Kindly be advised we cannot cancel subscriptions or issue refunds on the forum.
You may cancel your Bitdefender subscription from Bitdefender Central or by contacting Customer Support at: https://www.bitdefender.com/consumer/support/help/

Thank you for your understanding.

Need Help With 3 Viruses

Options

hey sorry to bothe but how do i get rid of these virus...heres the log


Virus Statistics


Scan path : C:\


D:\


Folders : 6031


Files : 26815


Memory processes scanned : 39


Archives : 3


Runtime packers : 1432


Identified viruses : 3


Infected files : 3


Memory processes infected : 0


Suspect files : 0


Warnings : 0


Disinfected files : 0


Deleted files : 0


Moved files : 3


I/O errors : 10


Scan time : 00:16:04


Scan speed (files/sec) : 27


Spyware Statistics


Registry keys scanned : 1884


Registry keys infected : 0


Cookies scanned : 34


Cookies infected : 0


Spyware files infected : 0


Spyware threats detected : 0


Virus definitions : 877190


Scan plugins : 16


Archive plugins : 41


Unpack plugins : 7


Mail plugins : 6


System plugins : 5


Virus scan options


Detection


[X] Scan boot sectors


[X] Memory Processes


[ ] Scan archives


[X] Scan runtime packers


[X] Scan email


File mask


[X] Programs


[ ] All files


[ ] User defined extensions:


[ ] Exclude extensions: ;


Action


Infected objects


[ ] Ignore


[X] Disinfect


[ ] Delete


[ ] Move to quarantine


[ ] Prompt user


Second action


[ ] Ignore


[ ] Delete


[X] Move to quarantine


[ ] Prompt user


Virus scan options


[X] Enable warnings


[ ] Enable heuristics


[ ] Show all files in log


[X] Report file: C:\Documents and Settings\All Users\Application Data\Bitdefender\Desktop\Profiles\Logs\full_scan\1195695875.log


Spyware scan options


[X] Scan for riskware


[ ] Skip dial and applications from scan


[X] Registry keys


[X] Cookies


Summary:


C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Startup\PowerReg Scheduler.exe Detected: Application.Powerreg.Scheduler.C


C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Startup\PowerReg Scheduler.exe Disinfection failed


C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Startup\PowerReg Scheduler.exe Moved


C:\Program Files\Paraben\Loader.exe Infected: Trojan.Fumn.A


C:\Program Files\Paraben\Loader.exe Disinfection failed


C:\Program Files\Paraben\Loader.exe Moved


C:\Program Files\SpyNoMore\snmIeGuard.dll Detected: Adware.Spynomore.B


C:\Program Files\SpyNoMore\snmIeGuard.dll Disinfection failed


C:\Program Files\SpyNoMore\snmIeGuard.dll Moved


thx

Comments

  • s4u
    Options

    Where were they moved to?

  • ? move to where? sry

  • To quarantine. Run the scan again to see if they're still detected. If not, just empty your quarantine.

  • ehmmmm ok il run a scan again thx

  • hey ehmmm i did a deep scan and found nothing...so what do i do now.


    do i still have to empty my quarantine?

  • Niels
    Options

    Dear Eugene


    If you really want to delete the quarantined items from your hard disc then you need to empty the quarantine folder. But at this moment they can't cause any harm.


    Best regards


    Niels

  • hey i got another problem...bitd keeps poping up virus however when i do a scan it does not find anything.. help?


    File c:\docume~1\compaq~1\locals~1\temp\ac8zt2\main_u~1.exe


    infected with Trojan.Agent.ABSG


    File c:\docume~1\compaq~1\locals~1\temp\ac8zt2\main_uninstaller.exe


    infected with Trojan.Agent.ABSG


    File c:\docume~1\compaq~1\locals~1\temp\ac8zt2\msmdev.dll


    infected with Trojan.Downloader.Agent.YNU


    File c:\docume~1\compaq~1\locals~1\temp\ac8zt2\nsduo.dll


    infected with Trojan.Downloader.Agent.YNQ

  • Niels
    Options

    Dear eugene199


    Go to start,my computer go to the tools menu,folder options,view (display),check show hidden files and folders. Now navigate further by double clicking on the icon of your hard disc,documents and settings,compaq,local settings,temp. Close your browser first and try to delete the files manually.


    Best regards


    Niels

  • I also suggest that you set your real time protection to Aggressive.

  • ehmmm ok but i could not find the files in temp...is it ok if i delete everything in the folder?


    o yea ehm i also used a programm called smitfraudfix i wondered if it had cleared the viruses as when i switch my computer on this morning i found 3 new icon and pop up about my com being infected wit viruses...i then run the programm and its no longer there


    ill do a scan again to see whether its still there

  • o sry this is the smitfraudfix log


    SmitFraudFix v2.240


    Scan done at 8:52:38.15, Fri 11/23/2007


    Run from C:\Documents and Settings\Compaq_Owner\Desktop\SmitfraudFix


    OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT


    The filesystem type is NTFS


    Fix run in safe mode


    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix


    !!!Attention, following keys are not inevitably infected!!!


    SrchSTS.exe by S!Ri


    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» Killing process


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System


    !!!Attention, following keys are not inevitably infected!!!


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]


    "System"=" "


    »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning


    Registry Cleaning done.


    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix


    !!!Attention, following keys are not inevitably infected!!!


    SrchSTS.exe by S!Ri


    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» End

  • Niels
    Options

    Dear eugene199


    smitfraudfix is only to be used for deleting rogue programs that changed your desktop.


    Do you mean that there are new icons in your system tray? Download rogueremover. Install it you will be informed to check for updates do that. Now press on scan. Download and install hijackthis once installed press on do a system scan and save a logfile. Paste the scan log and I or somebody else will take a look at it.


    Best regards


    Niels

  • ehm oi i did a scan with rogueremover and it found nothing so i think im still ok...


    heres the log for hijackthis :


    Logfile of Trend Micro HijackThis v2.0.2


    Scan saved at 8:05:56 PM, on 11/23/2007


    Platform: Windows XP SP2 (WinNT 5.01.2600)


    MSIE: Internet Explorer v7.00 (7.00.6000.16544)


    Boot mode: Normal


    Running processes:


    C:\WINDOWS\System32\smss.exe


    C:\WINDOWS\system32\winlogon.exe


    C:\WINDOWS\system32\services.exe


    C:\WINDOWS\system32\lsass.exe


    C:\WINDOWS\system32\Ati2evxx.exe


    C:\WINDOWS\system32\svchost.exe


    C:\WINDOWS\System32\svchost.exe


    C:\WINDOWS\system32\svchost.exe


    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe


    C:\WINDOWS\system32\Ati2evxx.exe


    C:\WINDOWS\Explorer.EXE


    C:\WINDOWS\system32\spoolsv.exe


    C:\WINDOWS\RTHDCPL.EXE


    C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe


    C:\Program Files\Softwin\BitDefender10\bdagent.exe


    C:\WINDOWS\system32\ctfmon.exe


    C:\Program Files\MSN Messenger\MsnMsgr.Exe


    C:\WINDOWS\system32\cisvc.exe


    C:\Program Files\Common Files\LightScribe\LSSrvc.exe


    C:\WINDOWS\system32\HPZipm12.exe


    C:\WINDOWS\System32\snmp.exe


    C:\WINDOWS\system32\svchost.exe


    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


    C:\WINDOWS\system32\MsPMSPSv.exe


    C:\Program Files\Webroot\Washer\WasherSvc.exe


    C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe


    C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe


    C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe


    C:\Program Files\Softwin\BitDefender10\vsserv.exe


    C:\Program Files\MSN Messenger\usnsvc.exe


    C:\Program Files\Internet Explorer\iexplore.exe


    C:\WINDOWS\system32\cidaemon.exe


    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe


    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 203.106.52.102:3128


    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll


    O1 - Hosts: HPEED661 HP0019BBEED661


    O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - (no file)


    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll


    O2 - BHO: ClickCatcher MSIE handler - {16664845-0E00-11D2-8059-000000000000} - C:\Program Files\Common Files\Paraben Shared\Catcher.dll


    O2 - BHO: (no name) - {2A646672-9C3A-4C28-9A7A-1FB0F63F28B6} - (no file)


    O2 - BHO: (no name) - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - (no file)


    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll


    O2 - BHO: MSVPS System - {88418AA3-16F5-4FC2-A9D8-90B1266DF841} - C:\WINDOWS\nsduo.dll (file missing)


    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll


    O2 - BHO: (no name) - {C6C7C348-C2F9-4465-9B41-121C467CC4E5} - (no file)


    O2 - BHO: (no name) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - (no file)


    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll


    O3 - Toolbar: The jokwmp - {54BA2889-CF6C-4D57-B2FB-B3FE1CA9EE8F} - C:\WINDOWS\jokwmp.dll (file missing)


    O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32


    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC


    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC


    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName


    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE


    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE


    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime


    O4 - HKLM\..\Run: [bDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe


    O4 - HKLM\..\Run: [bDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"


    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe


    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background


    O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe


    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')


    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')


    O4 - S-1-5-18 Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'SYSTEM')


    O4 - .DEFAULT Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')


    O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')


    O4 - Startup: Hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe


    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe


    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present


    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present


    O8 - Extra context menu item: Download A&ll by PDM - C:\Program Files\Common Files\Paraben Shared\CC_All.htm


    O8 - Extra context menu item: Download by PDM - C:\Program Files\Common Files\Paraben Shared\CC_Link.htm


    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll


    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll


    O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)


    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll


    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll


    O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm


    O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm


    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab


    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll


    O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} - http://gamedownload.ijjimax.com/gamedownlo...Plugin11USA.cab


    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1184120132454


    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1184416270968


    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab


    O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab


    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab


    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab


    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll


    O21 - SSODL: rmvgor - {E2E6FCCD-1938-4811-8397-FA13F9696B98} - (no file)


    O21 - SSODL: sapnet - {0CA5FDD9-725F-492D-B1C1-D65698ED238F} - (no file)


    O21 - SSODL: msmdev - {812CA095-31F5-469C-89AF-76BD7A990DCD} - (no file)


    O21 - SSODL: msmhost - {8D9DD8D5-19F4-4F25-9A7A-FC73E9F565C9} - (no file)


    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe


    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe


    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe


    O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE


    O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE


    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe


    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe


    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe


    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe


    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe


    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


    O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe


    O23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe


    O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe


    --


    End of file - 10034 bytes


    thx for helping btw

  • Niels
    Options

    Dear eugene199


    Check these entries and press on fix checked confirm the message


    O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - (no file)


    O2 - BHO: (no name) - {2A646672-9C3A-4C28-9A7A-1FB0F63F28B6} - (no file)


    O2 - BHO: (no name) - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - (no file)


    O2 - BHO: MSVPS System - {88418AA3-16F5-4FC2-A9D8-90B1266DF841} - C:\WINDOWS\nsduo.dll (file missing)


    O2 - BHO: (no name) - {C6C7C348-C2F9-4465-9B41-121C467CC4E5} - (no file)


    O2 - BHO: (no name) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - (no file)


    O3 - Toolbar: The jokwmp - {54BA2889-CF6C-4D57-B2FB-B3FE1CA9EE8F} - C:\WINDOWS\jokwmp.dll (file missing)


    O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)


    O21 - SSODL: rmvgor - {E2E6FCCD-1938-4811-8397-FA13F9696B98} - (no file)


    O21 - SSODL: sapnet - {0CA5FDD9-725F-492D-B1C1-D65698ED238F} - (no file)


    O21 - SSODL: msmdev - {812CA095-31F5-469C-89AF-76BD7A990DCD} - (no file)


    O21 - SSODL: msmhost - {8D9DD8D5-19F4-4F25-9A7A-FC73E9F565C9} - (no file)


    Do you have installed WinPcap by yourself?


    If not go to start,control panel,software,add/remove and uninstall WinPcap.


    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe


    Update first ad aware and spybot search & destroy reboot your pc afterwards. But press several times on the F8 button before the windows loading screen select safe mode press enter. Log in with your account and perform a full scan with both products. Reboot again your computer and place a new logfile.


    Best regards


    Niels

  • ehmmm ok i Check these entries and press on fix checked confirm the message.


    ill do a scan now but which log file do i put the ad aware or the spybot

  • i need help plz ty

  • ehmmmmm ????????????????

  • Niels
    Niels
    edited November 2007
    Options

    Dear eugene199


    I meant to post a new hijack this log and post also the scan results..


    Best regards


    Niels


    Dear Strength


    Please stop posting in somebody else topics.


    Best regards


    Niels

  • o ok heres the hijackthis log


    Logfile of Trend Micro HijackThis v2.0.2


    Scan saved at 7:28:30 PM, on 11/24/2007


    Platform: Windows XP SP2 (WinNT 5.01.2600)


    MSIE: Internet Explorer v7.00 (7.00.6000.16544)


    Boot mode: Normal


    Running processes:


    C:\WINDOWS\System32\smss.exe


    C:\WINDOWS\system32\winlogon.exe


    C:\WINDOWS\system32\services.exe


    C:\WINDOWS\system32\lsass.exe


    C:\WINDOWS\system32\Ati2evxx.exe


    C:\WINDOWS\system32\svchost.exe


    C:\WINDOWS\System32\svchost.exe


    C:\WINDOWS\system32\svchost.exe


    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe


    C:\WINDOWS\system32\Ati2evxx.exe


    C:\WINDOWS\Explorer.EXE


    C:\WINDOWS\system32\spoolsv.exe


    C:\WINDOWS\RTHDCPL.EXE


    C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe


    C:\Program Files\Softwin\BitDefender10\bdagent.exe


    C:\WINDOWS\system32\ctfmon.exe


    C:\WINDOWS\system32\cisvc.exe


    C:\Program Files\Common Files\LightScribe\LSSrvc.exe


    C:\WINDOWS\system32\HPZipm12.exe


    C:\WINDOWS\System32\snmp.exe


    C:\WINDOWS\system32\svchost.exe


    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


    C:\WINDOWS\system32\MsPMSPSv.exe


    C:\Program Files\Webroot\Washer\WasherSvc.exe


    C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe


    C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe


    C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe


    C:\Program Files\Softwin\BitDefender10\vsserv.exe


    C:\Program Files\MSN Messenger\usnsvc.exe


    C:\Program Files\Ocean Technology\GG E-Sports Platform\GGclient.exe


    C:\WINDOWS\system32\cidaemon.exe


    C:\Program Files\Internet Explorer\iexplore.exe


    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe


    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 203.106.52.102:3128


    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll


    O1 - Hosts: HPEED661 HP0019BBEED661


    O2 - BHO: (no name) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - (no file)


    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll


    O2 - BHO: ClickCatcher MSIE handler - {16664845-0E00-11D2-8059-000000000000} - C:\Program Files\Common Files\Paraben Shared\Catcher.dll


    O2 - BHO: (no name) - {2A646672-9C3A-4C28-9A7A-1FB0F63F28B6} - (no file)


    O2 - BHO: (no name) - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - (no file)


    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll


    O2 - BHO: (no name) - {88418AA3-16F5-4FC2-A9D8-90B1266DF841} - (no file)


    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll


    O2 - BHO: (no name) - {C6C7C348-C2F9-4465-9B41-121C467CC4E5} - (no file)


    O2 - BHO: (no name) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - (no file)


    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll


    O3 - Toolbar: The jokwmp - {54BA2889-CF6C-4D57-B2FB-B3FE1CA9EE8F} - (no file)


    O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32


    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC


    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC


    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName


    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE


    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE


    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime


    O4 - HKLM\..\Run: [bDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe


    O4 - HKLM\..\Run: [bDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"


    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe


    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background


    O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe


    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')


    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')


    O4 - S-1-5-18 Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'SYSTEM')


    O4 - .DEFAULT Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')


    O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')


    O4 - Startup: Hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe


    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe


    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present


    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present


    O8 - Extra context menu item: Download A&ll by PDM - C:\Program Files\Common Files\Paraben Shared\CC_All.htm


    O8 - Extra context menu item: Download by PDM - C:\Program Files\Common Files\Paraben Shared\CC_Link.htm


    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll


    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll


    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll


    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll


    O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm


    O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm


    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab


    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll


    O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} - http://gamedownload.ijjimax.com/gamedownlo...Plugin11USA.cab


    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1184120132454


    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1184416270968


    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab


    O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab


    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab


    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab


    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll


    O21 - SSODL: rmvgor - {E2E6FCCD-1938-4811-8397-FA13F9696B98} - (no file)


    O21 - SSODL: sapnet - {0CA5FDD9-725F-492D-B1C1-D65698ED238F} - (no file)


    O21 - SSODL: msmdev - {812CA095-31F5-469C-89AF-76BD7A990DCD} - (no file)


    O21 - SSODL: msmhost - {8D9DD8D5-19F4-4F25-9A7A-FC73E9F565C9} - (no file)


    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe


    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe


    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe


    O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE


    O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE


    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe


    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe


    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe


    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe


    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe


    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


    O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe


    O23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe


    O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe


    --


    End of file - 9911 bytes

  • and heres the scan result for ad aware


    Ad-Aware 2007 Build


    Log File Created on: 2007-11-24 00:54:34


    Using Definitions File: C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware 2007\core.aawdef


    Computer name: ANG


    Name of user performing scan: SYSTEM


    System information


    ===========================


    Number of processors: 2


    Processor type: Intel® Pentium® D CPU 2.80GHz


    Memory Available: 68%


    Total Physical Memory: 1005891584 Bytes


    Available Physical Memory: 680800256 Bytes


    Total Page File Size: 3015258112 Bytes


    Available On Page File: 2814246912 Bytes


    Total Virtual Memory: 2147352576 Bytes


    Available Virtual Memory: 1990770688 Bytes


    OS: Microsoft Windows XP Service Pack 2 (Build 2600)


    Ad-Aware 2007 Settings


    ===========================


    Skipping files larger than 1048576 kB


    Ignoring infections with lower TAI than: 3


    Extended Ad-Aware 2007 Settings


    ===========================


    Unloading known modules during scan


    Ignoring spanned files when scanning cab archives


    Reanalyzing results after scanning before displaying results


    Trying to unload modules prior to removal


    Let Windows remove files currently in use at next reboot


    Removing quarantined objects after restore


    Deactivating Ad-Watch during scans


    Writeprotecting system files after repairs


    Include info about ignored objects in log file


    Including basic settings in log file


    Including advanced settings in log file


    Including user and computer name in log file


    Create and save WebUpdate log file


    Databaseinfo


    ===========================


    Version number: 35


    Build Number: 0


    Build Date and Time: 2007/11/21 17:11:06


    Scan Statistics


    ===========================


    Method: Full


    Scan tracking cookies.............................: On


    Scan ADS filestreams..............................: Off


    Item Scanned: 247547


    Infections Detected: 13


    Infections Ignored: 0


    Scan detailed statistics


    ===========================


    Type Critical Total


    Process Scan....: 0 0


    Registry Scan...: 1 1


    Registry PE Scan: 0 0


    Hosts File Scan.: 0 0


    File Scan.......: 1 1


    Folder Scan.....: 0 0


    LSP Scan........: 0 0


    ADS Scan........: 0 0


    Cookie Scan.....: 9 9


    File Hash Scan..: 0 0


    Infections Found


    ===========================


    Family Id: 1040 Name: Win32.Trojandownloader.Zlob Category: Malware TAI:10


    Item Id: 300036708 Value: Root: HKU Path: S-1-5-21-3596813233-4262842479-3250221985-1008\software\microsoft\internet explorer\toolbar\webbrowser Value: {6ca49fdd-4aeb-4f08-a394-c0a1f82caa16}


    Item Id: 700006689 Value: File: c:\System Volume Information\tracking.log


    Family Id: 725 Name: Tracking Cookie Category: DataMiner TAI:3


    Item Id: 600000190 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Compaq_Owner\Cookies\index.dat www.googleadservices.com Conversion /pagead/conversion/1072728669/


    Item Id: 600000050 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Compaq_Owner\Cookies\index.dat tribalfusion.com ANON_ID /


    Item Id: 600000408 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Compaq_Owner\Cookies\index.dat serving-sys.com U /


    Item Id: 600000408 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Compaq_Owner\Cookies\index.dat serving-sys.com A2 /


    Item Id: 600000408 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Compaq_Owner\Cookies\index.dat serving-sys.com B2 /


    Item Id: 600000408 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Compaq_Owner\Cookies\index.dat serving-sys.com C3 /


    Item Id: 600000408 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Compaq_Owner\Cookies\index.dat serving-sys.com D3 /


    Item Id: 600000408 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Compaq_Owner\Cookies\index.dat serving-sys.com E2 /


    Item Id: 600000171 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\Compaq_Owner\Cookies\index.dat bs.serving-sys.com eyeblaster /


    Family Id: 9999 Name: MRU Object Category: MRU Object TAI:0


    Item Id: 1 Value: MRU Path: C:\Documents and Settings\Compaq_Owner\Recent Count: 8


    Item Id: 3 Value: MRU Registry Key: S-1-5-21-3596813233-4262842479-3250221985-1008\Software\Microsoft\Internet Explorer\TypedURLs Count: 1


    Items Ignored During Scan


    ===========================


    Listing of running processes


    ===========================


    C:\WINDOWS\SYSTEM32\SMSS.EXE


    c:\windows\system32\smss.exe


    c:\windows\system32\ntdll.dll


    C:\WINDOWS\SYSTEM32\CSRSS.EXE


    c:\windows\system32\csrss.exe


    c:\windows\system32\ntdll.dll


    c:\windows\system32\csrsrv.dll


    c:\windows\system32\basesrv.dll


    c:\windows\system32\winsrv.dll


    c:\windows\system32\gdi32.dll


    c:\windows\system32\kernel32.dll


    c:\windows\system32\user32.dll


    c:\windows\system32\lpk.dll


    c:\windows\system32\usp10.dll


    c:\windows\system32\msvcrt.dll


    c:\windows\system32\advapi32.dll


    c:\windows\system32\rpcrt4.dll


    c:\windows\system32\sxs.dll


    C:\WINDOWS\SYSTEM32\WINLOGON.EXE


    c:\windows\system32\winlogon.exe


    c:\windows\system32\ntdll.dll


    c:\windows\system32\kernel32.dll


    c:\windows\system32\advapi32.dll


    c:\windows\system32\rpcrt4.dll


    c:\windows\system32\authz.dll


    c:\windows\system32\msvcrt.dll


    c:\windows\system32\crypt32.dll


    c:\windows\system32\user32.dll


    c:\windows\system32\gdi32.dll


    c:\windows\system32\msasn1.dll


    c:\windows\system32\nddeapi.dll


    c:\windows\system32\profmap.dll


    c:\windows\system32\netapi32.dll


    c:\windows\system32\userenv.dll


    c:\windows\system32\psapi.dll


    c:\windows\system32\regapi.dll


    c:\windows\system32\secur32.dll


    c:\windows\system32\setupapi.dll


    c:\windows\system32\version.dll


    c:\windows\system32\winsta.dll


    c:\windows\system32\wintrust.dll


    c:\windows\system32\imagehlp.dll


    c:\windows\system32\ws2_32.dll


    c:\windows\system32\ws2help.dll


    c:\windows\system32\imm32.dll


    c:\windows\system32\lpk.dll


    c:\windows\system32\usp10.dll


    c:\windows\system32\msgina.dll


    c:\windows\system32\shell32.dll


    c:\windows\system32\shlwapi.dll


    c:\windows\system32\comctl32.dll


    c:\windows\system32\odbc32.dll


    c:\windows\system32\comdlg32.dll


    c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll


    c:\windows\system32\odbcint.dll


    c:\windows\system32\shsvcs.dll


    c:\windows\system32\sfc.dll


    c:\windows\system32\sfc_os.dll


    c:\windows\system32\ole32.dll


    c:\windows\system32\apphelp.dll


    c:\windows\system32\msctfime.ime


    c:\windows\system32\winmm.dll


    c:\program files\superantispyware\saswinlo.dll


    c:\windows\system32\oleaut32.dll


    c:\windows\system32\wininet.dll


    c:\windows\system32\normaliz.dll


    c:\windows\system32\iertutil.dll


    c:\windows\system32\ati2evxx.dll


    c:\windows\system32\rsaenh.dll


    c:\windows\system32\cscdll.dll


    c:\windows\system32\lmiinit.dll


    c:\windows\system32\wlnotify.dll


    c:\windows\system32\winscard.dll


    c:\windows\system32\wtsapi32.dll


    c:\windows\system32\winspool.drv


    c:\windows\system32\mpr.dll


    c:\windows\system32\wgalogon.dll


    c:\windows\system32\ntmarta.dll


    c:\windows\system32\wldap32.dll


    c:\windows\system32\samlib.dll


    c:\windows\system32\clbcatq.dll


    c:\windows\system32\comres.dll


    c:\windows\system32\uxtheme.dll


    c:\windows\system32\lmirfsclientnp.dll


    c:\windows\system32\cscui.dll


    c:\windows\system32\msv1_0.dll


    c:\windows\system32\iphlpapi.dll


    c:\windows\system32\xpsp2res.dll


    C:\WINDOWS\SYSTEM32\SERVICES.EXE


    c:\windows\system32\services.exe


    c:\windows\system32\ntdll.dll


    c:\windows\system32\kernel32.dll


    c:\windows\system32\msvcrt.dll


    c:\windows\system32\advapi32.dll


    c:\windows\system32\rpcrt4.dll


    c:\windows\system32\user32.dll


    c:\windows\system32\gdi32.dll


    c:\windows\system32\userenv.dll


    c:\windows\system32\scesrv.dll


    c:\windows\system32\authz.dll


    c:\windows\system32\umpnpmgr.dll


    c:\windows\system32\winsta.dll


    c:\windows\system32\netapi32.dll


    c:\windows\system32\ncobjapi.dll


    c:\windows\system32\msvcp60.dll


    c:\windows\system32\shimeng.dll


    c:\windows\apppatch\acadproc.dll


    c:\windows\system32\imm32.dll


    c:\windows\system32\lpk.dll


    c:\windows\system32\usp10.dll


    c:\windows\system32\secur32.dll


    c:\windows\system32\apphelp.dll


    c:\windows\system32\version.dll


    c:\windows\system32\eventlog.dll


    c:\windows\system32\ws2_32.dll


    c:\windows\system32\ws2help.dll


    c:\windows\system32\psapi.dll


    c:\windows\system32\wtsapi32.dll


    C:\WINDOWS\SYSTEM32\LSASS.EXE


    c:\windows\system32\lsass.exe


    c:\windows\system32\ntdll.dll


    c:\windows\system32\kernel32.dll


    c:\windows\system32\advapi32.dll


    c:\windows\system32\rpcrt4.dll


    c:\windows\system32\lsasrv.dll


    c:\windows\system32\mpr.dll


    c:\windows\system32\user32.dll


    c:\windows\system32\gdi32.dll


    c:\windows\system32\msasn1.dll


    c:\windows\system32\msvcrt.dll


    c:\windows\system32\netapi32.dll


    c:\windows\system32\ntdsapi.dll


    c:\windows\system32\dnsapi.dll


    c:\windows\system32\ws2_32.dll


    c:\windows\system32\ws2help.dll


    c:\windows\system32\wldap32.dll


    c:\windows\system32\secur32.dll


    c:\windows\system32\samlib.dll


    c:\windows\system32\samsrv.dll


    c:\windows\system32\cryptdll.dll


    c:\windows\system32\shimeng.dll


    c:\windows\apppatch\acgenral.dll


    c:\windows\system32\winmm.dll


    c:\windows\system32\ole32.dll


    c:\windows\system32\oleaut32.dll


    c:\windows\system32\msacm32.dll


    c:\windows\system32\version.dll


    c:\windows\system32\shell32.dll


    c:\windows\system32\shlwapi.dll


    c:\windows\system32\userenv.dll


    c:\windows\system32\uxtheme.dll


    c:\windows\system32\imm32.dll


    c:\windows\system32\lpk.dll


    c:\windows\system32\usp10.dll


    c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll


    c:\windows\system32\comctl32.dll


    c:\windows\system32\msprivs.dll


    c:\windows\system32\kerberos.dll


    c:\windows\system32\msv1_0.dll


    c:\windows\system32\iphlpapi.dll


    c:\windows\system32\netlogon.dll


    c:\windows\system32\w32time.dll


    c:\windows\system32\msvcp60.dll


    c:\windows\system32\schannel.dll


    c:\windows\system32\crypt32.dll


    c:\windows\system32\wdigest.dll


    c:\windows\system32\rsaenh.dll


    c:\windows\system32\setupapi.dll


    c:\windows\system32\scecli.dll


    C:\WINDOWS\SYSTEM32\SVCHOST.EXE


    c:\windows\system32\svchost.exe


    c:\windows\system32\ntdll.dll


    c:\windows\system32\kernel32.dll


    c:\windows\system32\advapi32.dll


    c:\windows\system32\rpcrt4.dll


    c:\windows\system32\shimeng.dll


    c:\windows\apppatch\acgenral.dll


    c:\windows\system32\user32.dll


    c:\windows\system32\gdi32.dll


    c:\windows\system32\winmm.dll


    c:\windows\system32\ole32.dll


    c:\windows\system32\msvcrt.dll


    c:\windows\system32\oleaut32.dll


    c:\windows\system32\msacm32.dll


    c:\windows\system32\version.dll


    c:\windows\system32\shell32.dll


    c:\windows\system32\shlwapi.dll


    c:\windows\system32\userenv.dll


    c:\windows\system32\uxtheme.dll


    c:\windows\system32\imm32.dll


    c:\windows\system32\lpk.dll


    c:\windows\system32\usp10.dll


    c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll


    c:\windows\system32\comctl32.dll


    c:\windows\system32\ntmarta.dll


    c:\windows\system32\wldap32.dll


    c:\windows\system32\samlib.dll


    c:\windows\system32\rpcss.dll


    c:\windows\system32\secur32.dll


    c:\windows\system32\ws2_32.dll


    c:\windows\system32\ws2help.dll


    c:\windows\system32\xpsp2res.dll


    c:\windows\system32\wtsapi32.dll


    c:\windows\system32\winsta.dll


    c:\windows\system32\netapi32.dll


    c:\windows\system32\msv1_0.dll


    c:\windows\system32\iphlpapi.dll


    c:\windows\system32\clbcatq.dll


    c:\windows\system32\comres.dll


    c:\windows\system32\svchost.exe


    c:\windows\system32\ntdll.dll


    c:\windows\system32\kernel32.dll


    c:\windows\system32\advapi32.dll


    c:\windows\system32\rpcrt4.dll


    c:\windows\system32\shimeng.dll


    c:\windows\apppatch\acgenral.dll


    c:\windows\system32\user32.dll


    c:\windows\system32\gdi32.dll


    c:\windows\system32\winmm.dll


    c:\windows\system32\ole32.dll


    c:\windows\system32\msvcrt.dll


    c:\windows\system32\oleaut32.dll


    c:\windows\system32\msacm32.dll


    c:\windows\system32\version.dll


    c:\windows\system32\shell32.dll


    c:\windows\system32\shlwapi.dll


    c:\windows\system32\userenv.dll


    c:\windows\system32\uxtheme.dll


    c:\windows\system32\imm32.dll


    c:\windows\system32\lpk.dll


    c:\windows\system32\usp10.dll


    c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll


    c:\windows\system32\comctl32.dll


    c:\windows\system32\rpcss.dll


    c:\windows\system32\secur32.dll


    c:\windows\system32\ws2_32.dll


    c:\windows\system32\ws2help.dll


    c:\windows\system32\xpsp2res.dll


    c:\windows\system32\rsaenh.dll


    c:\windows\system32\mswsock.dll


    c:\program files\ocean technology\gg e-sports platform\filter.dll


    c:\windows\system32\hnetcfg.dll


    c:\windows\system32\wshtcpip.dll


    c:\windows\system32\dnsapi.dll


    c:\windows\system32\iphlpapi.dll


    c:\windows\system32\winrnr.dll


    c:\windows\system32\wldap32.dll


    c:\windows\system32\rasadhlp.dll


    c:\windows\system32\clbcatq.dll


    c:\windows\system32\comres.dll


    C:\PROGRAM FILES\LAVASOFT\AD-AWARE 2007\AAWSERVICE.EXE


    c:\program files\lavasoft\ad-aware 2007\aawservice.exe


    c:\windows\system32\ntdll.dll


    c:\windows\system32\kernel32.dll


    c:\program files\lavasoft\ad-aware 2007\ceapi.dll


    c:\windows\system32\advapi32.dll


    c:\windows\system32\rpcrt4.dll


    c:\program files\lavasoft\ad-aware 2007\pkarchive84cb.dll


    c:\windows\system32\shell32.dll


    c:\windows\system32\gdi32.dll


    c:\windows\system32\user32.dll


    c:\windows\system32\msvcrt.dll


    c:\windows\system32\shlwapi.dll


    c:\windows\system32\ole32.dll


    c:\windows\system32\crypt32.dll


    c:\windows\system32\msasn1.dll


    c:\windows\system32\wldap32.dll


    c:\windows\system32\psapi.dll


    c:\windows\system32\version.dll


    c:\windows\system32\wininet.dll


    c:\windows\system32\normaliz.dll


    c:\windows\system32\iertutil.dll


    c:\program files\lavasoft\ad-aware 2007\update.dll


    c:\windows\system32\wsock32.dll


    c:\windows\system32\ws2_32.dll


    c:\windows\system32\ws2help.dll


    c:\windows\system32\userenv.dll


    c:\windows\system32\imm32.dll


    c:\windows\system32\lpk.dll


    c:\windows\system32\usp10.dll


    c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll


    c:\windows\system32\comctl32.dll


    c:\windows\system32\rsaenh.dll


    C:\WINDOWS\SYSTEM32\SVCHOST.EXE


    c:\windows\system32\svchost.exe


    c:\windows\system32\ntdll.dll


    c:\windows\system32\kernel32.dll


    c:\windows\system32\advapi32.dll


    c:\windows\system32\rpcrt4.dll


    c:\windows\system32\shimeng.dll


    c:\windows\apppatch\acgenral.dll


    c:\windows\system32\user32.dll


    c:\windows\system32\gdi32.dll


    c:\windows\system32\winmm.dll


    c:\windows\system32\ole32.dll


    c:\windows\system32\msvcrt.dll


    c:\windows\system32\oleaut32.dll


    c:\windows\system32\msacm32.dll


    c:\windows\system32\version.dll


    c:\windows\system32\shell32.dll


    c:\windows\system32\shlwapi.dll


    c:\windows\system32\userenv.dll


    c:\windows\system32\uxtheme.dll


    c:\windows\system32\imm32.dll


    c:\windows\system32\lpk.dll


    c:\windows\system32\usp10.dll


    c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll


    c:\windows\system32\comctl32.dll


    c:\windows\system32\ntmarta.dll


    c:\windows\system32\wldap32.dll


    c:\windows\system32\samlib.dll


    c:\windows\system32\xpsp2res.dll


    c:\windows\system32\cryptsvc.dll


    c:\windows\system32\wintrust.dll


    c:\windows\system32\crypt32.dll


    c:\windows\system32\msasn1.dll


    c:\windows\system32\imagehlp.dll


    c:\windows\system32\certcli.dll


    c:\windows\system32\atl.dll


    c:\windows\system32\secur32.dll


    c:\windows\system32\netapi32.dll


    c:\windows\system32\cryptui.dll


    c:\windows\system32\wininet.dll


    c:\windows\system32\normaliz.dll


    c:\windows\system32\iertutil.dll


    c:\windows\system32\esent.dll


    c:\windows\pchealth\helpctr\binaries\pchsvc.dll


    c:\windows\system32\winsta.dll


    c:\windows\system32\srsvc.dll


    c:\windows\system32\powrprof.dll


    c:\windows\system32\clbcatq.dll


    c:\windows\system32\comres.dll


    c:\windows\system32\wbem\wmisvc.dll


    c:\windows\system32\vssapi.dll


    c:\windows\system32\wbem\wbemcore.dll


    c:\windows\system32\msvcp60.dll


    c:\windows\system32\wbem\esscli.dll


    c:\windows\system32\wbem\wbemcomn.dll


    c:\windows\system32\wbem\fastprox.dll


    c:\windows\system32\ntdsapi.dll


    c:\windows\system32\dnsapi.dll


    c:\windows\system32\ws2_32.dll


    c:\windows\system32\ws2help.dll


    c:\windows\system32\wbem\wmiutils.dll


    c:\windows\system32\wbem\repdrvfs.dll


    c:\windows\system32\wbem\wmiprvsd.dll


    c:\windows\system32\ncobjapi.dll


    c:\windows\system32\wbem\wbemess.dll


    c:\windows\system32\rsaenh.dll


    c:\windows\system32\wbem\ncprov.dll


    c:\windows\system32\wbem\wbemcons.dll


    c:\windows\system32\wtsapi32.dll


    C:\WINDOWS\EXPLORER.EXE


    c:\windows\explorer.exe


    c:\windows\system32\ntdll.dll


    c:\windows\system32\kernel32.dll


    c:\windows\system32\advapi32.dll


    c:\windows\system32\rpcrt4.dll


    c:\windows\system32\browseui.dll


    c:\windows\system32\gdi32.dll


    c:\windows\system32\user32.dll


    c:\windows\system32\msvcrt.dll


    c:\windows\system32\ole32.dll


    c:\windows\system32\shlwapi.dll


    c:\windows\system32\oleaut32.dll


    c:\windows\system32\shdocvw.dll


    c:\windows\system32\crypt32.dll


    c:\windows\system32\msasn1.dll


    c:\windows\system32\cryptui.dll


    c:\windows\system32\wintrust.dll


    c:\windows\system32\imagehlp.dll


    c:\windows\system32\netapi32.dll


    c:\windows\system32\wininet.dll


    c:\windows\system32\normaliz.dll


    c:\windows\system32\iertutil.dll


    c:\windows\system32\wldap32.dll


    c:\windows\system32\version.dll


    c:\windows\system32\shell32.dll


    c:\windows\system32\uxtheme.dll


    c:\windows\system32\shimeng.dll


    c:\windows\apppatch\acgenral.dll


    c:\windows\system32\winmm.dll


    c:\windows\system32\msacm32.dll


    c:\windows\system32\userenv.dll


    c:\windows\system32\imm32.dll


    c:\windows\system32\lpk.dll


    c:\windows\system32\usp10.dll


    c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll


    c:\windows\system32\comctl32.dll


    c:\windows\system32\msctfime.ime


    c:\windows\system32\apphelp.dll


    c:\windows\system32\clbcatq.dll


    c:\windows\system32\comres.dll


    c:\windows\system32\cscui.dll


    c:\windows\system32\cscdll.dll


    c:\windows\system32\themeui.dll


    c:\windows\system32\secur32.dll


    c:\windows\system32\msimg32.dll


    c:\windows\system32\xpsp2res.dll


    c:\windows\system32\msutb.dll


    c:\windows\system32\msctf.dll


    c:\windows\system32\linkinfo.dll


    c:\windows\system32\ntshrui.dll


    c:\windows\system32\atl.dll


    c:\windows\system32\setupapi.dll


    c:\windows\system32\ieframe.dll


    c:\windows\system32\psapi.dll


    c:\windows\system32\netshell.dll


    c:\windows\system32\credui.dll


    c:\windows\system32\iphlpapi.dll


    c:\windows\system32\ws2_32.dll


    c:\windows\system32\ws2help.dll


    c:\windows\system32\rtutils.dll


    c:\windows\system32\winsta.dll


    c:\windows\system32\msi.dll


    c:\windows\system32\urlmon.dll


    c:\windows\system32\mlang.dll


    c:\program files\adobe\acrobat 7.0\activex\pdfshell.dll


    c:\windows\system32\rsaenh.dll


    c:\windows\system32\msisip.dll


    c:\windows\system32\wshext.dll


    c:\windows\system32\mfc42.dll


    c:\windows\system32\comdlg32.dll


    c:\progra~1\micros~2\office10\mcps.dll


    c:\windows\system32\msvcp60.dll


    C:\PROGRAM FILES\LAVASOFT\AD-AWARE 2007\AD-AWARE2007.EXE


    c:\program files\lavasoft\ad-aware 2007\ad-aware2007.exe


    c:\windows\system32\ntdll.dll


    c:\windows\system32\kernel32.dll


    c:\windows\system32\user32.dll


    c:\windows\system32\gdi32.dll


    c:\windows\system32\imm32.dll


    c:\windows\system32\advapi32.dll


    c:\windows\system32\rpcrt4.dll


    c:\windows\system32\lpk.dll


    c:\windows\system32\usp10.dll


    c:\windows\system32\msvcrt.dll


    c:\windows\system32\comctl32.dll


    c:\windows\system32\comdlg32.dll


    c:\windows\system32\shlwapi.dll


    c:\windows\system32\shell32.dll


    c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll


    c:\windows\system32\oleaut32.dll


    c:\windows\system32\ole32.dll


    c:\windows\system32\ws2_32.dll


    c:\windows\system32\ws2help.dll


    c:\windows\system32\inetmib1.dll


    c:\windows\system32\iphlpapi.dll


    c:\windows\system32\snmpapi.dll


    c:\windows\system32\wsock32.dll


    c:\windows\system32\mprapi.dll


    c:\windows\system32\activeds.dll


    c:\windows\system32\adsldpc.dll


    c:\windows\system32\netapi32.dll


    c:\windows\system32\wldap32.dll


    c:\windows\system32\atl.dll


    c:\windows\system32\rtutils.dll


    c:\windows\system32\samlib.dll


    c:\windows\system32\setupapi.dll


    c:\windows\system32\version.dll


    c:\windows\system32\mpr.dll


    c:\windows\system32\winmm.dll


    c:\windows\system32\oleacc.dll


    c:\windows\system32\msvcp60.dll


    c:\windows\system32\msctfime.ime


    c:\windows\system32\uxtheme.dll


    c:\windows\system32\apphelp.dll


    c:\windows\system32\clbcatq.dll


    c:\windows\system32\comres.dll


    c:\windows\system32\userenv.dll


    c:\windows\system32\olepro32.dll


    c:\windows\system32\secur32.dll


    End of Scan Section


    ===========================


    Cleaned Infections


    ===========================


    Root: HKU Path: S-1-5-21-3596813233-4262842479-3250221985-1008\software\microsoft\internet explorer\toolbar\webbrowser Value: {6ca49fdd-4aeb-4f08-a394-c0a1f82caa16}, Belonging to Win32.Trojandownloader.Zlob


    File: c:\System Volume Information\tracking.log, Belonging to Win32.Trojandownloader.Zlob


    End of Cleaned Infections


    ===========================


    Cleaned Infections


    ===========================


    MRU Path: C:\Documents and Settings\Compaq_Owner\Recent Count: 8, Belonging to MRU Object


    MRU Registry Key: S-1-5-21-3596813233-4262842479-3250221985-1008\Software\Microsoft\Internet Explorer\TypedURLs Count: 1, Belonging to MRU Object


    End of Cleaned Infections


    ===========================


    ehmm o yea the Win32.Trojandownloader.Zlob is always there for some reason...everytime i scan

  • Niels
    Options

    Dear eugene199


    I recommend that you clean your registry by using this program. You have to press on download now. Once you have installed the program click on modules,registry cleaner,scan registry for problems. When the scan is finished press on repair. Once you have done that use the disk cleaner option.


    Empty your system restore points by doing this click on start,right click on my computer choose properties,system restore,check disable system restore on all stations,press on apply wait till everything is greyed out. Once that is the case uncheck disable system restore on all stations and press on apply.


    Best regards


    Niels

  • yup ok i did all that now what?

  • Niels
    Options

    Dear eugene199


    Make another hijackthis log. Do you still have problems?


    Best regards


    Niels

  • ehmmm i dont think theres anymore thx for all the help


    heres the log :


    t thinLogfile of Trend Micro HijackThis v2.0.2


    Scan saved at 11:37:53 PM, on 11/24/2007


    Platform: Windows XP SP2 (WinNT 5.01.2600)


    MSIE: Internet Explorer v7.00 (7.00.6000.16544)


    Boot mode: Normal


    Running processes:


    C:\WINDOWS\System32\smss.exe


    C:\WINDOWS\system32\winlogon.exe


    C:\WINDOWS\system32\services.exe


    C:\WINDOWS\system32\lsass.exe


    C:\WINDOWS\system32\Ati2evxx.exe


    C:\WINDOWS\system32\svchost.exe


    C:\WINDOWS\System32\svchost.exe


    C:\WINDOWS\system32\svchost.exe


    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe


    C:\WINDOWS\system32\Ati2evxx.exe


    C:\WINDOWS\Explorer.EXE


    C:\WINDOWS\system32\spoolsv.exe


    C:\WINDOWS\RTHDCPL.EXE


    C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe


    C:\Program Files\Softwin\BitDefender10\bdagent.exe


    C:\WINDOWS\system32\ctfmon.exe


    C:\WINDOWS\system32\cisvc.exe


    C:\Program Files\Common Files\LightScribe\LSSrvc.exe


    C:\WINDOWS\system32\HPZipm12.exe


    C:\WINDOWS\System32\snmp.exe


    C:\WINDOWS\system32\svchost.exe


    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


    C:\WINDOWS\system32\MsPMSPSv.exe


    C:\Program Files\Webroot\Washer\WasherSvc.exe


    C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe


    C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe


    C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe


    C:\Program Files\Softwin\BitDefender10\vsserv.exe


    C:\Program Files\MSN Messenger\usnsvc.exe


    C:\WINDOWS\system32\cidaemon.exe


    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe


    C:\Program Files\Internet Explorer\iexplore.exe


    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe


    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 203.106.52.102:3128


    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll


    O1 - Hosts: HPEED661 HP0019BBEED661


    O2 - BHO: (no name) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - (no file)


    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll


    O2 - BHO: (no name) - {16664845-0E00-11D2-8059-000000000000} - (no file)


    O2 - BHO: (no name) - {2A646672-9C3A-4C28-9A7A-1FB0F63F28B6} - (no file)


    O2 - BHO: (no name) - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - (no file)


    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll


    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll


    O2 - BHO: (no name) - {88418AA3-16F5-4FC2-A9D8-90B1266DF841} - (no file)


    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll


    O2 - BHO: (no name) - {C6C7C348-C2F9-4465-9B41-121C467CC4E5} - (no file)


    O2 - BHO: (no name) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - (no file)


    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll


    O3 - Toolbar: The jokwmp - {54BA2889-CF6C-4D57-B2FB-B3FE1CA9EE8F} - (no file)


    O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32


    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC


    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName


    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE


    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE


    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime


    O4 - HKLM\..\Run: [bDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe


    O4 - HKLM\..\Run: [bDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"


    O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"


    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe


    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background


    O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe


    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')


    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')


    O4 - S-1-5-18 Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'SYSTEM')


    O4 - .DEFAULT Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')


    O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')


    O4 - Startup: Hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe


    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe


    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present


    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present


    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll


    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll


    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll


    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll


    O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm


    O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm


    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab


    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll


    O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} - http://gamedownload.ijjimax.com/gamedownlo...Plugin11USA.cab


    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1184120132454


    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1184416270968


    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab


    O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab


    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab


    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab


    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll


    O21 - SSODL: rmvgor - {E2E6FCCD-1938-4811-8397-FA13F9696B98} - (no file)


    O21 - SSODL: sapnet - {0CA5FDD9-725F-492D-B1C1-D65698ED238F} - (no file)


    O21 - SSODL: msmdev - {812CA095-31F5-469C-89AF-76BD7A990DCD} - (no file)


    O21 - SSODL: msmhost - {8D9DD8D5-19F4-4F25-9A7A-FC73E9F565C9} - (no file)


    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe


    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe


    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe


    O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE


    O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE


    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe


    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe


    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe


    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe


    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe


    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


    O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe


    O23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe


    O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe


    --


    End of file - 9741 bytes


    thx btw

  • Niels
    Options

    Dear eugene199


    How did you fixed the entries that I asked you to fix? You have to click in the box before these entries after that press on fix checked. I can't find anything that is still active.


    Best regards


    Niels

  • ehmmm i did what u told me.. i check thoese boxes and press fix