I thought I posted something before..it didn't come out. Anyways: For the past few days now, this "ghostly" dlldate.exe keeps popping out and disappearing. I searched this name online and found this forum. I read Jackie Lee's post, "Virus uses net1.exe! Hijack help!!" (November 14, 2003 at 15:48:09 Pacific) and it seemed like they solved her problem which feels to be similar to mine. I need help in figuring out which thing to 'fix check.' Any help is much appreciated from a guy who's not too good with computers. =) Here's my Hijack log (there's some porn stuff that my brother checks out more than I do. could it be that?): Logfile of HijackThis v1.97.7 Scan saved at 1:53:18 PM, on 11/22/2003 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe C:\WINDOWS\System32\drivers\CDAC11BA.exe C:\WINDOWS\System32\DRIVERS\CDANTSRV.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\System32\ltmsg.exe C:\Program Files\Logitech\iTouch\iTouch.exe C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.exe C:\WINDOWS\System32\devldr32.exe C:\PROGRA~1\NORTON~1\navapw32.exe C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe C:\Program Files\Microsoft Works\WksSb.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe C:\Program Files\Creative\ShareDLL\CtNotify.exe C:\WINDOWS\System32\VROVHMWMKV.exe C:\Program Files\Creative\ShareDLL\MediaDet.exe C:\Program Files\ISTsvc\istsvc.exe C:\Program Files\ClearSearch\Loader.exe C:\Program Files\Bargain Buddy\bin\bargains.exe C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\iedll.exe C:\Program Files\America Online 9.0\aoltray.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\PROGRA~1\Yahoo!\MESSEN~1\YPAGER.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\helpctr.exe C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpHost.exe C:\Documents and Settings\Francis_Basbas\Local Settings\Temp\Temporary Directory 5 for hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.fastwebfinder.com/sp.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.fastwebfinder.com/sp.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.fastwebfinder.com/sp.php R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/comcast.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.couldnotfind.com/search_page.html?&account_id=76081 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://out.true-counter.com/b/?344012 (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://out.true-counter.com/b/?344012 (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ok-search.com/search.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.fastwebfinder.com/sp.php R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *r2.attbi.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.comcast.net/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://www.fastwebfinder.com/hp.php R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://out.true-counter.com/b/?344012 (obfuscated) O1 - Hosts: 66.159.20.52 www1.ndhosting.com O1 - Hosts: 66.159.20.52 www3.ndhosting.com O1 - Hosts: 66.159.20.52 www2.ndhosting.com O1 - Hosts: 66.159.20.52 www.ndhosting.com O1 - Hosts: 66.159.20.52 www.kinghost.com O1 - Hosts: 66.159.20.52 kinghost.com O1 - Hosts: 66.159.20.52 www1.kinghost.com O1 - Hosts: 66.159.20.52 www2.kinghost.com O1 - Hosts: 66.159.20.52 www3.kinghost.com O1 - Hosts: 66.159.20.52 www4.kinghost.com O1 - Hosts: 