT 2006-10-21 19:58 ——– d——– C:\Documents and Settings\Administrator\Application Data\dvdcss 2006-10-15 21:56 ——– d——– C:\Program Files\Common Files\Logitech 2006-10-15 21:55 ——– d——– C:\Program Files\Logitech 2006-10-15 21:41 ——– d——– C:\Program Files\Google 2006-10-15 21:35 ——– d——– C:\Program Files\Creative 2006-10-07 10:22 ——– d——– C:\Program Files\AvantGo 2006-10-05 17:31 ——– d—s—- C:\Documents and Settings\Administrator\Application Data\Microsoft 2006-10-01 08:34 ——– d——– C:\Documents and Settings\Administrator\Application Data\Logitech 2006-10-01 07:48 ——– d——– C:\Program Files\Common Files\Microsoft Shared 2006-09-26 20:52 307200 –a—— C:\WINDOWS\system32\atiiiexx.dll 2006-09-26 20:50 260608 –a—— C:\WINDOWS\system32\ati2dvag.dll 2006-09-26 20:50 1754624 –a—— C:\WINDOWS\system32\drivers\ati2mtag.sys 2006-09-26 20:43 90112 –a—— C:\WINDOWS\system32\ati2evxx.dll 2006-09-26 20:43 77824 –a—— C:\WINDOWS\system32\Oemdspif.dll 2006-09-26 20:43 41984 –a—— C:\WINDOWS\system32\ati2edxx.dll 2006-09-26 20:43 26112 –a—— C:\WINDOWS\system32\Ati2mdxx.exe 2006-09-26 20:43 118784 –a—— C:\WINDOWS\system32\atipdlxx.dll 2006-09-26 20:41 53248 –a—— C:\WINDOWS\system32\ATIDDC.DLL 2006-09-26 20:41 425984 –a—— C:\WINDOWS\system32\ati2evxx.exe 2006-09-26 20:34 2415648 –a—— C:\WINDOWS\system32\ati3duag.dll 2006-09-26 20:29 1086144 –a—— C:\WINDOWS\system32\ativvaxx.dll 2006-09-26 20:23 6684672 –a—— C:\WINDOWS\system32\atioglx1.dll 2006-09-26 20:21 5144576 –a—— C:\WINDOWS\system32\atioglxx.dll 2006-09-26 20:18 303104 –a—— C:\WINDOWS\system32\ATIDEMGR.dll 2006-09-26 20:16 221184 –a—— C:\WINDOWS\system32\atikvmag.dll 2006-09-26 20:15 17408 –a—— C:\WINDOWS\system32\atitvo32.dll 2006-09-26 20:10 294912 –a—— C:\WINDOWS\system32\ati2cqag.dll 2006-09-21 14:10 ——– d——– C:\Program Files\PowerISO 2006-09-15 22:52 91904 –a—— C:\WINDOWS\system32\S32EVNT1.DLL 2006-09-15 22:52 124016 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2006-09-13 10:57 ——– d——– C:\Documents and Settings\Administrator\Application Data\Google 2006-09-13 00:01 1084416 –a—— C:\WINDOWS\system32\msxml3.dll 2006-08-25 10:45 617472 –a—— C:\WINDOWS\system32\comctl32.dll 2006-08-21 07:21 16896 –a—— C:\WINDOWS\system32\fltlib.dll 2006-08-21 04:14 23040 –a—— C:\WINDOWS\system32\fltmc.exe 2006-08-16 06:58 100352 –a—— C:\WINDOWS\system32\6to4svc.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ATI Scheduler"="\"C:\\Program Files\\ATI Multimedia\\main\\ATISched.EXE\"" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\AutorunsDisabled] "Uniblue Quick Access"="\"C:\\Program Files\\Uniblue\\ProcessLibrary\\qaccess.exe\" /startup" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "SpySweeper"="\"C:\\Program Files\\Webroot\\Spy Sweeper\\SpySweeperUI.exe\" /startintray" "Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\"" "AVG7_CC"="\"C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe\" /STARTUP" "type32"="\"C:\\Program Files\\Microsoft IntelliType Pro\\type32.exe\"" "Logitech Utility"="Logi_MwX.Exe" "Babylon Client"="\"C:\\Program Files\\Babylon\\Babylon.exe\" -AutoStart" "MSConfig"="\"C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe\" /auto" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000005 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,de,03,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,4e,00,00,00,00,00,00,00,b2,03,00,00,e2,02,\ 00,00,04,00,00,40 "RestoredStateInfo"=hex:18,00,00,00,4e,00,00,00,00,00,00,00,b2,03,00,00,e2,02,\ 00,00,01,00,00,00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HotSync Manager.lnk] "path"="C:\\Documents and Settings\\Administrator\\Start Menu\\Programs\\Startup\\HotSync Manager.lnk" "backup"="C:\\WINDOWS\\pss\\HotSync Manager.lnkStartup" "location"="Startup" "command"="C:\\PROGRA~1\\HANDSP~1\\HOTSYNC.EXE " "item"="HotSync Manager" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Yahoo! Widget Engine.lnk] "path"="C:\\Documents and Settings\\Administrator\\Start Menu\\Programs\\Startup\\Yahoo! Widget Engine.lnk" "backup"="C:\\WINDOWS\\pss\\Yahoo! Widget Engine.lnkStartup" "location"="Startup" "command"="C:\\PROGRA~1\\Yahoo!\\YAHOO!~1\\YAHOOW~1.EXE " "item"="Yahoo! Widget Engine" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk] "location"="Common Startup" "command"="C:\\WINDOWS\\Installer\\{AC76BA86-1033-F400-7760-000000000002}\\SC_Acrobat.exe " "item"="Adobe Acrobat Speed Launcher" "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Adobe Acrobat Speed Launcher.lnk" "backup"="C:\\WINDOWS\\pss\\Adobe Acrobat Speed Launcher.lnkCommon Startup" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^rknog.exe] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\rknog.exe" "backup"="C:\\WINDOWS\\pss\\rknog.exeCommon Startup" "location"="Common Startup" "command"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\rknog.exe" "item"="rknog" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="" "hkey"="HKCU" "command"="" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Acrotray" "hkey"="HKLM" "command"="\"C:\\Program Files\\Adobe\\Acrobat 7.0\\Distillr\\Acrotray.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\adobemgr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="adobemgr" "hkey"="HKCU" "inimapping"="0" "command"="C:\\WINDOWS\\system32\\adobemgr.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ALCMTR" "hkey"="HKLM" "command"="ALCMTR.EXE" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcWzrd] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ALCWZRD" "hkey"="HKLM" "command"="ALCWZRD.EXE" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI DeviceDetect] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ATIDtct" "hkey"="HKCU" "command"="\"C:\\Program Files\\ATI Multimedia\\main\\ATIDtct.EXE\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI Launchpad] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="LaunchPd" "hkey"="HKCU" "command"="\"C:\\Program Files\\ATI Multimedia\\main\\LaunchPd.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI Remote Control] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ATIRW" "hkey"="HKCU" "command"="C:\\Program Files\\ATI Multimedia\\RemCtrl\\ATIRW.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI Scheduler] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ATISched" "hkey"="HKCU" "command"="\"C:\\Program Files\\ATI Multimedia\\main\\ATISched.EXE\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="CLIStart" "hkey"="HKLM" "command"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\CLIStart.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="atiptaxx" "hkey"="HKLM" "command"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\awTray.exe] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="awtray" "hkey"="HKLM" "command"="\"C:\\Program Files\\Intel\\IDU\\awtray.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Configuration Manager] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="cfg32" "hkey"="HKLM" "command"="C:\\WINDOWS\\cfg32.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CoolSwitch] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="taskswitch" "hkey"="HKLM" "command"="C:\\WINDOWS\\system32\\taskswitch.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ctfmon" "hkey"="HKCU" "command"="C:\\WINDOWS\\system32\\ctfmon.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\defender] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="dfndrff_e51" "hkey"="HKLM" "command"="C:\\\\dfndrff_e51.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeluxeCommunications] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Dxc" "hkey"="HKLM" "command"="C:\\Program Files\\DeluxeCommunications\\Dxc.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="HDAShCut" "hkey"="HKLM" "command"="HDAShCut.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelAudioStudio] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="IntelAudioStudio" "hkey"="HKLM" "command"="\"C:\\Program Files\\Intel Audio Studio\\IntelAudioStudio.exe\" TRAY" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ipTray.exe] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="iptray" "hkey"="HKLM" "command"="\"C:\\Program Files\\Intel\\IDU\\iptray.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Iqrdnmnz] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="??ool32" "hkey"="HKCU" "command"="\"C:\\Program Files\\Common Files\\?ecurity\\??ool32.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="KHALMNPR" "hkey"="HKLM" "command"="KHALMNPR.EXE" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\keyboard] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="kybrdff_e51" "hkey"="HKLM" "command"="C:\\\\kybrdff_e51.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kgjg] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="rnnypbw" "hkey"="HKLM" "command"="\"C:\\WINDOWS\\system32\\rnnypbw.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="NeroCheck" "hkey"="HKLM" "command"="C:\\WINDOWS\\system32\\NeroCheck.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\New.net Startup] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="NEWDOT~1" "hkey"="HKLM" "command"="rundll32 C:\\PROGRA~1\\NEWDOT~1\\NEWDOT~1.DLL,NewDotNetStartup -s" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\newname] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="nwnmff_e51" "hkey"="HKLM" "command"="C:\\\\nwnmff_e51.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 9.0] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="GhostTray" "hkey"="HKLM" "inimapping"="0" "command"="C:\\Program Files\\Symantec\\Norton Ghost\\Agent\\GhostTray.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NWEReboot] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="" "hkey"="HKLM" "command"="" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCPitStopEraser] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="PCPitStopErase" "hkey"="HKLM" "inimapping"="0" "command"="C:\\Program Files\\PCPitstop\\Erase\\PCPitStopErase.exe /remindme" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleDriverCheck] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="PSDrvCheck" "hkey"="HKLM" "command"="C:\\WINDOWS\\system32\\\\PSDrvCheck.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PSCastor] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="PSCastor" "hkey"="HKCU" "command"="\"C:\\Program Files\\PSCastor\\PSCastor.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Skype" "hkey"="HKCU" "command"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="SOUNDMAN" "hkey"="HKLM" "command"="SOUNDMAN.EXE" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="SpySweeperUI" "hkey"="HKLM" "command"="\"C:\\Program Files\\Webroot\\Spy Sweeper\\SpySweeperUI.exe\" /startintray" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="GoogleToolbarNotifier" "hkey"="HKCU" "command"="\"C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.908.5008\\GoogleToolbarNotifier.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="SNDMon" "hkey"="HKLM" "command"="\"C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe\" /Consumer" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\THGuard] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="THGuard" "hkey"="HKLM" "command"="\"C:\\Program Files\\TrojanHunter 4.6\\THGuard.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue Registry Booster] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="RegistryBooster" "hkey"="HKCU" "command"="C:\\Program Files\\Uniblue\\Registry Booster\\RegistryBooster.exe /S" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Upwe] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ping" "hkey"="HKCU" "command"="\"C:\\WINDOWS\\CROSOF~1\\ping.exe\" -vt yazb" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uqmgb] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ycbnaa" "hkey"="HKCU" "command"="C:\\WINDOWS\\system32\\ycbnaa.exe reg_run" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ytffyx] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ycbnaa" "hkey"="HKLM" "command"="\"C:\\WINDOWS\\system32\\ycbnaa.exe\" reg_run" "inimapping"="0" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WebrootSpySweeperService Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Symantec NetDetect.job C:\WINDOWS\tasks\wrSpySweeper20060114080802.job Completion time: 06-11-09 7:27:54.81 C:\ComboFix.txt … 06-11-09 07:27

I see you are running 2 antivirus applications at the same time. Please uninstall your other antivirus and only keep 1. Not only will 2 or more AV's slow down your pc's performance but it reduces your overall system security at the same time. Use Add/Remove Programs in the Control Panel to uninstall the Antivirus that you don't want to keep.

Reboot after uninstalling

If you will uninstall Norton, you might want to try this tool HERE if the uninstall isn't successful.

__________________

Pls. download LSP FIX from Here

In the event that you lose connection after removing NewDotNet, just run the tool then click "Finish" and it will restore your internet connection.

Do not mess with this tool or do anything with it besides the instructions above.

Go to Control Panel > Add or Remove Programs > uninstall the items in bold if found.

DeluxeCommunications
PSCastor

The following program is listed as a Rogue Antispyware Program as listed HERE and it produces ridiculous false positives work as goad to purchase.

Security Stronghold

NewdotNet or New.Net <

We need to temporarily disable Spysweeper, it can stop our fix.

To disable SpySweeper Shields

• Open SpySweeper.
• Click Shield Settings on the right
  (or Shields on the left, depending what screen you're on).
• Click Internet Explorer and uncheck all items.
• Click Windows System and uncheck all items.
• Click Hosts File and uncheck all items.
• Click Startup Programs and uncheck all items.
• Close SpySweeper.
  After all of the fixes are complete it is very important that you enable Real-time Protection again.

Open HijackThis > choose Scan Only > Place a checkmark in the boxes beside these entries in bold.

O4 - HKLM\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe


Close your browsers and all open windows except for HijackThis, then click "Fix checked".

Reboot and post a fresh HijackThis log and please tell us how your machine is running.

We need to temporarily disable Spysweeper, it can stop our fix.

To disable SpySweeper Shields

• Open SpySweeper.
• Click Shield Settings on the right
  (or Shields on the left, depending what screen you're on).
• Click Internet Explorer and uncheck all items.
• Click Windows System and uncheck all items.
• Click Hosts File and uncheck all items.
• Click Startup Programs and uncheck all items.
• Close SpySweeper.
  Please do not re-enable SpySweeper until we declare that you are clean.

Open HijackThis > choose Scan Only > Place a checkmark in the boxes beside these entries in bold.

O4 - HKLM\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe


Close your browsers and all open windows except for HijackThis, then click "Fix checked".

After that, please click "Config" button found in the lower right corner of the HijackThis window.

Click "Misc Tools" button found in the upper part of HijackThis. Scroll down to the bottom and click "Uninstall HijackThis & exit"


Click HERE to download a self-extracting version of Hijackthis 1.99.1. Double click on the file, by default it will extract itself to C:\Hijackthis

___________________________________

Your HijackThis log shows that you are running your system under selective startup, that means you have some entries in msconfig - startup tab that are disabled. We may not see everything (including malware) if that's the case.

So, please

• start > run > type in: msconfig
• Under "startup tab", click enable all
• DO NOT reboot
• Navigate to C:\HijackThis
• Double click Hijackthis.exe and choose "Scan System and Save a Logfile"
• Close HijackThis.

On your next reply, please include a fresh HijackThis log and a description on how your machine is running.

sorry for the delayed response. My pc had survived a crash but i had to do a complete re-install. thanks again for your help!

Sorry to hear that..

Here are some free programs I recommend that could help you protect your system.

AntiVirus

» Avast!
» AVG AntiVirus
» AntiVir

Firewall Application - Although Windows Xp comes with a firewall, you should not rely on it because the Windows Firewall can only filter incoming data; outgoing traffic is not controlled, meaning that malware/viruses that are present in your computer can access the internet with no restrictions. There are several other Firewall that can protect you better by filtering incoming and outgoing data.

» ZoneAlarm
» Kerio

Adaware
~You can download it from here
~There is a tutorial on how to use Adaware properly here

Spybot Search and Destroy
~You can download it from here . Just choose a mirror and off you go.
~There is also a tutorial on how to use Spybot properly here

Install Spyware Guard
~You can download it from here
~You can read the tutorial on how to use Spyware Guard here

Install WinPatrol
~You can download it from here
~You can get some information about how WinPatrol works here

Note: Make sure you update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Please check out Tony Klein's article "How did I get infected in the first place?"

Happy safe surfing!

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php