Looks like you beat me to the keyboard. Please download ATF-Cleaner to your desktop from this link http://www.atribune.org/content/view/19/2/ We will need it later in safe mode P>Please download ComboFix to the desktop from this link: http://download.bleepingcomputer.com/sUBs/combofix.exe Don't run combofix yet Next, please reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select the first option, to run Windows in Safe Mode, then press "Enter". Choose your usual account. Once in Safe Mode, open the "SmitfraudFix" folder again and double-click "smitfraudfix.cmd" Select option #2 - Clean by typing 2 and press "Enter" to delete infected files. You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing " Y " and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection. The tool will now check if "wininet.dll " is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing "Y" and press "Enter". The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows. A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply. The report can also be found at the root of the system drive, usually at C:\rapport.txt Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Run Combofix. Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running, it may cause your system to hang.) Please post the combofix.txt log Run Hijack This, close all windows and browsers except Hijack This then place a check to the left of the following items and press "fix checked": O2 - BHO: (no name) - {67982BB7-0F95-44C5-92DC-E3AF3DC19D6D} - (no file) O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll O3 - Toolbar: Protection Bar - {0D045BAA-4BD3-4C94-BE8B-21536BD6BD9F} - (no file) O4 - HKLM\..\Run: [Alcmtr] ALCMTR.exe O21 - SSODL: buprestidae - {b59f3ba4-98da-4b5f-8a2d-7b56fb11140b} - C:\WINDOWS\system32\cthkpcv.dll (file missing) Exit Hijack This but remain in safe mode. From safe mode navigate to and delete these files if found: c:\windows\system32\BAE.dll C:\WINDOWS\system32\cthkpcv.dll Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. Post a new Hijack this log please.

0

Answer to response #6....Yes.

0

SmitFraudFix v2.131 Scan done at 11:14:21.60, Fri 12/29/2006 Run from C:\Documents and Settings\Owner\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}"="buprestidae" [HKEY_CLASSES_ROOT\CLSID\{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}\InProcServer32] @="C:\WINDOWS\system32\cthkpcv.dll" [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}\InProcServer32] @="C:\WINDOWS\system32\cthkpcv.dll" »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url Deleted C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url Deleted »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}"="buprestidae" [HKEY_CLASSES_ROOT\CLSID\{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}\InProcServer32] @="C:\WINDOWS\system32\cthkpcv.dll" [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}\InProcServer32] @="C:\WINDOWS\system32\cthkpcv.dll" »»»»»»»»»»»»»»»»»»»»»»»» End it did not ask me to replace the wininet,dll file or restart!

0

Owner - 06-12-29 11:17:23.43 Service Pack 2 ComboFix 06.11.27 - Running from: "C:\Documents and Settings\Owner\Desktop" ((((((((((((((((((((((((((((((( Files Created from 2006-11-29 to 2006-12-29 )))))))))))))))))))))))))))))))))) 2006-12-29 10:40 5,016 --a------ C:\WINDOWS\system32\tmp.reg 2006-12-29 08:44 <DIR> d-------- C:\!KillBox 2006-12-29 08:25 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2006-12-29 08:25 <DIR> d-------- C:\Program Files\Grisoft 2006-12-29 07:33 <DIR> d-------- C:\Program Files\Registry Medic 4 2006-12-29 07:06 <DIR> d-------- C:\Program Files\System Medic 2006-12-29 06:40 <DIR> d-------- C:\Program Files\Enigma Software Group 2006-12-03 15:45 <DIR> d-------- C:\b16453170758ee517186 2006-12-03 15:44 <DIR> d-------- C:\7ce120eb99cf5bad5fae4b5865 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-12-29 11:06 -------- d-------- C:\Program Files\Mozilla Firefox 2006-12-29 08:09 -------- d-------- C:\Program Files\Windows Media Connect 2 2006-12-26 23:46 -------- d-------- C:\Program Files\World of Warcraft 2006-12-22 06:12 -------- d-------- C:\Program Files\Lineage II 2006-12-19 23:54 -------- d-------- C:\Program Files\Outlook Express 2006-12-03 23:37 -------- d-------- C:\Program Files\StarWarsGalaxies 2006-12-03 15:45 -------- d-------- C:\Program Files\Windows Media Player 2006-12-03 15:04 2776 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys 2006-11-24 03:12 -------- d--h----- C:\Program Files\InstallShield Installation Information 2006-11-24 03:12 -------- d-------- C:\Program Files\Electronic Arts 2006-11-20 21:35 -------- d-------- C:\Program Files\QuickTime 2006-11-20 21:35 -------- d-------- C:\Program Files\iTunes 2006-11-20 21:35 -------- d-------- C:\Program Files\iPod 2006-11-17 22:01 -------- d-------- C:\Program Files\MSXML 4.0 2006-11-17 02:45 -------- d-------- C:\Program Files\Sierra 2006-11-17 02:42 -------- d-------- C:\Documents and Settings\Owner\Application Data\InstallShield 2006-11-14 00:21 -------- d-------- C:\Program Files\Firefly Studios 2006-11-11 16:12 -------- d-------- C:\Program Files\Winamp 2006-11-10 02:49 -------- d-------- C:\Program Files\CyberLink 2006-11-08 00:06 679424 --a------ C:\WINDOWS\system32\inetcomm.dll 2006-11-07 23:38 -------- d-------- C:\Documents and Settings\Owner\Application Data\Sony 2006-11-07 23:12 -------- d-------- C:\Program Files\Sony 2006-11-06 04:12 -------- d-------- C:\Program Files\AMD 2006-11-06 04:11 -------- d-------- C:\Program Files\Common Files\Wise Installation Wizard 2006-11-06 04:10 -------- d-------- C:\Program Files\Internet Explorer 2006-11-06 03:59 -------- d-------- C:\Program Files\DIFX 2006-11-04 14:14 1245696 --a------ C:\WINDOWS\system32\msxml4.dll 2006-11-02 02:52 -------- d-------- C:\Program Files\Realtek 2006-11-01 23:46 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2006-11-01 23:11 -------- d-------- C:\Program Files\Atari 2006-10-30 23:04 -------- d-------- C:\Program Files\Logitech 2006-10-27 15:09 6049280 --------- C:\WINDOWS\system32\ieframe.dll 2006-10-27 15:09 50688 --------- C:\WINDOWS\system32\msfeedsbs.dll 2006-10-27 15:09 458752 --------- C:\WINDOWS\system32\msfeeds.dll 2006-10-27 15:09 413696 --a------ C:\WINDOWS\system32\vbscript.dll 2006-10-27 15:09 231424 --a------ C:\WINDOWS\system32\webcheck.dll 2006-10-27 15:09 180736 --------- C:\WINDOWS\system32\ieui.dll 2006-10-27 15:09 156160 --a------ C:\WINDOWS\system32\msls31.dll 2006-10-27 02:44 71680 --a------ C:\WINDOWS\system32\admparse.dll 2006-10-27 02:44 55296 --a------ C:\WINDOWS\system32\iesetup.dll 2006-10-27 02:44 54784 --a------ C:\WINDOWS\system32\ie4uinit.exe 2006-10-27 02:44 43008 --a------ C:\WINDOWS\system32\iernonce.dll 2006-10-27 02:44 382976 --a------ C:\WINDOWS\system32\iedkcs32.dll 2006-10-27 02:44 229376 --a------ C:\WINDOWS\system32\ieaksie.dll 2006-10-27 02:44 152064 --a------ C:\WINDOWS\system32\ieakeng.dll 2006-10-27 02:44 13312 --a------ C:\WINDOWS\system32\ieudinit.exe 2006-10-27 02:44 123904 --a------ C:\WINDOWS\system32\advpack.dll 2006-10-27 02:42 161792 --a------ C:\WINDOWS\system32\ieakui.dll 2006-10-23 16:57 121288 --a------ C:\Documents and Settings\Owner\Application Data\Cosmos Prefs 2006-10-22 12:22 888832 --a------ C:\WINDOWS\system32\nvmobls.dll 2006-10-22 12:22 86016 --a------ C:\WINDOWS\system32\nvmctray.dll 2006-10-22 12:22 81920 --a------ C:\WINDOWS\system32\nvwddi.dll 2006-10-22 12:22 794624 --a------ C:\WINDOWS\system32\nvcplui.exe 2006-10-22 12:22 7700480 --a------ C:\WINDOWS\system32\nvcpl.dll 2006-10-22 12:22 581632 --a------ C:\WINDOWS\system32\nvhwvid.dll 2006-10-22 12:22 5644288 --a------ C:\WINDOWS\system32\nvoglnt.dll 2006-10-22 12:22 5619712 --a------ C:\WINDOWS\system32\nvdisps.dll 2006-10-22 12:22 5255168 --a------ C:\WINDOWS\system32\nvdispsr.dll 2006-10-22 12:22 466944 --a------ C:\WINDOWS\system32\nvshell.dll 2006-10-22 12:22 458752 --a------ C:\WINDOWS\system32\nvmccssr.dll 2006-10-22 12:22 4527488 --a------ C:\WINDOWS\system32\nv4_disp.dll 2006-10-22 12:22 45056 --a------ C:\WINDOWS\system32\nvmccsrs.dll 2006-10-22 12:22 442368 --a------ C:\WINDOWS\system32\nvappbar.exe 2006-10-22 12:22 425984 --a------ C:\WINDOWS\system32\keystone.exe 2006-10-22 12:22 35840 --a------ C:\WINDOWS\system32\nvcodins.dll 2006-10-22 12:22 35840 --a------ C:\WINDOWS\system32\nvcod.dll 2006-10-22 12:22 3203072 --a------ C:\WINDOWS\system32\nvgamesr.dll 2006-10-22 12:22 311296 --a------ C:\WINDOWS\system32\nvexpbar.dll 2006-10-22 12:22 3047424 --a------ C:\WINDOWS\system32\nvgames.dll 2006-10-22 12:22 2973696 --a------ C:\WINDOWS\system32\nvvitvsr.dll 2006-10-22 12:22 2924544 --a------ C:\WINDOWS\system32\nvvitvs.dll 2006-10-22 12:22 286720 --a------ C:\WINDOWS\system32\nvnt4cpl.dll 2006-10-22 12:22 2859008 --a------ C:\WINDOWS\system32\nvmoblsr.dll 2006-10-22 12:22 229376 --a------ C:\WINDOWS\system32\nvmccs.dll 2006-10-22 12:22 212992 --a------ C:\WINDOWS\system32\nvapi.dll 2006-10-22 12:22 188416 --a------ C:\WINDOWS\system32\nvmccss.dll 2006-10-22 12:22 1732608 --a------ C:\WINDOWS\system32\nvwssr.dll 2006-10-22 12:22 1662976 --a------ C:\WINDOWS\system32\nvwdmcpl.dll 2006-10-22 12:22 1622016 --a------ C:\WINDOWS\system32\nwiz.exe 2006-10-22 12:22 159810 --a------ C:\WINDOWS\system32\nvsvc32.exe 2006-10-22 12:22 147456 --a------ C:\WINDOWS\system32\nvcolor.exe 2006-10-22 12:22 1470464 --a------ C:\WINDOWS\system32\nview.dll 2006-10-22 12:22 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe 2006-10-22 12:22 1236992 --a------ C:\WINDOWS\system32\nvwss.dll 2006-10-22 12:22 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll 2006-10-22 12:22 1011712 --a------ C:\WINDOWS\system32\nvcpluir.dll 2006-10-19 08:56 713216 --a------ C:\WINDOWS\system32\sxs.dll 2006-10-18 21:58 8704 --a------ C:\WINDOWS\system32\wdfmgr.exe 2006-10-18 21:58 8704 --a------ C:\WINDOWS\system32\uwdf.exe 2006-10-18 21:47 99840 --a------ C:\WINDOWS\system32\wmpshell.dll 2006-10-18 21:47 991744 --a------ C:\WINDOWS\system32\drmv2clt.dll 2006-10-18 21:47 937984 --a------ C:\WINDOWS\system32\WMNetMgr.dll 2006-10-18 21:47 8231936 --a------ C:\WINDOWS\system32\wmploc.dll 2006-10-18 21:47 767488 --------- C:\WINDOWS\system32\WMVSENCD.dll 2006-10-18 21:47 757248 --a------ C:\WINDOWS\system32\WMADMOD.dll 2006-10-18 21:47 7168 --a------ C:\WINDOWS\system32\asferror.dll 2006-10-18 21:47 656896 --------- C:\WINDOWS\system32\WMVXENCD.dll 2006-10-18 21:47 63488 --a------ C:\WINDOWS\system32\wpdmtpus.dll 2006-10-18 21:47 629760 --a------ C:\WINDOWS\system32\wpd_ci.dll 2006-10-18 21:47 613376 --------- C:\WINDOWS\system32\wmpmde.dll 2006-10-18 21:47 603648 --a------ C:\WINDOWS\system32\WMSPDMOD.dll 2006-10-18 21:47 542720 --a------ C:\WINDOWS\system32\blackbox.dll 2006-10-18 21:47 535040 --a------ C:\WINDOWS\system32\wmdrmsdk.dll 2006-10-18 21:47 429056 --a------ C:\WINDOWS\system32\wmdrmdev.dll 2006-10-18 21:47 414208 --a------ C:\WINDOWS\system32\msscp.dll 2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\wmvdmoe2.dll 2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\wmvdmod.dll 2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\WMVADVE.DLL 2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\WMVADVD.dll 2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\wmsdmoe2.dll 2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\wmsdmod.dll 2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\wdfapi.dll 2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\MPG4DMOD.dll 2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\MP4SDMOD.dll 2006-10-18 21:47 4096 --a------ C:\WINDOWS\system32\MP43DMOD.dll 2006-10-18 21:47 38400 --------- C:\WINDOWS\system32\wpdshextres.dll 2006-10-18 21:47 37376 --a------ C:\WINDOWS\system32\wmdmps.dll 2006-10-18 21:47 35840 --a------ C:\WINDOWS\system32\wpdconns.dll 2006-10-18 21:47 356352 --a------ C:\WINDOWS\system32\wpdsp.dll 2006-10-18 21:47 348672 --a------ C:\WINDOWS\system32\wmdrmnet.dll 2006-10-18 21:47 33792 --a------ C:\WINDOWS\system32\wmdmlog.dll 2006-10-18 21:47 321536 --a------ C:\WINDOWS\system32\mswmdm.dll 2006-10-18 21:47 317440 --------- C:\WINDOWS\system32\MP4SDECD.dll 2006-10-18 21:47 314880 --a------ C:\WINDOWS\system32\wmpdxm.dll 2006-10-18 21:47 295936 --------- C:\WINDOWS\system32\wmpeffects.dll 2006-10-18 21:47 284160 --a------ C:\WINDOWS\system32\portabledeviceapi.dll 2006-10-18 21:47 276992 --a------ C:\WINDOWS\system32\audiodev.dll 2006-10-18 21:47 27136 --a------ C:\WINDOWS\system32\mspmsnsv.dll 2006-10-18 21:47 2603008 --------- C:\WINDOWS\system32\WpdShext.dll 2006-10-18 21:47 259072 --------- C:\WINDOWS\system32\MPG4DECD.dll 2006-10-18 21:47 259072 --------- C:\WINDOWS\system32\MP43DECD.dll 2006-10-18 21:47 2450944 --a------ C:\WINDOWS\system32\wmvcore.dll 2006-10-18 21:47 242688 --a------ C:\WINDOWS\system32\wmpasf.dll 2006-10-18 21:47 229376 --a------ C:\WINDOWS\system32\cewmdm.dll 2006-10-18 21:47 227328 --a------ C:\WINDOWS\system32\wmerror.dll 2006-10-18 21:47 222208 --a------ C:\WINDOWS\system32\wmasf.dll 2006-10-18 21:47 212992 --a------ C:\WINDOWS\system32\MFPLAT.dll 2006-10-18 21:47 211456 --a------ C:\WINDOWS\system32\qasf.dll 2006-10-18 21:47 204288 --a------ C:\WINDOWS\system32\wmpsrcwp.dll 2006-10-18 21:47 199168 --------- C:\WINDOWS\system32\PortableDeviceWMDRM.dll 2006-10-18 21:47 179712 --a------ C:\WINDOWS\system32\msnetobj.dll 2006-10-18 21:47 175616 --a------ C:\WINDOWS\system32\mspmsp.dll 2006-10-18 21:47 166912 --a------ C:\WINDOWS\system32\portabledevicetypes.dll 2006-10-18 21:47 1661440 --a------ C:\WINDOWS\system32\wmpencen.dll 2006-10-18 21:47 1574912 --------- C:\WINDOWS\system32\WMVENCOD.dll 2006-10-18 21:47 157184 --a------ C:\WINDOWS\system32\wmidx.dll 2006-10-18 21:47 154624 --a------ C:\WINDOWS\system32\wpdmtp.dll 2006-10-18 21:47 1543680 --------- C:\WINDOWS\system32\WMVDECOD.dll 2006-10-18 21:47 1382912 --------- C:\WINDOWS\system32\WMVSDECD.dll 2006-10-18 21:47 133632 --a------ C:\WINDOWS\system32\wpdshserviceobj.dll 2006-10-18 21:47 1329152 --a------ C:\WINDOWS\system32\WMSPDMOE.dll 2006-10-18 21:47 132096 --------- C:\WINDOWS\system32\PortableDeviceWiaCompat.dll 2006-10-18 21:47 130048 --------- C:\WINDOWS\system32\wmpps.dll 2006-10-18 21:47 11264 --a------ C:\WINDOWS\system32\LAPRXY.dll 2006-10-18 21:47 1117696 --a------ C:\WINDOWS\system32\WMADMOE.dll 2006-10-18 21:47 101888 --------- C:\WINDOWS\system32\PortableDeviceClassExtension.dll 2006-10-18 20:03 100864 --a------ C:\WINDOWS\system32\logagent.exe 2006-10-18 20:00 249856 --a------ C:\WINDOWS\system32\drmupgds.exe 2006-10-18 20:00 17408 --------- C:\WINDOWS\system32\wpdshextautoplay.exe 2006-10-17 13:06 78336 --a------ C:\WINDOWS\system32\ieencode.dll 2006-10-17 13:05 40960 --a------ C:\WINDOWS\system32\licmgr10.dll 2006-10-17 13:05 206336 --------- C:\WINDOWS\system32\WinFXDocObj.exe 2006-10-17 13:05 105984 --a------ C:\WINDOWS\system32\url.dll 2006-10-17 13:04 101376 --a------ C:\WINDOWS\system32\occache.dll 2006-10-17 13:03 17408 --a------ C:\WINDOWS\system32\corpol.dll 2006-10-17 12:58 61952 --------- C:\WINDOWS\system32\icardie.dll 2006-10-17 12:58 12288 --------- C:\WINDOWS\system32\msfeedssync.exe 2006-10-17 12:57 36352 --a------ C:\WINDOWS\system32\imgutil.dll 2006-10-17 12:57 266752 --------- C:\WINDOWS\system32\iertutil.dll 2006-10-17 12:56 45568 --a------ C:\WINDOWS\system32\mshta.exe 2006-10-17 12:28 48128 --a------ C:\WINDOWS\system32\mshtmler.dll 2006-10-17 12:27 380928 --------- C:\WINDOWS\system32\ieapfltr.dll 2006-10-13 07:35 65536 --a------ C:\WINDOWS\system32\nwwks.dll 2006-10-13 07:35 64000 --a------ C:\WINDOWS\system32\nwapi32.dll 2006-10-13 07:35 142336 --a------ C:\WINDOWS\system32\nwprovau.dll 2006-10-09 16:15 1669632 --a------ C:\WINDOWS\system32\msvidctl.dll 2006-10-09 16:12 456192 --a------ C:\WINDOWS\system32\encdec.dll 2006-10-09 16:12 291840 --a------ C:\WINDOWS\system32\sbe.dll 2006-10-09 16:12 235008 --------- C:\WINDOWS\system32\psisdecd.dll 2006-10-02 15:28 312128 --------- C:\WINDOWS\system32\msdelta.dll 2006-10-02 09:56 2508 --a------ C:\Documents and Settings\Owner\Application Data\$_hpcst$.hpc (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "LDM"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe" "Aim6"="" "BullGuard"="\"C:\\Program Files\\BullGuard Software\\BullGuard\\bullguard.exe\"" "swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.908.5008\\GoogleToolbarNotifier.exe" "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "EA Core"="\"C:\\Program Files\\Electronic Arts\\EA Link\\Core.exe\" -silent" "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "ehTray"="C:\\WINDOWS\\ehome\\ehtray.exe" "High Definition Audio Property Page Shortcut"="HDAShCut.exe" "readericon"="C:\\Program Files\\Digital Media Reader\\readericon45G.exe" "Reminder"=hex(2):25,57,49,4e,44,49,52,25,5c,43,72,65,61,74,6f,72,5c,52,65,6d,\ 69,6e,64,5f,58,50,2e,65,78,65,00 "Recguard"=hex(2):25,57,49,4e,44,49,52,25,5c,53,4d,49,4e,53,54,5c,52,45,43,47,\ 55,41,52,44,2e,45,58,45,00 "MSKDetectorExe"="C:\\Program Files\\McAfee\\SpamKiller\\MSKDetct.exe /uninstall" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "EPSON Stylus Photo R340 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIAJA.exe /P30 \"EPSON Stylus Photo R340 Series\" /O6 \"USB001\" /M \"Stylus Photo R340\"" "LogitechCommunicationsManager"="\"C:\\Program Files\\Common Files\\Logitech\\LComMgr\\Communications_Helper.exe\"" "LogitechQuickCamRibbon"="\"C:\\Program Files\\Logitech\\QuickCam10\\QuickCam10.exe\" /hide" "LVCOMSX"="\"C:\\Program Files\\Common Files\\Logitech\\LComMgr\\LVComSX.exe\"" "HostManager"="C:\\Program Files\\Common Files\\AOL\\1158812882\\ee\\AOLSoftware.exe" "IPHSend"="C:\\Program Files\\Common Files\\AOL\\IPHSend\\IPHSend.exe" "RTHDCPL"="RTHDCPL.EXE" "Alcmtr"="ALCMTR.EXE" "amd_dc_opt"="\"C:\\Program Files\\AMD\\amd_dc_opt\\amd_dc_opt.exe\"" "NvMediaCenter"="RunDLL32.exe NvMCTray.dll,NvTaskbarInit" "LanguageShortcut"="\"C:\\Program Files\\CyberLink\\PowerDVD\\Language\\Language.exe\"" "WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "SpyHunter"="C:\\Program Files\\Enigma Software Group\\SpyHunter\\SpyHunter.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Power2GoExpress"="NA" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "Power2GoExpress"="NA" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" "{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}"="buprestidae" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000095 "NoStartBanner"=hex:01 "NoControlPanel"=dword:00000000 "NoNetHood"=dword:00000000 "NoComputersNearMe"=dword:00000000 "NoDrives"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 "InstallVisualStyle"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,\ 63,65,73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,5c,52,6f,79,61,6c,65,2e,\ 6d,73,73,74,79,6c,65,73,00 "InstallTheme"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,63,65,\ 73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,2e,74,68,65,6d,65,00 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoControlPanel"=dword:00000000 "NoComputersNearMe"=dword:00000000 "NoDrives"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" "WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" "buprestidae"="{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\AppleSoftwareUpdate.job Completion time: 06-12-29 11:17:46.68 C:\ComboFix.txt ... 06-12-29 11:17 here is the post from combofix!

0

Logfile of HijackThis v1.99.1 Scan saved at 11:33:18 AM, on 12/29/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe C:\WINDOWS\Explorer.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\BullGuard Software\BullGuard\BullGuardUpdate.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\WINDOWS\ehome\ehtray.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\Program Files\Digital Media Reader\readericon45G.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAJA.exe C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe C:\Program Files\Logitech\QuickCam10\QuickCam10.exe C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe C:\WINDOWS\RTHDCPL.exe C:\WINDOWS\system32\RunDLL32.exe C:\Program Files\Common Files\AOL\1158812882\ee\aolsoftware.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Logitech\QuickCam10\COCIManager.exe C:\PROGRA~1\MOZILL~1\FIREFOX.exe C:\Documents and Settings\Owner\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM\..\Run: [readericon] C:\Program Files\Digital Media Reader\readericon45G.exe O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.exe O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [EPSON Stylus Photo R340 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAJA.exe /P30 "EPSON Stylus Photo R340 Series" /O6 "USB001" /M "Stylus Photo R340" O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe" O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe" O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1158812882\ee\AOLSoftware.exe O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.exe O4 - HKLM\..\Run: [amd_dc_opt] "C:\Program Files\AMD\amd_dc_opt\amd_dc_opt.exe" O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - HKCU\..\Run: [BullGuard] "C:\Program Files\BullGuard Software\BullGuard\bullguard.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EA Link\Core.exe" -silent O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\bigfix.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Owner\Start Menu\Programs\IMVU\Run IMVU.lnk O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O18 - Protocol: bw+0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw+0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: bwg0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwg0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0s - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: offline-8876480 - {1BCB5649-C978-420D-85FE-9D8C8144732E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: BullGuard LiveUpdate (BGLiveSvc) - BullGuard Software - C:\Program Files\BullGuard Software\BullGuard\BullGuardUpdate.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\Logitech\SrvLnch\SrvLnch.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe and finally here is the new hijack this file!

0

Run this reg file to keep this useless file from trying to use resources and your computer should be clean. Open notepad (Start Menu > Run > Type notepad and press "ok". Copy and paste everything into notepad between the x's making regedit4 the top line. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "Alcmtr"=- XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it Fix.reg then save it to your desktop. Double click Fix.reg (or right click and choose Merge) and it will ask if you want to merge the contents into the registry, choose Yes. I don't see "java" list in you HJT log. Go to start> control panel> add/remove programs and look at your java listings the newest version is JRE 1-6-0. That could be a security loop hole. Download the latest version of http://java.sun.com/javase/downloads/index.jsp Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications". Click the "Download" button to the right. Check the box that says: "Accept License Agreement". The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed . Then from your desktop double-click on jre-1_6_0-windowsi586-p.exe to install the newest version. You should consider adding "Spywareblaster" to your arsenol of antispyware tools, just do a google search for spywareblaster, download it,install it, and update it. Its free and runs in the background, so you don't actually run it, and re-writes malicious script before it can install on your computer. Look for updates weekly as there is no auto-update on the free version.

0

thanks for the help

0

Your Welcome, glad we could help.

0