66.159.20.52 www5.kinghost.com O1 - Hosts: 66.159.20.52 www6.kinghost.com O1 - Hosts: 66.159.20.52 www7.kinghost.com O1 - Hosts: 66.159.20.52 www8.kinghost.com O1 - Hosts: 66.159.20.52 www9.kinghost.com O1 - Hosts: 66.159.20.52 www10.kinghost.com O1 - Hosts: 66.159.20.52 www.smutserver.com O1 - Hosts: 66.159.20.52 smutserver.com O1 - Hosts: 66.159.20.52 www1.smutserver.com O1 - Hosts: 66.159.20.52 www2.smutserver.com O1 - Hosts: 66.159.20.52 www16.smutserver.com O1 - Hosts: 66.159.20.52 www3.smutserver.com O1 - Hosts: 66.159.20.52 www4.smutserver.com O1 - Hosts: 66.159.20.52 www5.smutserver.com O1 - Hosts: 66.159.20.52 www6.smutserver.com O1 - Hosts: 66.159.20.52 www7.smutserver.com O1 - Hosts: 66.159.20.52 www8.smutserver.com O1 - Hosts: 66.159.20.52 www9.smutserver.com O1 - Hosts: 66.159.20.52 www10.smutserver.com O1 - Hosts: 66.159.20.52 www11.smutserver.com O1 - Hosts: 66.159.20.52 www12.smutserver.com O1 - Hosts: 66.159.20.52 www13.smutserver.com O1 - Hosts: 66.159.20.52 www14.smutserver.com O1 - Hosts: 66.159.20.52 www15.smutserver.com O1 - Hosts: 66.159.20.52 www17.smutserver.com O1 - Hosts: 66.159.20.52 www18.smutserver.com O1 - Hosts: 66.159.20.52 www19.smutserver.com O1 - Hosts: 66.159.20.52 www20.smutserver.com O1 - Hosts: 66.159.20.52 www21.smutserver.com O1 - Hosts: 66.159.20.52 www22.smutserver.com O1 - Hosts: 66.159.20.52 www23.smutserver.com O1 - Hosts: 66.159.20.52 www24.smutserver.com O1 - Hosts: 66.159.20.52 www25.smutserver.com O1 - Hosts: 66.159.20.52 www26.smutserver.com O1 - Hosts: 66.159.20.52 www27.smutserver.com O1 - Hosts: 66.159.20.52 www28.smutserver.com O1 - Hosts: 66.159.20.52 www29.smutserver.com O1 - Hosts: 66.159.20.52 www30.smutserver.com O1 - Hosts: 66.159.20.52 www31.smutserver.com O1 - Hosts: 66.159.20.52 www32.smutserver.com O1 - Hosts: 66.159.20.52 agreathost.net O1 - Hosts: 66.159.20.52 www.agreathost.net O1 - Hosts: 66.159.20.52 hotfreehost.com O1 - Hosts: 66.159.20.52 www.hotfreehost.com O1 - Hosts: 66.159.20.52 greatfreehost.com O1 - Hosts: 66.159.20.52 www.greatfreehost.com O1 - Hosts: 66.159.20.52 freesmutpages.com O1 - Hosts: 66.159.20.52 www.freesmutpages.com O1 - Hosts: 66.159.20.52 apornhost.com O1 - Hosts: 66.159.20.52 www.apornhost.com O1 - Hosts: 66.159.20.52 nasty-pages.com O1 - Hosts: 66.159.20.52 www.nasty-pages.com O1 - Hosts: 66.159.20.52 sexyfreehost.com O1 - Hosts: 66.159.20.52 www.sexyfreehost.com O1 - Hosts: 66.159.20.52 x4web.com O1 - Hosts: 66.159.20.52 www.x4web.com O1 - Hosts: 66.159.20.52 sexplanets.com O1 - Hosts: 66.159.20.52 www.sexplanets.com O1 - Hosts: 66.159.20.52 maxismut.com O1 - Hosts: 66.159.20.52 www.maxismut.com O1 - Hosts: 66.159.20.52 tgpfriendly.com O1 - Hosts: 66.159.20.52 www.tgpfriendly.com O1 - Hosts: 66.159.20.52 tgp-server.com O1 - Hosts: 66.159.20.52 www.tgp-server.com O1 - Hosts: 66.159.20.52 magnaplza.com O1 - Hosts: 66.159.20.52 www.magnaplza.com O1 - Hosts: 66.159.20.52 free-xxx-server.com O1 - Hosts: 66.159.20.52 www.free-xxx-server.com O1 - Hosts: 66.159.20.52 libereco.net O1 - Hosts: 66.159.20.52 www.libereco.net O1 - Hosts: 66.159.20.52 0190-dialer.com O1 - Hosts: 66.159.20.52 www.0190-dialer.com O1 - Hosts: 66.159.20.52 xxxod.net O1 - Hosts: 66.159.20.52 www.xxxod.net O1 - Hosts: 66.159.20.52 altsights.com O1 - Hosts: 66.159.20.52 www.altsights.com O1 - Hosts: 66.159.20.52 adulthosting.com O1 - Hosts: 66.159.20.52 www.adulthosting.com O1 - Hosts: 66.159.20.52 superhova.com O1 - Hosts: 66.159.20.52 www.superhova.com O1 - Hosts: 66.159.20.52 bestpornhost.com O1 - Hosts: 66.159.20.52 www.bestpornhost.com O1 - Hosts: 66.159.20.52 hostingfree.com O1 - Hosts: 66.159.20.52 www.hostingfree.com O1 - Hosts: 66.159.20.52 xfreehosting.com O1 - Hosts: 66.159.20.52 www.xfreehosting.com O1 - Hosts: 66.159.20.52 blinghosting.com O1 - Hosts: 66.159.20.52 www.blinghosting.com O1 - Hosts: 66.159.20.52 x-x-x-hosting.com O1 - Hosts: 66.159.20.52 www.x-x-x-hosting.com O1 - Hosts: 66.159.20.52 pornparks.com O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\WINDOWS\Downloaded Program Files\ycomp5_1_5_0.dll O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Clear Search - {947E6D5A-4B9F-4CF4-91B3-562CA8D03313} - C:\Program Files\ClearSearch\IE_ClrSch.DLL O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: Url Catcher - {CE31A1F7-3D90-4874-8FBE-A5D97F8BC8F1} - C:\PROGRA~1\BARGAI~1\bin\apuc.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\WINDOWS\Downloaded Program Files\ycomp5_1_5_0.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9 O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.exe O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe" O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe O4 - HKLM\..\Run: [motmzfm] "C:\WINDOWS\System32\motmzfm.exe" O4 - HKLM\..\Run: [SysExplore] C:\WINDOWS\System32\explorer32.exe O4 - HKLM\..\Run: [MSConfig] VROVHMWMKV.exe O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe O4 - HKLM\..\Run: [ClrSchLoader] C:\Program Files\ClearSearch\Loader.exe O4 - HKLM\..\Run: [Bargains] C:\Program Files\Bargain Buddy\bin\bargains.exe O4 - HKLM\..\Run: [mmtask] C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [iedll] C:\WINDOWS\iedll.exe O4 - HKCU\..\Run: [loader] C:\WINDOWS\loader.exe O4 - HKCU\..\RunOnce: [MSConfig] VROVHMWMKV.exe O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O4 - Global Startup: webdav.exe O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM) O9 - Extra button: AIM (HKLM) O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O9 - Extra button: Real.com (HKLM) O9 - Extra button: MoneySide (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab O16 - DPF: {018B7EC3-EECA-11D3-8E71-0000E82C6C0D} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v3.0/0006.cab O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {02C20140-76F8-4763-83D5-B660107B7A90} (Loader Class) - http://connect.online-dialer.com/MaConnect.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37861.0722916667 O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) - http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/yiebio5_1_5_0.cab O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab O19 - User stylesheet: C:\WINDOWS\Web\oslogo.bmp (HKLM)

You are infected with W32.Spybot, have a CoolWebSearch hijack and misc other nasties. 1. Download and run CWShredder: CWShredder 2. Download, unzip and run Process Explorer and end process (kill) on the following. C:\WINDOWS\System32\VROVHMWMKV.exe C:\Program Files\ISTsvc\istsvc.exe C:\Program Files\ClearSearch\Loader.exe C:\Program Files\Bargain Buddy\bin\bargains.exe Process Explorer 3. Run HT again and check the following items. Next, close all browser Windows, and have HT 'fix checked'. You Must restart your computer in SAFE MODE when you're done. O2 - BHO: Clear Search - {947E6D5A-4B9F-4CF4-91B3-562CA8D03313} - C:\Program Files\ClearSearch\IE_ClrSch.DLL O2 - BHO: Url Catcher - {CE31A1F7-3D90-4874-8FBE-A5D97F8BC8F1} - C:\PROGRA~1\BARGAI~1\bin\apuc.