[learner04]

Hi,
Coachwife6: Thanks for your reply. As per your advice I am posting my HJT Log below, along with the original message. Please help!

"I have joined the forum recently. I am also facing the problem of "look today bar". The look-today search bar won't go even though I run Adaware SE and SpyBot S & D. I am clue less now. Can any one help me in resolving the issue. Thank you.
My HJT Log is posted below".

Logfile of HijackThis v1.98.2
Scan saved at 9:39:14 AM, on 10/19/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft
Shared\VS7Debug\mdm.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\WINDOWS\SOINTGR.EXE
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Hewlett-Packard\PrecisionScan Pro
3.0\hpscnsvr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Netropa\Multimedia Keyboard\TrayMon.exe
C:\Program Files\Netropa\Onscreen Display\OSD.exe
C:\Program Files\TurboNote\tbnote.exe
C:\WINDOWS\webshots.scr
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\userinit.exe
C:\Documents and Settings\una\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search
Bar =
http://www.atxowfxqv...veHswLVe0t.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start
Page_bak = about:blank
N1 - Netscape 4: user_pref("browser.startup.homepage", "
http://www.dhqzgnqxr...er.startup.page
", 1); (C:\Program Files\Netscape\Users\una\prefs.js)
O2 - BHO: Yahoo! Companion BHO -
{02478D38-C3F9-4efb-9B51-7695ECA05670} -
C:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_3_12_0.dll
O2 - BHO: AcroIEHlprObj Class -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program
Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) -
{128C135C-493A-69D1-49CE-855A23BCC147} -
C:\PROGRA~1\ISOPLA~1\Slow Proc.exe (file missing)
O2 - BHO: (no name) -
{494FE6FA-D4E4-6D89-1FF7-9EBCE769598B} -
C:\DOCUME~1\una\APPLIC~1\ISOPLA~1\Slow Proc.exe
O2 - BHO: (no name) -
{53707962-6F74-2D53-2644-206D7942484F} - C:\Program
Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Pile Owns Tray -
{7399F704-5F12-24EA-56CA-4680359BCE34} -
C:\PROGRA~1\ISOPLA~1\EachSoftware.dll (file missing)
O3 - Toolbar: &Yahoo! Companion -
{EF99BD32-C1FB-11D2-892F-0090271D4F88} -
C:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: corn axis -
{75200E74-2942-977D-79F0-27DC21D90D8A} -
C:\PROGRA~1\ISOPLA~1\EachSoftware.dll (file missing)
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program
Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [SO5 Integrator Pass Two]
C:\WINDOWS\SOINTGR.EXE
O4 - HKLM\..\Run: [NeroCheck]
C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [HP LanScan Server] C:\Program
Files\Hewlett-Packard\PrecisionScan Pro 3.0\hpscnsvr.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common
Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray]
C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [admin vc wipe htm] C:\Documents and
Settings\All Users\Application Data\mp3seekadminvc\Hold lite.exe
O4 - HKLM\..\Run: [PestPatrol Control Center]
C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck]
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol]
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [SmcService]
C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program
Files\Netscape\Netscape\Netscp.exe" -turbo
O4 - HKCU\..\Run: [tinySpell] C:\Program
Files\tinySpell\tinyspell.exe
O4 - HKCU\..\Run: [ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [bashdvd]
C:\DOCUME~1\una\APPLIC~1\THUNKH~1\meta plan.exe
O4 - Startup: Webshots.lnk = C:\Program
Files\Webshots\Launcher.exe
O4 - Global Startup: Image Transfer.lnk = ?
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program
Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: TurboNote.lnk = C:\Program
Files\TurboNote\tbnote.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program
Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program
Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Download with &DAP -
C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program
Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Download &all with DAP -
C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary -
file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program
Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger -
{4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program
Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger -
{4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program
Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AIM -
{AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program
Files\Netscape\Communicator\Program\AIM\aim.exe
O9 - Extra button: Corel Network monitor worker -
{E6919353-2085-427C-A75B-C3BBA4E4DB02} - (no file)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker -
{E6919353-2085-427C-A75B-C3BBA4E4DB02} - (no file)
O9 - Extra button: Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O9 - Extra button: Corel Network monitor worker -
{E6919353-2085-427C-A75B-C3BBA4E4DB02} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker -
{E6919353-2085-427C-A75B-C3BBA4E4DB02} - (no file) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet
Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Chat -
http://us.chat1.yimg...t/c381/chat.cab
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850}
(Microsoft RDP Client Control (redist)) -
http://distbr1/TSWeb/msrdp.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999}
(YAddBook Class) -
http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {E99D3E39-5D92-4360-BA86-2C563B3CFFEB}
(Microsoft CMS HTML Editor Toolbar) -
http://www.cms1.godr...ort/nrdhtml.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain =
GILNT.COM
O17 - HKLM\Software\..\Telephony: DomainName = GILNT.COM
O17 -
HKLM\System\CCS\Services\Tcpip\..\{DDE8E6E8-3A01-4F14-95C3-344A84299F6A}:
NameServer = 10.10.1.210,10.10.1.1
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain =
GILNT.COM

[Advertisements]

Hi learner04. Welcome to GTG.

You have many oddly named files in your system. Did you rename them? If so, then leave them. But if not, let's get rid of them.

You may wish to print out a copy of these instructions to follow while you complete this procedure.

Please save Hijack This in a permanent folder (i.e. C:\HJT). This ensures backups are saved and accessible.

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items, then click fix checked.


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search
Bar =
http://www.atxowfxqv...veHswLVe0t.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start
Page_bak = about:blank
N1 - Netscape 4: user_pref("browser.startup.homepage", "
http://www.dhqzgnqxr...er.startup.page
", 1); (C:\Program Files\Netscape\Users\una\prefs.js)

O2 - BHO: (no name) -
{128C135C-493A-69D1-49CE-855A23BCC147} -
C:\PROGRA~1\ISOPLA~1\Slow Proc.exe (file missing)
O2 - BHO: (no name) -
{494FE6FA-D4E4-6D89-1FF7-9EBCE769598B} -
C:\DOCUME~1\una\APPLIC~1\ISOPLA~1\Slow Proc.exe

O2 - BHO: Pile Owns Tray -
{7399F704-5F12-24EA-56CA-4680359BCE34} -
C:\PROGRA~1\ISOPLA~1\EachSoftware.dll (file missing)

O3 - Toolbar: corn axis -
{75200E74-2942-977D-79F0-27DC21D90D8A} -
C:\PROGRA~1\ISOPLA~1\EachSoftware.dll (file missing)

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [admin vc wipe htm] C:\Documents and
Settings\All Users\Application Data\mp3seekadminvc\Hold lite.exe (What is this? If you don't know, get rid of it.)
O4 - HKCU\..\Run: [bashdvd]
C:\DOCUME~1\una\APPLIC~1\THUNKH~1\meta plan.exe (What is this? If you don't know, get rid of it.)
O4 - Startup: Webshots.lnk = C:\Program
Files\Webshots\Launcher.exe (What is this? If you don't know, get rid of it.

O8 - Extra context menu item: &Download with &DAP -
C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP -
C:\PROGRA~1\DAP\dapextie2.htm


O9 - Extra button: Corel Network monitor worker -
{E6919353-2085-427C-A75B-C3BBA4E4DB02} - (no file)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker -
{E6919353-2085-427C-A75B-C3BBA4E4DB02} - (no file)

O9 - Extra button: Corel Network monitor worker -
{E6919353-2085-427C-A75B-C3BBA4E4DB02} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker -
{E6919353-2085-427C-A75B-C3BBA4E4DB02} - (no file) (HKCU)

Do you recognize the following domain as belonging to your ISP or company?


O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain =
GILNT.COM
O17 - HKLM\Software\..\Telephony: DomainName = GILNT.COM
O17 -
HKLM\System\CCS\Services\Tcpip\..\{DDE8E6E8-3A01-4F14-95C3-344A84299F6A}:
NameServer = 10.10.1.210,10.10.1.1
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain =
GILNT.COM

Please reboot into safe mode - How do I boot into "Safe" mode?.
Be sure you're able to view hidden files, and remove the following files in bold (if found):


C:\DOCUME~1\una\APPLIC~1\ISOPLA~1\Slow Proc.exe
C:\PROGRA~1\ISOPLA~1\Slow Proc.ex
C:\PROGRA~1\ISOPLA~1\EachSoftware.dll
C:\Documents and Settings\mp3seekadminvc
C:\DOCUME~1\una\APPLIC~1\THUNKH~1
C:\PROGRA~1\DAP\dapextie.htm
C:\PROGRA~1\DAP\dapextie2.htm
C:\Program Files\Webshots

Please delete your temporary files by deleting all files and folders that are in those folders (do not delete the temp folder itself) like for example
C:\WINDOWS\Temp\
C:\Temp\
C:\Documents and Settings\username\Local Settings\Temp\
Also delete your Temporary Internet Files, be sure to also select delete all offline content.


Please delete your temporary files. Double Click My Computer (WinXP: Navigate to Start --->My Computer)
You will see an icon representing your harddrive (most likely C: Drive) Right Click on the hard drive icon and click Properties at the
bottom of the fly out window. One the very first tab (General) you will see a button labeled "Disk Cleanup"...click that button.
Make sure the following are checked:
Downloaded Program Files
Temporary Internet Files and
Recycle Bin
Click OK and Disk Cleanup will delete those files for you.

REboot and post a fresh log.

[coachwife6]

Hi learner04. Welcome to GTG.

You have many oddly named files in your system. Did you rename them? If so, then leave them. But if not, let's get rid of them.

You may wish to print out a copy of these instructions to follow while you complete this procedure.

Please save Hijack This in a permanent folder (i.e. C:\HJT). This ensures backups are saved and accessible.

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items, then click fix checked.


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search
Bar =
http://www.atxowfxqv...veHswLVe0t.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start
Page_bak = about:blank
N1 - Netscape 4: user_pref("browser.startup.homepage", "
http://www.dhqzgnqxr...er.startup.page
", 1); (C:\Program Files\Netscape\Users\una\prefs.js)

O2 - BHO: (no name) -
{128C135C-493A-69D1-49CE-855A23BCC147} -
C:\PROGRA~1\ISOPLA~1\Slow Proc.exe (file missing)
O2 - BHO: (no name) -
{494FE6FA-D4E4-6D89-1FF7-9EBCE769598B} -
C:\DOCUME~1\una\APPLIC~1\ISOPLA~1\Slow Proc.exe

O2 - BHO: Pile Owns Tray -
{7399F704-5F12-24EA-56CA-4680359BCE34} -
C:\PROGRA~1\ISOPLA~1\EachSoftware.dll (file missing)

O3 - Toolbar: corn axis -
{75200E74-2942-977D-79F0-27DC21D90D8A} -
C:\PROGRA~1\ISOPLA~1\EachSoftware.dll (file missing)

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [admin vc wipe htm] C:\Documents and
Settings\All Users\Application Data\mp3seekadminvc\Hold lite.exe (What is this? If you don't know, get rid of it.)
O4 - HKCU\..\Run: [bashdvd]
C:\DOCUME~1\una\APPLIC~1\THUNKH~1\meta plan.exe (What is this? If you don't know, get rid of it.)
O4 - Startup: Webshots.lnk = C:\Program
Files\Webshots\Launcher.exe (What is this? If you don't know, get rid of it.

O8 - Extra context menu item: &Download with &DAP -
C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP -
C:\PROGRA~1\DAP\dapextie2.htm


O9 - Extra button: Corel Network monitor worker -
{E6919353-2085-427C-A75B-C3BBA4E4DB02} - (no file)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker -
{E6919353-2085-427C-A75B-C3BBA4E4DB02} - (no file)

O9 - Extra button: Corel Network monitor worker -
{E6919353-2085-427C-A75B-C3BBA4E4DB02} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker -
{E6919353-2085-427C-A75B-C3BBA4E4DB02} - (no file) (HKCU)

Do you recognize the following domain as belonging to your ISP or company?


O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain =
GILNT.COM
O17 - HKLM\Software\..\Telephony: DomainName = GILNT.COM
O17 -
HKLM\System\CCS\Services\Tcpip\..\{DDE8E6E8-3A01-4F14-95C3-344A84299F6A}:
NameServer = 10.10.1.210,10.10.1.1
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain =
GILNT.COM

Please reboot into safe mode - How do I boot into "Safe" mode?.
Be sure you're able to view hidden files, and remove the following files in bold (if found):


C:\DOCUME~1\una\APPLIC~1\ISOPLA~1\Slow Proc.exe
C:\PROGRA~1\ISOPLA~1\Slow Proc.ex
C:\PROGRA~1\ISOPLA~1\EachSoftware.dll
C:\Documents and Settings\mp3seekadminvc
C:\DOCUME~1\una\APPLIC~1\THUNKH~1
C:\PROGRA~1\DAP\dapextie.htm
C:\PROGRA~1\DAP\dapextie2.htm
C:\Program Files\Webshots

Please delete your temporary files by deleting all files and folders that are in those folders (do not delete the temp folder itself) like for example
C:\WINDOWS\Temp\
C:\Temp\
C:\Documents and Settings\username\Local Settings\Temp\
Also delete your Temporary Internet Files, be sure to also select delete all offline content.


Please delete your temporary files. Double Click My Computer (WinXP: Navigate to Start --->My Computer)
You will see an icon representing your harddrive (most likely C: Drive) Right Click on the hard drive icon and click Properties at the
bottom of the fly out window. One the very first tab (General) you will see a button labeled "Disk Cleanup"...click that button.
Make sure the following are checked:
Downloaded Program Files
Temporary Internet Files and
Recycle Bin
Click OK and Disk Cleanup will delete those files for you.

REboot and post a fresh log.

[learner04]

Hi Coachwife6,
It worked!!! Great. The Look-today bar vanished. I thank you very much for your timely help.
Here is my new HJT Log :

Logfile of HijackThis v1.98.2
Scan saved at 9:28:44 AM, on 10/20/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\WINDOWS\SOINTGR.EXE
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Hewlett-Packard\PrecisionScan Pro 3.0\hpscnsvr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Netropa\Multimedia Keyboard\TrayMon.exe
C:\Program Files\Netropa\Onscreen Display\OSD.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\TurboNote\tbnote.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Documents and Settings\una\My Documents\software download\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.slotchbar...ll/removed.html
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_3_12_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_3_12_0.dll
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [SO5 Integrator Pass Two] C:\WINDOWS\SOINTGR.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [HP LanScan Server] C:\Program Files\Hewlett-Packard\PrecisionScan Pro 3.0\hpscnsvr.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Image Transfer.lnk = ?
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: TurboNote.lnk = C:\Program Files\TurboNote\tbnote.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\Netscape\Communicator\Program\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg...t/c381/chat.cab
O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - http://distbr1/TSWeb/msrdp.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {E99D3E39-5D92-4360-BA86-2C563B3CFFEB} (Microsoft CMS HTML Editor Toolbar) - http://www.cms1.godr...ort/nrdhtml.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = GILNT.COM
O17 - HKLM\Software\..\Telephony: DomainName = GILNT.COM
O17 - HKLM\System\CCS\Services\Tcpip\..\{DDE8E6E8-3A01-4F14-95C3-344A84299F6A}: NameServer = 10.10.1.210,10.10.1.1
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = GILNT.COM

Once again I thank you for your guidence. Please do tell me if I need to take any action on the log posted above.

[admin]

You just need to change your homepage to a default page of your choosing.

Congratulations! Your system is CLEAN

How do you prevent spyware from being installed again? We strongly recommend installing SpywareBlaster (it's free for personal use) Click Here.

Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted pests.
Block spyware/tracking cookies in Internet Explorer and Mozilla/Firefox.
Restrict the actions of potentially dangerous sites in Internet Explorer.
Consumes no system resources.

Download, run, check for updates, download updates, select all, protect against checked. All done. Check for updates every couple of weeks. If you have any errors running the program like a missing file see the link at the bottom of the javacool page.

It's also very important to keep your system up to date to avoid unnecessary security risks. Click Here to make sure that you have the latest patches for Windows.

These next two steps are optional, but will provide the greatest protection.
1. Use ANY browser besides Internet Explorer, almost every exploit is crafted to take advantage of an IE weakness. We usually recommend FireFox .
2. Install Sun's Java. It's much more secure than Microsoft's Java Virtual Machine .

It's okay to delete the Hijack This folder if everything is working okay.

After doing all these, your system will be thoroughly protected from future threats.