Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Dr Watson [resolved]

Started by Taran_Walker , Feb 23 2005 01:34 PM

This topic is locked

#1
Taran_Walker

Posted 23 February 2005 - 01:34 PM

Member

Member
48 posts

I have the same problem as many users with Dr Watson I am not a computer expert and dont have a monkeys what it is all about please help as i can not get in to anything on the right side of the start menu except run

Here is my Hijack This Log file

Logfile of HijackThis v1.99.1
Scan saved at 19:27:25, on 23/02/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\winrk.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\GhostTray.exe
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\crqr.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Taran\Local Settings\Temporary Internet Files\Content.IE5\QPX6F61G\HijackThis[1].exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\fnttz.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\fnttz.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\fnttz.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\fnttz.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\fnttz.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\fnttz.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\fnttz.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.euro.dell...gen/default.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {6D58C8C3-0A00-0929-E359-77C521C2D819} - C:\WINDOWS\ntgb32.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Norton Ghost 9.0] C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\GhostTray.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [crqr.exe] C:\WINDOWS\system32\crqr.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab28578.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zon...nt.cab30149.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...er.cab30149.cab
O16 - DPF: {88C51E90-8E9C-4C96-8A45-574D88B63FAF} - http://acceso.masmin.../aplicacion.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab28578.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} - http://www.installen...gine/isetup.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zon...ro.cab30149.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zon...ot.cab30149.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft....ayx_vp3_mp3.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zon...ss.cab30149.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...wn.cab30149.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1727CC60-9FB7-48CC-8382-5D4CCD88A251}: NameServer = 195.92.195.94 195.92.195.95
O17 - HKLM\System\CS1\Services\Tcpip\..\{1727CC60-9FB7-48CC-8382-5D4CCD88A251}: NameServer = 195.92.195.94 195.92.195.95
O18 - Protocol: dialux - {8352FA4C-39C6-11D3-ADBA-00A0244FB1A2} - C:\Program Files\DIALux\System\DLXToolBox.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Workstation NetLogon Service (%AFå¤¶À¨) - Unknown owner - C:\WINDOWS\winrk.exe

#2
Taran_Walker

Posted 23 February 2005 - 02:44 PM

Member

Topic Starter
Member
48 posts

PLEASE HELP ANY HELP WOULD BE GREATLY APPRECIATED

#3
Dragon

Posted 23 February 2005 - 04:47 PM

All Around Computer Nut

Retired Staff
2,682 posts

sorry for the wait, as we are quite busy here and short of help at the moment.

olor=red]During the fix do NOT connect to the internet. Unless you

can memorize these instructions, it would be a good idea to print

them out.[/color]

Boot into safe mode:
Restart your computer and as soon as it starts booting up again

continuously tap F8. A menu should come up where you will be given

the option to enter Safe Mode.

Run AboutBuster
-Click Start to begin the process
-Click OK on the Buster Report dialogue box to start the scan
AboutBuster scans the computer for malicious files and deletes them.
Save the report (copy and paste into Notepad and save as a .txt file)

to post a copy for review.

Run CWShredder
-Next, click on the: ‘Fix’ button
-Follow the prompts, and press OK

Run CleanUp
-Make sure it is on Standard Mode
-Click the "CleanUp!" button

Run Ad-Aware
-Configure Ad-Aware for a full system scan
-Run it

Clean Up the left overs

Run HJT, close any open windows, and fix the following items (if they

are still there):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\fnttz.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\fnttz.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\fnttz.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\fnttz.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\fnttz.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\fnttz.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\fnttz.dll/sp.html#37049
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {6D58C8C3-0A00-0929-E359-77C521C2D819} - C:\WINDOWS\ntgb32.dll
O4 - HKLM\..\Run: [crqr.exe] C:\WINDOWS\system32\crqr.exe

Did you set this with spybot:search and destroy? if not please fix this entry also;

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

Then delete the following files (if they exist):

C:\WINDOWS\ntgb32.dll
C:\WINDOWS\system32\crqr.exe

Reboot into normal mode (simply restart your computer as you normally

would), and run the following free, online virus scans:

http://housecall.tre.../start_corp.asp
http://www.pandasoft...n_principal.htm
http://housecall.tre.../start_corp.asp

Then restart your computer one more time and post a new HJT log as

well as the About:Buster log I asked you to save earlier.

#4
Dragon

Posted 24 February 2005 - 12:30 PM

All Around Computer Nut

Retired Staff
2,682 posts

sorry for the mess up, for some reason my entire instructions didn't list properly.

1) About:Buster - Download it and extract it to C:/aboutbuster.
2) CleanUp! - Download it and install it.
3) CWShredder 2.11 - Download it and save it to your desktop.
4) Ad-ware - Download, install, and update.

Enable hidden files and folders: http://www.bleepingc...torial=62#winme

During the fix do NOT connect to the internet. Unless you can memorize these instructions, it would be a good idea to print them out.

Boot into safe mode:
Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Run AboutBuster
-Click Start to begin the process
-Click OK on the Buster Report dialogue box to start the scan
AboutBuster scans the computer for malicious files and deletes them.
Save the report (copy and paste into Notepad and save as a .txt file) to post a copy for review.

Run CWShredder
-Next, click on the: ‘Fix’ button
-Follow the prompts, and press OK

Run CleanUp
-Make sure it is on Standard Mode
-Click the "CleanUp!" button

Run Ad-Aware
-Configure Ad-Aware for a full system scan
-Run it

Clean Up the left overs

Run HJT, close any open windows, and fix the following items (if they are still there):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\fnttz.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\fnttz.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\fnttz.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\fnttz.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\fnttz.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\fnttz.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\fnttz.dll/sp.html#37049
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {6D58C8C3-0A00-0929-E359-77C521C2D819} - C:\WINDOWS\ntgb32.dll
O4 - HKLM\..\Run: [crqr.exe] C:\WINDOWS\system32\crqr.exe

Did you set this with spybot:search and destroy? if not please fix this entry also;

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

Then delete the following files (if they exist):

C:\WINDOWS\ntgb32.dll
C:\WINDOWS\system32\crqr.exe

Reboot into normal mode (simply restart your computer as you normally would), and run the following free, online virus scans:

http://housecall.tre.../start_corp.asp
http://www.pandasoft...n_principal.htm
http://housecall.tre.../start_corp.asp

Then restart your computer one more time and post a new HJT log as well as the About:Buster log I asked you to save earlier.

Edited by Efwis, 24 February 2005 - 12:32 PM.

#5
Taran_Walker

Posted 24 February 2005 - 02:55 PM

Member

Topic Starter
Member
48 posts

Here is my HJT log

ogfile of HijackThis v1.98.2
Scan saved at 20:53:01, on 24/02/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\GhostTray.exe
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Taran\My Documents\Unzipped\hijackthis[1]\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.euro.dell...gen/default.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Norton Ghost 9.0] C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\GhostTray.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab28578.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zon...nt.cab30149.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...er.cab30149.cab
O16 - DPF: {88C51E90-8E9C-4C96-8A45-574D88B63FAF} - http://acceso.masmin.../aplicacion.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab28578.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} - http://www.installen...gine/isetup.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zon...ro.cab30149.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zon...ot.cab30149.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft....ayx_vp3_mp3.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zon...ss.cab30149.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...wn.cab30149.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1727CC60-9FB7-48CC-8382-5D4CCD88A251}: NameServer = 195.92.195.94 195.92.195.95
O17 - HKLM\System\CS2\Services\Tcpip\..\{1727CC60-9FB7-48CC-8382-5D4CCD88A251}: NameServer = 195.92.195.94 195.92.195.95
O18 - Protocol: dialux - {8352FA4C-39C6-11D3-ADBA-00A0244FB1A2} - C:\Program Files\DIALux\System\DLXToolBox.dll

And here is my AboutBuster log

-- Scan 1 ---------------------------
About:Buster Version 4.0
Reference List : 19

Removed Data Streams:
C:\WINDOWS\aaqcx.dat:qndgt
C:\WINDOWS\abrow.dll:jsqfh
C:\WINDOWS\addfo32.exe:ioxod
C:\WINDOWS\addjv32.exe:lmiei
C:\WINDOWS\apigs.exe:ekxlt
C:\WINDOWS\apjjz.dat:ttqds
C:\WINDOWS\apphu.exe:mnmwq
C:\WINDOWS\Coffee Bean.bmp:zsxud
C:\WINDOWS\ejkjk.dll:bblim
C:\WINDOWS\fezec.dat:aiscd
C:\WINDOWS\fnfrn.dll:gsvtw
C:\WINDOWS\gnrko.dll:cstsu
C:\WINDOWS\hmtuj.dll:dfbrh
C:\WINDOWS\hrglbl.dat:vgtwb
C:\WINDOWS\iensx.ini:gnsbr
C:\WINDOWS\iphs32.exe:upjgb
C:\WINDOWS\ipwr32.dll:svwma
C:\WINDOWS\javaov.dll:qxgms
C:\WINDOWS\jouac.dll:maopj
C:\WINDOWS\lxnlr.txt:wehml
C:\WINDOWS\mepsbo.dat:fhfts
C:\WINDOWS\mfcgx32.dll:csgci
C:\WINDOWS\mskc.dll:defxp
C:\WINDOWS\mvnpn.dll:krleb
C:\WINDOWS\neskn.txt:iadmu
C:\WINDOWS\netgv32.exe:juqox
C:\WINDOWS\nexhd.txt:jiejc
C:\WINDOWS\ngjjg.txt:iolvz
C:\WINDOWS\nsmyf.txt:lqgty
C:\WINDOWS\oetrv.txt:szfjf
C:\WINDOWS\prpiy.dll:whtiu
C:\WINDOWS\qsxez.dll:xacsi
C:\WINDOWS\qxmaj.dll:ybzlx
C:\WINDOWS\rkffk.dll:ntvon
C:\WINDOWS\rorlhf.dat:gmcgo
C:\WINDOWS\rzwhv.dll:nthqq
C:\WINDOWS\SETUPLOG.TXT:crgni
C:\WINDOWS\sfvfp.log:cnvbn
C:\WINDOWS\svrjf.dll:fudwh
C:\WINDOWS\ttmlx.txt:dlbla
C:\WINDOWS\TWAIN.DLL:lqkgj
C:\WINDOWS\vlrhb.txt:pdznw
C:\WINDOWS\wekoh.txt:qxhgk
C:\WINDOWS\Windows Update.log:rshmc
C:\WINDOWS\winhlp32.exe:igxlt
C:\WINDOWS\winol.dll:lywpf
C:\WINDOWS\winxg32.dll:qdpsd
C:\WINDOWS\wohoc.txt:xsvdo
C:\WINDOWS\wtyou.dat:klyyk
C:\WINDOWS\zolqx.txt:pouvr

Removed 4 Random Key Entries
Removed! : C:\WINDOWS\aaqcx.dat
Removed! : C:\WINDOWS\abbuw.dat
Removed! : C:\WINDOWS\abrow.dll
Removed! : C:\WINDOWS\addcy32.exe
Removed! : C:\WINDOWS\addfo32.exe
Removed! : C:\WINDOWS\addjv32.exe
Removed! : C:\WINDOWS\addke32.exe
Removed! : C:\WINDOWS\addky.exe
Removed! : C:\WINDOWS\addop.exe
Removed! : C:\WINDOWS\addox.exe
Removed! : C:\WINDOWS\aflbo.dat
Removed! : C:\WINDOWS\ahvvn.dat
Removed! : C:\WINDOWS\ajpkh.dll
Removed! : C:\WINDOWS\apiar32.exe
Removed! : C:\WINDOWS\apiav.exe
Removed! : C:\WINDOWS\apira32.exe
Removed! : C:\WINDOWS\apisd32.exe
Removed! : C:\WINDOWS\apiwk32.exe
Removed! : C:\WINDOWS\appdf32.exe
Removed! : C:\WINDOWS\appfl32.exe
Removed! : C:\WINDOWS\apphu.exe
Removed! : C:\WINDOWS\apphu32.exe
Removed! : C:\WINDOWS\appjo.exe
Removed! : C:\WINDOWS\appou.exe
Removed! : C:\WINDOWS\appse.exe
Removed! : C:\WINDOWS\appst32.exe
Removed! : C:\WINDOWS\asrau.dll
Removed! : C:\WINDOWS\atlch32.exe
Removed! : C:\WINDOWS\atljt.exe
Removed! : C:\WINDOWS\atlwu32.exe
Removed! : C:\WINDOWS\atoua.dat
Removed! : C:\WINDOWS\avzfk.dll
Removed! : C:\WINDOWS\awbbn.dll
Removed! : C:\WINDOWS\awtmc.dat
Removed! : C:\WINDOWS\bgvvg.dat
Removed! : C:\WINDOWS\bhcix.dll
Removed! : C:\WINDOWS\biern.dll
Removed! : C:\WINDOWS\bkgyd.dll
Removed! : C:\WINDOWS\blbfp.dat
Removed! : C:\WINDOWS\blygu.dll
Removed! : C:\WINDOWS\boifr.dll
Removed! : C:\WINDOWS\bpnwc.dat
Removed! : C:\WINDOWS\bqxle.dll
Removed! : C:\WINDOWS\brcqv.dat
Removed! : C:\WINDOWS\bsqtt.dll
Removed! : C:\WINDOWS\bvuii.dll
Removed! : C:\WINDOWS\bynyc.dat
Removed! : C:\WINDOWS\caxpf.dll
Removed! : C:\WINDOWS\ccsvh.dat
Removed! : C:\WINDOWS\cdwzh.dat
Removed! : C:\WINDOWS\ceeui.dat
Removed! : C:\WINDOWS\cepnx.dat
Removed! : C:\WINDOWS\chdnz.dll
Removed! : C:\WINDOWS\ciert.dat
Removed! : C:\WINDOWS\ckojv.dll
Removed! : C:\WINDOWS\ckvgc.dat
Removed! : C:\WINDOWS\cmeof.dat
Removed! : C:\WINDOWS\cmkmi.dll
Removed! : C:\WINDOWS\cmlfm.dll
Removed! : C:\WINDOWS\cnznl.dll
Removed! : C:\WINDOWS\crcz.exe
Removed! : C:\WINDOWS\crhs.exe
Removed! : C:\WINDOWS\crjj32.exe
Removed! : C:\WINDOWS\crkm32.exe
Removed! : C:\WINDOWS\crlx32.exe
Removed! : C:\WINDOWS\crpi32.exe
Removed! : C:\WINDOWS\crqb32.exe
Removed! : C:\WINDOWS\cruj32.exe
Removed! : C:\WINDOWS\cseph.dll
Removed! : C:\WINDOWS\cwlhc.dat
Removed! : C:\WINDOWS\cynoe.dll
Removed! : C:\WINDOWS\czpez.dll
Removed! : C:\WINDOWS\d3dn32.exe
Removed! : C:\WINDOWS\d3hv32.exe
Removed! : C:\WINDOWS\d3kx32.exe
Removed! : C:\WINDOWS\d3po.exe
Removed! : C:\WINDOWS\d3pt.exe
Removed! : C:\WINDOWS\d3sn.exe
Removed! : C:\WINDOWS\dbasi.dll
Removed! : C:\WINDOWS\ddazk.dat
Removed! : C:\WINDOWS\dgily.dat
Removed! : C:\WINDOWS\dhinu.dll
Removed! : C:\WINDOWS\dkcct.dll
Removed! : C:\WINDOWS\dmnen.dat
Removed! : C:\WINDOWS\dmpom.dll
Removed! : C:\WINDOWS\doair.dll
Removed! : C:\WINDOWS\dsgmx.dll
Removed! : C:\WINDOWS\dspsc.dll
Removed! : C:\WINDOWS\dtctl.dll
Removed! : C:\WINDOWS\dueqe.dll
Removed! : C:\WINDOWS\dwsbl.dll
Removed! : C:\WINDOWS\dwuoz.dll
Removed! : C:\WINDOWS\dwvqc.dll
Removed! : C:\WINDOWS\dxrra.dll
Removed! : C:\WINDOWS\dyxmt.dll
Removed! : C:\WINDOWS\eaour.dll
Removed! : C:\WINDOWS\ecadp.dat
Removed! : C:\WINDOWS\eiywi.dll
Removed! : C:\WINDOWS\ejkjk.dll
Removed! : C:\WINDOWS\ejrrn.dll
Removed! : C:\WINDOWS\enjte.dll
Removed! : C:\WINDOWS\eoxhr.dll
Removed! : C:\WINDOWS\eqgfw.dll
Removed! : C:\WINDOWS\eqwdm.dat
Removed! : C:\WINDOWS\ethoa.dll
Removed! : C:\WINDOWS\evmmp.dll
Removed! : C:\WINDOWS\ezkvi.dll
Removed! : C:\WINDOWS\ezwdx.dll
Removed! : C:\WINDOWS\fahbh.dat
Removed! : C:\WINDOWS\fezec.dat
Removed! : C:\WINDOWS\fgcbz.dll
Removed! : C:\WINDOWS\fjcuc.dll
Removed! : C:\WINDOWS\fjmjd.dat
Removed! : C:\WINDOWS\fnfrn.dll
Removed! : C:\WINDOWS\frfil.dll
Removed! : C:\WINDOWS\friua.dat
Removed! : C:\WINDOWS\ftaqr.dll
Removed! : C:\WINDOWS\fyvky.dll
Removed! : C:\WINDOWS\gawmi.dat
Removed! : C:\WINDOWS\gdwsi.dll
Removed! : C:\WINDOWS\geyrb.dll
Removed! : C:\WINDOWS\ggvej.dll
Removed! : C:\WINDOWS\giarr.dat
Removed! : C:\WINDOWS\giwad.dat
Removed! : C:\WINDOWS\gjwye.dat
Removed! : C:\WINDOWS\gnrko.dll
Removed! : C:\WINDOWS\gpqky.dat
Removed! : C:\WINDOWS\gxwga.dat
Removed! : C:\WINDOWS\hexic.dll
Removed! : C:\WINDOWS\hiwwq.dat
Removed! : C:\WINDOWS\hjihg.dat
Removed! : C:\WINDOWS\hkonq.dll
Removed! : C:\WINDOWS\hmkzw.dll
Removed! : C:\WINDOWS\hmtuj.dll
Removed! : C:\WINDOWS\hoiae.dll
Removed! : C:\WINDOWS\hoidm.dll
Removed! : C:\WINDOWS\homik.dll
Removed! : C:\WINDOWS\huboi.dat
Removed! : C:\WINDOWS\hvixc.dll
Removed! : C:\WINDOWS\hwohf.dll
Removed! : C:\WINDOWS\hxnne.dat
Removed! : C:\WINDOWS\ianrw.dat
Removed! : C:\WINDOWS\icojv.dll
Removed! : C:\WINDOWS\iedl.exe
Removed! : C:\WINDOWS\ieip32.exe
Removed! : C:\WINDOWS\iejt.exe
Removed! : C:\WINDOWS\ieop32.exe
Removed! : C:\WINDOWS\ierq.dll
Removed! : C:\WINDOWS\iesi32.exe
Removed! : C:\WINDOWS\ietj32.exe
Removed! : C:\WINDOWS\iexe.exe
Removed! : C:\WINDOWS\iexn32.exe
Removed! : C:\WINDOWS\ifwim.dll
Removed! : C:\WINDOWS\igikx.dll
Removed! : C:\WINDOWS\ikdgy.dll
Removed! : C:\WINDOWS\ilvpz.dat
Removed! : C:\WINDOWS\imocd.dat
Removed! : C:\WINDOWS\ioqaz.dll
Removed! : C:\WINDOWS\iphs32.exe
Removed! : C:\WINDOWS\ipqv32.exe
Removed! : C:\WINDOWS\ipyq32.exe
Removed! : C:\WINDOWS\iqrby.dll
Removed! : C:\WINDOWS\isxan.dat
Removed! : C:\WINDOWS\iucdk.dll
Removed! : C:\WINDOWS\iwadz.dll
Removed! : C:\WINDOWS\iwnpb.dat
Removed! : C:\WINDOWS\iyqzs.dat
Removed! : C:\WINDOWS\javaow32.exe
Removed! : C:\WINDOWS\javask32.exe
Removed! : C:\WINDOWS\javazz32.exe
Removed! : C:\WINDOWS\jdhjo.dll
Removed! : C:\WINDOWS\jfmxc.dll
Removed! : C:\WINDOWS\jhnlq.dll
Removed! : C:\WINDOWS\jikix.dll
Removed! : C:\WINDOWS\jkzbl.dat
Removed! : C:\WINDOWS\jlakh.dll
Removed! : C:\WINDOWS\jlfuc.dat
Removed! : C:\WINDOWS\jmedv.dat
Removed! : C:\WINDOWS\jmjdo.dll
Removed! : C:\WINDOWS\jmpqa.dll
Removed! : C:\WINDOWS\jnqge.dll
Removed! : C:\WINDOWS\jnxmv.dll
Removed! : C:\WINDOWS\jouac.dll
Removed! : C:\WINDOWS\jqtow.dat
Removed! : C:\WINDOWS\jxecq.dll
Removed! : C:\WINDOWS\jxqbe.dll
Removed! : C:\WINDOWS\jyyar.dll
Removed! : C:\WINDOWS\kebso.dll
Removed! : C:\WINDOWS\kgkuv.dll
Removed! : C:\WINDOWS\kpgjq.dat
Removed! : C:\WINDOWS\kqijs.dat
Removed! : C:\WINDOWS\kroju.dat
Removed! : C:\WINDOWS\krowz.dat
Removed! : C:\WINDOWS\ksddi.dat
Removed! : C:\WINDOWS\ktzyg.dat
Removed! : C:\WINDOWS\laldi.dll
Removed! : C:\WINDOWS\lhpls.dll
Removed! : C:\WINDOWS\ljbdw.dll
Removed! : C:\WINDOWS\ljqpbc.dat
Removed! : C:\WINDOWS\lmozp.dll
Removed! : C:\WINDOWS\lnsys.dll
Removed! : C:\WINDOWS\lsojm.dat
Removed! : C:\WINDOWS\lujub.dll
Removed! : C:\WINDOWS\lvwzd.dll
Removed! : C:\WINDOWS\lyjco.dll
Removed! : C:\WINDOWS\lyvdj.dat
Removed! : C:\WINDOWS\mcpqk.dat
Removed! : C:\WINDOWS\mfchv.exe
Removed! : C:\WINDOWS\mfcre.exe
Removed! : C:\WINDOWS\mfcza.exe
Removed! : C:\WINDOWS\mgswz.dll
Removed! : C:\WINDOWS\mjcrn.dat
Removed! : C:\WINDOWS\mqyoy.dat
Removed! : C:\WINDOWS\msdf32.exe
Removed! : C:\WINDOWS\msfi32.exe
Removed! : C:\WINDOWS\msxo.exe
Removed! : C:\WINDOWS\msyk.exe
Removed! : C:\WINDOWS\mvnpn.dll
Removed! : C:\WINDOWS\mvuay.dll
Removed! : C:\WINDOWS\nbesg.dat
Removed! : C:\WINDOWS\nbkqw.dll
Removed! : C:\WINDOWS\nbztx.dll
Removed! : C:\WINDOWS\netcm32.exe
Removed! : C:\WINDOWS\netgv32.exe
Removed! : C:\WINDOWS\netij32.exe
Removed! : C:\WINDOWS\netmp32.exe
Removed! : C:\WINDOWS\netmu32.exe
Removed! : C:\WINDOWS\netob32.exe
Removed! : C:\WINDOWS\netpg32.exe
Removed! : C:\WINDOWS\nettq.exe
Removed! : C:\WINDOWS\netxa.exe
Removed! : C:\WINDOWS\nhsto.dll
Removed! : C:\WINDOWS\nlgao.dll
Removed! : C:\WINDOWS\nqjni.dll
Removed! : C:\WINDOWS\nqutq.dat
Removed! : C:\WINDOWS\ntgt32.exe
Removed! : C:\WINDOWS\ntnn.exe
Removed! : C:\WINDOWS\ntnw32.exe
Removed! : C:\WINDOWS\ntny32.exe
Removed! : C:\WINDOWS\ntpge.dat
Removed! : C:\WINDOWS\ntro32.exe
Removed! : C:\WINDOWS\ntyo.exe
Removed! : C:\WINDOWS\nugzb.dat
Removed! : C:\WINDOWS\nvlmh.dat
Removed! : C:\WINDOWS\nxlng.dll
Removed! : C:\WINDOWS\nxzai.dat
Removed! : C:\WINDOWS\nyhsd.dat
Removed! : C:\WINDOWS\nzhbm.dll
Removed! : C:\WINDOWS\obhnu.dll
Removed! : C:\WINDOWS\oceqo.dat
Removed! : C:\WINDOWS\odaaw.dll
Removed! : C:\WINDOWS\ofryb.dat
Removed! : C:\WINDOWS\ogssk.dat
Removed! : C:\WINDOWS\ojpyl.dat
Removed! : C:\WINDOWS\okktp.dll
Removed! : C:\WINDOWS\opzcd.dat
Removed! : C:\WINDOWS\oqqfq.dll
Removed! : C:\WINDOWS\orhpg.dll
Removed! : C:\WINDOWS\oscvn.dll
Removed! : C:\WINDOWS\osetz.dat
Removed! : C:\WINDOWS\ouncl.dat
Removed! : C:\WINDOWS\ovcwt.dll
Removed! : C:\WINDOWS\ovgwz.dat
Removed! : C:\WINDOWS\ovtiy.dat
Removed! : C:\WINDOWS\owslk.dat
Removed! : C:\WINDOWS\ozgui.dll
Removed! : C:\WINDOWS\pajyo.dat
Removed! : C:\WINDOWS\peoxh.dat
Removed! : C:\WINDOWS\pfczl.dll
Removed! : C:\WINDOWS\phdbv.dat
Removed! : C:\WINDOWS\pjkib.dat
Removed! : C:\WINDOWS\plpmq.dll
Removed! : C:\WINDOWS\prlje.dat
Removed! : C:\WINDOWS\prpiy.dll
Removed! : C:\WINDOWS\pszwj.dat
Removed! : C:\WINDOWS\ptirh.dll
Removed! : C:\WINDOWS\pvtux.dat
Removed! : C:\WINDOWS\pwzwy.dll
Removed! : C:\WINDOWS\qbfkv.dll
Removed! : C:\WINDOWS\qbmjr.dll
Removed! : C:\WINDOWS\qbuyr.dat
Removed! : C:\WINDOWS\qdqpi.dll
Removed! : C:\WINDOWS\qjoin.dat
Removed! : C:\WINDOWS\qkmzx.dll
Removed! : C:\WINDOWS\qkola.dll
Removed! : C:\WINDOWS\qqgfq.dll
Removed! : C:\WINDOWS\qrssx.dll
Removed! : C:\WINDOWS\qsbkr.dll
Removed! : C:\WINDOWS\qsxez.dll
Removed! : C:\WINDOWS\qvujg.dat
Removed! : C:\WINDOWS\qxmaj.dll
Removed! : C:\WINDOWS\qyxse.dll
Removed! : C:\WINDOWS\qzogm.dll
Removed! : C:\WINDOWS\rbgbt.dll
Removed! : C:\WINDOWS\rcmhc.dll
Removed! : C:\WINDOWS\rcxta.dll
Removed! : C:\WINDOWS\reanm.dat
Removed! : C:\WINDOWS\repug.dll
Removed! : C:\WINDOWS\rgdxb.dll
Removed! : C:\WINDOWS\rhipw.dll
Removed! : C:\WINDOWS\rhvix.dat
Removed! : C:\WINDOWS\rkffk.dll
Removed! : C:\WINDOWS\rnrsd.dat
Removed! : C:\WINDOWS\rodkn.dll
Removed! : C:\WINDOWS\rodqp.dat
Removed! : C:\WINDOWS\rooig.dll
Removed! : C:\WINDOWS\rowzv.dll
Removed! : C:\WINDOWS\rtvfo.dat
Removed! : C:\WINDOWS\rzwhv.dll
Removed! : C:\WINDOWS\sajhw.dll
Removed! : C:\WINDOWS\sbpnb.dat
Removed! : C:\WINDOWS\sccwg.dat
Removed! : C:\WINDOWS\sddiy.dll
Removed! : C:\WINDOWS\sdkdw.exe
Removed! : C:\WINDOWS\sdkhk.exe
Removed! : C:\WINDOWS\sdkjy.exe
Removed! : C:\WINDOWS\sdkka32.exe
Removed! : C:\WINDOWS\sdkor32.exe
Removed! : C:\WINDOWS\seclc.dll
Removed! : C:\WINDOWS\sjbqv.dll
Removed! : C:\WINDOWS\skezq.dll
Removed! : C:\WINDOWS\smftc.dll
Removed! : C:\WINDOWS\snlac.dll
Removed! : C:\WINDOWS\sqodz.dat
Removed! : C:\WINDOWS\sqrpz.dll
Removed! : C:\WINDOWS\ssori.dat
Removed! : C:\WINDOWS\stvhn.dat
Removed! : C:\WINDOWS\sugbj.dat
Removed! : C:\WINDOWS\svrjf.dll
Removed! : C:\WINDOWS\sxcqp.dat
Removed! : C:\WINDOWS\syscb32.exe
Removed! : C:\WINDOWS\sysic.exe
Removed! : C:\WINDOWS\sysjp.exe
Removed! : C:\WINDOWS\sysol.exe
Removed! : C:\WINDOWS\syssq.exe
Removed! : C:\WINDOWS\sysxs.exe
Removed! : C:\WINDOWS\sysyk32.exe.bak
Removed! : C:\WINDOWS\tcedv.dat
Removed! : C:\WINDOWS\tdhup.dll
Removed! : C:\WINDOWS\tdnvt.dat
Removed! : C:\WINDOWS\tftsw.dll
Removed! : C:\WINDOWS\thopv.dll
Removed! : C:\WINDOWS\thruo.dll
Removed! : C:\WINDOWS\tjqxh.dat
Removed! : C:\WINDOWS\tnbvz.dat
Removed! : C:\WINDOWS\tsdtf.dll
Removed! : C:\WINDOWS\ttatb.dat
Removed! : C:\WINDOWS\tvfot.dll
Removed! : C:\WINDOWS\txakn.dll
Removed! : C:\WINDOWS\typeo.dat
Removed! : C:\WINDOWS\uaerl.dat
Removed! : C:\WINDOWS\ubhmn.dll
Removed! : C:\WINDOWS\ufiar.dat
Removed! : C:\WINDOWS\ufzlp.dll
Removed! : C:\WINDOWS\ugpir.dat
Removed! : C:\WINDOWS\uhyjm.dll
Removed! : C:\WINDOWS\uisqv.dll
Removed! : C:\WINDOWS\ujfve.dll
Removed! : C:\WINDOWS\umqzw.dat
Removed! : C:\WINDOWS\unmcj.dll
Removed! : C:\WINDOWS\uotgj.dll
Removed! : C:\WINDOWS\uskth.dll
Removed! : C:\WINDOWS\utrwc.dll
Removed! : C:\WINDOWS\utydu.dll
Removed! : C:\WINDOWS\uuuzz.dll
Removed! : C:\WINDOWS\vcbzc.dll
Removed! : C:\WINDOWS\vczcr.dat
Removed! : C:\WINDOWS\vdctg.dll
Removed! : C:\WINDOWS\vevtd.dat
Removed! : C:\WINDOWS\vgwze.dll
Removed! : C:\WINDOWS\vmoat.dat
Removed! : C:\WINDOWS\voozz.dll
Removed! : C:\WINDOWS\vpipx.dat
Removed! : C:\WINDOWS\vrooe.dll
Removed! : C:\WINDOWS\vwjpt.dll
Removed! : C:\WINDOWS\vxulf.dll
Removed! : C:\WINDOWS\waphv.dll
Removed! : C:\WINDOWS\warls.dat
Removed! : C:\WINDOWS\wgena.dll
Removed! : C:\WINDOWS\winfd32.exe
Removed! : C:\WINDOWS\winfv32.exe
Removed! : C:\WINDOWS\winmx.exe
Removed! : C:\WINDOWS\wintx32.exe
Removed! : C:\WINDOWS\winve.exe
Removed! : C:\WINDOWS\winxn.exe
Removed! : C:\WINDOWS\wjloq.dat
Removed! : C:\WINDOWS\wlymx.dat
Removed! : C:\WINDOWS\wmnhb.dll
Removed! : C:\WINDOWS\woedu.dll
Removed! : C:\WINDOWS\wqfll.dat
Removed! : C:\WINDOWS\wtyou.dat
Removed! : C:\WINDOWS\wxiwn.dat
Removed! : C:\WINDOWS\wyplv.dat
Removed! : C:\WINDOWS\xdxpp.dll
Removed! : C:\WINDOWS\xetho.dat
Removed! : C:\WINDOWS\xisge.dll
Removed! : C:\WINDOWS\xiwnh.dll
Removed! : C:\WINDOWS\xmhrf.dat
Removed! : C:\WINDOWS\xotdb.dll
Removed! : C:\WINDOWS\xpfhw.dat
Removed! : C:\WINDOWS\xqpcm.dat
Removed! : C:\WINDOWS\xquic.dat
Removed! : C:\WINDOWS\xsfdg.dll
Removed! : C:\WINDOWS\xvvgs.dll
Removed! : C:\WINDOWS\yasqf.dll
Removed! : C:\WINDOWS\ycnhm.dat
Removed! : C:\WINDOWS\yebvo.dat
Removed! : C:\WINDOWS\yfhnv.dll
Removed! : C:\WINDOWS\yilwp.dll
Removed! : C:\WINDOWS\yiucd.dat
Removed! : C:\WINDOWS\yjnbe.dll
Removed! : C:\WINDOWS\yjpxt.dll
Removed! : C:\WINDOWS\yljdp.dat
Removed! : C:\WINDOWS\yljpc.dll
Removed! : C:\WINDOWS\ylthk.dat
Removed! : C:\WINDOWS\yluag.dat
Removed! : C:\WINDOWS\yrzld.dat
Removed! : C:\WINDOWS\ysdam.dat
Removed! : C:\WINDOWS\yuxao.dll
Removed! : C:\WINDOWS\ywblq.dll
Removed! : C:\WINDOWS\yxlfy.dll
Removed! : C:\WINDOWS\yzgcm.dll
Removed! : C:\WINDOWS\zafzz.dat
Removed! : C:\WINDOWS\zauze.dll
Removed! : C:\WINDOWS\zazaa.dat
Removed! : C:\WINDOWS\zdqqx.dll
Removed! : C:\WINDOWS\zemnn.dat
Removed! : C:\WINDOWS\zeyrd.dll
Removed! : C:\WINDOWS\zidxk.dll
Removed! : C:\WINDOWS\zjfyo.dll
Removed! : C:\WINDOWS\zkczm.dll
Removed! : C:\WINDOWS\zmlvz.dat
Removed! : C:\WINDOWS\zobtu.dat
Removed! : C:\WINDOWS\zoczc.dat
Removed! : C:\WINDOWS\zpuro.dat
Removed! : C:\WINDOWS\ztkzc.dat
Removed! : C:\WINDOWS\ztxkn.dll
Removed! : C:\WINDOWS\zwvxw.dll
Removed! : C:\WINDOWS\zxlfg.dat
Removed! : C:\WINDOWS\zzpiz.dat
Removed! : C:\WINDOWS\system32\aapcc.dat
Removed! : C:\WINDOWS\system32\addac.exe
Removed! : C:\WINDOWS\system32\adddo.exe
Removed! : C:\WINDOWS\system32\addef.exe
Removed! : C:\WINDOWS\system32\addeg32.exe
Removed! : C:\WINDOWS\system32\addhl.exe
Removed! : C:\WINDOWS\system32\addlc.exe
Removed! : C:\WINDOWS\system32\adduq.exe
Removed! : C:\WINDOWS\system32\afhml.dll
Removed! : C:\WINDOWS\system32\agamr.dat
Removed! : C:\WINDOWS\system32\ajnur.dll
Removed! : C:\WINDOWS\system32\amrhc.dll
Removed! : C:\WINDOWS\system32\aopvy.dat
Removed! : C:\WINDOWS\system32\apiki32.exe
Removed! : C:\WINDOWS\system32\apiqz.exe
Removed! : C:\WINDOWS\system32\apirp.exe
Removed! : C:\WINDOWS\system32\appby.exe
Removed! : C:\WINDOWS\system32\appct.exe
Removed! : C:\WINDOWS\system32\appdx.exe
Removed! : C:\WINDOWS\system32\appow32.exe
Removed! : C:\WINDOWS\system32\appsc.exe
Removed! : C:\WINDOWS\system32\appug.exe
Removed! : C:\WINDOWS\system32\appum.exe
Removed! : C:\WINDOWS\system32\appxl32.exe
Removed! : C:\WINDOWS\system32\atley.exe
Removed! : C:\WINDOWS\system32\atlgr.exe
Removed! : C:\WINDOWS\system32\atlkh.exe
Removed! : C:\WINDOWS\system32\atloh.exe
Removed! : C:\WINDOWS\system32\atlos32.exe
Removed! : C:\WINDOWS\system32\atlrw.exe
Removed! : C:\WINDOWS\system32\atlxd32.exe
Removed! : C:\WINDOWS\system32\aurxr.dll
Removed! : C:\WINDOWS\system32\avtfx.dll
Removed! : C:\WINDOWS\system32\avuiu.dll
Removed! : C:\WINDOWS\system32\azgap.dll
Removed! : C:\WINDOWS\system32\bcliq.dll
Removed! : C:\WINDOWS\system32\bhdgt.dat
Removed! : C:\WINDOWS\system32\bhipj.dat
Removed! : C:\WINDOWS\system32\bnmbh.dll
Removed! : C:\WINDOWS\system32\bnykd.dat
Removed! : C:\WINDOWS\system32\boodh.dll
Removed! : C:\WINDOWS\system32\bqjmc.dll
Removed! : C:\WINDOWS\system32\bsepb.dat
Removed! : C:\WINDOWS\system32\bsifh.dat
Removed! : C:\WINDOWS\system32\bwxcd.dat
Removed! : C:\WINDOWS\system32\byncw.dll
Removed! : C:\WINDOWS\system32\bywje.dll
Removed! : C:\WINDOWS\system32\bzedt.dll
Removed! : C:\WINDOWS\system32\cchtc.dat
Removed! : C:\WINDOWS\system32\cfoiv.dll
Removed! : C:\WINDOWS\system32\clmnv.dat
Removed! : C:\WINDOWS\system32\clnxu.dll
Removed! : C:\WINDOWS\system32\cqlbr.dll
Removed! : C:\WINDOWS\system32\cqqap.dat
Removed! : C:\WINDOWS\system32\crcx32.exe
Removed! : C:\WINDOWS\system32\crqj32.exe
Removed! : C:\WINDOWS\system32\crsk32.exe
Removed! : C:\WINDOWS\system32\cshwp.dat
Removed! : C:\WINDOWS\system32\cvaes.dat
Removed! : C:\WINDOWS\system32\cywxv.dat
Removed! : C:\WINDOWS\system32\d3lj.exe
Removed! : C:\WINDOWS\system32\d3me.exe
Removed! : C:\WINDOWS\system32\d3rm.exe
Removed! : C:\WINDOWS\system32\d3ts32.exe
Removed! : C:\WINDOWS\system32\d3xk.exe
Removed! : C:\WINDOWS\system32\d3zs32.exe
Removed! : C:\WINDOWS\system32\dbcjp.dat
Removed! : C:\WINDOWS\system32\ddpsc.dat
Removed! : C:\WINDOWS\system32\dgrjn.dat
Removed! : C:\WINDOWS\system32\dhwpj.dll
Removed! : C:\WINDOWS\system32\djijr.dll
Removed! : C:\WINDOWS\system32\dlqrf.dll
Removed! : C:\WINDOWS\system32\dpfws.dll
Removed! : C:\WINDOWS\system32\dptgp.dll
Removed! : C:\WINDOWS\system32\dqtac.dat
Removed! : C:\WINDOWS\system32\dsuev.dll
Removed! : C:\WINDOWS\system32\dtrst.dat
Removed! : C:\WINDOWS\system32\dufqj.dll
Removed! : C:\WINDOWS\system32\duhsw.dat
Removed! : C:\WINDOWS\system32\ebeud.dll
Removed! : C:\WINDOWS\system32\edxdr.dll
Removed! : C:\WINDOWS\system32\eizha.dll
Removed! : C:\WINDOWS\system32\enywz.dll
Removed! : C:\WINDOWS\system32\eonth.dll
Removed! : C:\WINDOWS\system32\eqgii.dll
Removed! : C:\WINDOWS\system32\eqron.dll
Removed! : C:\WINDOWS\system32\eyiqi.dat
Removed! : C:\WINDOWS\system32\faftj.dll
Removed! : C:\WINDOWS\system32\ffyph.dll
Removed! : C:\WINDOWS\system32\fhfbz.dat
Removed! : C:\WINDOWS\system32\flgyj.dll
Removed! : C:\WINDOWS\system32\fmauh.dll
Removed! : C:\WINDOWS\system32\fqifu.dll
Removed! : C:\WINDOWS\system32\fsjie.dll
Removed! : C:\WINDOWS\system32\ftcoz.dll
Removed! : C:\WINDOWS\system32\ftxbf.dat
Removed! : C:\WINDOWS\system32\fwisf.dat
Removed! : C:\WINDOWS\system32\fzofz.dll
Removed! : C:\WINDOWS\system32\gamrl.dll
Removed! : C:\WINDOWS\system32\gdanb.dll
Removed! : C:\WINDOWS\system32\gdkka.dll
Removed! : C:\WINDOWS\system32\gguvi.dll
Removed! : C:\WINDOWS\system32\gnrtq.dat
Removed! : C:\WINDOWS\system32\goydl.dll
Removed! : C:\WINDOWS\system32\grpce.dll
Removed! : C:\WINDOWS\system32\gssvs.dat
Removed! : C:\WINDOWS\system32\gwdcv.dll
Removed! : C:\WINDOWS\system32\gxbva.dll
Removed! : C:\WINDOWS\system32\gyabj.dll
Removed! : C:\WINDOWS\system32\gyzxx.dat
Removed! : C:\WINDOWS\system32\gznnn.dll
Removed! : C:\WINDOWS\system32\gzntl.dat
Removed! : C:\WINDOWS\system32\hbwoc.dat
Removed! : C:\WINDOWS\system32\hedyz.dat
Removed! : C:\WINDOWS\system32\heycp.dll
Removed! : C:\WINDOWS\system32\hfkpf.dll
Removed! : C:\WINDOWS\system32\hgqaz.dat
Removed! : C:\WINDOWS\system32\hgqjo.dat
Removed! : C:\WINDOWS\system32\hhtto.dll
Removed! : C:\WINDOWS\system32\hjeaq.dat
Removed! : C:\WINDOWS\system32\hknjw.dll
Removed! : C:\WINDOWS\system32\hkrxp.dll
Removed! : C:\WINDOWS\system32\hmeqy.dll
Removed! : C:\WINDOWS\system32\hnyit.dat
Removed! : C:\WINDOWS\system32\hrong.dat
Removed! : C:\WINDOWS\system32\hsbnc.dll
Removed! : C:\WINDOWS\system32\htxbg.dll
Removed! : C:\WINDOWS\system32\hufum.dat
Removed! : C:\WINDOWS\system32\husse.dat
Removed! : C:\WINDOWS\system32\hxevf.dll
Removed! : C:\WINDOWS\system32\hyegh.dll
Removed! : C:\WINDOWS\system32\ibsck.dat
Removed! : C:\WINDOWS\system32\idyta.dat
Removed! : C:\WINDOWS\system32\ieacx.dll
Removed! : C:\WINDOWS\system32\ieiri.dll
Removed! : C:\WINDOWS\system32\iewb.exe
Removed! : C:\WINDOWS\system32\igkcq.dat
Removed! : C:\WINDOWS\system32\iiyjr.dat
Removed! : C:\WINDOWS\system32\ijgrv.dll
Removed! : C:\WINDOWS\system32\injkr.dll
Removed! : C:\WINDOWS\system32\ipap.exe
Removed! : C:\WINDOWS\system32\ipca.exe
Removed! : C:\WINDOWS\system32\ipdw32.exe
Removed! : C:\WINDOWS\system32\ipgo.exe
Removed! : C:\WINDOWS\system32\ipif32.exe
Removed! : C:\WINDOWS\system32\iplb32.exe
Removed! : C:\WINDOWS\system32\ipob.exe
Removed! : C:\WINDOWS\system32\ipoi.exe
Removed! : C:\WINDOWS\system32\ippw32.exe
Removed! : C:\WINDOWS\system32\ipsz.exe
Removed! : C:\WINDOWS\system32\ipyl32.exe
Removed! : C:\WINDOWS\system32\iqlrf.dat
Removed! : C:\WINDOWS\system32\iskwq.dat
Removed! : C:\WINDOWS\system32\itenx.dll
Removed! : C:\WINDOWS\system32\iukwx.dat
Removed! : C:\WINDOWS\system32\iuqpc.dll
Removed! : C:\WINDOWS\system32\izqwq.dll
Removed! : C:\WINDOWS\system32\jador.dll
Removed! : C:\WINDOWS\system32\javaoc32.exe
Removed! : C:\WINDOWS\system32\javaxc32.exe
Removed! : C:\WINDOWS\system32\jdckm.dll
Removed! : C:\WINDOWS\system32\jegut.dll
Removed! : C:\WINDOWS\system32\jfcfm.dat
Removed! : C:\WINDOWS\system32\jjqqk.dll
Removed! : C:\WINDOWS\system32\jouxq.dll
Removed! : C:\WINDOWS\system32\jpieh.dll
Removed! : C:\WINDOWS\system32\jxowc.dll
Removed! : C:\WINDOWS\system32\jxshh.dll
Removed! : C:\WINDOWS\system32\jyyfz.dll
Removed! : C:\WINDOWS\system32\kbwjv.dat
Removed! : C:\WINDOWS\system32\kdyli.dll
Removed! : C:\WINDOWS\system32\khkzb.dll
Removed! : C:\WINDOWS\system32\kitny.dll
Removed! : C:\WINDOWS\system32\knjcy.dll
Removed! : C:\WINDOWS\system32\ksnwp.dll
Removed! : C:\WINDOWS\system32\kujql.dat
Removed! : C:\WINDOWS\system32\kwhep.dat
Removed! : C:\WINDOWS\system32\kwukc.dll
Removed! : C:\WINDOWS\system32\kxayc.dll
Removed! : C:\WINDOWS\system32\kyopt.dat
Removed! : C:\WINDOWS\system32\ldrzw.dll
Removed! : C:\WINDOWS\system32\lefdm.dll
Removed! : C:\WINDOWS\system32\lijbx.dat
Removed! : C:\WINDOWS\system32\lkhmr.dat
Removed! : C:\WINDOWS\system32\lmymd.dll
Removed! : C:\WINDOWS\system32\lsroa.dll
Removed! : C:\WINDOWS\system32\lvfdr.dat
Removed! : C:\WINDOWS\system32\mathf.dat
Removed! : C:\WINDOWS\system32\mcsnf.dll
Removed! : C:\WINDOWS\system32\mdhst.dll
Removed! : C:\WINDOWS\system32\mdsph.dll
Removed! : C:\WINDOWS\system32\mefst.dll
Removed! : C:\WINDOWS\system32\mfcjv.exe
Removed! : C:\WINDOWS\system32\mfctj32.exe
Removed! : C:\WINDOWS\system32\mfctt.exe
Removed! : C:\WINDOWS\system32\mfzyl.dll
Removed! : C:\WINDOWS\system32\mhpya.dat
Removed! : C:\WINDOWS\system32\miepy.dat
Removed! : C:\WINDOWS\system32\miojr.dat
Removed! : C:\WINDOWS\system32\mkfae.dll
Removed! : C:\WINDOWS\system32\mkhps.dat
Removed! : C:\WINDOWS\system32\mlyrl.dll
Removed! : C:\WINDOWS\system32\mmkjk.dll
Removed! : C:\WINDOWS\system32\mmsks.dll
Removed! : C:\WINDOWS\system32\mmusq.dat
Removed! : C:\WINDOWS\system32\msal32.exe
Removed! : C:\WINDOWS\system32\mscx.exe
Removed! : C:\WINDOWS\system32\mseh.exe
Removed! : C:\WINDOWS\system32\msfc32.exe
Removed! : C:\WINDOWS\system32\msfk.exe
Removed! : C:\WINDOWS\system32\msfz32.exe
Removed! : C:\WINDOWS\system32\msiz32.exe
Removed! : C:\WINDOWS\system32\msjk.exe
Removed! : C:\WINDOWS\system32\msjp.exe
Removed! : C:\WINDOWS\system32\mskl.exe
Removed! : C:\WINDOWS\system32\msym.exe
Removed! : C:\WINDOWS\system32\mtyua.dat
Removed! : C:\WINDOWS\system32\mzpfu.dll
Removed! : C:\WINDOWS\system32\nbhib.dll
Removed! : C:\WINDOWS\system32\netcv32.exe
Removed! : C:\WINDOWS\system32\netfr.exe
Removed! : C:\WINDOWS\system32\netgg.exe
Removed! : C:\WINDOWS\system32\netit.exe
Removed! : C:\WINDOWS\system32\netjx32.exe
Removed! : C:\WINDOWS\system32\netpd.exe
Removed! : C:\WINDOWS\system32\netqc32.exe
Removed! : C:\WINDOWS\system32\netrn.exe
Removed! : C:\WINDOWS\system32\netuk.exe
Removed! : C:\WINDOWS\system32\netuq.exe
Removed! : C:\WINDOWS\system32\netyz.exe
Removed! : C:\WINDOWS\system32\nhpnc.dll
Removed! : C:\WINDOWS\system32\nkacm.dll
Removed! : C:\WINDOWS\system32\nmitc.dll
Removed! : C:\WINDOWS\system32\nmkvv.dat
Removed! : C:\WINDOWS\system32\nrvku.dll
Removed! : C:\WINDOWS\system32\nspys.dat
Removed! : C:\WINDOWS\system32\ntbyt.dll
Removed! : C:\WINDOWS\system32\ntcg32.exe
Removed! : C:\WINDOWS\system32\ntcl.exe
Removed! : C:\WINDOWS\system32\ntif.exe
Removed! : C:\WINDOWS\system32\ntxfv.dll
Removed! : C:\WINDOWS\system32\nubxz.dll
Removed! : C:\WINDOWS\system32\nufxk.dat
Removed! : C:\WINDOWS\system32\nvvrm.dat
Removed! : C:\WINDOWS\system32\oaiji.dat
Removed! : C:\WINDOWS\system32\ocfft.dll
Removed! : C:\WINDOWS\system32\ohdua.dat
Removed! : C:\WINDOWS\system32\ohymh.dat
Removed! : C:\WINDOWS\system32\olrrs.dat
Removed! : C:\WINDOWS\system32\onhqp.dll
Removed! : C:\WINDOWS\system32\ookfu.dat
Removed! : C:\WINDOWS\system32\oqwzx.dat
Removed! : C:\WINDOWS\system32\ordcb.dll
Removed! : C:\WINDOWS\system32\otigr.dll
Removed! : C:\WINDOWS\system32\owana.dat
Removed! : C:\WINDOWS\system32\pbscl.dll
Removed! : C:\WINDOWS\system32\peyye.dll
Removed! : C:\WINDOWS\system32\pfrpe.dll
Removed! : C:\WINDOWS\system32\pfxvl.dll
Removed! : C:\WINDOWS\system32\phceg.dll
Removed! : C:\WINDOWS\system32\pmjao.dll
Removed! : C:\WINDOWS\system32\pokql.dll
Removed! : C:\WINDOWS\system32\ppwof.dll
Removed! : C:\WINDOWS\system32\pqbyi.dll
Removed! : C:\WINDOWS\system32\prihm.dat
Removed! : C:\WINDOWS\system32\pxcmm.dat
Removed! : C:\WINDOWS\system32\pzboz.dll
Removed! : C:\WINDOWS\system32\qfscu.dll
Removed! : C:\WINDOWS\system32\qfufk.dll
Removed! : C:\WINDOWS\system32\qktno.dll
Removed! : C:\WINDOWS\system32\qqajc.dat
Removed! : C:\WINDOWS\system32\qqsgj.dat
Removed! : C:\WINDOWS\system32\qrgwc.dll
Removed! : C:\WINDOWS\system32\qslxg.dll
Removed! : C:\WINDOWS\system32\qsrrx.dat
Removed! : C:\WINDOWS\system32\qtflo.dll
Removed! : C:\WINDOWS\system32\qxkgf.dat
Removed! : C:\WINDOWS\system32\qykzq.dll
Removed! : C:\WINDOWS\system32\raygo.dat
Removed! : C:\WINDOWS\system32\rbzvw.dll
Removed! : C:\WINDOWS\system32\rcmth.dll
Removed! : C:\WINDOWS\system32\reuyf.dat
Removed! : C:\WINDOWS\system32\rfhbu.dll
Removed! : C:\WINDOWS\system32\rhbyx.dat
Removed! : C:\WINDOWS\system32\rhjtu.dll
Removed! : C:\WINDOWS\system32\rjktj.dll
Removed! : C:\WINDOWS\system32\rkbjm.dat
Removed! : C:\WINDOWS\system32\rkpaj.dat
Removed! : C:\WINDOWS\system32\rlxcw.dat
Removed! : C:\WINDOWS\system32\rnkxc.dat
Removed! : C:\WINDOWS\system32\ryita.dll
Removed! : C:\WINDOWS\system32\rysfv.dll
Removed! : C:\WINDOWS\system32\sabpu.dll
Removed! : C:\WINDOWS\system32\sbild.dat
Removed! : C:\WINDOWS\system32\sdkiu.exe
Removed! : C:\WINDOWS\system32\sdkms32.exe
Removed! : C:\WINDOWS\system32\sdkoz32.exe
Removed! : C:\WINDOWS\system32\sdkrt.exe
Removed! : C:\WINDOWS\system32\sdkye32.exe
Removed! : C:\WINDOWS\system32\sfala.dll
Removed! : C:\WINDOWS\system32\shdnw.dll
Removed! : C:\WINDOWS\system32\shwpq.dll
Removed! : C:\WINDOWS\system32\skwjw.dll
Removed! : C:\WINDOWS\system32\slhqr.dat
Removed! : C:\WINDOWS\system32\slwzf.dll
Removed! : C:\WINDOWS\system32\snlha.dat
Removed! : C:\WINDOWS\system32\somsv.dll
Removed! : C:\WINDOWS\system32\sphiq.dll
Removed! : C:\WINDOWS\system32\spysg.dll
Removed! : C:\WINDOWS\system32\spytf.dll
Removed! : C:\WINDOWS\system32\sqtii.dll
Removed! : C:\WINDOWS\system32\ssews.dat
Removed! : C:\WINDOWS\system32\ssohe.dat
Removed! : C:\WINDOWS\system32\svbvl.dat
Removed! : C:\WINDOWS\system32\sxqqh.dat
Removed! : C:\WINDOWS\system32\sxytp.dll
Removed! : C:\WINDOWS\system32\syqiu.dll
Removed! : C:\WINDOWS\system32\sysmg.exe
Removed! : C:\WINDOWS\system32\syspk.exe
Removed! : C:\WINDOWS\system32\systs32.exe
Removed! : C:\WINDOWS\system32\syszq.exe
Removed! : C:\WINDOWS\system32\szmzo.dll
Removed! : C:\WINDOWS\system32\tafhm.dat
Removed! : C:\WINDOWS\system32\tcqtz.dll
Removed! : C:\WINDOWS\system32\tkcfr.dat
Removed! : C:\WINDOWS\system32\tkndh.dat
Removed! : C:\WINDOWS\system32\tlceg.dll
Removed! : C:\WINDOWS\system32\tmlzb.dat
Removed! : C:\WINDOWS\system32\tmmkj.dat
Removed! : C:\WINDOWS\system32\toacf.dll
Removed! : C:\WINDOWS\system32\tpynr.dat
Removed! : C:\WINDOWS\system32\trjpt.dll
Removed! : C:\WINDOWS\system32\twdpz.dat
Removed! : C:\WINDOWS\system32\txmcf.dll
Removed! : C:\WINDOWS\system32\tzbjo.dat
Removed! : C:\WINDOWS\system32\tzewd.dll
Removed! : C:\WINDOWS\system32\uamxk.dll
Removed! : C:\WINDOWS\system32\uczor.dat
Removed! : C:\WINDOWS\system32\udkvs.dat
Removed! : C:\WINDOWS\system32\upxcr.dll
Removed! : C:\WINDOWS\system32\utnan.dat
Removed! : C:\WINDOWS\system32\uvxlu.dll
Removed! : C:\WINDOWS\system32\uwasg.dll
Removed! : C:\WINDOWS\system32\uwlkv.dat
Removed! : C:\WINDOWS\system32\uwtfl.dll
Removed! : C:\WINDOWS\system32\vbfws.dll
Removed! : C:\WINDOWS\system32\vbpsb.dat
Removed! : C:\WINDOWS\system32\vcqab.dll
Removed! : C:\WINDOWS\system32\vdpeb.dat
Removed! : C:\WINDOWS\system32\vehbm.dll
Removed! : C:\WINDOWS\system32\vgajj.dll
Removed! : C:\WINDOWS\system32\vhpuf.dll
Removed! : C:\WINDOWS\system32\vhxlf.dll
Removed! : C:\WINDOWS\system32\viaop.dll
Removed! : C:\WINDOWS\system32\vicvg.dat
Removed! : C:\WINDOWS\system32\vjllt.dat
Removed! : C:\WINDOWS\system32\vjuul.dat
Removed! : C:\WINDOWS\system32\vkifo.dll
Removed! : C:\WINDOWS\system32\vplkm.dll
Removed! : C:\WINDOWS\system32\vshtg.dll
Removed! : C:\WINDOWS\system32\vszsn.dll
Removed! : C:\WINDOWS\system32\vubjp.dat
Removed! : C:\WINDOWS\system32\vvabd.dll
Removed! : C:\WINDOWS\system32\vvpdm.dat
Removed! : C:\WINDOWS\system32\vyhna.dll
Removed! : C:\WINDOWS\system32\wcsjk.dat
Removed! : C:\WINDOWS\system32\weoqs.dat
Removed! : C:\WINDOWS\system32\wewxu.dll
Removed! : C:\WINDOWS\system32\wexvz.dll
Removed! : C:\WINDOWS\system32\wfzkz.dat
Removed! : C:\WINDOWS\system32\wfzmi.dat
Removed! : C:\WINDOWS\system32\wgtqo.dll
Removed! : C:\WINDOWS\system32\winer32.exe
Removed! : C:\WINDOWS\system32\winet.exe
Removed! : C:\WINDOWS\system32\winfz32.exe
Removed! : C:\WINDOWS\system32\winog32.exe
Removed! : C:\WINDOWS\system32\winvu32.exe
Removed! : C:\WINDOWS\system32\winvw.exe
Removed! : C:\WINDOWS\system32\winxz32.exe
Removed! : C:\WINDOWS\system32\wixtr.dat
Removed! : C:\WINDOWS\system32\wmjta.dll
Removed! : C:\WINDOWS\system32\wqcyq.dll
Removed! : C:\WINDOWS\system32\wrrpc.dll
Removed! : C:\WINDOWS\system32\wskmd.dll
Removed! : C:\WINDOWS\system32\wsszs.dat
Removed! : C:\WINDOWS\system32\wucoa.dll
Removed! : C:\WINDOWS\system32\wvnjs.dll
Removed! : C:\WINDOWS\system32\wwkhs.dat
Removed! : C:\WINDOWS\system32\wxcdr.dll
Removed! : C:\WINDOWS\system32\xcmmi.dll
Removed! : C:\WINDOWS\system32\xeqgi.dat
Removed! : C:\WINDOWS\system32\xfyxb.dat
Removed! : C:\WINDOWS\system32\xgzxu.dat
Removed! : C:\WINDOWS\system32\xihfn.dll
Removed! : C:\WINDOWS\system32\xmfpj.dll
Removed! : C:\WINDOWS\system32\xnkvg.dat
Removed! : C:\WINDOWS\system32\xnvby.dll
Removed! : C:\WINDOWS\system32\xobjs.dat
Removed! : C:\WINDOWS\system32\xohiu.dll
Removed! : C:\WINDOWS\system32\xrdln.dat
Removed! : C:\WINDOWS\system32\yebmh.dll
Removed! : C:\WINDOWS\system32\yewwx.dll
Removed! : C:\WINDOWS\system32\ygluk.dll
Removed! : C:\WINDOWS\system32\ygmeb.dll
Removed! : C:\WINDOWS\system32\ygvvb.dat
Removed! : C:\WINDOWS\system32\ylyad.dat
Removed! : C:\WINDOWS\system32\ymfaf.dat
Removed! : C:\WINDOWS\system32\yrfck.dll
Removed! : C:\WINDOWS\system32\yrkke.dll
Removed! : C:\WINDOWS\system32\yveum.dat
Removed! : C:\WINDOWS\system32\yykeq.dll
Removed! : C:\WINDOWS\system32\yyrkl.dll
Removed! : C:\WINDOWS\system32\yyyma.dll
Removed! : C:\WINDOWS\system32\yzpsa.dat
Removed! : C:\WINDOWS\system32\zakgu.dat
Removed! : C:\WINDOWS\system32\zbgck.dat
Removed! : C:\WINDOWS\system32\zepbc.dll
Removed! : C:\WINDOWS\system32\zfewg.dll
Removed! : C:\WINDOWS\system32\zfymn.dat
Removed! : C:\WINDOWS\system32\zjdmi.dll
Removed! : C:\WINDOWS\system32\zjkcq.dll
Removed! : C:\WINDOWS\system32\zntli.dll
Removed! : C:\WINDOWS\system32\zpkpl.dat
Removed! : C:\WINDOWS\system32\zplgc.dll
Removed! : C:\WINDOWS\system32\zpsaa.dll
Removed! : C:\WINDOWS\system32\zqoxf.dll
Removed! : C:\WINDOWS\system32\zsjwd.dll
Removed! : C:\WINDOWS\system32\ztlce.dat
Removed! : C:\WINDOWS\system32\zvmpx.dat
Removed! : C:\WINDOWS\system32\zxffu.dll
Removed! : C:\WINDOWS\system32\zytou.dat
Attempted Clean Of Temp folder.
Removed Uninstall Key (HSA)
Removed Uninstall Key (SE)
Removed Uninstall Key (SW)
Pages Reset... Done!

-- Scan 2 ---------------------------
About:Buster Version 4.0
Reference List : 19

Removed Data Streams:
C:\WINDOWS\aaqcx.dat:qndgt
C:\WINDOWS\abrow.dll:jsqfh
C:\WINDOWS\addfo32.exe:ioxod
C:\WINDOWS\addjv32.exe:lmiei
C:\WINDOWS\apigs.exe:ekxlt
C:\WINDOWS\apjjz.dat:ttqds
C:\WINDOWS\apphu.exe:mnmwq
C:\WINDOWS\Coffee Bean.bmp:zsxud
C:\WINDOWS\ejkjk.dll:bblim
C:\WINDOWS\fezec.dat:aiscd
C:\WINDOWS\fnfrn.dll:gsvtw
C:\WINDOWS\gnrko.dll:cstsu
C:\WINDOWS\hmtuj.dll:dfbrh
C:\WINDOWS\hrglbl.dat:vgtwb
C:\WINDOWS\iensx.ini:gnsbr
C:\WINDOWS\iphs32.exe:upjgb
C:\WINDOWS\ipwr32.dll:svwma
C:\WINDOWS\javaov.dll:qxgms
C:\WINDOWS\jouac.dll:maopj
C:\WINDOWS\lxnlr.txt:wehml
C:\WINDOWS\mepsbo.dat:fhfts
C:\WINDOWS\mfcgx32.dll:csgci
C:\WINDOWS\mskc.dll:defxp
C:\WINDOWS\mvnpn.dll:krleb
C:\WINDOWS\neskn.txt:iadmu
C:\WINDOWS\netgv32.exe:juqox
C:\WINDOWS\nexhd.txt:jiejc
C:\WINDOWS\ngjjg.txt:iolvz
C:\WINDOWS\nsmyf.txt:lqgty
C:\WINDOWS\oetrv.txt:szfjf
C:\WINDOWS\prpiy.dll:whtiu
C:\WINDOWS\qsxez.dll:xacsi
C:\WINDOWS\qxmaj.dll:ybzlx
C:\WINDOWS\rkffk.dll:ntvon
C:\WINDOWS\rorlhf.dat:gmcgo
C:\WINDOWS\rzwhv.dll:nthqq
C:\WINDOWS\SETUPLOG.TXT:crgni
C:\WINDOWS\sfvfp.log:cnvbn
C:\WINDOWS\svrjf.dll:fudwh
C:\WINDOWS\ttmlx.txt:dlbla
C:\WINDOWS\TWAIN.DLL:lqkgj
C:\WINDOWS\vlrhb.txt:pdznw
C:\WINDOWS\wekoh.txt:qxhgk
C:\WINDOWS\Windows Update.log:rshmc
C:\WINDOWS\winhlp32.exe:igxlt
C:\WINDOWS\winol.dll:lywpf
C:\WINDOWS\winxg32.dll:qdpsd
C:\WINDOWS\wohoc.txt:xsvdo
C:\WINDOWS\wtyou.dat:klyyk
C:\WINDOWS\zolqx.txt:pouvr

#6
Dragon

Posted 24 February 2005 - 03:01 PM

All Around Computer Nut

Retired Staff
2,682 posts

I don't know how you did it, but when you ran HJT, it was the older version of 1.82 please post a new log from version 1.99.1

#7
Taran_Walker

Posted 24 February 2005 - 03:04 PM

Member

Topic Starter
Member
48 posts

Sorry i dont no what happened either

Logfile of HijackThis v1.99.1
Scan saved at 21:04:09, on 24/02/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\GhostTray.exe
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Taran\Local Settings\Temporary Internet Files\Content.IE5\S181BFUX\HijackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.euro.dell...gen/default.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Norton Ghost 9.0] C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\GhostTray.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab28578.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zon...nt.cab30149.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...er.cab30149.cab
O16 - DPF: {88C51E90-8E9C-4C96-8A45-574D88B63FAF} - http://acceso.masmin.../aplicacion.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab28578.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} - http://www.installen...gine/isetup.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zon...ro.cab30149.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zon...ot.cab30149.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft....ayx_vp3_mp3.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zon...ss.cab30149.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...wn.cab30149.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1727CC60-9FB7-48CC-8382-5D4CCD88A251}: NameServer = 195.92.195.94 195.92.195.95
O17 - HKLM\System\CS2\Services\Tcpip\..\{1727CC60-9FB7-48CC-8382-5D4CCD88A251}: NameServer = 195.92.195.94 195.92.195.95
O18 - Protocol: dialux - {8352FA4C-39C6-11D3-ADBA-00A0244FB1A2} - C:\Program Files\DIALux\System\DLXToolBox.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

#8
Dragon

Posted 24 February 2005 - 03:08 PM

All Around Computer Nut

Retired Staff
2,682 posts

Run hijack this again and check the following entry, making sure all windows, icluding this one, are closed select "fix checked"

R3 - Default URLSearchHook is missing

otherwise then that your log is clean. :tazz:

For Future Protection
Download and install:

SpywareBlaster will block bad ActiveX and malevolent cookies. http://www.javacools...areblaster.html

IE-SPYAD puts over 4000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
https://netfiles.uiu...rce.htm#IESPYAD

Both are very small free programs that you run once, and then just occasionally to check for updates.

And also see
So how did I get infected in the first place?

happy Computing