[C-H-R-I-S]

Hello

This trojan well at least i think its a trojan im not sure. When im on google its redirects me to advertisement sites & it also shoots my ram usage up to like 1 GIG & it maxes out my CPU

I really need help in removing this i really think this is one of those trojans you have to restart & have it removed trough reboot.

Thanks

Heres my hijackthis Logfile:




Logfile of HijackThis v1.99.1
Scan saved at 7:08:08 PM, on 6/21/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
G:\SYSTEM\WINDOWS\System32\smss.exe
G:\SYSTEM\WINDOWS\system32\csrss.exe
G:\SYSTEM\WINDOWS\system32\winlogon.exe
G:\SYSTEM\WINDOWS\system32\services.exe
G:\SYSTEM\WINDOWS\system32\lsass.exe
G:\SYSTEM\WINDOWS\system32\svchost.exe
G:\SYSTEM\WINDOWS\System32\svchost.exe
G:\SYSTEM\WINDOWS\System32\svchost.exe
G:\SYSTEM\WINDOWS\System32\svchost.exe
G:\SYSTEM\WINDOWS\system32\spoolsv.exe
G:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
G:\SYSTEM\WINDOWS\System32\alg.exe
G:\SYSTEM\WINDOWS\System32\CTsvcCDA.exe
G:\SYSTEM\WINDOWS\System32\bgidaytd.exe
G:\SYSTEM\WINDOWS\System32\nvsvc32.exe
G:\SYSTEM\WINDOWS\System32\HPZipm12.exe
G:\SYSTEM\WINDOWS\System32\svchost.exe
G:\SYSTEM\WINDOWS\System32\wdfmgr.exe
G:\SYSTEM\WINDOWS\Explorer.EXE
G:\SYSTEM\WINDOWS\System32\CTHELPER.EXE
G:\SYSTEM\WINDOWS\avp.exe
G:\SYSTEM\WINDOWS\smanager.7.exe
G:\Program Files\Internet Explorer\IEXPLORE.EXE
G:\Program Files\Windows Media Player\wmplayer.exe
G:\Program Files\Internet Explorer\IEXPLORE.EXE
G:\Documents and Settings\C-H-R-I-S\Local Settings\Temp\Temporary Directory 11 for hijackthis[1].zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = G:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = G:\windows\system32\blank.htm
F2 - REG:system.ini: UserInit=G:\SYSTEM\WINDOWS\system32\userinit.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - G:\SYSTEM\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE G:\SYSTEM\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE G:\SYSTEM\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SBDrvDet] G:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] "G:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [UpdReg] G:\SYSTEM\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avp] G:\SYSTEM\WINDOWS\avp.exe
O4 - HKLM\..\Run: [SManager] smanager.7.exe
O4 - HKLM\..\Run: [GPLv3] rundll32.exe "G:\SYSTEM\WINDOWS\System32\oyqvvjfa.dll",realset
O8 - Extra context menu item: &AOL Toolbar search - res://G:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {341FF14B-00CB-49F5-A427-A164DF1D5E1F} (MALPlaybackCtrl Class) - http://musicstore.co...ALStreaming.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg...l_v1-0-3-48.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.r...ip/RdxIE601.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1161132488468
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - https://secure2.comn...login-devel.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://216.130.146.1...sCamControl.ocx
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - http://69.131.248.14/activex/AMC.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - G:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - G:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: PostBootReminder - G:\SYSTEM\WINDOWS\system32\SHELL321a9} - (no file)
O21 - SSODL: CDBurn - G:\SYSTEM\WINDOWS\system32\SHELL325e9} - (no file)
O21 - SSODL: WebCheck - G:\SYSTEM\WINDOWS\System32\webcheckED} - (no file)
O21 - SSODL: SysTray - G:\SYSTEM\WINDOWS\System32\stobject.dll - (no file)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Unknown owner - G:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - Unknown owner - G:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - G:\SYSTEM\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: DomainService - - G:\SYSTEM\WINDOWS\System32\bgidaytd.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - G:\SYSTEM\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - G:\SYSTEM\WINDOWS\System32\HPZipm12.exe
O23 - Service: Messenger Sharing Folders USN Journal Reader service (usnjsvc) - Unknown owner - G:\Program Files\MSN Messenger\usnsvc.exe