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe" O4 - HKLM\..\Run: [motmzfm] "C:\WINDOWS\System32\motmzfm.exe" O4 - HKLM\..\Run: [SysExplore] C:\WINDOWS\System32\explorer32.exe O4 - HKLM\..\Run: [MSConfig] VROVHMWMKV.exe O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe O4 - HKLM\..\Run: [ClrSchLoader] C:\Program Files\ClearSearch\Loader.exe O4 - HKLM\..\Run: [Bargains] C:\Program Files\Bargain Buddy\bin\bargains.exe O4 - HKCU\..\RunOnce: [MSConfig] VROVHMWMKV.exe O4 - Global Startup: webdav.exe O16 - DPF: {018B7EC3-EECA-11D3-8E71-0000E82C6C0D} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v3.0/0006.cab O16 - DPF: {02C20140-76F8-4763-83D5-B660107B7A90} (Loader Class) - http://connect.online-dialer.com/MaConnect.cab Once in safe mode delete the following: C:\WINDOWS\System32\VROVHMWMKV.exe C:\WINDOWS\System32\motmzfm.exe C:\WINDOWS\System32\explorer32.exe C:\Program Files\ISTsvc folder C:\Program Files\ClearSearch C:\Program Files\Bargain Buddy 4. Reboot to Windows and run an online scan here. Delete any files listed as infected. RAV 5. Install, update and run Spybot-S&D. Have Spybot fix all red entries it lists. Spybot

Thanks Tom! Before just checkin my post, Kevin from this site emailed me and suggested me to a couple of links before posting something mentioning Hijack. So i got Ad-Aware 6.0 So it said that it terminated a bunch of stuff. I did another log with HT and this is what I got after running Ad-Aware. I just want to know if I'm good know after doing this. Here is my log. THANKS. Logfile of HijackThis v1.97.7 Scan saved at 1:39:57 AM, on 11/23/2003 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe C:\WINDOWS\System32\drivers\CDAC11BA.exe C:\WINDOWS\System32\DRIVERS\CDANTSRV.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\System32\devldr32.exe C:\WINDOWS\System32\ltmsg.exe C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\Logitech\iTouch\iTouch.exe C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.exe C:\PROGRA~1\NORTON~1\navapw32.exe C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe C:\Program Files\Microsoft Works\WksSb.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe C:\Program Files\Creative\ShareDLL\CtNotify.exe C:\WINDOWS\System32\explorer32.exe C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\iedll.exe C:\Program Files\Creative\ShareDLL\MediaDet.exe C:\Program Files\America Online 9.0\aoltray.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe c:\windows\system32\cmd.exe C:\WINDOWS\SYSTEM32\msconfig32.exe c:\windows\system32\net.exe c:\windows\system32\net1.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\NOTEPAD.exe C:\Documents and Settings\Francis_Basbas\Local Settings\Temp\Temporary Directory 9 for hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.fastwebfinder.com/sp.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.fastwebfinder.com/sp.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.fastwebfinder.com/sp.php R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/comcast.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://out.true-counter.com/b/?344012 (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://out.true-counter.com/b/?344012 (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.fastwebfinder.com/sp.php R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *r2.attbi.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.comcast.net/ R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://out.true-counter.com/b/?344012 (obfuscated) R3 - Default URLSearchHook is missing O1 - Hosts: 66.159.20.52 www1.ndhosting.com O1 - Hosts: 66.159.20.52 www3.ndhosting.com O1 - Hosts: 66.159.20.52 www2.ndhosting.com O1 - Hosts: 66.159.20.52 www.ndhosting.com O1 - Hosts: 66.159.20.52 www.kinghost.com O1 - Hosts: 66.159.20.52 kinghost.com O1 - Hosts: 66.159.20.52 www1.kinghost.com O1 - Hosts: 66.159.20.52 www2.kinghost.com O1 - Hosts: 66.159.20.52 www3.kinghost.com O1 - Hosts: 66.159.20.52 www4.kinghost.com O1 - Hosts: 66.159.20.52 www5.kinghost.com O1 - Hosts: 66.159.20.52 www6.kinghost.com O1 - Hosts: 66.159.20.52 www7.kinghost.com O1 - Hosts: 66.159.20.52 www8.kinghost.com O1 - Hosts: 66.159.20.52 www9.kinghost.com O1 - Hosts: 66.159.20.52 www10.kinghost.com O1 - Hosts: 66.159.20.52 www.smutserver.com O1 - Hosts: 66.159.20.52 smutserver.com O1 - Hosts: 66.159.20.52 www1.smutserver.com O1 - Hosts: 66.159.20.52 www2.smutserver.com O1 - Hosts: 66.159.20.52 www16.smutserver.com O1 - Hosts: 66.159.20.52 www3.smutserver.com O1 - Hosts: 66.159.20.52 www4.smutserver.com O1 - Hosts: 66.159.20.52 www5.smutserver.com O1 - Hosts: 66.159.20.52 www6.smutserver.com O1 - Hosts: 66.159.20.52 www7.smutserver.com O1 - Hosts: 66.159.20.52 www8.smutserver.com O1 - Hosts: 66.159.20.52 www9.smutserver.com O1 - Hosts: 66.159.20.52 www10.smutserver.com O1 - Hosts: 66.159.20.52 www11.smutserver.com O1 - Hosts: 66.159.20.52 www12.smutserver.com O1 - Hosts: 66.159.20.52 www13.smutserver.com O1 - Hosts: 66.159.20.52 www14.smutserver.com O1 - Hosts: 66.159.20.52 www15.smutserver.com O1 - Hosts: 66.159.20.52 www17.smutserver.com O1 - Hosts: 66.159.20.52 www18.smutserver.com O1 - Hosts: 66.159.20.52 www19.smutserver.com O1 - Hosts: 66.159.20.52 www20.smutserver.com O1 - Hosts: 66.159.20.52 www21.smutserver.com O1 - Hosts: 66.159.20.52 www22.smutserver.com O1 - Hosts: 66.159.20.52 www23.smutserver.com O1 - Hosts: 66.159.20.52 www24.smutserver.com O1 - Hosts: 66.159.20.52 www25.smutserver.com O1 - Hosts: 66.159.20.52 www26.smutserver.com O1 - Hosts: 66.159.20.52 www27.smutserver.com O1 - Hosts: 66.159.20.52 www28.smutserver.com O1 - Hosts: 66.159.20.52 www29.smutserver.com O1 - Hosts: 66.159.20.52 www30.smutserver.com O1 - Hosts: 66.159.20.52 www31.smutserver.com O1 - Hosts: 66.159.20.52 www32.smutserver.com O1 - Hosts: 66.159.20.52 agreathost.net O1 - Hosts: 66.159.20.52 www.agreathost.net O1 - Hosts: 66.159.20.52 hotfreehost.com O1 - Hosts: 66.159.20.52 www.hotfreehost.com O1 - Hosts: 66.159.20.52 greatfreehost.com O1 - Hosts: 66.159.20.52 www.greatfreehost.com O1 - Hosts: 66.159.20.52 freesmutpages.com O1 - Hosts: 66.159.20.52 www.freesmutpages.com O1 - Hosts: 66.159.20.52 apornhost.com O1 - Hosts: 66.159.20.52 www.apornhost.com O1 - Hosts: 66.159.20.52 nasty-pages.com O1 - Hosts: 66.159.20.52 www.nasty-pages.com O1 - Hosts: 66.159.20.52 sexyfreehost.com O1 - Hosts: 66.159.20.52 www.sexyfreehost.com O1 - Hosts: 66.159.20.52 x4web.com O1 - Hosts: 66.159.20.52 www.x4web.com O1 - Hosts: 66.159.20.52 sexplanets.com O1 - Hosts: 66.159.20.52 www.sexplanets.com O1 - Hosts: 66.159.20.52 maxismut.com O1 - Hosts: 66.159.20.52 www.maxismut.com O1 - Hosts: 66.159.20.52 tgpfriendly.com O1 - Hosts: 66.159.20.52 www.tgpfriendly.com O1 - Hosts: 66.159.20.52 tgp-server.com O1 - Hosts: 66.159.20.52 www.tgp-server.com O1 - Hosts: 66.159.20.52 magnaplza.com O1 - Hosts: 66.159.20.52 www.magnaplza.com O1 - Hosts: 66.159.20.52 free-xxx-server.com O1 - Hosts: 66.159.20.52 www.free-xxx-server.com O1 - Hosts: 66.159.20.52 libereco.net O1 - Hosts: 66.159.20.52 www.libereco.net O1 - Hosts: 66.159.20.52 0190-dialer.com O1 - Hosts: 66.159.20.52 www.0190-dialer.com O1 - Hosts: 66.159.20.52 xxxod.net O1 - Hosts: 66.159.20.52 www.xxxod.net O1 - Hosts: 66.159.20.52 altsights.com O1 - Hosts: 66.159.20.52 www.altsights.com O1 - Hosts: 66.159.20.52 adulthosting.com O1 - Hosts: 66.159.20.52 www.adulthosting.com O1 - Hosts: 66.159.20.52 superhova.com O1 - Hosts: 66.159.20.52 www.superhova.com O1 - Hosts: 66.159.20.52 bestpornhost.com O1 - Hosts: 66.159.20.52 www.bestpornhost.com O1 - Hosts: 66.159.20.52 hostingfree.com O1 - Hosts: 66.159.20.52 www.hostingfree.com O1 - Hosts: 66.159.20.52 xfreehosting.com O1 - Hosts: 66.159.20.52 www.xfreehosting.com O1 - Hosts: 66.159.20.52 blinghosting.com O1 - Hosts: 66.159.20.52 www.blinghosting.com O1 - Hosts: 66.159.20.52 x-x-x-hosting.com O1 - Hosts: 66.159.20.52 www.x-x-x-hosting.com O1 - Hosts: 66.159.20.52 pornparks.com O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\WINDOWS\Downloaded Program Files\ycomp5_1_5_0.dll O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\WINDOWS\Downloaded Program Files\ycomp5_1_5_0.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9 O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.exe O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe" O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe O4 - HKLM\..\Run: [motmzfm] "C:\WINDOWS\System32\motmzfm.exe" O4 - HKLM\..\Run: [SysExplore] C:\WINDOWS\System32\explorer32.exe O4 - HKLM\..\Run: [mmtask] C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [MSConfig] MSCONFIG32.exe O4 - HKCU\..\Run: [iedll] C:\WINDOWS\iedll.exe O4 - HKCU\..\Run: [loader] C:\WINDOWS\loader.exe O4 - HKCU\..\RunOnce: [MSConfig] MSCONFIG32.exe O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O4 - Global Startup: webdav.exe O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM) O9 - Extra button: AIM (HKLM) O9 - Extra button: Real.com (HKLM) O9 - Extra button: MoneySide (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37861.0722916667 O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) - http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/yiebio5_1_5_0.cab O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab O19 - User stylesheet: C:\WINDOWS\Web\oslogo.bmp (HKLM)

No, You are not good.. Follow my previous instructions but everywhere I have VROVHMWMKV.exe listed change it to MSCONFIG32.exe. (W32.Spybot has morphed because of an incorrect removal attempt)

Thanks, I will try this now. Also, I did a regular windows search on 'dlldate,' and it my computer has this: DLLDATE.EXE-1A1668B2.pf (C:\WINDOWS\Prefetch) and dlldate. The black pop ups that disappear on my computer (that sign told me that there's something wrong) say "killing dlldate.exe" Is DLLDATE a virus, or something I should get rid off too? Will this disappear when I follow ur directions? Thanks, I will get to that now.

I have done everything Tom has asked me to do (sorry it took a while, had to work this weekend), and I just want to double-triple check to see if i'm completely clean. When I was in safe mode, I couldn't find C:\Program Files\ISTsvc folder so maybe it was taken care of already. However, O4 - Global Startup: webdav.exe is still there (one of the things Tom wanted me to get rid of), it won't be 'fix checked' on Hijack This (HT asked me to close it through task manager). How do go about this, erasing webdav.exe? I'm still wondering if any spybot morphed into something else or into some other name. ALSO: How do I erase all that "O1-Hosts: 66.159.20.52" stuff from my system. I traced it through WINDOWS/System32/drivers/etc/hosts, but it asked me to choose an application to open the hosts folder..which do i use. When I chose explorer, it wasn't any help. THANKS! I JUST NEED HELP IN SEEING THAT I'M GOOD IN MY LOG. Logfile of HijackThis v1.97.7 Scan saved at 2:20:39 AM, on 11/24/2003 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe C:\WINDOWS\System32\drivers\CDAC11BA.exe C:\WINDOWS\System32\DRIVERS\CDANTSRV.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\System32\ltmsg.exe C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\Logitech\iTouch\iTouch.exe C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.exe C:\WINDOWS\System32\devldr32.exe C:\PROGRA~1\NORTON~1\navapw32.exe C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe C:\Program Files\Microsoft Works\WksSb.exe C:\Program Files\Creative\ShareDLL\CtNotify.exe C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\America Online 9.0\aoltray.exe C:\Program Files\Creative\ShareDLL\MediaDet.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Francis_Basbas\Local Settings\Temp\Temporary Directory 14 for hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/comcast.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *r2.attbi.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.comcast.net/ R3 - Default URLSearchHook is missing O1 - Hosts: 66.159.20.52 agreathost.net O1 - Hosts: 66.159.20.52 www.agreathost.net O1 - Hosts: 66.159.20.52 hotfreehost.com O1 - Hosts: 66.159.20.52 www.hotfreehost.com O1 - Hosts: 66.159.20.52 greatfreehost.com O1 - Hosts: 66.159.20.52 www.greatfreehost.com O1 - Hosts: 66.159.20.52 freesmutpages.com O1 - Hosts: 66.159.20.52 www.freesmutpages.com O1 - Hosts: 66.159.20.52 apornhost.com O1 - Hosts: 66.159.20.52 www.apornhost.com O1 - Hosts: 66.159.20.52 nasty-pages.com O1 - Hosts: 66.159.20.52 www.nasty-pages.com O1 - Hosts: 66.159.20.52 sexyfreehost.com O1 - Hosts: 66.159.20.52 www.sexyfreehost.com O1 - Hosts: 66.159.20.52 x4web.com O1 - Hosts: 66.159.20.52 www.x4web.com O1 - Hosts: 66.159.20.52 sexplanets.com O1 - Hosts: 66.159.20.52 www.sexplanets.com O1 - Hosts: 66.159.20.52 maxismut.com O1 - Hosts: 66.159.20.52 www.maxismut.com O1 - Hosts: 66.159.20.52 tgpfriendly.com O1 - Hosts: 66.159.20.52 www.tgpfriendly.com O1 - Hosts: 66.159.20.52 tgp-server.com O1 - Hosts: 66.159.20.52 www.tgp-server.com O1 - Hosts: 66.159.20.52 magnaplza.com O1 - Hosts: 66.159.20.52 www.magnaplza.com O1 - Hosts: 66.159.20.52 free-xxx-server.com O1 - Hosts: 66.159.20.52 www.free-xxx-server.com O1 - Hosts: 66.159.20.52 libereco.net O1 - Hosts: 66.159.20.52 www.libereco.net O1 - Hosts: 66.159.20.52 0190-dialer.com O1 - Hosts: 66.159.20.52 www.0190-dialer.com O1 - Hosts: 66.159.20.52 xxxod.net O1 - Hosts: 66.159.20.52 www.xxxod.net O1 - Hosts: 66.159.20.52 altsights.com O1 - Hosts: 66.159.20.52 www.altsights.com O1 - Hosts: 66.159.20.52 adulthosting.com O1 - Hosts: 66.159.20.52 www.adulthosting.com O1 - Hosts: 66.159.20.52 superhova.com O1 - Hosts: 66.159.20.52 www.superhova.com O1 - Hosts: 66.159.20.52 bestpornhost.com O1 - Hosts: 66.159.20.52 www.bestpornhost.com O1 - Hosts: 66.159.20.52 hostingfree.com O1 - Hosts: 66.159.20.52 www.hostingfree.com O1 - Hosts: 66.159.20.52 xfreehosting.com O1 - Hosts: 66.159.20.52 www.xfreehosting.com O1 - Hosts: 66.159.20.52 blinghosting.com O1 - Hosts: 66.159.20.52 www.blinghosting.com O1 - Hosts: 66.159.20.52 x-x-x-hosting.com O1 - Hosts: 66.159.20.52 www.x-x-x-hosting.com O1 - Hosts: 66.159.20.52 pornparks.com O1 - Hosts: 66.159.20.52 www.pornparks.com O1 - Hosts: 66.159.20.52 sexls.com O1 - Hosts: 66.159.20.52 www.sexls.com O1 - Hosts: 66.159.20.52 royalfreehost.com O1 - Hosts: 66.159.20.52 www.royalfreehost.com O1 - Hosts: 66.159.20.52 pleasuremedia.com O1 - Hosts: 66.159.20.52 www.pleasuremedia.com O1 - Hosts: 66.159.20.52 www.mtree.com O1 - Hosts: 66.159.20.52 mtree.com O1 - Hosts: 66.159.20.52 www.dialacom.com O1 - Hosts: 66.159.20.52 dialacom.com O1 - Hosts: 66.159.20.52 nocreditcard.com O1 - Hosts: 66.159.20.52 www.nocreditcard.com O1 - Hosts: 66.159.20.52 movies-etc.com O1 - Hosts: 66.159.20.52 www.movies-etc.com O1 - Hosts: 66.159.20.52 22469.com O1 - Hosts: 66.159.20.52 alehina.com O1 - Hosts: 66.159.20.52 allowednet.com O1 - Hosts: 66.159.20.52 amateurnudephoto.com O1 - Hosts: 66.159.20.52 amateursgonebad.com O1 - Hosts: 66.159.20.52 badbimbo.com O1 - Hosts: 66.159.20.52 beautifulbondage.com O1 - Hosts: 66.159.20.52 big-xxx-movies.com O1 - Hosts: 66.159.20.52 bizshura.com O1 - Hosts: 66.159.20.52 boyanxxx.com O1 - Hosts: 66.159.20.52 cleanadulthost.com O1 - Hosts: 66.159.20.52 cleanpornhost.com O1 - Hosts: 66.159.20.52 cyberxxxhost.com O1 - Hosts: 66.159.20.52 discretesex.com O1 - Hosts: 66.159.20.52 easythumbs.com O1 - Hosts: 66.159.20.52 exscapeporn.com O1 - Hosts: 66.159.20.52 free-freeporn.com O1 - Hosts: 66.159.20.52 freepornofreeporn.com O1 - Hosts: 66.159.20.52 glamourmodelsgonebad.com O1 - Hosts: 66.159.20.52 hot3movie.com O1 - Hosts: 66.159.20.52 hot-adult-clips.com O1 - Hosts: 66.159.20.52 hottestbabes.net O1 - Hosts: 66.159.20.52 huge-cock-big-cock.com O1 - Hosts: 66.159.20.52 hyperfree.com O1 - Hosts: 66.159.20.52 inaughty.com O1 - Hosts: 66.159.20.52 lady-love.com O1 - Hosts: 66.159.20.52 liquidservers.com O1 - Hosts: 66.159.20.52 newsexmovies.com O1 - Hosts: 66.159.20.52 nohiddenfaces.com O1 - Hosts: 66.159.20.52 only10s.com O1 - Hosts: 66.159.20.52 pinkcenterfold.com O1 - Hosts: 66.159.20.52 porn-movies-quality.com O1 - Hosts: 66.159.20.52 pornwarp.com O1 - Hosts: 66.159.20.52 pwgalleries.com O1 - Hosts: 66.159.20.52 sex.com O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\WINDOWS\Downloaded Program Files\ycomp5_1_5_0.dll O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\WINDOWS\Downloaded Program Files\ycomp5_1_5_0.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9 O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.exe O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe O4 - HKLM\..\Run: [mmtask] C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SysCfgLoad] C:\WINNT\explorer.exe O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O4 - Global Startup: webdav.exe O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM) O9 - Extra button: AIM (HKLM) O9 - Extra button: Real.com (HKLM) O9 - Extra button: MoneySide (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37948.5573032407 O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) - http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/yiebio5_1_5_0.cab O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab