What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Feeling i'm being watched..

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Everyday AVG will complete scan my computer and always get this "virus" thingy. I always press heal but it still comes often'ly..

Logfile of HijackThis v1.99.1
Scan saved at 4:00:15 PM, on 11/26/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Xfire\xfiremusic.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\BitComet\BitComet.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Xfire\xfire.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Documents and Settings\ShadowUltima\Desktop\Personal Files Drive\Malware Remover\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://youtube.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RegEasy.exe] C:\Program Files\RegistryEasy\RegEasy.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Xfire Music] "C:\Program Files\Xfire\xfiremusic.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.tinyonline.com.hk
O16 - DPF: {05BCE06B-A300-4C4E-A42F-4C04BCCDE63B} (TRLuncherROC Control) - http://weblogin.talesrunner.com.hk/TRLuncherROC.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/d…wlscbase969.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1161440450937
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1161440437546
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin9USA.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
Post #2
Hi Micheal03and welcome to Tom Coyote forums

I am currently looking over your log. As I am an Undergraduate, everything that I post to you must be checked by an Admin or Moderator. Thus, there may be a tiny bit of a delay between posts, but it shouldn't be too long. I will post back shortly with a potential fix.

Thanks for your patience!
Thanks dan
Post #3
Hi Micheal03

You are running a P2P filesharing programmes. LimeWire and BitComet
  • Many of these programmes come with unwanted components bundled with them.
  • If you wish to find out whether the one you're using does click here.

Please note: Even if you are using a "safe" P2P programme, it is only the programme that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.


My recommendation is you uninstall them.



I see that you are using"Download Accelerator Plus". This program has a dubious reputation as you can read Here

A free, and spyware free, alternative is Star Downloader, or one of the other alternatives from Here.

Should you choose to remove it, uninstall it through Control Panel=>Add/Remove Programs.

Download Accelerator Plus from Speedbit. Download manager for resuming downloads, amongst other features. Available via Start -> Programs. Note that the free version is "adware" based


________________________

Download ATF Cleaner by Atribune and save it to your Desktop.
Do not use yet!

Ewido is now known as ( AVG Anti-Spyware.)

Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/
  • Install AVG Anti-Spyware by double clicking the installer.
  • Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
  • On the main screen under Your Computer's security.
    • Click on Change state next to Resident shield. It should now change to inactive.
    • Click on Change state next to Automatic updates. It should now change to inactive.
    • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
    • Wait until you see the Update succesfull message.
  • Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
  • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.
Dont use yet!
____________________

You are running an older version of Java.

Download the latest version of Java Runtime Environment (JRE) 5.0 Update 9.
  • Scroll down to where it says " Java Runtime Environment (JRE) 5.0 Update 9
    The J2SE Runtime Environment (JRE) allows end-users to run Java applications."
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement".
  • The page will refresh.
  • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the icon next to it.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-1_5_0_09-windowsi586-p.exe to install the newest version.
__________________________

Run ATF cleaner
  • Double click ATF-Cleaner.exe to run the program.
  • Check the following boxes:
    • Windows Temp
    • Current User Temp
    • All Users Temp
    • Temporary Internet Files
    • Prefetch
    • Recycle Bin
    • Java Cache
  • The rest are optional - if you want to remove the lot, check Select All.
  • Now click Empty Selected.
  • When you get the Done Cleaning message, click OK.
  • If you use Firefox browser.
    • Click Firefox at the top and choose: Select All
    • If you would like to keep your saved passwords, please click No at the prompt.
    • Click the Empty Selected button.
  • If you use Opera browser.
    • Click Opera at the top and choose: Select All
    • If you would like to keep your saved passwords, please click No at the prompt.
    • Click the Empty Selected button.

Run AVG Anti-Spyware

Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
  • Click on Scanner on the toolbar.
  • Click on the Settings tab.
    • Under How to act?
      • Click on Recommended Action and choose Quarantine from the popup menu.
    • Under How to scan?
      • All checkboxes should be ticked.
    • Under Possibly unwanted software:
      • All checkboxes should be ticked.
    • Under Reports:
      • Select Automatically generate report after every scan and uncheck Only if threats were found.
    • Under What to scan?
      • Select Scan every file.
  • Click on the Scan tab.
  • Click on Complete System Scan to start the scan process.
  • Let the program scan the machine.
  • When the scan has finished, follow the instructions below.
    IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
    • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
    • At the bottom of the window click on the Apply all Actions button. (3)

