I Need A Fast Answer Quick Please !

HELP !!!! I THINK I HAVE SOME BAD VIRUS !!!

My explorer.exe just crashes by itself i didn't do anything when it occured , just like the explorer.exe crashed , i tried to create a new task: explorer.exe but it didn't help . Can you please help me fast , or atleast tell me how to backup my files , so that if i need to format local disc C: then i have my files backed up ! This is urgent .

Find more posts tagged with

Comments

farbar

HELP !!!! I THINK I HAVE SOME BAD VIRUS !!!

My explorer.exe just crashes by itself i didn't do anything when it occured , just like the explorer.exe crashed , i tried to create a new task: explorer.exe but it didn't help . Can you please help me fast , or atleast tell me how to backup my files , so that if i need to format local disc C: then i have my files backed up ! This is urgent .

Hi,

A very difficult situation. Have you tried to see if you can go to safe mode preferably with networking?

Have you had the recent Vundo variant that creates a lot of junk files (P*.tmp)?

If you can I can assist you remove the Vundo, or at least free the explorer then you decide on the next step.

To get into the Windows XP Safe mode:

As the Computer is booting, start tapping the "F8 key" before WinXP starts loading, which should bring up the "Windows Advanced Options Menu".

Use your arrow keys to move to "Safe Mode with networking " and press your Enter key.

Niels

Dear TotalErik,

To see what crashed explorer.exe once you are in safe mode press the windows button together with r now type eventvwr press enter open the application logbook and look for logged errors on the time that you had this issue more specificly application error. Double click on these entries and post if you see what module that caused the crash in explorer that is normally written after module. If that still fails please put in your windows installation cd-rom press the windows button together with r now type cmd press enter,after that type sfc /scannow and press enter.

Best regards

Niels

farbar

The reason I asked if you are infected with the recent Vundo is that it creates a lot of junk files which sometimes overloads the system. Besides it tends to make a copy of running processes that then interfere with the legit processes. Every reboot creats more and more trouble. You may know it if you have some of the followings:

* a common symptom is getting pop ups and error warnings.

*your Internet privacy is lowered, and gets lowered after every reboot,

*you may see a lot of P*.tmp files usually on the root of C drive or in My Documents folder

* in some cases when you open the task manger you see more than usual processes running, some processes which have usually one entry have two entries, one is a .exe the other . exe (note the space in between), in some cases you may even see . exe. exe.

* BD detects Vundo, removes or blocks them but they come back again.

* in some cases there appears some Icons on the desktop (help and support center, window update, etc.),

* in some cases there is a red x on the the c drive

So if your system is not infected follow the suggestion made by Niels. Otherwise it may be just a temporary solution, which is also good because it open up the way to the next step. In case you are infected the short cut is removing the infection and at the end running the sfc /scannow command. If you opted for disinfection let me know.

TotalBalance

The reason I asked if you are infected with the recent Vundo is that it creates a lot of junk files which sometimes overloads the system. Besides it tends to make a copy of running processes that then interfere with the legit processes. Every reboot creats more and more trouble. You may know it if you have some of the followings:

* a common symptom is getting pop ups and error warnings.

*your Internet privacy is lowered, and gets lowered after every reboot,

*you may see a lot of P*.tmp files usually on the root of C drive or in My Documents folder

* in some cases when you open the task manger you see more than usual processes running, some processes which have usually one entry have two entries, one is a .exe the other . exe (note the space in between), in some cases you may even see . exe. exe.

* BD detects Vundo, removes or blocks them but they come back again.

* in some cases there appears some Icons on the desktop (help and support center, window update, etc.),

* in some cases there is a red x on the the c drive

So if your system is not infected follow the suggestion made by Niels. Otherwise it may be just a temporary solution, which is also good because it open up the way to the next step. In case you are infected the short cut is removing the infection and at the end running the sfc /scannow command. If you opted for disinfection let me know.

Well i've been noticing unusual processes yes . Like is it normal to have 5 svchost.exe's running ? if yes then what about unusual huge CPU Usage it's like 55% most of the time . (before it was like 2% at normal state )

Oh and im in a normal mode at the moment , but i run programs with task manager .

TotalBalance

Dear TotalErik,

To see what crashed explorer.exe once you are in safe mode press the windows button together with r now type eventvwr press enter open the application logbook and look for logged errors on the time that you had this issue more specificly application error. Double click on these entries and post if you see what module that caused the crash in explorer that is normally written after module. If that still fails please put in your windows installation cd-rom press the windows button together with r now type cmd press enter,after that type sfc /scannow and press enter.

Best regards

Niels

Ok i'll try it and i'll post the news as soon as i can !

TotalBalance

Dear TotalErik,

To see what crashed explorer.exe once you are in safe mode press the windows button together with r now type eventvwr press enter open the application logbook and look for logged errors on the time that you had this issue more specificly application error. Double click on these entries and post if you see what module that caused the crash in explorer that is normally written after module. If that still fails please put in your windows installation cd-rom press the windows button together with r now type cmd press enter,after that type sfc /scannow and press enter.

Best regards

Niels

I didn't find exactly any logs for explorer.exe , but i did find something like this :Source: Winlogon , Description: The shell stopped unexpectedly and Explorer.exe was restarted. i hope this means anything to you , though it does not for me And there were alot of such kind of logs in the event viewer.

TotalBalance

Farbar ,

There was this one virus Trojan.Vundo.DVS but they said that it might just be a configuration file used by the Vundo virus . But as they said , if the file reappears then im infected with vundo , but no it hasn't reappeared .

farbar

Farbar ,

There was this one virus Trojan.Vundo.DVS but they said that it might just be a configuration file used by the Vundo virus . But as they said , if the file reappears then im infected with vundo , but no it hasn't reappeared .

Frankly when I saw your post I thought you are in trouble not able to stay in normal mode.

Ok, if you are in normal mode and you don't recognize those symptoms it is good news. Having 5 svchost.exe or more is normal. It looks like you are not infected by Vundo. But the 55% CPU is not normal. If you want to be sure post a hijackthis log into your replay. I can tell you if you are infected.

Then we can see what happened and why the winlogon shell stopped. The main question is if this is a system malfunction or a malware.

So I suggest you to do this:

You can download a Trend Micro Hijackthis installer from here:

http://www.trendsecure.com/portal/en-US/to...ckthis/download

Install it, run it and click Do a system scan and save a logfile.

Please copy and paste the content of the logfile into your next reply.

Can you please check which process is having a hight CPU usage.

TotalBalance

OK, NOW I HAVE SOME VUNDOS ALERTS !!! Bitdefender found 2 vundos : Trojan.Vundo.DWB and Trojan.Vundo.DZK .

And i must add that the bitdefender File zone scanner is like always GREEN. ( i know it means that it's scanning some stuff ) . is it possible to scan with bitdefender in safe mode too ? (and im gonna reply you with the hijack-this logs soon )

TotalBalance

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 23:18:25, on 22.02.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\DAP\DAP.EXE

C:\Program Files\Softwin\BitDefender10\bdmcon.exe

C:\Program Files\Softwin\BitDefender10\bdagent.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\system32\cisvc.exe

C:\WINDOWS\sttray.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\uTorrent\uTorrent.exe

C:\Program Files\Macrogaming\SweetIM\SweetIM.exe

C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe

C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe

C:\Program Files\Softwin\BitDefender10\vsserv.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\taskmgr.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\cidaemon.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com

R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll

O2 - BHO: (no name) - {239F0C96-9D01-4146-B90F-3F52B7E39B04} - C:\WINDOWS\system32\ddaba.dll

O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll

O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live'i sisselogimisabiline - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\xloydjio.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: (no name) - {BA6C6CB6-676C-4DEA-9BDA-3BC4AB075F7C} - C:\WINDOWS\system32\ljjkhed.dll

O2 - BHO: {7bd4294f-7957-fe78-89c4-962ed07afaab} - {baafa70d-e269-4c98-87ef-7597f4924db7} - C:\WINDOWS\system32\nldnpbpf.dll

O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\PROGRA~1\FlashGet\getflash.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll

O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL

O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"

O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP

O4 - HKLM\..\Run: [bDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg

O4 - HKLM\..\Run: [bDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [sigmatelSysTrayApp] sttray.exe

O4 - HKLM\..\Run: [149d6d99] rundll32.exe "C:\WINDOWS\system32\wsvbgbxv.dll",b

O4 - HKLM\..\RunOnce: [Execute] C:\WINDOWS\System32\Tools\DelFolders.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"

O4 - HKCU\..\Run: [sweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Reboot.exe

O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm

O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm

O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm

O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm

O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe

O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1198603750796

O16 - DPF: {AA07EBD2-EBDD-4BD6-9F8F-114BD513492C} (NeffyLauncherCtl Class) - http://dist.globalgamecdn.com/dist/neffy/NeffyLauncher.cab

O20 - Winlogon Notify: ljjkhed - C:\WINDOWS\SYSTEM32\ljjkhed.dll

O20 - Winlogon Notify: xloydjio - C:\WINDOWS\SYSTEM32\xloydjio.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe

O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

End of file - 8375 bytes

Chesda

Please, send these files in a zip folder with the password infected on your next reply.

C:\WINDOWS\system32\xloydjio.dll

C:\WINDOWS\system32\ljjkhed.dll

C:\WINDOWS\system32\wsvbgbxv.dll

TotalBalance

ok i was told that i should upload these files/applications/core/interface/file/attachment.php?id=1555" data-fileid="1555" rel="">suspected_files.zip

suspected_files.zip

farbar

Now I am sure you have Vundo. But there is no time to do it tonight. I'll come back tomorrow.

TotalBalance

i forgot to put the INFECTED as a password is it bad ?

TotalBalance

I got this error today :

Important - Potential Errors found in the system.

During a scan of files at system startup , potential errors in the system registry were found.

p-07-0100 irwl: 1f SYSVER 0xff00024

NT_Kernel error 1256

KMODE_EXCEPTION_NOT_HANDLED.

Ok i hope this is ain't something real bad

farbar

... You may know it if you have some of the followings:

* a common symptom is getting pop ups and error warnings.

*your Internet privacy is lowered, and gets lowered after every reboot,

*you may see a lot of P*.tmp files usually on the root of C drive or in My Documents folder

* in some cases when you open the task manger you see more than usual processes running, some processes which have usually one entry have two entries, one is a .exe the other . exe (note the space in between), in some cases you may even see . exe. exe.

* BD detects Vundo, removes or blocks them but they come back again.

* in some cases there appears some Icons on the desktop (help and support center, window update, etc.),

* in some cases there is a red x on the the c drive

It is the recent Vundo variant.

TotalBalance

is there a removal tool for that Vundo ?

Or any way to get rid of it ?

Chesda

TotalErik,

Yes there is a Vundo Removal Tool (VundoFix), download here: http://www.majorgeeks.com/download4954.html

Please download VundoFix.exe to your desktop.

Double-click VundoFix.exe to run it.
When VundoFix re-opens, click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.

Best of luck

TotalBalance

erm... it says

Error 404!

/download4954.html/url

File Not Found!

Chesda

erm... it says

Error 404!

/download4954.html/url

File Not Found!

TotalErik,

Try downloading at a different mirror location. If this does not work either, please download VundoFix here: http://www.atribune.org/ccount/click.php?id=4

farbar

Hi,

I am know looking at your log. I can assist you removing the malware. It is not just vundo, it is multiple infection. If you want me to help you step by step removing the malware post back. In that case I want you to follow the steps I am going to give you and fix nothing on your own or the suggestions of others. I am waiting for your reply.

TotalBalance

Hi,

I am know looking at your log. I can assist you removing the malware. It is not just vundo, it is multiple infection. If you want me to help you step by step removing the malware post back. In that case I want you to follow the steps I am going to give you and fix nothing on your own or the suggestions of others. I am waiting for your reply.

Well i think i got the vundo fixed but if you think i have something more then i think , yes of course i want you to help me remove the malware but i can't at the moment because i have to go away for like 6 hours or something like that .

AND I WANT TO THANK YOU ALL WHO WAS HELPING ME WITH THIS VUNDO THING !!!!!!!

TotalBalance

I had some happiness tears in my eyes when i fixed the vundo because i thought that i have to format local disk C . I love ya'll at bitdefender and other guys . Thank you again

TotalBalance

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:15:28, on 23.02.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\cisvc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe

C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe

C:\Program Files\Softwin\BitDefender10\vsserv.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Softwin\BitDefender10\bdmcon.exe

C:\Program Files\Softwin\BitDefender10\bdagent.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\sttray.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Macrogaming\SweetIM\SweetIM.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\cidaemon.exe

C:\Documents and Settings\Kodu\Desktop\VundoFix.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Softwin\BitDefender10\bdlite.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com

R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll

O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL

O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"

O4 - HKLM\..\Run: [bDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg

O4 - HKLM\..\Run: [bDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [sigmatelSysTrayApp] sttray.exe

O4 - HKLM\..\Run: [149d6d99] rundll32.exe "C:\WINDOWS\system32\hcujscof.dll",b