[iconcurr]

Hi,

Thanks to all who contribute to this forum. You are truly appreciated.

Please help if you can. I know you guys are SUPER busy. I am very patient.

I think I have some stuff going on that I can't locate. Here's my Hijack file and below that is the scan I did at Kaspersky:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:11:14 PM, on 1/30/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\V0220Mon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\System32\wpcumi.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\Netgear Update Assistant\LANUpdate.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\WZQKPICK.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Java\jre6\bin\jp2launcher.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Program Files\Market Samurai\Market Samurai.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [V0220Mon.exe] C:\Windows\V0220Mon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [LanUpdate] "C:\Program Files\Netgear Update Assistant\LanUpdate.exe"
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Program Files\Trend Micro\HijackThis\HijackThis.exe /startupscan
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix:
O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} (WMI Class) - http://support.dell....r/SysProExe.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: FlipShare Service - Unknown owner - C:\Program Files\Pure Digital Technologies\FlipShare\FlipShareService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

--
End of file - 6008 bytes


--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Friday, January 30, 2009
Operating System: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 1 (build 6001)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Friday, January 30, 2009 05:14:03
Records in database: 1727417
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
H:\
I:\
J:\
K:\

Scan statistics:
Files scanned: 410966
Threat name: 12
Infected objects: 19
Suspicious objects: 4
Duration of the scan: 06:52:29


File name / Threat name / Threats count
C:\My Downloads\0-the_corpe_rises.asf Infected: Trojan-Clicker.ASF.Ambal.a 1
C:\Windows.old\Users\default.WORKGROUP\.housecall\Quarantine\01 - violin plugin for fruity loops.rar.bac_a00496 Infected: Trojan-Downloader.Win32.IstBar.nj 1
C:\Windows.old\Users\default.WORKGROUP\.housecall\Quarantine\jar.jar-2ad522e1-36cd6dcc.zip.bac_a03752 Infected: Trojan.Java.Femad 4
C:\Windows.old\Users\default.WORKGROUP\.housecall\Quarantine\jar.jar-2ad522e1-36cd6dcc.zip.bac_a03752 Infected: Trojan.Win32.LowZones.dn 1
C:\Windows.old\Users\default.WORKGROUP\.housecall\Quarantine\jar.jar-5f5cccb6-28982176.zip.bac_a03752 Infected: Trojan.Java.Femad 4
C:\Windows.old\Users\default.WORKGROUP\.housecall\Quarantine\jar.jar-5f5cccb6-28982176.zip.bac_a03752 Infected: Trojan.Win32.Small.ev 1
C:\Windows.old\Users\default.WORKGROUP\.housecall\Quarantine\keyfinder.exe.bac_a00496 Infected: not-a-virus:PSWTool.Win32.RAS.a 2
C:\Windows.old\Users\default.WORKGROUP\.housecall\Quarantine\violin plugin for fruity loops.zip.bac_a00496 Infected: Trojan-Downloader.Win32.IstBar.us 1
C:\Windows.old\Users\default.WORKGROUP\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\HBJ0ATT9\deliver46860[1].htm Suspicious: Exploit.HTML.Mht 1
C:\Windows.old\Users\default.WORKGROUP\AppData\Roaming\Identities\{66308FCE-0639-4DA7-AED3-9700A8CD8D92}\Microsoft\Outlook Express\Inbox.dbx Infected: Trojan-Spy.HTML.Bayfraud.kl 1
C:\Windows.old\Users\default.WORKGROUP\AppData\Roaming\Identities\{66308FCE-0639-4DA7-AED3-9700A8CD8D92}\Microsoft\Outlook Express\Sent Items.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 3
C:\Windows.old\Users\iconcurr\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\SF76QHFM\xplaymovie[1].htm Infected: Trojan-Downloader.HTML.Agent.lq 1
C:\Windows.old\Users\iconcurr\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\XW18W2W3\xplaymovie[1].htm Infected: Trojan-Downloader.HTML.Agent.lq 1
C:\Windows.old\Users\iconcurr\Downloads\acehtml6pro.exe Infected: not-a-virus:AdWare.Win32.MegaSearch.n 1

The selected area was scanned.

[Advertisements]

Please do not start another thread if you haven't received help.

You already have a topic open for this issue in this link.

If your topic has gone more than three days without a reply, post a link to your topic in The Waiting Room and a staff member will pick it up as soon as they can.

[Octagonal]

Please do not start another thread if you haven't received help.

You already have a topic open for this issue in this link.

If your topic has gone more than three days without a reply, post a link to your topic in The Waiting Room and a staff member will pick it up as soon as they can.