Please Help!

dragoiugabriel · November 2007

Hello! I'm not an expert in computers, and surely a beginner in fighting viruses. I have troubles with: Worm/VB.COX; Win32.Worm.IM.Sohanat.B; Exploit.ADODB.Stream.DC. Honestly I know allmost nothing about this viruses, but I cannot wipe them away. I've tried with AVG and BitDefender 8 Professional Plus, wich wiped them away, but they reappear. What can I do? I cannot change the home internet page. When I sign in at Yahoo Messenger, the virus sends messages with infected websites to my friends list... How bad are these viruses for my computer? When the files have been moved to the Quarantine in BeatDefender as infected should I click the delete button? Can BeatDefender work properly if AVG is still instaled and working? Sorry for all these many questions... but I think you can help me! Thank you!

bluesprite · November 2007

Hello,

you can't have two real-time antivirus scanners installed at the same time, that causes problems. Why are you still using BitDefender 8, that's too old? I suggest that you run the BitDefender online scanner, it's very good at cleaning viruses.

http://www.bitdefender.com/scan8/ie.html

dragoiugabriel · November 2007

Hello! I have tried the online antivirus and the files were deleted. Still I find them again in the computer. I cannot change the start web site. It's www.uklottery.com or something like that. I have problems with a file called SWCHOST.exe The virus didn't disappear. What can I do? Thanks again!

Can this scan report help you?

<HTML>

<HEAD>

<TITLE>BitDefender Online Scanner -Scan Report</TITLE>

</HEAD>

<tr>

BitDefender

Online Scanner

</td>

</td>

</td>

</tr>

<tr>

Scan report generated

at: Fri, Nov 30, 2007 - 22:34:55

</td>

</tr>

<tr>

</td>

</td>

</td>

</tr>

<tr>

Scan

path: A:\;C:\;D:\;E:\;F:\;G:\;

</td>

</td>

</td>

</tr>

<tr>

</td>

</td>

</td>

</tr>

<tr>

<tr>

Statistics

</td>

</tr>

<tr>

Time

</td>

03:04:29

</td>

</tr>

<tr>

Files

</td>

349978

</td>

</tr>

<tr>

Folders

</td>

11021

</td>

</tr>

<tr>

Boot Sectors

</td>

3

</td>

</tr>

<tr>

Archives

</td>

3410

</td>

</tr>

<tr>

Packed Files

</td>

18850

</td>

</tr>

</table>

</td>

</td>

</td>

</tr>

<tr>

<tr>

Results

</td>

</tr>

<tr>

Identified Viruses

</td>

4

</td>

</tr>

<tr>

Infected Files

</td>

7

</td>

</tr>

<tr>

Suspect Files

</td>

0

</td>

</tr>

<tr>

Warnings

</td>

0

</td>

</tr>

<tr>

Disinfected

</td>

0

</td>

</tr>

<tr>

Deleted Files

</td>

8

</td>

</tr>

</table>

</td>

</td>

</td>

</tr>

<tr>

<tr>

Engines Info

</td>

</tr>

<tr>

Virus Definitions

</td>

879615

</td>

</tr>

<tr>

Engine build

</td>

AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

</td>

</tr>

<tr>

Scan plugins

</td>

14

</td>

</tr>

<tr>

Archive plugins

</td>

38

</td>

</tr>

<tr>

Unpack plugins

</td>

7

</td>

</tr>

<tr>

E-mail plugins

</td>

6

</td>

</tr>

<tr>

System plugins

</td>

1

</td>

</tr>

</table>

</td>

</td>

</td>

</tr>

<tr>

<tr>

Scan Settings

</td>

</tr>

<tr>

First Action

</td>

Disinfect

</td>

</tr>

<tr>

Second Action

</td>

Delete

</td>

</tr>

<tr>

Heuristics

</td>

Yes

</td>

</tr>

<tr>

Enable Warnings

</td>

Yes

</td>

</tr>

<tr>

Scanned Extensions

</td>

*;

</td>

</tr>

<tr>

Exclude Extensions

</td>

</td>

</tr>

<tr>

Scan Emails

</td>

Yes

</td>

</tr>

<tr>

Scan Archives

</td>

Yes

</td>

</tr>

<tr>

Scan Packed

</td>

Yes

</td>

</tr>

<tr>

Scan Files

</td>

Yes

</td>

</tr>

<tr>

Scan Boot

</td>

Yes

</td>

</tr>

</table>

</td>

</td>

</td>

</tr>

<tr>

<tr>

Scanned File

</td>

Status

</td>

</tr>

<tr>

C:\Documents and Settings\Gabi\Local Settings\Temp\SVCHOST.EXE=>(AutoIT)

</td>

Infected with: Win32.Worm.IM.Sohanat.B

</td>

</tr><tr>

C:\Documents and Settings\Gabi\Local Settings\Temp\SVCHOST.EXE=>(AutoIT)

</td>

Disinfection failed

</td>

</tr><tr>

C:\Documents and Settings\Gabi\Local Settings\Temp\SVCHOST.EXE=>(AutoIT)

</td>

Deleted

</td>

</tr><tr>

C:\Documents and Settings\Gabi\Local Settings\Temporary Internet Files\Content.IE50BX6P8X\index[2].htm

</td>

Infected with: Exploit.ADODB.Stream.DC

</td>

</tr><tr>

C:\Documents and Settings\Gabi\Local Settings\Temporary Internet Files\Content.IE50BX6P8X\index[2].htm

</td>

Disinfection failed

</td>

</tr><tr>

C:\Documents and Settings\Gabi\Local Settings\Temporary Internet Files\Content.IE50BX6P8X\index[2].htm

</td>

Deleted

</td>

</tr><tr>

C:\Documents and Settings\Gabi\Local Settings\Temporary Internet Files\Content.IE5\3WHLY0YT\popup[1].htm

</td>

Infected with: Trojan.Clicker.CM

</td>

</tr><tr>

C:\Documents and Settings\Gabi\Local Settings\Temporary Internet Files\Content.IE5\3WHLY0YT\popup[1].htm

</td>

Disinfection failed

</td>

</tr><tr>

C:\Documents and Settings\Gabi\Local Settings\Temporary Internet Files\Content.IE5\3WHLY0YT\popup[1].htm

</td>

Deleted

</td>

</tr><tr>

C:\Documents and Settings\Gabi\Local Settings\Temporary Internet Files\Content.IE5\YHRYKCG2\exe[1]

</td>

Infected with: Trojan.PWS.Zbot.E

</td>

</tr><tr>

C:\Documents and Settings\Gabi\Local Settings\Temporary Internet Files\Content.IE5\YHRYKCG2\exe[1]

</td>

Disinfection failed

</td>

</tr><tr>

C:\Documents and Settings\Gabi\Local Settings\Temporary Internet Files\Content.IE5\YHRYKCG2\exe[1]

</td>

Deleted

</td>

</tr><tr>

C:\Documents and Settings\Gabi\Local Settings\Temporary Internet Files\Content.IE5\YHRYKCG2\YM[1].exe=>(AutoIT)

</td>

Infected with: Win32.Worm.IM.Sohanat.B

</td>

</tr><tr>

C:\Documents and Settings\Gabi\Local Settings\Temporary Internet Files\Content.IE5\YHRYKCG2\YM[1].exe=>(AutoIT)

</td>

Disinfection failed

</td>

</tr><tr>

C:\Documents and Settings\Gabi\Local Settings\Temporary Internet Files\Content.IE5\YHRYKCG2\YM[1].exe=>(AutoIT)

</td>

Deleted

</td>

</tr><tr>

C:\tmp03sz.exe

</td>

Infected with: Trojan.PWS.Zbot.E

</td>

</tr><tr>

C:\tmp03sz.exe

</td>

Disinfection failed

</td>

</tr><tr>

C:\tmp03sz.exe

</td>

Deleted

</td>

</tr><tr>

C:\WINDOWS\system\antivirus.exe=>(AutoIT)

</td>

Infected with: Win32.Worm.IM.Sohanat.B

</td>

</tr><tr>

C:\WINDOWS\system\antivirus.exe=>(AutoIT)

</td>

Disinfection failed </td>

</tr><tr>

C:\WINDOWS\system\antivirus.exe=>(AutoIT)

</td>

Deleted

</td>

</tr>

</table>

</td>

</td>

</tr>

<tr>

</td>

</td>

</td>

</tr>

<tr>

</td>

</td>

</td>

</tr>

</table>

</body>

</html>

bluesprite · November 2007

The report says some files have been deleted, but probably the swchost.exe remained. Please download this program: http://www.filehippo.com/download/0e0a4476...3c07c/download/ , run it and click Do a system scan and safe logfile. Save the file to your desktop and then post here the contents.

dragoiugabriel · December 2007

Hello! This is the hijackthis scan:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:24:27, on 03.12.2007

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Ahead\InCD\InCDsrv.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\WINDOWS\explorer.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

C:\WINDOWS\System32\drivers\CDAC11BA.EXE

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\QuickTime\qttask.exe

\Program Files\D-Tools\daemon.exe

C:\WINDOWS\system\antivirus.exe

C:\WINDOWS\wt\updater\wcmdmgr.exe

C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe

C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

C:\Program Files\Softwin\BitDefender8\bdmcon.exe

C:\Program Files\Softwin\BitDefender8\bdoesrv.exe

C:\Program Files\Softwin\BitDefender8\bdnagent.exe

C:\Program Files\Softwin\BitDefender8\bdswitch.exe

C:\WINDOWS\System32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Softwin\BitDefender8\vsserv.exe

C:\PROGRA~1\Grisoft\AVG7\avgw.exe

C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe

C:\Program Files\Internet Explorer\iexplore.exe

c:\program files\winamp toolbar\WinampTbServer.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.rd.yahoo.com/customize/ycomp/def.../search/ie.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ycomp/def...://uk.yahoo.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uklotttery.us/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.yahoo.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/def...://uk.yahoo.com

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

F2 - REG:system.ini: Shell=explorer.exe C:\WINDOWS\system\lsass.exe

F2 - REG:system.ini: UserInit=userinit.exe,C:\WINDOWS\system\lsass.exe,C:\WINDOWS\System32\ntos.exe,

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll

O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"

O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [Task Manager] C:\WINDOWS\system\antivirus.exe

O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKLM\..\Run: yoyxofs.exe

O4 - HKLM\..\Run: [bDMCon] C:\Program Files\Softwin\BitDefender8\\bdmcon.exe

O4 - HKLM\..\Run: [bDOESRV] C:\Program Files\Softwin\BitDefender8\\bdoesrv.exe

O4 - HKLM\..\Run: [bDNewsAgent] C:\Program Files\Softwin\BitDefender8\\bdnagent.exe

O4 - HKLM\..\Run: [bDSwitchAgent] C:\Program Files\Softwin\BitDefender8\\bdswitch.exe

O4 - HKLM\..\Run: [Yahoo Messenger] C:\WINDOWS\system\symantec.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot

O4 - HKCU\..\Run: yoyxofs.exe

O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background

O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\EROProj.dll

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/...nst_current.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/...tiveXPlugin.cab

O20 - AppInit_DLLs: sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe

O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE

O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe

O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender8\vsserv.exe

O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

--

End of file - 8459 bytes

Thank you!

alexcrist · December 2007

Hello Gabby,

Please fix the following lines:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uklotttery.us/
F2 - REG:system.ini: Shell=explorer.exe C:\WINDOWS\system\lsass.exe
F2 - REG:system.ini: UserInit=userinit.exe,C:\WINDOWS\system\lsass.exe,C:\WINDOWS\System32\ntos.exe,
O4 - HKLM\..\Run: [Task Manager] C:\WINDOWS\system\antivirus.exe
O4 - HKLM\..\Run: [Topic lnternet] yoyxofs.exe
O4 - HKLM\..\Run: [Yahoo Messenger] C:\WINDOWS\system\symantec.exe
O4 - HKCU\..\Run: [Topic lnternet] yoyxofs.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

Also, this line seems a little suspicious to me, but I'm not sure. I ask someone else to say if it should be fixed or not:

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

And the following line seems very weird. sockspy.dll is a file belonging to BitDefender v10, but why it is called this many times is a mistry to me. Maybe someone else can answer this question:

O20 - AppInit_DLLs: sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll

Cris.

dragoiugabriel · December 2007

Hello again! I deleted the first group of files you told me. Still, some of them remained, but I can't find them anymore in the hijackthis window so I can fix them. They appear only in the notepad report:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 23:43:34, on 03.12.2007

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Ahead\InCD\InCDsrv.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

C:\WINDOWS\System32\drivers\CDAC11BA.EXE

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe

C:\Program Files\Softwin\BitDefender8\vsserv.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

\Program Files\D-Tools\daemon.exe

C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

C:\Program Files\Softwin\BitDefender8\bdmcon.exe

C:\Program Files\Softwin\BitDefender8\bdoesrv.exe

C:\Program Files\Softwin\BitDefender8\bdnagent.exe

C:\Program Files\Softwin\BitDefender8\bdswitch.exe

C:\WINDOWS\System32\ctfmon.exe

C:\Program Files\Winamp Remote\bin\OrbTray.exe

C:\WINDOWS\wt\updater\wcmdmgr.exe

C:\Program Files\Winamp Remote\bin\Orb.exe

C:\DOCUME~1\Gabi\LOCALS~1\Temp\SVCHOST.EXE

C:\Program Files\Internet Explorer\iexplore.exe

C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Aware.exe

C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe

C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe

C:\Program Files\Internet Explorer\iexplore.exe

c:\program files\winamp toolbar\WinampTbServer.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.rd.yahoo.com/customize/ycomp/def.../search/ie.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ycomp/def...://uk.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.yahoo.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/def...://uk.yahoo.com

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll