[deedeeo]

hi! first time user here. we have two viruses; w32/sillydl and btv. we use sympatico high speed, and the anti-virus is, natch, useless. could someone kindly give us a helping hand? thanks deedeeo

[Advertisements]

Hi deedeeo, welcome to Geeks to Go!

Please run a free online virus scan here:
http://housecall.antivirus.com/

And a free trojan scan here:
http://www.moosoft.com/

When finished, reboot. Let us take a closer look at what is running on your PC. We'll need you to use a free diagnostic tool (HiJackThis) and post a log back here with the results.

Click the HijackThis Guide in my signature, download it and follow the instructions in the guide.

Most of what it lists will be harmless or even essential, DO NOT delete or modify anything yet! Someone will be along to tell you what steps to take after you post the contents of the scan results.

[admin]

Hi deedeeo, welcome to Geeks to Go!

Please run a free online virus scan here:
http://housecall.antivirus.com/

And a free trojan scan here:
http://www.moosoft.com/

When finished, reboot. Let us take a closer look at what is running on your PC. We'll need you to use a free diagnostic tool (HiJackThis) and post a log back here with the results.

Click the HijackThis Guide in my signature, download it and follow the instructions in the guide.

Most of what it lists will be harmless or even essential, DO NOT delete or modify anything yet! Someone will be along to tell you what steps to take after you post the contents of the scan results.

[deedeeo]

Hi - thanks for the advice. we did as you said and here is our post:
Logfile of HijackThis v1.98.2
Scan saved at 10:49:34 PM, on 8/31/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE
C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPClient.exe
C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPMon32.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\WINDOWS\System32\wjview.exe
C:\Program Files\BTV\btv.exe
C:\Program Files\The Cleaner\tca.exe
C:\Program Files\The Cleaner\tcm.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\WebSavingsfromEbates\WebSavingsfromEbates.exe
C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPClient.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\JFDT5TD2\HijackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://81.211.105.9/search.php?v=1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://81.211.105.9/index.php?v=1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ca.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Sympatico
O1 - Hosts: 81.211.105.5 www.0190-dialer.com
O1 - Hosts: 81.211.105.5 www.22469.com
O1 - Hosts: 81.211.105.5 www.3wisp.com
O1 - Hosts: 81.211.105.5 www.adult-cinema.org
O1 - Hosts: 81.211.105.5 www.adultfreehosting.com
O1 - Hosts: 81.211.105.5 www.adulthosting.com
O1 - Hosts: 81.211.105.5 www.adultlinks1.com
O1 - Hosts: 81.211.105.5 www.adultmegamovies.com
O1 - Hosts: 81.211.105.5 www.adultsexmovie.net
O1 - Hosts: 81.211.105.5 www.adultwall.com
O1 - Hosts: 81.211.105.5 www.afro-sex.com
O1 - Hosts: 81.211.105.5 www.agreathost.net
O1 - Hosts: 81.211.105.5 www.alehina.com
O1 - Hosts: 81.211.105.5 www.allnichestgp.com
O1 - Hosts: 81.211.105.5 www.allowednet.com
O1 - Hosts: 81.211.105.5 www.amateurlips.com
O1 - Hosts: 81.211.105.5 www.amateurnudephoto.com
O1 - Hosts: 81.211.105.5 www.amateursgonebad.com
O1 - Hosts: 81.211.105.5 www.ambersamateurhardcore.com
O1 - Hosts: 81.211.105.5 www.anyamateur.com
O1 - Hosts: 81.211.105.5 www.apornhost.com
O1 - Hosts: 81.211.105.5 www.findmodels.com
O1 - Hosts: 81.211.105.5 www.asianscum.com
O1 - Hosts: 81.211.105.5 www.awethumbs.com
O1 - Hosts: 81.211.105.5 www.badassxxx.com
O1 - Hosts: 81.211.105.5 www.badbimbo.com
O1 - Hosts: 81.211.105.5 www.beautifulbondage.com
O1 - Hosts: 81.211.105.5 www.bestpornhost.com
O1 - Hosts: 81.211.105.5 www.biggestdickinporn.net
O1 - Hosts: 81.211.105.5 www1.3wisp.com
O1 - Hosts: 81.211.105.5 www1.kinghost.com
O1 - Hosts: 81.211.105.5 www1.ndhosting.com
O1 - Hosts: 81.211.105.5 www1.sexls.com
O1 - Hosts: 81.211.105.5 www1.smutserver.com
O1 - Hosts: 81.211.105.5 www1.toptgphost.com
O1 - Hosts: 81.211.105.5 www1.xfreehosting.com
O1 - Hosts: 81.211.105.5 www10.kinghost.com
O1 - Hosts: 81.211.105.5 www10.smutserver.com
O1 - Hosts: 81.211.105.5 www11.kinghost.com
O1 - Hosts: 81.211.105.5 www11.smutserver.com
O1 - Hosts: 81.211.105.5 www12.kinghost.com
O1 - Hosts: 81.211.105.5 www12.smutserver.com
O1 - Hosts: 81.211.105.5 www13.smutserver.com
O1 - Hosts: 81.211.105.5 www14.smutserver.com
O1 - Hosts: 81.211.105.5 www15.smutserver.com
O1 - Hosts: 81.211.105.5 www16.smutserver.com
O1 - Hosts: 81.211.105.5 www17.smutserver.com
O1 - Hosts: 81.211.105.5 www18.smutserver.com
O1 - Hosts: 81.211.105.5 www19.smutserver.com
O1 - Hosts: 81.211.105.5 www2.3wisp.com
O1 - Hosts: 81.211.105.5 www2.kinghost.com
O1 - Hosts: 81.211.105.5 www2.ndhosting.com
O1 - Hosts: 81.211.105.5 www2.smutserver.com
O1 - Hosts: 81.211.105.5 www2.toptgphost.com
O1 - Hosts: 81.211.105.5 www2.xfreehosting.com
O1 - Hosts: 81.211.105.5 www2.zpornstars.com
O1 - Hosts: 81.211.105.5 www20.smutserver.com
O1 - Hosts: 81.211.105.5 www21.smutserver.com
O1 - Hosts: 81.211.105.5 www22.smutserver.com
O1 - Hosts: 81.211.105.5 www23.smutserver.com
O1 - Hosts: 81.211.105.5 www24.smutserver.com
O1 - Hosts: 81.211.105.5 www25.smutserver.com
O1 - Hosts: 81.211.105.5 www26.smutserver.com
O1 - Hosts: 81.211.105.5 www27.smutserver.com
O1 - Hosts: 81.211.105.5 www28.smutserver.com
O1 - Hosts: 81.211.105.5 www29.smutserver.com
O1 - Hosts: 81.211.105.5 www3.kinghost.com
O1 - Hosts: 81.211.105.5 www3.ndhosting.com
O1 - Hosts: 81.211.105.5 www3.smutserver.com
O1 - Hosts: 81.211.105.5 www3.xfreehosting.com
O1 - Hosts: 81.211.105.5 www3.zpornstars.com
O1 - Hosts: 81.211.105.5 www30.smutserver.com
O1 - Hosts: 81.211.105.5 www31.smutserver.com
O1 - Hosts: 81.211.105.5 www32.smutserver.com
O1 - Hosts: 81.211.105.5 www4.kinghost.com
O1 - Hosts: 81.211.105.5 www4.smutserver.com
O1 - Hosts: 81.211.105.5 www4.xfreehosting.com
O1 - Hosts: 81.211.105.5 www4.zpornstars.com
O1 - Hosts: 81.211.105.5 www5.kinghost.com
O1 - Hosts: 81.211.105.5 www5.smutserver.com
O1 - Hosts: 81.211.105.5 www6.kinghost.com
O1 - Hosts: 81.211.105.5 www6.smutserver.com
O1 - Hosts: 81.211.105.5 www7.kinghost.com
O1 - Hosts: 81.211.105.5 www7.smutserver.com
O1 - Hosts: 81.211.105.5 www8.kinghost.com
O1 - Hosts: 81.211.105.5 www8.smutserver.com
O1 - Hosts: 81.211.105.5 www9.kinghost.com
O1 - Hosts: 81.211.105.5 www9.smutserver.com
O1 - Hosts: 81.211.105.5 www.bigmovies.com
O1 - Hosts: 81.211.105.5 www.bigpornvideos.com
O1 - Hosts: 81.211.105.5 www.big-xxx-movies.com
O1 - Hosts: 81.211.105.5 www.samplehosting.com
O1 - Hosts: 81.211.105.5 www.blinghosting.com
O1 - Hosts: 81.211.105.5 www.blitz-hosting.com
O1 - Hosts: 81.211.105.5 www.boyanxxx.com
O1 - Hosts: 81.211.105.5 www.bustyx.com
O1 - Hosts: 81.211.105.5 www.cleanadulthost.com
O1 - Hosts: 81.211.105.5 www.cleanpornhost.com
O1 - Hosts: 81.211.105.5 www.cyberxxxhost.com
O1 - Hosts: 81.211.105.5 www.dialcom.com
O1 - Hosts: 81.211.105.5 www.eldererotica.tv
O2 - BHO: MyWay Search Assistant BHO - {04079851-5845-4dea-848C-3ECD647AA554} - C:\Program Files\MyWay\SrchAstt\1.bin\MYSRCHAS.DLL (file missing)
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Freedom Popup Killer - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Zero Knowledge\Freedom\pkR.dll
O2 - BHO: Freedom BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\Zero Knowledge\Freedom\FreeBHOR.dll
O2 - BHO: BRedObj Class - {63CF97E8-4133-438a-A831-CC9C6D47D673} - c:\Program Files\Reg2\Reg2.dll (file missing)
O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386BB8F05} - (no file)
O2 - BHO: Flash Enhancer - {7CD20E91-1F31-41da-8379-479EA31DF969} - c:\Program Files\XML\XML.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O4 - HKLM\..\Run: [EPSON Stylus C82 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE /P23 "EPSON Stylus C82 Series" /O5 "LPT1:" /M "Stylus C82"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPMon32.exe"
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [WebSavingsfromEbates] wjview /cp:p "C:\Program Files\WebSavingsfromEbates\System\Code" Main lp: "C:\Program Files\WebSavingsfromEbates"
O4 - HKLM\..\Run: [BTV] "C:\Program Files\BTV\btv.exe"
O4 - HKLM\..\Run: [Breg] "C:\Program Files\Common Files\Java\breg.exe"
O4 - HKLM\..\Run: [Xcpy1] "C:\Program Files\Common Files\Java\Xcpy1.exe"
O4 - HKLM\..\Run: [tcactive] C:\Program Files\The Cleaner\tca.exe
O4 - HKLM\..\Run: [tcmonitor] C:\Program Files\The Cleaner\tcm.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Freedom] C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NetAssistant.lnk = C:\Program Files\NetAssistant\bin\matcli.exe
O8 - Extra context menu item: Web Savings - file://C:\Program Files\WebSavingsfromEbates\System\Temp\ebateswebsavings_script0.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...ry/msgrchkr.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {2048B51E-8D74-4762-82CE-B48CF545EEEA} - http://fred.gibralta...aler/eu_cax.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...MineSweeper.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...StatsClient.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...ireShowdown.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BCCBABED-1D68-4A10-9E07-E5A3B9FF0622}: NameServer = 206.47.244.133 206.47.244.52
O18 - Filter: text/html - {4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB} - C:\WINDOWS\System32\xplugin.dll

[admin]

Download Ad-aware from: http://www.lavasoft.de/res/aaw6.exe

Install the program and launch it.

First, in the main window, look in the bottom right corner and click on Check for updates now and download the latest reference files.

Next, we need to configure Ad-aware for a full scan.

-> Click on the Gear icon (second from the left) to access the preferences/settings window

1. In the General window make sure the following are selected:

• Automatically save log-file
• Automatically quarantine objects prior to removal
• Safe Mode (always request confirmation)

2. Click on the Scanning button on the left and select :

• Scan Within Archives
• Scan Active Processes
• Scan Registry
• Deep Scan Registry
• Scan my IE favorites for banned URL’s
• Scan my Hosts file
• Under Click here to select drives + folders, choose:
• All of your hard drives

-> Click on the Advanced button on the left and select:

• Include additional process information
• Include additional file information
• Include environment information
• Include additional object details

-> Click the Tweak button and select:

• Under the Scanning Engine:
  • Unload recognized processes during scanning
  • Include basic Ad-aware settings in logfile
  • Include additional Ad-aware settings in logfile
• Under the Cleaning Engine:
  • Let Windows remove files in use at next reboot

-> Click on Proceed to save the settings.

-> Click Start and on the next screen choose Activate in-depth Scan at the bottom of the page and then choose:

• Use Custom Scanning Options

-> Click Next and Ad-aware will scan your hard drive(s) with the options you have selected.

-> Save the log file when it asks and then click Finish

-> When finished, mark everything for removal and get rid of it. (Right-click the window and choose Select All from the drop down menu and click Next).

-> Reboot your computer, and post a fresh log so we can remove anything that's left.

[deedeeo]

Thanks for your help
Unfortunately, my son came to use the PC and did not keep the log.
Sillydl is gone! One concern left, however: TCMonitor is loaded, bottom right hand corner. I have "disabled: it for now-should I get rid of it? Or is it one of the "good guys"? Thanks. Deedeeo

[admin]

Can we see a fresh Hijack This log?

[deedeeo]

Hi,
Here is the log as requested. Should we disable TC Monitor again?
Thank you so much!!
Deedeeo


Logfile of HijackThis v1.98.2
Scan saved at 9:06:27 PM, on 9/9/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE
C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPClient.exe
C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPMon32.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\Program Files\The Cleaner\tca.exe
C:\Program Files\The Cleaner\tcm.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
C:\Program Files\NetAssistant\bin\mpbtn.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Adobe\Acrobat 6.0\Reader\AcroRd32.exe
C:\WINDOWS\System32\WISPTIS.EXE
C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPClient.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\hijack this\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ca.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Sympatico
O2 - BHO: MyWay Search Assistant BHO - {04079851-5845-4dea-848C-3ECD647AA554} - C:\Program Files\MyWay\SrchAstt\1.bin\MYSRCHAS.DLL (file missing)
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Freedom Popup Killer - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Zero Knowledge\Freedom\pkR.dll
O2 - BHO: Freedom BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\Zero Knowledge\Freedom\FreeBHOR.dll
O2 - BHO: Flash Enhancer - {7CD20E91-1F31-41da-8379-479EA31DF969} - c:\Program Files\XML\XML.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
O4 - HKLM\..\Run: [EPSON Stylus C82 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE /P23 "EPSON Stylus C82 Series" /O5 "LPT1:" /M "Stylus C82"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPMon32.exe"
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [BTV] "C:\Program Files\BTV\btv.exe"
O4 - HKLM\..\Run: [Breg] "C:\Program Files\Common Files\Java\breg.exe"
O4 - HKLM\..\Run: [Xcpy1] "C:\Program Files\Common Files\Java\Xcpy1.exe"
O4 - HKLM\..\Run: [tcactive] C:\Program Files\The Cleaner\tca.exe
O4 - HKLM\..\Run: [tcmonitor] C:\Program Files\The Cleaner\tcm.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Freedom] C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NetAssistant.lnk = C:\Program Files\NetAssistant\bin\matcli.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...ry/msgrchkr.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...MineSweeper.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...StatsClient.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...ireShowdown.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BCCBABED-1D68-4A10-9E07-E5A3B9FF0622}: NameServer = 206.47.244.133 206.47.244.52

[Smokey]

Almost there, just a little more cleaning up to do . You may wish to print out a copy of these instructions to follow while you complete this procedure.

Reboot in safe mode (by tapping F8 at startup and select safe mode from the menu). Be sure you're able to view hidden files, and remove the following:

C:\Program Files\NetAssistant\
C:\WINDOWS\System32\P2P Networking\
C:\Program Files\BTV\
C:\Program Files\Common Files\Java\breg.exe
C:\Program Files\Common Files\Java\Xcpy1.exe

Next, please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items, then click fix checked.

2 - BHO: MyWay Search Assistant BHO - {04079851-5845-4dea-848C-3ECD647AA554} - C:\Program Files\MyWay\SrchAstt\1.bin\MYSRCHAS.DLL (file missing)
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [BTV] "C:\Program Files\BTV\btv.exe"
O4 - HKLM\..\Run: [Breg] "C:\Program Files\Common Files\Java\breg.exe"
O4 - HKLM\..\Run: [Xcpy1] "C:\Program Files\Common Files\Java\Xcpy1.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NetAssistant.lnk = C:\Program Files\NetAssistant\bin\matcli.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -

If you do not use MSN Messenger, fix this one too:
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

If you want the title of you Internet Explorer to just say "Microsoft Internet Explorer" (without the "by Sympatico" part), fix this one too:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Sympatico

Also, you have an unnecessary office process running that is a RAM HOG! For more information and how to disable it, see here:
http://support.micro...spx?kbid=282599

Reboot your PC.

If you would please, rescan with HijackThis and post a fresh log, and let us know how your system's working.