well, i followed your instructions, i hope i did it correctly....here are my logs
Logfile of HijackThis v1.99.1
Scan saved at 11:48:34 PM, on 07/03/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\rcuc.exe
C:\Documents and Settings\The NewCraig Kuhnert\Local Settings\Temp\Temporary Directory 1 for HijackThis.zip\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.dellnet.com/R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.yahoo.com/O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\System32\hulurr.exe reg_run
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [AccuWeatherDesktopAlerts] C:\Program Files\AccuWeatherDesktopAlerts\AccuWeatherDesktopAlerts.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Ready Fire\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Toki Toki Boom -
http://download.game...nts/y/vto_x.cabO16 - DPF: Tornado 21 -
http://download.game...s/y/t21t0_x.cabO16 - DPF: Video Poker -
http://download.game...ts/y/vpt0_x.cabO16 - DPF: Yahoo! Backgammon -
http://download.game...nts/y/at1_x.cabO16 - DPF: Yahoo! Bingo -
http://download.game...nts/y/xt0_x.cabO16 - DPF: Yahoo! Blackjack -
http://download.game...nts/y/jt0_x.cabO16 - DPF: Yahoo! Canasta -
http://download.game...nts/y/yt1_x.cabO16 - DPF: Yahoo! Cribbage -
http://download.game...nts/y/it1_x.cabO16 - DPF: Yahoo! Dice -
http://download.game...ts/y/dct4_x.cabO16 - DPF: Yahoo! Dominoes -
http://download.game...ts/y/dot8_x.cabO16 - DPF: Yahoo! Fleet -
http://download.game...s/y/fltt3_x.cabO16 - DPF: Yahoo! Freecell Solitaire -
http://yog55.games.s...og/y/fs10_x.cabO16 - DPF: Yahoo! Gin -
http://download.game...nts/y/nt1_x.cabO16 - DPF: Yahoo! Go Fish -
http://download.game...nts/y/zt3_x.cabO16 - DPF: Yahoo! Graffiti -
http://download.game...ts/y/grt5_x.cabO16 - DPF: Yahoo! Hearts -
http://download.game...nts/y/ht1_x.cabO16 - DPF: Yahoo! Klondike Solitaire -
http://yog55.games.s...og/y/ks12_x.cabO16 - DPF: Yahoo! MahJong -
http://download.game...nts/y/ot0_x.cabO16 - DPF: Yahoo! Poker -
http://download.game...nts/y/pt3_x.cabO16 - DPF: Yahoo! Pool 2 -
http://download.game...ts/y/pote_x.cabO16 - DPF: Yahoo! Pyramids -
http://download.game...ts/y/pyt1_x.cabO16 - DPF: Yahoo! Word Racer -
http://download.game...nts/y/wt1_x.cabO16 - DPF: {00C0A1F2-D492-4DBA-A8E2-76CB1B791724} (TNPLDownloader Control) -
https://dtwx2.accuwe...LDownloader.cabO16 - DPF: {33E54F7F-561C-49E6-929B-D7E76D3AFEB1} (Pool Control) -
http://mirror.worldw...4/pool/pool.cabO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) -
http://www.bitdefend...can8/oscan8.cabO16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
http://us.games2.yim...ctl_0_0_0_2.ocxO16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} (Installer Class) -
http://www.ysbweb.co...ysb_regular.cabO16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) -
http://www.ravantivi...n/ravonline.cabO16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) -
http://download.game...aploader_v6.cabO16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} -
http://us.dl1.yimg.c...ebio5_1_6_0.cabO16 - DPF: {FAE74270-E5EE-49C3-B816-EA8B4D55F38F} (H2hPool Control) -
http://mirror.worldw...ool/h2hpool.cabO16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} (WMService Class) -
http://download.over...com/WildApp.cabO23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
and here is my About:Buster........
AboutBuster 5.0 reference file 30
Scan started on [07/03/2005] at [11:15:38 PM]
------------------------------------------------
Removed Stream! C:\WINDOWS\A message to outer space.SCR:qcdztb
Removed Stream! C:\WINDOWS\Active Setup Log.BAK:fyrtvc
Removed Stream! C:\WINDOWS\Blue Lace 16.bmp:bouktl
Removed Stream! C:\WINDOWS\BOOTSTAT.DAT:vskovf
Removed Stream! C:\WINDOWS\cdplayer.ini:yhqcct
Removed Stream! C:\WINDOWS\CLOCK.AVI:fifbsg
Removed Stream! C:\WINDOWS\CLOCK.AVI:rkdobm
Removed Stream! C:\WINDOWS\CLOCK.AVI:tofpnw
Removed Stream! C:\WINDOWS\clozr.txt:osctxh
Removed Stream! C:\WINDOWS\clozr.txt:qhahev
Removed Stream! C:\WINDOWS\Coffee Bean.bmp:jlouwo
Removed Stream! C:\WINDOWS\Coffee Bean.bmp:xjygui
Removed Stream! C:\WINDOWS\COMSETUP.LOG:mxvxwi
Removed Stream! C:\WINDOWS\CONTROL.INI:mpxdpg
Removed Stream! C:\WINDOWS\cwxeu.dll:tjlaaq
Removed Stream! C:\WINDOWS\czcbj.log:cgqgro
Removed Stream! C:\WINDOWS\czcbj.log:ikbzid
Removed Stream! C:\WINDOWS\d3dl32.dll:pdzpjm
Removed Stream! C:\WINDOWS\DESKTOP.INI:hesvlp
Removed Stream! C:\WINDOWS\DtcInstall.log:ximehl
Removed Stream! C:\WINDOWS\dwogr.txt:kvakmr
Removed Stream! C:\WINDOWS\eqvpl.txt:sfvnhj
Removed Stream! C:\WINDOWS\eReg.dat:cwlygt
Removed Stream! C:\WINDOWS\EXPLORER.EXE:ptrucv
Removed Stream! C:\WINDOWS\EXPLORER.SCF:qbejkw
Removed Stream! C:\WINDOWS\FeatherTexture.bmp:hujixg
Removed Stream! C:\WINDOWS\gjvlc.txt:sucnrq
Removed Stream! C:\WINDOWS\Greenstone.bmp:amcjjc
Removed Stream! C:\WINDOWS\GREUninstall.exe:pqjose
Removed Stream! C:\WINDOWS\hzvlj.dll:eycffu
Removed Stream! C:\WINDOWS\hzvlj.dll:fnnbpx
Removed Stream! C:\WINDOWS\hzvlj.dll:nnrsnc
Removed Stream! C:\WINDOWS\ieuw.dll:lonbfp
Removed Stream! C:\WINDOWS\ieuw.dll:xzvsiw
Removed Stream! C:\WINDOWS\INSP-8X6.BMP:dpyhzz
Removed Stream! C:\WINDOWS\INSP-8X6.BMP:pagxch
Removed Stream! C:\WINDOWS\INSP-8X6.BMP:qoggji
Removed Stream! C:\WINDOWS\iPlayer.INI:gojxhm
Removed Stream! C:\WINDOWS\IsUninst.exe:yocdjx
Removed Stream! C:\WINDOWS\kmyvh.txt:rpmidz
Removed Stream! C:\WINDOWS\ldqud.dll:yfvjmm
Removed Stream! C:\WINDOWS\LUINSTALL.LOG:rgnpow
Removed Stream! C:\WINDOWS\lzsgm.log:ikyspv
Removed Stream! C:\WINDOWS\metawrds.lst:efmxkc
Removed Stream! C:\WINDOWS\ModemLog_Actiontec MD56ORD V92 MDC Modem.txt:adrfjg
Removed Stream! C:\WINDOWS\MSDFMAP.INI:pnvfxg
Removed Stream! C:\WINDOWS\msoffice.ini:mczwr
Removed Stream! C:\WINDOWS\mvgqr.log:aamuvz
Removed Stream! C:\WINDOWS\nem220.dll:aozptt
Removed Stream! C:\WINDOWS\NOTEPAD.EXE:lbpfrl
Removed Stream! C:\WINDOWS\noxqk.dll:bufxhl
Removed Stream! C:\WINDOWS\noxqk.dll:xtnaez
Removed Stream! C:\WINDOWS\nqghu.log:ncblwi
Removed Stream! C:\WINDOWS\nsreg.dat:dcislw
Removed Stream! C:\WINDOWS\ntdtcsetup.log:lpkipo
Removed Stream! C:\WINDOWS\OCGEN.LOG:aviyuw
Removed Stream! C:\WINDOWS\OCGEN.LOG:loamrw
Removed Stream! C:\WINDOWS\OEWABLog.txt:dolrlg
Removed Stream! C:\WINDOWS\orun32.isu:lpswnf
Removed Stream! C:\WINDOWS\orun32.isu:noohdi
Removed Stream! C:\WINDOWS\orun32.isu:wpdenq
Removed Stream! C:\WINDOWS\pcngx.log:cgaipc
Removed Stream! C:\WINDOWS\pcngx.log:uegvyk
Removed Stream! C:\WINDOWS\pdsfo.dll:widojs
Removed Stream! C:\WINDOWS\polfi.txt:avqdlh
Removed Stream! C:\WINDOWS\polfi.txt:yizszc
Removed Stream! C:\WINDOWS\Prairie Wind.bmp:ltsqil
Removed Stream! C:\WINDOWS\ptpwf.log:grjkkq
Removed Stream! C:\WINDOWS\Q308677.log:nilamo
Removed Stream! C:\WINDOWS\Q308677.log:qirxun
Removed Stream! C:\WINDOWS\Q310601.log:vjmbng
Removed Stream! C:\WINDOWS\Q310601.log:zxwcns
Removed Stream! C:\WINDOWS\Q311889.log:bjckwp
Removed Stream! C:\WINDOWS\Q311889.log:nqibnp
Removed Stream! C:\WINDOWS\Q313596.log:rtmcgc
Removed Stream! C:\WINDOWS\Q314862.log:ohcfzk
Removed Stream! C:\WINDOWS\Q314862.log:sphppd
Removed Stream! C:\WINDOWS\Q315000.log:fisohz
Removed Stream! C:\WINDOWS\Q315000.log:obfgpq
Removed Stream! C:\WINDOWS\Q315403.log:nokwtp
Removed Stream! C:\WINDOWS\Q316253.log:ghvtuu
Removed Stream! C:\WINDOWS\Q317277.log:dqunkq
Removed Stream! C:\WINDOWS\Q317277.log:qjlujj
Removed Stream! C:\WINDOWS\qpcoh.txt:gpdbns
Removed Stream! C:\WINDOWS\qpcoh.txt:hejdpi
Removed Stream! C:\WINDOWS\qpcoh.txt:vpzazo
Removed Stream! C:\WINDOWS\rebsg.txt:rjgdqh
Removed Stream! C:\WINDOWS\REGEDIT.EXE:gqjfty
Removed Stream! C:\WINDOWS\REGLOCS.OLD:gmdcjq
Removed Stream! C:\WINDOWS\REGOPT.LOG:qqgmkn
Removed Stream! C:\WINDOWS\Rhododendron.bmp:yqctvb
Removed Stream! C:\WINDOWS\River Sumida.bmp:bloegw
Removed Stream! C:\WINDOWS\rnqjx.log:adhqmu
Removed Stream! C:\WINDOWS\rxzin.log:serdgw
Removed Stream! C:\WINDOWS\SAHUninstall.exe:vshaor
Removed Stream! C:\WINDOWS\Santa Fe Stucco.bmp:humeqy
Removed Stream! C:\WINDOWS\Santa Fe Stucco.bmp:rohnfc
Removed Stream! C:\WINDOWS\saxdp.log:lxkjjh
Removed Stream! C:\WINDOWS\SchedLgU.Txt:ntrniu
Removed Stream! C:\WINDOWS\SchedLgU.Txt:rgkbia
Removed Stream! C:\WINDOWS\sdkpu.dll:bgupkk
Removed Stream! C:\WINDOWS\setdebug.exe:gtkske
Removed Stream! C:\WINDOWS\setdebug.exe:jozshn
Removed Stream! C:\WINDOWS\SETPWRCG.EXE:dvzrlr
Removed Stream! C:\WINDOWS\SETPWRCG.EXE:xlmqrd
Removed Stream! C:\WINDOWS\setup.log:tozlgt
Removed Stream! C:\WINDOWS\SETUPACT.LOG:vorwnb
Removed Stream! C:\WINDOWS\SETUPAPI.LOG:lpkqbd
Removed Stream! C:\WINDOWS\SETUPAPI.LOG:pmewtf
Removed Stream! C:\WINDOWS\SETUPERR.LOG:skefsw
Removed Stream! C:\WINDOWS\SETUPLOG.TXT:opkjhe
Removed Stream! C:\WINDOWS\SETUPLOG.TXT:swoxre
Removed Stream! C:\WINDOWS\smscfg.ini:ctubfg
Removed Stream! C:\WINDOWS\smscfg.ini:inpjnq
Removed Stream! C:\WINDOWS\smscfg.ini:mobquu
Removed Stream! C:\WINDOWS\Soap Bubbles.bmp:eicvdg
Removed Stream! C:\WINDOWS\Soap Bubbles.bmp:klwkuh
Removed Stream! C:\WINDOWS\sqlkx.log:dxhklo
Removed Stream! C:\WINDOWS\sqlkx.log:qcbxxu
Removed Stream! C:\WINDOWS\Sti_Trace.log:anhoqa
Removed Stream! C:\WINDOWS\Sti_Trace.log:vpapnz
Removed Stream! C:\WINDOWS\SynInst.log:oqkuhb
Removed Stream! C:\WINDOWS\SYSTEM.INI:aaapde
Removed Stream! C:\WINDOWS\TWUNK_16.EXE:evibca
Removed Stream! C:\WINDOWS\uneng.exe:xwagek
Removed Stream! C:\WINDOWS\uninst.exe:knajoo
Removed Stream! C:\WINDOWS\urllist.dat:dokpjy
Removed Stream! C:\WINDOWS\urllist.dat:pwtmyu
Removed Stream! C:\WINDOWS\VB.INI:lmzwaq
Removed Stream! C:\WINDOWS\vcgyl.txt:zvtnav
Removed Stream! C:\WINDOWS\vgibd.dll:ixezsx
Removed Stream! C:\WINDOWS\vgibd.dll:vpdclj
Removed Stream! C:\WINDOWS\VMINST.LOG:emzqob
Removed Stream! C:\WINDOWS\wduit.dll:pnrvqm
Removed Stream! C:\WINDOWS\wfwog.txt:wgkkxt
Removed Stream! C:\WINDOWS\WIASERVC.LOG:hocakw
Removed Stream! C:\WINDOWS\WIASERVC.LOG:peztwt
Removed Stream! C:\WINDOWS\Windows Update.log:exagrc
Removed Stream! C:\WINDOWS\Windows Update.log:wpxozi
Removed Stream! C:\WINDOWS\WINHELP.EXE:cqouxj
Removed Stream! C:\WINDOWS\WINHLP32.EXE:oqqtts
Removed Stream! C:\WINDOWS\WINNT.BMP:grigvu
Removed Stream! C:\WINDOWS\WMSysPrx.prx:shwajp
Removed Stream! C:\WINDOWS\wsem302.dll:cjoodn
Removed Stream! C:\WINDOWS\xatgz.txt:rekjid
Removed Stream! C:\WINDOWS\yecwk.dat:vjsyzm
Removed Stream! C:\WINDOWS\yrjxw.dll:eocgpw
Removed Stream! C:\WINDOWS\ysjzq.txt:ocldbx
Removed Stream! C:\WINDOWS\Zapotec.bmp:lpiiyq
Removed Stream! C:\WINDOWS\Zapotec.bmp:yckurr
Removed Stream! C:\WINDOWS\ztdtv.txt:bijoca
Removed Stream! C:\WINDOWS\ztdtv.txt:xictfm
------------------------------------------------
Removed File! : C:\Windows\aczvj.dat
Removed File! : C:\Windows\ascxo.dat
Removed File! : C:\Windows\azbzt.dat
Removed File! : C:\Windows\ccotv.dat
Removed File! : C:\Windows\chdws.dat
Removed File! : C:\Windows\cmnla.dat
Removed File! : C:\Windows\erelj.dat
Removed File! : C:\Windows\fekrl.dat
Removed File! : C:\Windows\fjiig.dat
Removed File! : C:\Windows\ipvif.dat
Removed File! : C:\Windows\krmkj.dat
Removed File! : C:\Windows\mfsjz.dat
Removed File! : C:\Windows\mqzsw.dat
Removed File! : C:\Windows\mzjnq.dat
Removed File! : C:\Windows\nekxp.dat
Removed File! : C:\Windows\ntsqh.dat
Removed File! : C:\Windows\rdlqc.dat
Removed File! : C:\Windows\shqdo.dat
Removed File! : C:\Windows\sjwtz.dat
Removed File! : C:\Windows\uhnue.dat
Removed File! : C:\Windows\uptxk.dat
Removed File! : C:\Windows\wlulh.dat
Removed File! : C:\Windows\wmxkk.dat
Removed File! : C:\Windows\yfnql.dat
Removed File! : C:\Windows\System32\aaayk.dat
Removed File! : C:\Windows\System32\bojrq.dat
Removed File! : C:\Windows\System32\ccdhx.dat
Removed File! : C:\Windows\System32\clblh.dat
Removed File! : C:\Windows\System32\dnfdb.dat
Removed File! : C:\Windows\System32\drjjg.dat
Removed File! : C:\Windows\System32\dwsmt.dat
Removed File! : C:\Windows\System32\fmldj.dat
Removed File! : C:\Windows\System32\hfith.dat
Removed File! : C:\Windows\System32\hfpta.dat
Removed File! : C:\Windows\System32\hoarb.dat
Removed File! : C:\Windows\System32\jjaes.dat
Removed File! : C:\Windows\System32\lclih.dat
Removed File! : C:\Windows\System32\ngwow.dat
Removed File! : C:\Windows\System32\opiwx.dat
Removed File! : C:\Windows\System32\pnqpe.dat
Removed File! : C:\Windows\System32\ptlnw.dat
Removed File! : C:\Windows\System32\saueo.dat
Removed File! : C:\Windows\System32\tzzhw.dat
Removed File! : C:\Windows\System32\ucyzp.dat
Removed File! : C:\Windows\System32\vdact.dat
Removed File! : C:\Windows\System32\vnfqu.dat
Removed File! : C:\Windows\System32\welhp.dat
Removed File! : C:\Windows\System32\wjrqa.dat
Removed File! : C:\Windows\System32\yjqgw.dat
Removed File! : C:\Windows\System32\zpdld.dat
Removed File! : C:\Windows\System32\zptxv.dat
------------------------------------------------
Scan was COMPLETED SUCCESSFULLY at 11:16:28 PM
AboutBuster 5.0 reference file 30
Scan started on [07/03/2005] at [11:19:40 PM]
------------------------------------------------
No Ads Found!
------------------------------------------------
No Files Found!
------------------------------------------------
Scan was COMPLETED SUCCESSFULLY at 11:20:07 PM
...................................................................................
thank you very much for the help, let me know if we need to go to Round 2 on this thing,
Craig