[Seiko]

hey guys, im a n00b at computers and i really need help. i have the project1 virus but also my comp is pretty much infested with viruses. here's my log can anyone tell me what do fix using hijack this and preferably what to do to get rid of the project1 virus? thanks!

Logfile of HijackThis v1.99.1
Scan saved at 21:19:11, on 09/05/2005
Platform: Windows 2000 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\stisvc.exe
C:\PROGRA~1\Toolbar\TBPSSvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\Common Files\WinTools\WToolsS.exe
C:\WINNT\explorer.exe
C:\PROGRA~1\Toolbar\TBPS.exe
C:\PROGRA~1\Toolbar\PIB.exe
c:\PROGRA~1\Toolbar\radio.exe
C:\Program Files\Common Files\WinTools\WToolsA.exe
C:\Program Files\Common Files\WinTools\WSup.exe
C:\WINNT\d3ne32.exe
C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
C:\WINNT\loadqm.exe
C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\WINNT\System32\P2P Networking\P2P Networking.exe
C:\WINNT\system32\apibu.exe
C:\WINNT\System32\pxckt\rfcehrlg.exe
C:\WINNT\System32\xswal\jjpphr.exe
C:\WINNT\System32\aloc\cubt.exe
C:\WINNT\System32\run.exe
C:\Program Files\Media Access\MediaAccK.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\SAHAGE~1.EXE
C:\Program Files\Media Access\MediaAccess.exe
C:\msvc.exe
C:\winfw.exe
C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Ares Lite Edition\Ares.exe
C:\reg.exe
C:\program files\internet explorer\iexplore.exe
C:\unzipped\hijackthis[1]\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch...spx?tb_id=50245
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\mfulu.dll/sp.html#37680
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.makemesearch.com/?said=515
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\mfulu.dll/sp.html#37680
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch...spx?tb_id=50245
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\mfulu.dll/sp.html#37680
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\mfulu.dll/sp.html#37680
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.makemesearch.com/?said=515
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\mfulu.dll/sp.html#37680
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch...spx?tb_id=50245
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=explorer.exe C:\WINNT\System32\msbl.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1C8D5677-21BC-95DF-8CAC-E5E32B10FD03} - C:\WINNT\javaru32.dll
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll
O2 - BHO: Tubby - {9EAC0102-5E61-2312-BC2D-4D54434D5443} - C:\WINNT\System32\MTC.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [PMXInit] C:\WINNT\System32\pmxinit.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe" /SU
O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adstartup] C:\WINNT\System32\automove.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [P2P Networking] C:\WINNT\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [apibu.exe] C:\WINNT\system32\apibu.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [crwq.exe] C:\WINNT\system32\crwq.exe
O4 - HKLM\..\Run: [tlnh] C:\WINNT\System32\sbjjab\tlnh.exe
O4 - HKLM\..\Run: [Windows AdStatus] C:\Program Files\Windows AdStatus\WinStat.exe
O4 - HKLM\..\Run: [mspx.exe] C:\WINNT\system32\mspx.exe
O4 - HKLM\..\Run: [taxbnon] C:\WINNT\System32\ujwljvl\taxbnon.exe
O4 - HKLM\..\Run: [cogkn] C:\WINNT\System32\vnhhduep\cogkn.exe
O4 - HKLM\..\Run: [appog32.exe] C:\WINNT\system32\appog32.exe
O4 - HKLM\..\Run: [mfcqd32.exe] C:\WINNT\system32\mfcqd32.exe
O4 - HKLM\..\Run: [javalx32.exe] C:\WINNT\system32\javalx32.exe
O4 - HKLM\..\Run: [iewh32.exe] C:\WINNT\system32\iewh32.exe
O4 - HKLM\..\Run: [mfcre.exe] C:\WINNT\system32\mfcre.exe
O4 - HKLM\..\Run: [ipvz32.exe] C:\WINNT\system32\ipvz32.exe
O4 - HKLM\..\Run: [d3gy32.exe] C:\WINNT\system32\d3gy32.exe
O4 - HKLM\..\Run: [ipii.exe] C:\WINNT\system32\ipii.exe
O4 - HKLM\..\Run: [crej32.exe] C:\WINNT\system32\crej32.exe
O4 - HKLM\..\Run: [sysdx32.exe] C:\WINNT\system32\sysdx32.exe
O4 - HKLM\..\Run: [addbm32.exe] C:\WINNT\system32\addbm32.exe
O4 - HKLM\..\Run: [Windows] run.exe
O4 - HKLM\..\Run: [salm] c:\temp\salm.exe
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [SAHBundle] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\SAHAGE~1.EXE run
O4 - HKLM\..\Run: [Anti-Virus Update Scheduler V1.39.12R] C:\msvc.exe
O4 - HKLM\..\Run: [cubt] C:\WINNT\System32\aloc\cubt.exe
O4 - HKLM\..\Run: [jjpphr] C:\WINNT\System32\xswal\jjpphr.exe
O4 - HKLM\..\Run: [rfcehrlg] C:\WINNT\System32\pxckt\rfcehrlg.exe
O4 - HKLM\..\Run: [eTunnel] C:\winfw.exe
O4 - HKLM\..\Run: [REGRUN] C:\reg.exe
O4 - HKLM\..\RunServices: [Windows] run.exe
O4 - HKLM\..\RunOnce: [MNSIndex] C:\Program Files\Max Net Shield\MNSIndex.exe
O4 - HKLM\..\RunOnce: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe /boot
O4 - HKLM\..\RunOnce: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe /boot
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [LDM] \Program\
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Flag Active] C:\DOCUME~1\ADMINI~1\APPLIC~1\64HOPE\eqdvdtest.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares Lite Edition\Ares.exe" -h
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\RunOnce: [MNShist] C:\Program Files\Max Net Shield\MNSHist.exe MNSErase
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O15 - Trusted IP range: 206.161.125.149
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...er.cab28177.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab28177.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zon...ro.cab30149.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5125FFEA-BB56-4523-8868-6D15EED76D4A}: NameServer = 199.166.31.3,199.5.157.128
O17 - HKLM\System\CCS\Services\Tcpip\..\{859B5C13-843B-4886-8683-C91050E7446F}: NameServer = 199.166.31.3,199.5.157.128
O17 - HKLM\System\CS1\Services\VxD\MSTCP: NameServer = 69.50.176.156,195.225.176.31
O17 - HKLM\System\CS2\Services\VxD\MSTCP: NameServer = 69.50.176.156,195.225.176.31
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 69.50.176.156,195.225.176.31
O18 - Protocol: bw+0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {7A94FA66-30A1-447E-8F53-E6318883F513} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: tpro - {FF76A5DA-6158-4439-99FF-EDC1B3FE100C} - C:\PROGRA~1\Toolbar\toolbar.dll
O23 - Service: Network Security Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINNT\appat.exe (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: WebSeach Toolbar support NT service (TBPSSvc) - Unknown owner - C:\PROGRA~1\Toolbar\TBPSSvc.exe
O23 - Service: WinTools for IE service (WinToolsSvc) - Unknown owner - C:\Program Files\Common Files\WinTools\WToolsS.exe

[Advertisements]

Welcome to GTG.

I'm going to tell you what I usually tell others. Get rid of Messenger Plus. That program is scumware if you ask me. They have spyware bundled with it. Even with the option to opt-out of their so-called "sponsor" program, I still won't use it. I recommend the same for you.

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that 'Display the contents of system folders' is checked. If you have Windows XP, the search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that 'Search system folders', 'Search hidden files and folders', and 'Search subfolders' are checked.

For the options that you checked/enabled earlier, you may uncheck them after your log is clean. If we ask you to fix a program that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep).

Download AboutBuster http://www.greyknigh...AboutBuster.zip and unzip it to a folder on your the Desktop. Run AboutBuster and click OK. Click Update and then Check For Update to see if there are any updates. Close the program now.

Download KillBox http://www.greyknigh...spy/KillBox.exe. Don't run it yet.

The Temp folders should be cleaned out periodically as installation programs and hijack programs leave a lot of junk there. Download CleanUp! http://cleanup.stevengould.org/ (Alternate Link if main link don't work - http://www.greyknigh...spy/Cleanup.exe ) and install it. Don't run it yet.

Reboot into Safe Mode by hitting the F8 key until menu shows up. In some systems, this may be the F5 key, so try that if F8 doesn't work.
Go to Start->Run and type in services.msc and hit OK. Then look for Network Security Service ( 11Fßä#·ºÄÖ`I) and double click on it. Click on the Stop button and under Startup type, choose Disabled.

Make sure to close any open browsers. Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist:

P2P Networking
Messenger Plus
Windows AdStatus
WinTools
Internet Optimizer
Media Access

Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch...spx?tb_id=50245
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\mfulu.dll/sp.html#37680
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.makemesearch.com/?said=515
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\mfulu.dll/sp.html#37680
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch...spx?tb_id=50245
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\mfulu.dll/sp.html#37680
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\mfulu.dll/sp.html#37680
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.makemesearch.com/?said=515
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\mfulu.dll/sp.html#37680
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch...spx?tb_id=50245
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=explorer.exe C:\WINNT\System32\msbl.exe
O2 - BHO: (no name) - {1C8D5677-21BC-95DF-8CAC-E5E32B10FD03} - C:\WINNT\javaru32.dll
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll
O2 - BHO: Tubby - {9EAC0102-5E61-2312-BC2D-4D54434D5443} - C:\WINNT\System32\MTC.dll
O4 - HKLM\..\Run: [PMXInit] C:\WINNT\System32\pmxinit.exe
O4 - HKLM\..\Run: [Adstartup] C:\WINNT\System32\automove.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [P2P Networking] C:\WINNT\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [apibu.exe] C:\WINNT\system32\apibu.exe
O4 - HKLM\..\Run: [crwq.exe] C:\WINNT\system32\crwq.exe
O4 - HKLM\..\Run: [tlnh] C:\WINNT\System32\sbjjab\tlnh.exe
O4 - HKLM\..\Run: [Windows AdStatus] C:\Program Files\Windows AdStatus\WinStat.exe
O4 - HKLM\..\Run: [mspx.exe] C:\WINNT\system32\mspx.exe
O4 - HKLM\..\Run: [taxbnon] C:\WINNT\System32\ujwljvl\taxbnon.exe
O4 - HKLM\..\Run: [cogkn] C:\WINNT\System32\vnhhduep\cogkn.exe
O4 - HKLM\..\Run: [appog32.exe] C:\WINNT\system32\appog32.exe
O4 - HKLM\..\Run: [mfcqd32.exe] C:\WINNT\system32\mfcqd32.exe
O4 - HKLM\..\Run: [javalx32.exe] C:\WINNT\system32\javalx32.exe
O4 - HKLM\..\Run: [iewh32.exe] C:\WINNT\system32\iewh32.exe
O4 - HKLM\..\Run: [mfcre.exe] C:\WINNT\system32\mfcre.exe
O4 - HKLM\..\Run: [ipvz32.exe] C:\WINNT\system32\ipvz32.exe
O4 - HKLM\..\Run: [d3gy32.exe] C:\WINNT\system32\d3gy32.exe
O4 - HKLM\..\Run: [ipii.exe] C:\WINNT\system32\ipii.exe
O4 - HKLM\..\Run: [crej32.exe] C:\WINNT\system32\crej32.exe
O4 - HKLM\..\Run: [sysdx32.exe] C:\WINNT\system32\sysdx32.exe
O4 - HKLM\..\Run: [addbm32.exe] C:\WINNT\system32\addbm32.exe
O4 - HKLM\..\Run: [Windows] run.exe
O4 - HKLM\..\Run: [salm] c:\temp\salm.exe
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [SAHBundle] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\SAHAGE~1.EXE run
O4 - HKLM\..\Run: [Anti-Virus Update Scheduler V1.39.12R] C:\msvc.exe
O4 - HKLM\..\Run: [cubt] C:\WINNT\System32\aloc\cubt.exe
O4 - HKLM\..\Run: [jjpphr] C:\WINNT\System32\xswal\jjpphr.exe
O4 - HKLM\..\Run: [rfcehrlg] C:\WINNT\System32\pxckt\rfcehrlg.exe
O4 - HKLM\..\Run: [eTunnel] C:\winfw.exe
O4 - HKLM\..\RunServices: [Windows] run.exe
O4 - HKLM\..\RunOnce: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe /boot
O4 - HKLM\..\RunOnce: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe /boot
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Flag Active] C:\DOCUME~1\ADMINI~1\APPLIC~1\64HOPE\eqdvdtest.exe
O15 - Trusted IP range: 206.161.125.149
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O17 - HKLM\System\CS1\Services\VxD\MSTCP: NameServer = 69.50.176.156,195.225.176.31
O17 - HKLM\System\CS2\Services\VxD\MSTCP: NameServer = 69.50.176.156,195.225.176.31
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 69.50.176.156,195.225.176.31

Check and fix ALL those O18 entries that relate to Logitech. It's ok, so check them. Best way to do this is to hit your spacebar and down arrow. Keep repeating this until all the Logitech entries are checked.

O18 - Protocol: tpro - {FF76A5DA-6158-4439-99FF-EDC1B3FE100C} - C:\PROGRA~1\Toolbar\toolbar.dll
O23 - Service: Network Security Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINNT\appat.exe (file missing)
O23 - Service: WebSeach Toolbar support NT service (TBPSSvc) - Unknown owner - C:\PROGRA~1\Toolbar\TBPSSvc.exe
O23 - Service: WinTools for IE service (WinToolsSvc) - Unknown owner - C:\Program Files\Common Files\WinTools\WToolsS.exe

Run AboutBuster and click OK. Click Start->OK and then follow the rest of the prompts to scan (choose Yes/OK for all). It will ask you if you want a second scan, choose Yes. Save the log file and post it here.

Run KillBox and check the box that says 'End Explorer Shell While Killing File'. Next click on 'Delete on Reboot'. For each of the following files below, check the box that says 'Unregister .dll Before Deleting' if it's not grayed out. Copy the below in bold and then go back to the KillBox program. Go to File->Copy from Clipboard and then click on the red circle with a white X button. Confirm to delete, but do NOT restart yet:

C:\Program Files\Internet Optimizer\
C:\DOCUME~1\ADMINI~1\APPLIC~1\64HOPE\
C:\msvc.exe
C:\PROGRA~1\COMMON~1\WinTools\
C:\PROGRA~1\Toolbar\
C:\Program Files\Media Access\
C:\Program Files\Messenger Plus! 3\
C:\Program Files\Windows AdStatus\
C:\winfw.exe
C:\WINNT\d3ne32.exe
C:\WINNT\javaru32.dll
C:\WINNT\system32\addbm32.exe
C:\WINNT\System32\aloc\
C:\WINNT\system32\apibu.exe
C:\WINNT\system32\appog32.exe
C:\WINNT\System32\automove.exe
C:\WINNT\system32\crej32.exe
C:\WINNT\system32\crwq.exe
C:\WINNT\system32\d3gy32.exe
C:\WINNT\system32\iewh32.exe
C:\WINNT\system32\ipii.exe
C:\WINNT\system32\ipvz32.exe
C:\WINNT\system32\javalx32.exe
C:\WINNT\system32\mfcqd32.exe
C:\WINNT\system32\mfcre.exe
C:\WINNT\System32\msbl.exe
C:\WINNT\system32\mspx.exe
C:\WINNT\System32\MTC.dll
C:\WINNT\System32\P2P Networking\
C:\WINNT\System32\pmxinit.exe
C:\WINNT\System32\pxckt\
C:\WINNT\System32\run.exe
C:\WINNT\System32\sbjjab\
C:\WINNT\system32\sysdx32.exe
C:\WINNT\System32\ujwljvl\
C:\WINNT\System32\vnhhduep\
C:\WINNT\System32\xswal\

Run CleanUp! and click on CleanUp! button. When it asks you if you want to logoff, click on Yes.

Reboot into Normal Mode run a new HijackThis scan. Save the log file and post it here.

For this file (C:\reg.exe), I want you to upload it this site. Just browse for it in the c: drive and then submit it. What does it say?

[greyknight17]

Welcome to GTG.

I'm going to tell you what I usually tell others. Get rid of Messenger Plus. That program is scumware if you ask me. They have spyware bundled with it. Even with the option to opt-out of their so-called "sponsor" program, I still won't use it. I recommend the same for you.

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that 'Display the contents of system folders' is checked. If you have Windows XP, the search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that 'Search system folders', 'Search hidden files and folders', and 'Search subfolders' are checked.

For the options that you checked/enabled earlier, you may uncheck them after your log is clean. If we ask you to fix a program that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep).

Download AboutBuster http://www.greyknigh...AboutBuster.zip and unzip it to a folder on your the Desktop. Run AboutBuster and click OK. Click Update and then Check For Update to see if there are any updates. Close the program now.

Download KillBox http://www.greyknigh...spy/KillBox.exe. Don't run it yet.

The Temp folders should be cleaned out periodically as installation programs and hijack programs leave a lot of junk there. Download CleanUp! http://cleanup.stevengould.org/ (Alternate Link if main link don't work - http://www.greyknigh...spy/Cleanup.exe ) and install it. Don't run it yet.

Reboot into Safe Mode by hitting the F8 key until menu shows up. In some systems, this may be the F5 key, so try that if F8 doesn't work.
Go to Start->Run and type in services.msc and hit OK. Then look for Network Security Service ( 11Fßä#·ºÄÖ`I) and double click on it. Click on the Stop button and under Startup type, choose Disabled.

Make sure to close any open browsers. Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist:

P2P Networking
Messenger Plus
Windows AdStatus
WinTools
Internet Optimizer
Media Access

Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch...spx?tb_id=50245
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\mfulu.dll/sp.html#37680
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.makemesearch.com/?said=515
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\mfulu.dll/sp.html#37680
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch...spx?tb_id=50245
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\mfulu.dll/sp.html#37680
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\mfulu.dll/sp.html#37680
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.makemesearch.com/?said=515
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\mfulu.dll/sp.html#37680
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch...spx?tb_id=50245
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=explorer.exe C:\WINNT\System32\msbl.exe
O2 - BHO: (no name) - {1C8D5677-21BC-95DF-8CAC-E5E32B10FD03} - C:\WINNT\javaru32.dll
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll
O2 - BHO: Tubby - {9EAC0102-5E61-2312-BC2D-4D54434D5443} - C:\WINNT\System32\MTC.dll
O4 - HKLM\..\Run: [PMXInit] C:\WINNT\System32\pmxinit.exe
O4 - HKLM\..\Run: [Adstartup] C:\WINNT\System32\automove.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [P2P Networking] C:\WINNT\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [apibu.exe] C:\WINNT\system32\apibu.exe
O4 - HKLM\..\Run: [crwq.exe] C:\WINNT\system32\crwq.exe
O4 - HKLM\..\Run: [tlnh] C:\WINNT\System32\sbjjab\tlnh.exe
O4 - HKLM\..\Run: [Windows AdStatus] C:\Program Files\Windows AdStatus\WinStat.exe
O4 - HKLM\..\Run: [mspx.exe] C:\WINNT\system32\mspx.exe
O4 - HKLM\..\Run: [taxbnon] C:\WINNT\System32\ujwljvl\taxbnon.exe
O4 - HKLM\..\Run: [cogkn] C:\WINNT\System32\vnhhduep\cogkn.exe
O4 - HKLM\..\Run: [appog32.exe] C:\WINNT\system32\appog32.exe
O4 - HKLM\..\Run: [mfcqd32.exe] C:\WINNT\system32\mfcqd32.exe
O4 - HKLM\..\Run: [javalx32.exe] C:\WINNT\system32\javalx32.exe
O4 - HKLM\..\Run: [iewh32.exe] C:\WINNT\system32\iewh32.exe
O4 - HKLM\..\Run: [mfcre.exe] C:\WINNT\system32\mfcre.exe
O4 - HKLM\..\Run: [ipvz32.exe] C:\WINNT\system32\ipvz32.exe
O4 - HKLM\..\Run: [d3gy32.exe] C:\WINNT\system32\d3gy32.exe
O4 - HKLM\..\Run: [ipii.exe] C:\WINNT\system32\ipii.exe
O4 - HKLM\..\Run: [crej32.exe] C:\WINNT\system32\crej32.exe
O4 - HKLM\..\Run: [sysdx32.exe] C:\WINNT\system32\sysdx32.exe
O4 - HKLM\..\Run: [addbm32.exe] C:\WINNT\system32\addbm32.exe
O4 - HKLM\..\Run: [Windows] run.exe
O4 - HKLM\..\Run: [salm] c:\temp\salm.exe
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [SAHBundle] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\SAHAGE~1.EXE run
O4 - HKLM\..\Run: [Anti-Virus Update Scheduler V1.39.12R] C:\msvc.exe
O4 - HKLM\..\Run: [cubt] C:\WINNT\System32\aloc\cubt.exe
O4 - HKLM\..\Run: [jjpphr] C:\WINNT\System32\xswal\jjpphr.exe
O4 - HKLM\..\Run: [rfcehrlg] C:\WINNT\System32\pxckt\rfcehrlg.exe
O4 - HKLM\..\Run: [eTunnel] C:\winfw.exe
O4 - HKLM\..\RunServices: [Windows] run.exe
O4 - HKLM\..\RunOnce: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe /boot
O4 - HKLM\..\RunOnce: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe /boot
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Flag Active] C:\DOCUME~1\ADMINI~1\APPLIC~1\64HOPE\eqdvdtest.exe
O15 - Trusted IP range: 206.161.125.149
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O17 - HKLM\System\CS1\Services\VxD\MSTCP: NameServer = 69.50.176.156,195.225.176.31
O17 - HKLM\System\CS2\Services\VxD\MSTCP: NameServer = 69.50.176.156,195.225.176.31
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 69.50.176.156,195.225.176.31

Check and fix ALL those O18 entries that relate to Logitech. It's ok, so check them. Best way to do this is to hit your spacebar and down arrow. Keep repeating this until all the Logitech entries are checked.

O18 - Protocol: tpro - {FF76A5DA-6158-4439-99FF-EDC1B3FE100C} - C:\PROGRA~1\Toolbar\toolbar.dll
O23 - Service: Network Security Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINNT\appat.exe (file missing)
O23 - Service: WebSeach Toolbar support NT service (TBPSSvc) - Unknown owner - C:\PROGRA~1\Toolbar\TBPSSvc.exe
O23 - Service: WinTools for IE service (WinToolsSvc) - Unknown owner - C:\Program Files\Common Files\WinTools\WToolsS.exe

Run AboutBuster and click OK. Click Start->OK and then follow the rest of the prompts to scan (choose Yes/OK for all). It will ask you if you want a second scan, choose Yes. Save the log file and post it here.

Run KillBox and check the box that says 'End Explorer Shell While Killing File'. Next click on 'Delete on Reboot'. For each of the following files below, check the box that says 'Unregister .dll Before Deleting' if it's not grayed out. Copy the below in bold and then go back to the KillBox program. Go to File->Copy from Clipboard and then click on the red circle with a white X button. Confirm to delete, but do NOT restart yet:

C:\Program Files\Internet Optimizer\
C:\DOCUME~1\ADMINI~1\APPLIC~1\64HOPE\
C:\msvc.exe
C:\PROGRA~1\COMMON~1\WinTools\
C:\PROGRA~1\Toolbar\
C:\Program Files\Media Access\
C:\Program Files\Messenger Plus! 3\
C:\Program Files\Windows AdStatus\
C:\winfw.exe
C:\WINNT\d3ne32.exe
C:\WINNT\javaru32.dll
C:\WINNT\system32\addbm32.exe
C:\WINNT\System32\aloc\
C:\WINNT\system32\apibu.exe
C:\WINNT\system32\appog32.exe
C:\WINNT\System32\automove.exe
C:\WINNT\system32\crej32.exe
C:\WINNT\system32\crwq.exe
C:\WINNT\system32\d3gy32.exe
C:\WINNT\system32\iewh32.exe
C:\WINNT\system32\ipii.exe
C:\WINNT\system32\ipvz32.exe
C:\WINNT\system32\javalx32.exe
C:\WINNT\system32\mfcqd32.exe
C:\WINNT\system32\mfcre.exe
C:\WINNT\System32\msbl.exe
C:\WINNT\system32\mspx.exe
C:\WINNT\System32\MTC.dll
C:\WINNT\System32\P2P Networking\
C:\WINNT\System32\pmxinit.exe
C:\WINNT\System32\pxckt\
C:\WINNT\System32\run.exe
C:\WINNT\System32\sbjjab\
C:\WINNT\system32\sysdx32.exe
C:\WINNT\System32\ujwljvl\
C:\WINNT\System32\vnhhduep\
C:\WINNT\System32\xswal\

Run CleanUp! and click on CleanUp! button. When it asks you if you want to logoff, click on Yes.

Reboot into Normal Mode run a new HijackThis scan. Save the log file and post it here.

For this file (C:\reg.exe), I want you to upload it this site. Just browse for it in the c: drive and then submit it. What does it say?

[greyknight17]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member with address of this thread. This applies only to the original topic starter. Everyone else please begin a New Topic.