      [external image: Posted Image]
  • When done, click the Save Scan Report button. (4)
    • Click the Save Report as button.
    • Save the report to your Desktop.
  • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
Reboot in Normal Mode.

please do an online scan with Kaspersky Online Scanner

Click on Kaspersky Online Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then start to download the latest definition files.
  • Once the scanner is installed and the definitions downloaded, click Next.
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  • Extended (If available otherwise Standard)
  • Scan Options:
  • Scan Archives
  • Scan Mail Bases
  • Click OK
  • Now under select a target to scan select My Computer
  • The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post.
Please include new HJT log, AVG Anti-Spyware log and kaspersky log
in your next post
Thanks dan
Post #6
I have lost the URL of my previous post, :rant: Anyway, these days, i'm feeling im being watched whenever im typing my passwords. Is there a Spyware in my comp?

Logfile of HijackThis v1.99.1
Scan saved at 7:38:29 PM, on 12/9/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Xfire\xfiremusic.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\BitComet\BitComet.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Xfire\xfire.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\ShadowUltima\Desktop\Personal Files Drive\Malware Remover\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://youtube.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RegEasy.exe] C:\Program Files\RegistryEasy\RegEasy.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Xfire Music] "C:\Program Files\Xfire\xfiremusic.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.tinyonline.com.hk
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200610…ex/qtplugin.cab
O16 - DPF: {05BCE06B-A300-4C4E-A42F-4C04BCCDE63B} (TRLuncherROC Control) - http://weblogin.talesrunner.com.hk/TRLuncherROC.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/d…wlscbase969.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1161440450937
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1161440437546
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin9USA.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
Post #7
Thanks for redirecting me here =) Anyway one problem, the Kaspersky Scan, there was no Save as Text there. But the resulrts were: Total number of scanned files: 135607
Number of viruses found: 1
Number of infected objects: 65
Number of suspicious objects: 0
Duration of the scan process: 01:32:38

Anyway here are the other reports.

Logfile of HijackThis v1.99.1
Scan saved at 9:05:54 PM, on 12/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Xfire\xfiremusic.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\BitComet\BitComet.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Xfire\xfire.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Documents and Settings\ShadowUltima\Desktop\Personal Files Drive\Malware Remover\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://youtube.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RegEasy.exe] C:\Program Files\RegistryEasy\RegEasy.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Xfire Music] "C:\Program Files\Xfire\xfiremusic.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.tinyonline.com.hk
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200610…ex/qtplugin.cab
O16 - DPF: {05BCE06B-A300-4C4E-A42F-4C04BCCDE63B} (TRLuncherROC Control) - http://weblogin.talesrunner.com.hk/TRLuncherROC.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/d…wlscbase969.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1161440450937
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1161440437546
O16 - DPF: {7B41B7AC-3496-4C13-A70F-DE6B60A6A8A8} (MGAME manager Class) - http://download.mgame.com/download/cab/mgmanagerv1001.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin9USA.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS




———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 7:12:37 PM 12/10/2006

+ Scan result:



C:\System Volume Information\_restore{F0B582C7-44B8-4B00-92EB-B82D996BF398}\RP111\A0034089.exe -> Backdoor.IRCBot.uu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{F0B582C7-44B8-4B00-92EB-B82D996BF398}\RP144\A0067347.exe -> Backdoor.VB.ate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{F0B582C7-44B8-4B00-92EB-B82D996BF398}\RP112\A0034092.exe -> Backdoor.VB.ayx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{F0B582C7-44B8-4B00-92EB-B82D996BF398}\RP94\A0030060.exe -> Backdoor.VB.ayx : Cleaned with backup (quarantined).
:mozilla.109:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.110:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@cnn.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@microsofteup.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.136:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.59:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.61:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\[removed][1].txt -> TrackingCookie.Addcontrol : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\[removed][2].txt -> TrackingCookie.Addynamix : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@adrevolver[1].txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.111:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.112:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.24:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\[removed][2].txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.134:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.181:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Clickbank : Cleaned.
:mozilla.10:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.11:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.12:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.13:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.6:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.7:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.8:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.9:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@com[1].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@commission-junction[2].txt -> TrackingCookie.Commission-junction : Cleaned.
:mozilla.60:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Cqcounter : Cleaned.
:mozilla.27:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\[removed][2].txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.47:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.125:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.62:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.63:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.64:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@hotlog[2].txt -> TrackingCookie.Hotlog : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\[removed][2].txt -> TrackingCookie.Liveperson : Cleaned.
:mozilla.74:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Masterstats : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\[removed][1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@overture[1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\[removed][1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\[removed][2].txt -> TrackingCookie.Pointroll : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\[removed][1].txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.135:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Revenue : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\[removed][1].txt -> TrackingCookie.Revenue : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@revenue[2].txt -> TrackingCookie.Revenue : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.88:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.89:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\[removed][2].txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.75:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Sexlist : Cleaned.
:mozilla.76:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Sexlist : Cleaned.
:mozilla.77:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Sexlist : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\[removed][1].txt -> TrackingCookie.Sextracker : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\[removed][1].txt -> TrackingCookie.Sextracker : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@sextracker[1].txt -> TrackingCookie.Sextracker : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\[removed][1].txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.90:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Spylog : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\[removed][1].txt -> TrackingCookie.Starware : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\[removed][2].txt -> TrackingCookie.Starware : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@statcounter[2].txt -> TrackingCookie.Statcounter : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\[removed][1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.123:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\[removed][2].txt -> TrackingCookie.Valuead : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@valueclick[1].txt -> TrackingCookie.Valueclick : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@yadro[1].txt -> TrackingCookie.Yadro : Cleaned.
:mozilla.43:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.44:C:\Documents and Settings\ShadowUltima\Application Data\Mozilla\Firefox\Profiles\fh9upjai.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@zedo[1].txt -> TrackingCookie.Zedo : Cleaned.
C:\Documents and Settings\ShadowUltima\Cookies\shadowultima@zedo[3].txt -> TrackingCookie.Zedo : Cleaned.
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{052AD724-4D6A-41E4-BEFE-ECDAB84328C0} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{062854A8-03D7-4FA6-8DF3-FC19A9A6F844} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{0FD6F108-6AA3-4719-965A-D5583B2470A2} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{17EC5AAD-BEE1-4F14-BEE2-BA23205C66CB} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{18E8739F-303D-43AB-8421-CA8925964750} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{1DF51ABE-3425-4E46-92EC-C5568A8F523F} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{23969FBC-4A22-4815-9F02-EE970264D20B} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{32A9C321-F622-43E2-ABB2-9AD5D31E6F83} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{33713B4D-159B-4614-A092-D18DDE0C7BEF} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{36D38888-02E8-4D02-B9CD-F87C730DC4B0} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{39BA26CA-1EDD-4D5D-92CF-7074EC4D548F} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{40156349-E9E9-4F9A-8CA6-38D470D35694} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{41750153-B93C-4A6F-A7F2-1CBEE3F362B3} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{4DA07389-D994-42B4-89D2-E54BE659A90B} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{4DA6ADC3-A31C-4042-BD7A-7ADE02965CC5} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{58CE4101-4F1E-40DB-9A4A-FD8D30436B5A} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{5AC2B0C0-9A31-433F-B1B3-9DCEA8472BFA} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{691C3F92-33BE-430F-8816-38D96823AC0C} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{6D75085A-46AE-45C7-B974-E9900FACC2E2} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{6F7E3989-B8A6-4EBB-AA90-093312C91A12} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{6FEC1258-A187-481C-BB84-3F8252EA8608} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{82492D05-DF1A-46D7-9EFD-2E0D0C57CB66} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{83EBFC74-7A9F-4C8B-9C5F-8F6687AAF711} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{8724A2BC-C9EA-4EFE-B4DC-4544DA023E97} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{88590D9B-4CA4-4C93-B372-23150E230C02} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{8F53430A-8D9C-464A-86F3-FBF34B9CE15E} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{9428AC4F-BE73-4DF7-A5BB-67E195CEE3FE} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{980C2821-EBAC-40C8-8F0F-2EDDEE0E5124} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{A1EE75BF-294A-41F7-B8C5-93BA67B71D75} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{A72BCF30-CF11-44A8-ADA8-77B1A32E385B} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{A79BF574-474F-4D49-9087-5A051B853BA8} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{A96C3C8A-A29F-452D-B899-0370DD1F7F3E} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{B0C93312-8BFB-42FA-A983-2A3385AB6C78} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{B5D8FABD-30E9-44A1-A424-5FDAF7DEFCED} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{BC4F7756-201F-4EB7-9603-1F09F46A5D3E} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{C0ADA50B-E637-4201-AC6C-B5E13635F1C7} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{C0B401A0-ACC1-4B75-BC18-E5C9532BD0A1} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{C2E84699-615B-42A7-9944-202932BE5FD3} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{CBBE033E-5114-4675-A19C-886F7452709D} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{D2F7CF5C-6432-4096-B27C-4899FBDA2500} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{E5738D62-8651-42C4-BF17-5221AB97CAA4} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{E70B8825-7F1F-4129-AC23-97C71D788857} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{F0D84BAB-FE16-4F35-AED8-A7F6F037CD40} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{F16E6784-738A-43BF-9135-0EFBA5B6C379} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{F365ABEA-85F5-4869-94F5-8B9EA7E04CA8} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{F66801D4-66DF-417B-BE64-987F464AF6BC} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{F79E0E51-563F-4D00-A0E8-C077B015489F} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\Documents and Settings\ShadowUltima\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{FD0363E7-22B9-409B-B3F7-BB8509820AD4} -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\WINDOWS\system32\drivers\etc\hosts -> Trojan.Qhosts : Cleaned with backup (quarantined).


::Report end
Post #11
Hihi! It was a long time now. But i just remained quite patient to recieve the respense =)

Logfile of HijackThis v1.99.1
Scan saved at 6:50:09 PM, on 12/15/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Xfire\xfiremusic.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\BitComet\BitComet.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Xfire\xfire.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\ShadowUltima\Desktop\Personal Files Drive\Malware Remover\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://youtube.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RegEasy.exe] C:\Program Files\RegistryEasy\RegEasy.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Xfire Music] "C:\Program Files\Xfire\xfiremusic.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: AMV convert tool grab multimedia file - grab.html
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: MediaManager tool grab multimedia file - grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.tinyonline.com.hk
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200610…ex/qtplugin.cab
O16 - DPF: {05BCE06B-A300-4C4E-A42F-4C04BCCDE63B} (TRLuncherROC Control) - http://weblogin.talesrunner.com.hk/TRLuncherROC.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/d…wlscbase969.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1161440450937
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1161440437546
O16 - DPF: {7B41B7AC-3496-4C13-A70F-DE6B60A6A8A8} (MGAME manager Class) - http://download.mgame.com/download/cab/mgmanagerv1001.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin9USA.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
Post #12
Hi Micheal03

Have you decided to keep your P2P and Download Accelerator Plus programs?
As I see from your log they are still there!

You need to update your Adobe Reader
You may want to go here and update Acrobat 5.0 to the latest version, Adobe Reader® 7.0

With regards to the Kaspersky scan try this :Click on the zoom tool in the right corner and reduce to 75 %. Buttons will be visible.

If you still have problems we will check some settings.

post the kaspersky scan.
thanks dan
Post #13
What "Click on the zoom tool in the right corner"? U mean the IE7 Zoom tool in the below-right thing? Even i did that, it's still not visible…
Post #14
Hi Micheal03

Can you let me know how your system is at this time are you having any issues?
Let me Know what you decided regards the P2P program? and if you were ok updating to "Adobe Reader® 7.0"
Try this for that scan:

Let's check your IE settings and see if we can get an online scan going.
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click on the Security tab
  • Click the Internet icon so it becomes highlighted.
  • Click on Default Level and click Ok
  • Click on the Custom Level button.
    • Change the Download signed ActiveX controls to Prompt
    • Change the Download unsigned ActiveX controls to Disable
    • Check that Script ActiveX controls marked safe for scripting is set to Enabled or Prompt
    • Check that Run ActiveX controls and plugins is Enabled
    • Change the Initialise and script ActiveX controls not marked as safe to Disable
    • Change the Installation of desktop items to Prompt
    • Change the Launching programs and files in an IFRAME to Prompt
    • Change the Navigate sub-frames across different domains to Prompt
    • Check that Active Scripting is set to Enabled
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
Open a new IE window and try to run the online scan.

we will get that scan yet!
____________________

Open up "AVG Anti-Spyware" if you click on the Infections icon, then it will show you all the items in Quarrantine and you can remove them. Just click Select All (if all of the items in quarrantine need removing) then Remove Finally.

post kaspersky scan, if able and new HJT log
let me know how system is running
thanks dan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI