|  | 
 
															
															
	
			
			
				| I'm Just New Here...Can Someone Help Me With My Hijackthis Log.Thankz.. |  |  
					
					
				 
						| RheeyaJunior Member 
   | 16. April 2006 @ 04:22 |  Link to this message   |  
						| 
							
							My pc sometimes crash when i am connecting to my internet and when i inserted my bluetooth device to my usb port...it crashes...and my pc runs slow...
wwwaaahhh.....i really need your help.. :'c
 
 
 thank'z in ADVANCE...*muah*
 
 This is my hijackthis log file..
 
 Logfile of HijackThis v1.99.1
 Scan saved at 8:14:15 PM, on 4/16/2006
 Platform: Windows XP SP2 (WinNT 5.01.2600)
 MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
 
 Running processes:
 C:\WINDOWS\System32\smss.exe
 C:\WINDOWS\system32\winlogon.exe
 C:\WINDOWS\system32\services.exe
 C:\WINDOWS\system32\lsass.exe
 C:\WINDOWS\system32\svchost.exe
 C:\WINDOWS\System32\svchost.exe
 C:\WINDOWS\system32\spoolsv.exe
 c:\progra~1\mcafee\mcafee antispyware\massrv.exe
 c:\program files\mcafee.com\agent\mcdetect.exe
 c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
 C:\WINDOWS\Explorer.EXE
 C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
 c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
 C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
 C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe
 C:\WINDOWS\SOUNDMAN.EXE
 C:\WINDOWS\system32\carpserv.exe
 C:\WINDOWS\system32\rundll32.exe
 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
 C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
 C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
 C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
 c:\progra~1\mcafee.com\vso\mcvsescn.exe
 c:\program files\mcafee.com\agent\mcagent.exe
 C:\progra~1\mcafee\MCAFEE~1\masalert.exe
 C:\Program Files\Messenger\msmsgs.exe
 C:\Program Files\CursorXP\CursorXP.exe
 C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
 C:\WINDOWS\system32\ctfmon.exe
 C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFAGENT.EXE
 C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
 C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
 c:\progra~1\mcafee.com\vso\mcvsftsn.exe
 C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
 c:\PROGRA~1\mcafee.com\vso\mcshield.exe
 C:\PROGRA~1\McAfee.com\Agent\mcupdui.exe
 C:\Program Files\Windows Live Safety Center\wlscUploader.exe
 C:\Program Files\Internet Explorer\iexplore.exe
 C:\WINDOWS\system32\NOTEPAD.EXE
 C:\Program Files\Internet Explorer\iexplore.exe
 C:\HJT\HijackThis.exe
 
 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sp/*http...
 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=msgr
 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?.home=msgr
 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://www...
 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr7/*http://www...
 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=msgr
 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http...
 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
 O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_6_2_0.dll
 O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
 O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
 O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
 O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_6_2_0.dll
 O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
 O4 - HKLM\..\Run: [CARPService] carpserv.exe
 O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
 O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
 O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
 O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
 O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
 O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
 O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
 O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
 O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
 O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
 O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
 O4 - HKLM\..\Run: [_AntiSpyware] c:\progra~1\mcafee\MCAFEE~1\masalert.exe
 O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
 O4 - HKCU\..\Run: [CursorXP] "C:\Program Files\CursorXP\CursorXP.exe" -s
 O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
 O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
 O4 - HKCU\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
 O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
 O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
 O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
 O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
 O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
 O4 - Global Startup: Bluetooth Manager.lnk = ?
 O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
 O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
 O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
 O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
 O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
 O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
 O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
 O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - https://scan.safety.live.com/resource/download/scanner/en-us/wlscbase7617.cab
 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/...
 O17 - HKLM\System\CCS\Services\Tcpip\..\{9EB5E203-A058-4F8E-85EB-CB3F68CEB514}: NameServer = 210.14.16.5 210.14.16.2
 O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
 O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
 O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
 O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
 O23 - Service: McAfee AntiSpyware Service - McAfee, Inc. - c:\progra~1\mcafee\mcafee antispyware\massrv.exe
 O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
 O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
 O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
 O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
 O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
 O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe
 O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
 O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe
 This message has been edited since posting. Last time this message was edited on 16. April 2006 @ 04:28 |  
						| Advertisement   |   |  
						|  |  
						| RheeyaJunior Member 
   | 16. April 2006 @ 05:54 |  Link to this message   |  
						| 
							
							I Have run the system windows scanner..
 after that i run the hijackthis
 
 and this is the result:
 Logfile of HijackThis v1.99.1
 Scan saved at 9:48:57 PM, on 4/16/2006
 Platform: Windows XP SP2 (WinNT 5.01.2600)
 MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
 
 Running processes:
 C:\WINDOWS\System32\smss.exe
 C:\WINDOWS\system32\winlogon.exe
 C:\WINDOWS\system32\services.exe
 C:\WINDOWS\system32\lsass.exe
 C:\WINDOWS\system32\svchost.exe
 C:\WINDOWS\System32\svchost.exe
 C:\WINDOWS\system32\spoolsv.exe
 c:\progra~1\mcafee\mcafee antispyware\massrv.exe
 c:\program files\mcafee.com\agent\mcdetect.exe
 c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
 C:\WINDOWS\Explorer.EXE
 C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
 c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
 C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
 C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe
 C:\WINDOWS\SOUNDMAN.EXE
 C:\WINDOWS\system32\carpserv.exe
 C:\WINDOWS\system32\rundll32.exe
 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
 C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
 C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
 C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
 c:\progra~1\mcafee.com\vso\mcvsescn.exe
 c:\program files\mcafee.com\agent\mcagent.exe
 C:\progra~1\mcafee\MCAFEE~1\masalert.exe
 C:\Program Files\Messenger\msmsgs.exe
 C:\Program Files\CursorXP\CursorXP.exe
 C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
 C:\WINDOWS\system32\ctfmon.exe
 C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFAGENT.EXE
 C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
 C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
 c:\progra~1\mcafee.com\vso\mcvsftsn.exe
 C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
 c:\PROGRA~1\mcafee.com\vso\mcshield.exe
 C:\PROGRA~1\McAfee.com\Agent\mcupdui.exe
 C:\Program Files\Internet Explorer\iexplore.exe
 C:\Program Files\Internet Explorer\iexplore.exe
 C:\Documents and Settings\She Iyah Ingrid\Desktop\HijackThis_v1.99.1.exe
 
 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sp/*http...
 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=msgr
 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?.home=msgr
 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://www...
 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr7/*http://www...
 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=msgr
 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http...
 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
 O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_6_2_0.dll
 O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
 O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
 O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
 O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_6_2_0.dll
 O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
 O4 - HKLM\..\Run: [CARPService] carpserv.exe
 O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
 O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
 O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
 O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
 O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
 O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
 O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
 O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
 O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
 O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
 O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
 O4 - HKLM\..\Run: [_AntiSpyware] c:\progra~1\mcafee\MCAFEE~1\masalert.exe
 O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
 O4 - HKCU\..\Run: [CursorXP] "C:\Program Files\CursorXP\CursorXP.exe" -s
 O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
 O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
 O4 - HKCU\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
 O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
 O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
 O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
 O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
 O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
 O4 - Global Startup: Bluetooth Manager.lnk = ?
 O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
 O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
 O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
 O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
 O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
 O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
 O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
 O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - https://scan.safety.live.com/resource/download/scanner/en-us/wlscbase7617.cab
 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/...
 O17 - HKLM\System\CCS\Services\Tcpip\..\{9EB5E203-A058-4F8E-85EB-CB3F68CEB514}: NameServer = 210.14.16.5 210.14.16.2
 O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
 O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
 O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
 O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
 O23 - Service: McAfee AntiSpyware Service - McAfee, Inc. - c:\progra~1\mcafee\mcafee antispyware\massrv.exe
 O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
 O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
 O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
 O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
 O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
 O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe
 O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
 O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe
 
 ????????????????????????
 
 any difference with my log files?
 
 thankz...
 |  
						| Senior Member 
   | 17. April 2006 @ 10:21 |  Link to this message   |  
						| 
							
							Sorry for the long wait :)
 You have two firewalls running. That is not recommended (might cause crashing, freezes, slowdonws etc.) so you should disable either McAfee firewall or the ZoneAlarm.
 
 And there is something that need fixing....
 
 Cleaning instructions:
 
 Move HijackThis into its own folder C:\HJT
 
 Run HijackThis and fix these entries (if found): (Do a system scan only, check entries, close all other windows, press Fix checked)
 
 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sp/*http...
 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=msgr
 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?.home=msgr
 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://www...
 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr7/*http://www...
 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=msgr
 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http...
 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
 
 
 Then if you want to free your memory (make your computer faster), you can fix all these entries with HijackThis: (unnecessary startups)
 
 O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
 O4 - HKLM\..\Run: [CARPService] carpserv.exe
 O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
 O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
 O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
 O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
 O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
 O4 - HKCU\..\Run: [CursorXP] "C:\Program Files\CursorXP\CursorXP.exe" -s
 O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
 O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
 O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
 O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
 O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
 O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
 
 
 You live in the Philippines?
 
 Post a fresh HijackThis log.
 
 
 
 I have moved from AD, I won''t be taking new HijackThis logs from here. Reason: The AD''s Unsupportive athmosphere. This message has been edited since posting. Last time this message was edited on 17. April 2006 @ 10:22 |  
						| RheeyaJunior Member 
   | 17. April 2006 @ 23:26 |  Link to this message   |  
						| 
							
							It's Okie.. ^_^
 Thank You for the Reply..
 
 You have two firewalls running. That is not recommended (might cause crashing, freezes, slowdonws etc.) so you should disable either McAfee firewall or the ZoneAlarm.
 ---> uhmm... which of the 2 firewall should a disable
 Mcaffe or Zone alarm? which of the 2 firewalls would you recommend for my computer?
 
 Move HijackThis into its own folder C:\HJT
 ---> how can i move the HJT to its own folder?
 can you give the intructions on how to move it in its own folder?
 
 Then if you want to free your memory (make your computer faster), you can fix all these entries with HijackThis: (unnecessary startups)
 
 O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
 O4 - HKLM\..\Run: [CARPService] carpserv.exe
 O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
 O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
 O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
 O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
 O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
 O4 - HKCU\..\Run: [CursorXP] "C:\Program Files\CursorXP\CursorXP.exe" -s
 O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
 O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
 O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
 O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
 O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
 O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
 
 ---> how can i fix this entries using hijackthis???can you post the instructions on how to fix this entries..
 
 
 thankz.. n_n
 
 You live in the Philippines?
 --->yup i live in the phillipines... =)
 why do you ask...
 sorry if my grammar is bad...coz i'm not that good in speaking english :c
 This message has been edited since posting. Last time this message was edited on 18. April 2006 @ 04:16 |  
						| RheeyaJunior Member 
   | 18. April 2006 @ 00:42 |  Link to this message   |  
						| 
							
							ARRGHH... >:c My PC crash again...
 this is the online crash analysis in microsoft:
 
 Virus alert: a virus has been detected on your computer
 
 Thank you for submitting an error report.
 
 Problem description
 
 The error was likely caused by a computer virus that is known by the following names:
 
 Win32/Apropos.B
 WinNT/Zufyx.A
 Spyware.Apropos.C
 Trojan.Win32.Crypt.t
 
 
 wwwaaahhhh.... how can i delete this virus? oh..puhleesee i'm begging you... help me... T_T
 This message has been edited since posting. Last time this message was edited on 18. April 2006 @ 04:10 |  
						| Senior Member 
   | 18. April 2006 @ 04:54 |  Link to this message   |  
						| 
							
							Ok you got an infection, lets try with better instructions :) 
 At first,
 
 Download AproposFix from the following link -> http://swandog46.geekstogo.com/aproposfix.exe
 Save it to your desktop, but do NOT run it yet.
 
 Restart your computer to the safemode:
 1. Restart your computer.
 2. When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
 3. Select the option for Safe Mode using the arrow keys.
 4. Then press enter on your keyboard to boot into Safe Mode.
 
 Doubleclick the aproposfix.exe and unzip it to the desktop.
 
 Open the AproposFix folder on your desktop and doubleclick the file RunThis.bat.Follow the instuctions.
 
 When it is ready, restart your computer normally.
 
 Then:
 
 Download HijackThis from here -> http://koti.mbnet.fi/pattaya1/lataus/hijackthis_self.exe
 Save it to your desktop.
 
 The go to your desktop and doubleclick the file hijackthis_self.exe
 
 Press OK button. [Don't mind the Finnish text =)]
 Then press Unzip button.
 Then press OK button.
 
 IF HijackThis doesn't open automatically, go to C:\HJT and doubleclick the file hijackthis.exe
 
 Then press "Do a system scan only" button.
 
 Then a list of entries will appear.
 
 Put a checkmark to these entries:
 
 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sp/*http...
 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=msgr
 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?.home=msgr
 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://www...
 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr7/*http://www...
 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=msgr
 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http...
 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
 
 
 Close all other windows and press the "Fix checked" button.
 
 The firewall question:
 
 Well it is your choice, but it might be easier to Disable/Remove ZoneAlarm.
 
 If you decise to remove ZoneAlarm :
 ->Press Start
 ->Control Panel
 ->Add or Remove programs
 ->Remove ZoneAlarm
 
 Then post a new HijackThis log  (do it like you did in your first two posts) and the contents from the log.txt file to here (log.txt is inside the AproposFix folder, on your desktop)
 
 Then we'll see if your computer is clean.
 
 
 
 I have moved from AD, I won''t be taking new HijackThis logs from here. Reason: The AD''s Unsupportive athmosphere. This message has been edited since posting. Last time this message was edited on 18. April 2006 @ 04:57 |  
						| RheeyaJunior Member 
   | 18. April 2006 @ 18:55 |  Link to this message   |  
						| 
							
							Thank you for the fast reply JaPK n_n
 anywayz...here's my  New HijackThis Log:
 
 Logfile of HijackThis v1.99.1
 Scan saved at 10:40:14 AM, on 4/19/2006
 Platform: Windows XP SP2 (WinNT 5.01.2600)
 MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
 
 Running processes:
 C:\WINDOWS\System32\smss.exe
 C:\WINDOWS\system32\winlogon.exe
 C:\WINDOWS\system32\services.exe
 C:\WINDOWS\system32\lsass.exe
 C:\WINDOWS\system32\svchost.exe
 C:\WINDOWS\System32\svchost.exe
 C:\WINDOWS\system32\spoolsv.exe
 C:\WINDOWS\system32\CTsvcCDA.EXE
 c:\progra~1\mcafee\mcafee antispyware\massrv.exe
 c:\program files\mcafee.com\agent\mcdetect.exe
 c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
 C:\WINDOWS\Explorer.EXE
 c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
 C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
 C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe
 C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
 C:\WINDOWS\SOUNDMAN.EXE
 C:\WINDOWS\system32\carpserv.exe
 C:\WINDOWS\system32\rundll32.exe
 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
 C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
 C:\PROGRA~1\mcafee.com\agent\mcagent.exe
 c:\progra~1\mcafee.com\vso\mcvsescn.exe
 C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
 C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
 C:\progra~1\mcafee\MCAFEE~1\masalert.exe
 C:\Program Files\iTunes\iTunesHelper.exe
 C:\Program Files\QuickTime\qttask.exe
 C:\Program Files\Messenger\msmsgs.exe
 C:\WINDOWS\system32\ctfmon.exe
 C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
 C:\Program Files\McAfee\McAfee QuickClean\PlgUni.exe
 C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
 C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFAGENT.EXE
 C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
 c:\progra~1\mcafee.com\vso\mcvsftsn.exe
 C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
 C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
 C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
 c:\PROGRA~1\mcafee.com\vso\mcshield.exe
 C:\Program Files\iPod\bin\iPodService.exe
 C:\WINDOWS\system32\NOTEPAD.EXE
 C:\HJT\HijackThis.exe
 
 R3 - Default URLSearchHook is missing
 O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_6_2_0.dll
 O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
 O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
 O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
 O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_6_2_0.dll
 O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
 O4 - HKLM\..\Run: [CARPService] carpserv.exe
 O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
 O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
 O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
 O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
 O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
 O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
 O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
 O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
 O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
 O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
 O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
 O4 - HKLM\..\Run: [_AntiSpyware] c:\progra~1\mcafee\MCAFEE~1\masalert.exe
 O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
 O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
 O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
 O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
 O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
 O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
 O4 - HKCU\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
 O4 - HKCU\..\Run: [McAfee QuickClean Imonitor] "C:\Program Files\McAfee\McAfee QuickClean\PlgUni.exe" /START
 O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
 O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
 O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
 O4 - Global Startup: Bluetooth Manager.lnk = ?
 O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
 O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
 O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
 O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
 O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
 O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
 O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
 O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cab
 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
 O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - https://scan.safety.live.com/resource/download/scanner/en-us/wlscbase7617.cab
 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/...
 O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
 O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
 O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
 O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
 O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
 O23 - Service: McAfee AntiSpyware Service - McAfee, Inc. - c:\progra~1\mcafee\mcafee antispyware\massrv.exe
 O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
 O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
 O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
 O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
 O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
 O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe
 O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
 O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe
 
 and here's my Aproposfix Log:
 Log of AproposFix v1.1
 
 ************
 
 Running from directory:
 C:\Documents and Settings\Raffy & Linda\Desktop\aproposfix
 
 ************
 
 
 
 Registry entries found:
 
 [HKEY_LOCAL_MACHINE\Software\CzgOFACtYMFs]
 @="3ERgPRTabbabbcbqDF2:0 abbaqdb6w\\r.62bSYSTEMhgbDRIVERSbUAG_CNXTcSYS"
 "Device"="\\\\.\\CdfSPQM"
 "DriverPath"="C:\\WINDOWS\\system32\\drivers\\uag_cnxt.sys"
 "DriverName"="Ter2prt"
 "HideUninstallerName"="C:\\Program Files\\Ituogies\\toondstr.exe"
 "UninstallerPath"="C:\\WINDOWS\\system32\\osuxdiag.exe"
 "UninstallerRegKey"="HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{06508EA0-4F8C-4F42-94B4-12C25821E044}"
 "UninstallerParams"="/CTUN"
 "HDll"="C:\\WINDOWS\\system32\\qdvdwwin.dll"
 "ServerAddress"="adchannel.contextplus.net"
 "LegalNote"="http://adchannel.contextplus.net/legal-note/nonbranded.html"
 "PartnerId"="CP.IST2"
 "InstallationId"="{X2e9b0f1-c659-74e3-34cd-c98f83734138}"
 "PageFiltering"=dword:00000001
 "CrMnTmt"=dword:0036ee80
 
 ************
 
 Removing hidden service:
 Service Ter2prt removed.
 
 Removing hidden folder:
 Deletion of folder Ituogies succeeded!
 
 Deleting files:
 
 Deletion of file C:\WINDOWS\system32\drivers\uag_cnxt.sys succeeded!
 Deletion of file C:\WINDOWS\system32\reshutdn.exe succeeded!
 Deletion of file C:\WINDOWS\system32\qdvdwwin.dll succeeded!
 Deletion of file C:\WINDOWS\system32\osuxdiag.exe succeeded!
 
 Backing up files:
 Done!
 
 Removing registry entries:
 
 REGEDIT4
 
 [-HKEY_CURRENT_USER\Software\CzgOFACtYMFs]
 [-HKEY_LOCAL_MACHINE\Software\CzgOFACtYMFs]
 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{06508EA0-4F8C-4F42-94B4-12C25821E044}]
 
 Done!
 
 Finished!
 
 
 hmmm.....is my computer clean?
 
 
 *ooppss...before i forgot..how can i disable the Zone alarm..i follow your instruction but i couldnt find the zone alarm in my remove or add programs???
 |  
						| Senior Member 
   | 18. April 2006 @ 20:15 |  Link to this message   |  
						| 
							
							Ok very good, almost clean...
 Go to C:\HJT and doubleclick the file HijackThis.exe
 
 Then press "Do a system scan only" button.
 
 Then a list of entries will appear.
 
 Put a checkmark to this entry:
 R3 - Default URLSearchHook is missing
 
 Close all other windows and press the "Fix checked" button.
 
 Post a new HijackThis log.
 
 And the firewall question, check again from the "Add or remove programs". ZoneAlarm is propably at the end of the list.
 
 
 
 I have moved from AD, I won''t be taking new HijackThis logs from here. Reason: The AD''s Unsupportive athmosphere. |  
						| guinnyssSuspended due to non-functional email address 
   | 18. April 2006 @ 21:18 |  Link to this message   |  
						| 
							
							can you help me with mines...
 Logfile of HijackThis v1.99.1
 Scan saved at 1:16:35 AM, on 4/19/2006
 Platform: Windows XP SP2 (WinNT 5.01.2600)
 MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
 
 Running processes:
 C:\WINDOWS\System32\smss.exe
 C:\WINDOWS\system32\winlogon.exe
 C:\WINDOWS\system32\services.exe
 C:\WINDOWS\system32\lsass.exe
 C:\WINDOWS\system32\svchost.exe
 C:\WINDOWS\System32\svchost.exe
 C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
 C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
 C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
 C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
 C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
 C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
 C:\WINDOWS\system32\spoolsv.exe
 C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
 C:\WINDOWS\Explorer.EXE
 C:\WINDOWS\System32\ezSP_Px.exe
 C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
 C:\WINDOWS\AGRSMMSG.exe
 C:\Program Files\Common Files\Symantec Shared\ccApp.exe
 C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
 C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
 C:\Program Files\WinRAR\WinRAR.exe
 C:\Program Files\Messenger\msmsgs.exe
 C:\DOCUME~1\mark\LOCALS~1\Temp\Rar$EX64.438\HijackThis.exe
 
 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
 F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\rgvce.exe
 F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,cbcfons.exe
 O2 - BHO: (no name) - {02DCA195-602B-4B1F-83FF-381B7E804BDB} - C:\WINDOWS\system32\HDBHO.dll
 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program
 
 Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
 O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Hook UPS!\Spybot - Search &
 
 Destroy\SDHelper.dll
 O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program
 
 Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
 O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet
 
 Security\Norton AntiVirus\NavShExt.dll
 O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} -
 
 D:\HOOKUP~1\FlashFXP\IEFlash.dll
 O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program
 
 Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
 O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton
 
 Internet Security\Norton AntiVirus\NavShExt.dll
 O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
 O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
 O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
 O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
 O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
 O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
 O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
 O4 - HKLM\..\Run: [VAIO Recovery] C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe
 O4 - HKCU\..\Run: [ccleaner] "D:\Hook UPS!\CCleaner\ccleaner.exe" /AUTO
 O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11
 
 \EXCEL.EXE/3000
 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
 
 Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
 O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
 
 C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2
 
 \OFFICE11\REFIEBAR.DLL
 O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\Program Files\AIM95\aim.exe
 O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
 O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
 
 http://go.microsoft.com/fwlink/?linkid=39204
 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
 
 http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/...
 
 1137775073040
 O16 - DPF: {670821E0-76D1-11D4-9F60-009027A966BF} (YouBet Secure Data Transfer Control) -
 
 http://racing.youbet.com/wr_5_8/controls/ybrequest.cab
 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
 
 http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/...
 
 1137775055681
 O16 - DPF: {C9DB5AF8-4C14-4A3E-90F8-DB49D6B4866D} (YBUICtrl.FloatWnd.1) -
 
 http://racing.youbet.com/wr_5_8/controls/YBUICtrl.cab
 O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} -
 
 http://download.abacast.com/download/files/abasetup162.cab
 O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
 O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common
 
 Files\Symantec Shared\ccEvtMgr.exe
 O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation
 
 - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
 O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common
 
 Files\Symantec Shared\ccProxy.exe
 O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program
 
 Files\Common Files\Symantec Shared\ccSetMgr.exe
 O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet
 
 Security\comHost.exe
 O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation -
 
 C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
 O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program
 
 Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
 O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
 
 \nvsvc32.exe
 O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %
 
 ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
 O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton
 
 Internet Security\Norton AntiVirus\SAVScan.exe
 O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program
 
 Files\Common Files\Symantec Shared\SNDSrvc.exe
 O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common
 
 Files\Symantec Shared\SPBBC\SPBBCSvc.exe
 O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common
 
 Files\Sony Shared\AVLib\Sptisrv.exe
 O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec
 
 Shared\CCPD-LC\symlcsvc.exe
 
 how do i get rid of this?O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
 it keeps returning...
 This message has been edited since posting. Last time this message was edited on 18. April 2006 @ 21:20 |  
						| Senior Member 
   | 19. April 2006 @ 07:14 |  Link to this message   |  
						| 
							
							Hi guinnyss.
 Ok, we'll need some more information before we can clean you.
 
 Download FindQool by LonnyRJones -> http://downloads.subratam.org/Lon/FindQool.zip
 
 Extract the files to a new folder C:\FindQool
 
 Open the FindQool folder and doubleclik the file Qlocate.bat
 
 A text file will open, post its contents to here.
 
 
 I have moved from AD, I won''t be taking new HijackThis logs from here. Reason: The AD''s Unsupportive athmosphere. |  
						| RheeyaJunior Member 
   | 19. April 2006 @ 08:28 |  Link to this message   |  
						| 
							
							Hi JaPK...
 here's my latest Hijackthis log:
 
 Logfile of HijackThis v1.99.1
 Scan saved at 8:10:44 PM, on 4/19/2006
 Platform: Windows XP SP2 (WinNT 5.01.2600)
 MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
 
 Running processes:
 C:\WINDOWS\System32\smss.exe
 C:\WINDOWS\system32\winlogon.exe
 C:\WINDOWS\system32\services.exe
 C:\WINDOWS\system32\lsass.exe
 C:\WINDOWS\system32\svchost.exe
 C:\WINDOWS\System32\svchost.exe
 C:\WINDOWS\system32\spoolsv.exe
 C:\WINDOWS\system32\CTsvcCDA.EXE
 c:\progra~1\mcafee\mcafee antispyware\massrv.exe
 c:\program files\mcafee.com\agent\mcdetect.exe
 c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
 c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
 C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
 C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe
 C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
 C:\WINDOWS\Explorer.EXE
 C:\WINDOWS\SOUNDMAN.EXE
 C:\WINDOWS\system32\carpserv.exe
 C:\WINDOWS\system32\rundll32.exe
 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
 C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
 C:\PROGRA~1\mcafee.com\agent\mcagent.exe
 C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
 c:\progra~1\mcafee.com\vso\mcvsescn.exe
 C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
 C:\progra~1\mcafee\MCAFEE~1\masalert.exe
 C:\Program Files\iTunes\iTunesHelper.exe
 C:\Program Files\Messenger\msmsgs.exe
 C:\WINDOWS\system32\ctfmon.exe
 C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
 C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFAGENT.EXE
 C:\Program Files\McAfee\McAfee QuickClean\PlgUni.exe
 C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
 C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
 c:\progra~1\mcafee.com\vso\mcvsftsn.exe
 c:\PROGRA~1\mcafee.com\vso\mcshield.exe
 C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
 C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
 C:\Program Files\iPod\bin\iPodService.exe
 C:\HJT\HijackThis.exe
 
 O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_6_2_0.dll
 O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
 O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
 O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
 O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_6_2_0.dll
 O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
 O4 - HKLM\..\Run: [CARPService] carpserv.exe
 O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
 O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
 O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
 O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
 O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
 O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
 O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
 O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
 O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
 O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
 O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
 O4 - HKLM\..\Run: [_AntiSpyware] c:\progra~1\mcafee\MCAFEE~1\masalert.exe
 O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
 O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
 O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
 O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
 O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
 O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
 O4 - HKCU\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
 O4 - HKCU\..\Run: [McAfee QuickClean Imonitor] "C:\Program Files\McAfee\McAfee QuickClean\PlgUni.exe" /START
 O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
 O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
 O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
 O4 - Global Startup: Bluetooth Manager.lnk = ?
 O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
 O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
 O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
 O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
 O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
 O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
 O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
 O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cab
 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
 O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - https://scan.safety.live.com/resource/download/scanner/en-us/wlscbase7617.cab
 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/...
 O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
 O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
 O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
 O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
 O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
 O23 - Service: McAfee AntiSpyware Service - McAfee, Inc. - c:\progra~1\mcafee\mcafee antispyware\massrv.exe
 O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
 O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
 O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
 O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
 O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
 O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe
 O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
 O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe
 
 is my computer clean????
 
 uhhmm..JaPK if my computer is clean can i still free my memory? like what you've said earlier? fix the uneccessary startups?
 
 which entries???
 can you copy paste again the entries that i will fix? thankz..
 
 if i have fixed the all the entries that you have given me will my programs in my computer will work properly?
 
 I mean, if i fixed it, it will not cause harm to my computer?
 
 
 sorry if i have so many questions ...hehehe n_n
 
 last... about the zone alarm look at my  Add or Remove Program Window:
 
   
 the program zone alarm is not in there..
 
 how can i disabble or delete it?
 
 thank you so much JaPK..
 
 I really appreciatte your kindness *muah* ^_^
 This message has been edited since posting. Last time this message was edited on 19. April 2006 @ 08:32 |  
						| guinnyssSuspended due to non-functional email address 
   | 19. April 2006 @ 15:53 |  Link to this message   |  
						| 
							
							That file when extract i can't run it because it keep on saying it need to be unzipped so im lost there.. can you help...
i also tried in safe mode..
 |  
						| Senior Member 
   | 20. April 2006 @ 04:42 |  Link to this message   |  
						| 
							
							Hi Rheeya, sorry for the delay. You're clean now =)
 Ok, you were right (my mistake), ZoneAlarm isn't visible in the list (it has propably been uninstalled earlier). But there is that one remaining running and we should take it off.
 
 Open Notepad
 -> copy the following lines into a new document:
 
 @echo off
 sc stop vsmon
 sc delete vsmon
 
 Save the document to your desktop as Removal.bat and filetype: All Files
 Go to your desktop and run the file Removal.bat and answer yes to any questions.
 
 Then those unnecessary startups:
 
 You can fix these entries with HijackThis. (Open HijackThis, check these entries, press Fix checked)
 
 O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
 O4 - HKLM\..\Run: [CARPService] carpserv.exe
 O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
 O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
 O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
 O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
 O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
 O4 - HKCU\..\Run: [CursorXP] "C:\Program Files\CursorXP\CursorXP.exe" -s
 O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
 O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
 O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
 O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
 O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
 O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
 
 
 -----------------------------------------------------------------------------------------------------------------------------------
 
 Hi guinnyss. Sorry for the delay.
 
 You must unzip/extract that zip file first.
 
 Instructions -> http://consumer.installshield.com/kb.asp?id=Q108326
 
 Set the unzipping location to C:\FindQool
 
 Then:
 
 Open the FindQool folder and doubleclik the file Qlocate.bat
 
 A text file will open, post its contents to here.
 
 
 I have moved from AD, I won''t be taking new HijackThis logs from here. Reason: The AD''s Unsupportive athmosphere. This message has been edited since posting. Last time this message was edited on 22. April 2006 @ 03:53 |  
						| guinnyssSuspended due to non-functional email address 
   | 20. April 2006 @ 08:34 |  Link to this message   |  
						| 
							
							Hey.. can we work around the winzipp for FindQool because that program is not unzippin...
							
						 |  
						| Senior Member 
   | 20. April 2006 @ 09:50 |  Link to this message   |  
						| 
							
							Hi again guinnyss.
 Ok, so you have WinZIP installed?
 
 Click the FindQool.zip file with your right mousebutton.
 
 Choose Winzip from the list.
 
 Then press Extract to... button
 
 Copy this to the Extract to: field -> C:\FindQool
 
 Press Extract button
 
 
 Then:
 
 Open the FindQool folder (from C:\) and doubleclick the file Qlocate.bat
 
 A text file will open, post its contents to here.
 
 
 I have moved from AD, I won''t be taking new HijackThis logs from here. Reason: The AD''s Unsupportive athmosphere. |  
						| guinnyssSuspended due to non-functional email address 
   | 20. April 2006 @ 22:19 |  Link to this message   |  
						| 
							
							Nope no luck here, still saying the same and i follow step by step.
							
						 |  
						| RheeyaJunior Member 
   | 20. April 2006 @ 23:45 |  Link to this message   |  
						| 
							
							Hi JaPK..
 I just want to say thank you so much for helping me to fix my computer. n_n
 
 here's the result for my new HijackThis log:
 
 Logfile of HijackThis v1.99.1
 Scan saved at 3:42:27 PM, on 4/21/2006
 Platform: Windows XP SP2 (WinNT 5.01.2600)
 MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
 
 Running processes:
 C:\WINDOWS\System32\smss.exe
 C:\WINDOWS\system32\winlogon.exe
 C:\WINDOWS\system32\services.exe
 C:\WINDOWS\system32\lsass.exe
 C:\WINDOWS\system32\svchost.exe
 C:\WINDOWS\System32\svchost.exe
 C:\WINDOWS\system32\spoolsv.exe
 C:\WINDOWS\system32\CTsvcCDA.EXE
 c:\progra~1\mcafee\mcafee antispyware\massrv.exe
 c:\program files\mcafee.com\agent\mcdetect.exe
 c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
 C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
 c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
 C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
 C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
 C:\WINDOWS\Explorer.EXE
 C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
 C:\PROGRA~1\mcafee.com\agent\mcagent.exe
 c:\progra~1\mcafee.com\vso\mcvsescn.exe
 C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
 C:\progra~1\mcafee\MCAFEE~1\masalert.exe
 C:\Program Files\iTunes\iTunesHelper.exe
 C:\Program Files\QuickTime\qttask.exe
 C:\Program Files\McAfee\McAfee QuickClean\PlgUni.exe
 C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
 C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
 c:\progra~1\mcafee.com\vso\mcvsftsn.exe
 C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
 C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
 c:\PROGRA~1\mcafee.com\vso\mcshield.exe
 C:\Program Files\iPod\bin\iPodService.exe
 C:\PROGRA~1\McAfee.com\Agent\mcupdui.exe
 C:\Program Files\Internet Explorer\iexplore.exe
 C:\Program Files\Internet Explorer\iexplore.exe
 C:\Program Files\Chikka\chikka.exe
 C:\WINDOWS\system32\NOTEPAD.EXE
 C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFAGENT.EXE
 C:\PROGRA~1\MCAFEE.COM\PERSON~1\MpfTray.exe
 C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe
 C:\HJT\HijackThis.exe
 
 O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_6_2_0.dll
 O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
 O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
 O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
 O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_6_2_0.dll
 O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
 O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
 O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
 O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
 O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
 O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
 O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
 O4 - HKLM\..\Run: [_AntiSpyware] c:\progra~1\mcafee\MCAFEE~1\masalert.exe
 O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
 O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
 O4 - HKCU\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
 O4 - HKCU\..\Run: [McAfee QuickClean Imonitor] "C:\Program Files\McAfee\McAfee QuickClean\PlgUni.exe" /START
 O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
 O4 - Global Startup: Bluetooth Manager.lnk = ?
 O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
 O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
 O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
 O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
 O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
 O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
 O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
 O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cab
 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
 O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - https://scan.safety.live.com/resource/download/scanner/en-us/wlscbase7617.cab
 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/...
 O17 - HKLM\System\CCS\Services\Tcpip\..\{9EB5E203-A058-4F8E-85EB-CB3F68CEB514}: NameServer = 210.14.16.5 210.14.16.2
 O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
 O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
 O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
 O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
 O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
 O23 - Service: McAfee AntiSpyware Service - McAfee, Inc. - c:\progra~1\mcafee\mcafee antispyware\massrv.exe
 O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
 O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
 O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
 O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
 O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
 O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe
 O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
 |  
						| Senior Member 
   | 21. April 2006 @ 03:24 |  Link to this message   |  
						| 
							
							Hi Rheeya, you're both clean and welcome =)
 ----------------------------------------------------------------------------------------
 
 Hi guinnyss, lets try this instead.......
 
 Download BFU.zip to C:\ -> http://www.merijn.org/files/bfu.zip
 
 Then Go to My Computer -> C:\
 
 Click the file BFU.zip with your rigth mousebutton
 -> menu opens
 -> choose Winzip
 -> choose Extract to here
 -> folder named bfu appears to C:\
 
 Then download qooFix.bat -> http://downloads.subratam.org/Lon/qooFix.bat
 Save it to folder C:\bfu
 
 Close all other windows, including explorer folders.
 Go to C:\bfu and doubleclick the file QooFix.bat
 Choose option 1# (QoolFix autofix) and follow the instructions.
 Be patient, it takes about 5 minutes.
 
 Post a fresh HijackThis log to here.
 
 
 I have moved from AD, I won''t be taking new HijackThis logs from here. Reason: The AD''s Unsupportive athmosphere. |  
						| guinnyssSuspended due to non-functional email address 
   | 21. April 2006 @ 08:44 |  Link to this message   |  
						| 
							
							Heres the new file...
 Logfile of HijackThis v1.99.1
 Scan saved at 12:42:13 PM, on 4/21/2006
 Platform: Windows XP SP2 (WinNT 5.01.2600)
 MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
 
 Running processes:
 C:\WINDOWS\System32\smss.exe
 C:\WINDOWS\system32\winlogon.exe
 C:\WINDOWS\system32\services.exe
 C:\WINDOWS\system32\lsass.exe
 C:\WINDOWS\system32\svchost.exe
 C:\WINDOWS\System32\svchost.exe
 C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
 C:\WINDOWS\system32\spoolsv.exe
 C:\WINDOWS\system32\ZoneLabs\vsmon.exe
 C:\WINDOWS\system32\wuauclt.exe
 C:\WINDOWS\Explorer.EXE
 C:\WINDOWS\System32\ezSP_Px.exe
 C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
 C:\WINDOWS\AGRSMMSG.exe
 C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
 C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
 C:\Program Files\Messenger\msmsgs.exe
 C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe
 C:\Program Files\KeirNet\K9\K9.exe
 C:\Program Files\WinRAR\WinRAR.exe
 C:\DOCUME~1\mark\LOCALS~1\Temp\Rar$EX00.547\HijackThis.exe
 
 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
 F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,cbcfons.exe
 O2 - BHO: (no name) - {02DCA195-602B-4B1F-83FF-381B7E804BDB} - C:\WINDOWS\system32\HDBHO.dll
 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
 O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
 O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - D:\HOOKUP~1\FlashFXP\IEFlash.dll
 O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
 O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
 O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
 O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
 O4 - HKLM\..\Run: [VAIO Recovery] C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe
 O4 - HKLM\..\Run: [anjoeg] C:\WINDOWS\system32\bwexei.exe reg_run
 O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
 O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
 O4 - HKCU\..\Run: [ccleaner] "D:\Hook UPS!\CCleaner\ccleaner.exe" /AUTO
 O4 - HKCU\..\Run: [wkpqf] C:\WINDOWS\system32\bwexei.exe reg_run
 O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
 O4 - HKCU\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe"
 O4 - Startup: Launch K9.lnk = C:\Program Files\KeirNet\K9\K9.exe
 O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
 O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
 O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
 O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
 O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\Program Files\AIM95\aim.exe
 O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
 O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/...
 O16 - DPF: {670821E0-76D1-11D4-9F60-009027A966BF} (YouBet Secure Data Transfer Control) - http://racing.youbet.com/wr_5_8/controls/ybrequest.cab
 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/...
 O16 - DPF: {C9DB5AF8-4C14-4A3E-90F8-DB49D6B4866D} (YBUICtrl.FloatWnd.1) - http://racing.youbet.com/wr_5_8/controls/YBUICtrl.cab
 O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup162.cab
 O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
 O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
 O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
 O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
 O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
 O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
 |  
						| Senior Member 
   | 21. April 2006 @ 23:21 |  Link to this message   |  
						| 
							
							Ok did you follow my instructions ?
 You're still infected, lets try this:
 
 Restart your computer to the safemode (Press F8 button when computer is starting and choose safemode)
 
 Close all other windows, including explorer folders.
 Go to C:\bfu and doubleclick the file QooFix.bat
 Choose option 1# (QoolFix autofix) and follow the instructions.
 Be patient, it takes about 5 minutes.
 
 Restart your computer normally.
 
 Post a fresh HijackThis log to here.
 
 
 I have moved from AD, I won''t be taking new HijackThis logs from here. Reason: The AD''s Unsupportive athmosphere. This message has been edited since posting. Last time this message was edited on 21. April 2006 @ 23:24 |  
						| guinnyssSuspended due to non-functional email address 
   | 22. April 2006 @ 20:27 |  Link to this message   |  
						| 
							
							Whats is it thats infected?
							
						 |  
						| Advertisement   |   |  
						| 
 |  
						| Senior Member 
   | 22. April 2006 @ 20:57 |  Link to this message   |  
						| 
							
							You =)
 You have a Qoologic infection.
 
 Did you follow my instructions?
 
 
 I have moved from AD, I won''t be taking new HijackThis logs from here. Reason: The AD''s Unsupportive athmosphere. |  |