onlilife

Hello again, i will post the mbam log first, as i have trouble with kaspersky scanner, been trying the whole day and always got stuck at 40%. MBAM Malwarebytes' Anti-Malware 1.30 Database version: 1358 Windows 5.1.2600 Service Pack 3 11/3/2008 8:21:36 PM mbam-log-2008-11-03 (20-21-36).txt Scan type: Quick Scan Objects scanned: 50417 Time elapsed: 3 minute(s), 9 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

Hello jean, will let my sis know asap, n thx for mentioning.

I hav try to open task manger, and it works fine now, thx a lot roschach112, i really appiciate your help, thx again

OTMoveIt3 ========== PROCESSES ========== Process explorer.exe killed successfully. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\DisableRegistryTools deleted successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\DisableTaskMgr deleted successfully. Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1cd9d87c-a59e-11dd-ba28-0019dbb54ec5}\\ deleted successfully. Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d21561a4-6eab-11dd-b9b5-0019dbb54ec5}\\ deleted successfully. ========== FILES ========== C:\WINDOWS\system32\Flashy.exe moved successfully. File/Folder G:\Winnie.exe not found. File/Folder C:\Documents and Settings\Zj\Start Menu\Programs\Startup\systemID.pif not found. ========== COMMANDS ========== File delete failed. C:\DOCUME~1\Zj\LOCALS~1\Temp\etilqs_emxFXFEI0BzIZEX15Pcn scheduled to be deleted on reboot. User's Temp folder emptied. User's Temporary Internet Files folder emptied. User's Internet Explorer cache folder emptied. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_4e0.dat scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_001_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_002_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_003_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\urlclassifier3.sqlite scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\XUL.mfl scheduled to be deleted on reboot. FireFox cache emptied. Temp folders emptied. Explorer started successfully RSIT log.txt Logfile of random's system information tool 1.04 (written by random/random) Run by Zj at 2008-11-02 02:30:45 Microsoft Windows XP Professional Service Pack 3 System drive C: has 33 GB (11%) free of 305 GB Total RAM: 2047 MB (77% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:30:46 AM, on 11/2/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\PPStream\ppsap.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\DAEMON Tools Pro\DTProAgent.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Zj\Desktop\RSIT.exe C:\Program Files\Trend Micro\HijackThis\Zj.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - (no file) O2 - BHO: ThunderAtOnce Class - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: (no name) - {0EEDB912-C5FA-486F-8334-57288578C627} - (no file) O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Thunder Browser Helper - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: PPVADownloader - {A986E409-30CC-4185-89BB-AB212C104524} - C:\Program Files\PPLiveVA\DownloaderManager.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [sW24] C:\WINDOWS\system32\sw24.exe O4 - HKLM\..\Run: [sW20] C:\WINDOWS\system32\sw20.exe O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [PPS Accelerator] C:\Program Files\PPStream\ppsap.exe O4 - HKCU\..\Run: [PPLiveVA] C:\Program Files\PPLiveVA\PPLiveVA.exe /LoadModule PPVA.DLL /M REAL /S 0 /T 0 O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [iDMan] C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IDMan.exe /onboot O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" O4 - HKCU\..\Run: [ares vista] "C:\Program Files\Ares\Ares.exe" -h O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O8 - Extra context menu item: Download all links with IDM - C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IEGetAll.htm O8 - Extra context menu item: Download FLV video content with IDM - C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IEGetVL.htm O8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Crux P2P\Plugins\RazaWebHook.dll/3000 O8 - Extra context menu item: Download with IDM - C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IEExt.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button:

Hi again, the usb which hav flashy its actually a tumbdrive from my sis, i need to collect it from her b4 i can continue, i will post back asap , pls be patience with me, if there is other way to get rid of it without the tumbdrive, pls let me know, thx a lot

Thx for the fast reply, here's the log OTMoveIt3 ========== PROCESSES ========== Process explorer.exe killed successfully. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== C:\DOCUME~1\Zj\Application Data\uTorrent\Crysis Warhead Crack.torrent moved successfully. C:\DOCUME~1\Zj\Application Data\uTorrent\FIFA.09.Crackfix-RELOADED.torrent moved successfully. C:\DOCUME~1\Zj\Application Data\uTorrent\Pro Evolution Soccer 2008 (Crack and Serial) by SMoKE (FIXED).torrent moved successfully. C:\DOCUME~1\Zj\Application Data\uTorrent\Pro Evolution Soccer 2009 Keygen Serial FIXED - Play Online PC PES 2009.torrent moved successfully. C:\DOCUME~1\Zj\Application Data\uTorrent\SporeCrack.torrent moved successfully. C:\DOCUME~1\Zj\Application Data\uTorrent\The two worlds keygen.rar.torrent moved successfully. ========== COMMANDS ========== File delete failed. C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IDMan.exe scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\idmmkb.dll scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\Zj\LOCALS~1\Temp\etilqs_J0laS9E3C85KF9FWiY4Y scheduled to be deleted on reboot. User's Temp folder emptied. User's Temporary Internet Files folder emptied. User's Internet Explorer cache folder emptied. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_754.dat scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_001_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_002_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_003_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\urlclassifier3.sqlite scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\XUL.mfl scheduled to be deleted on reboot. FireFox cache emptied. Temp folders emptied. Explorer started successfully OTMoveIt3 by OldTimer - Version 1.0.7.0 log created on 11022008_000751 Files moved on Reboot... C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IDMan.exe moved successfully. DllUnregisterServer procedure not found in C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\idmmkb.dll C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\idmmkb.dll NOT unregistered. C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\idmmkb.dll moved successfully. File C:\DOCUME~1\Zj\LOCALS~1\Temp\etilqs_J0laS9E3C85KF9FWiY4Y not found! File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot. File C:\WINDOWS\temp\Perflib_Perfdata_754.dat not found! C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_001_ moved successfully. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_002_ moved successfully. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_003_ moved successfully. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\Cache\_CACHE_MAP_ moved successfully. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\urlclassifier3.sqlite moved successfully. C:\Documents and Settings\Zj\Local Settings\Application Data\Mozilla\Firefox\Profiles\w1i4kg0t.default\XUL.mfl moved successfully. RSIT log.txt Logfile of random's system information tool 1.04 (written by random/random) Run by Zj at 2008-11-02 00:13:05 Microsoft Windows XP Professional Service Pack 3 System drive C: has 33 GB (11%) free of 305 GB Total RAM: 2047 MB (77% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:13:07 AM, on 11/2/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe C:\WINDOWS\system32\Flashy.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\PPStream\ppsap.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\DAEMON Tools Pro\DTProAgent.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Zj\Desktop\RSIT.exe C:\Program Files\Trend Micro\HijackThis\Zj.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - (no file) O2 - BHO: ThunderAtOnce Class - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: (no name) - {0EEDB912-C5FA-486F-8334-57288578C627} - (no file) O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Thunder Browser Helper - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: PPVADownloader - {A986E409-30CC-4185-89BB-AB212C104524} - C:\Program Files\PPLiveVA\DownloaderManager.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [sW24] C:\WINDOWS\system32\sw24.exe O4 - HKLM\..\Run: [sW20] C:\WINDOWS\system32\sw20.exe O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Flashy Bot] C:\WINDOWS\system32\Flashy.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [PPS Accelerator] C:\Program Files\PPStream\ppsap.exe O4 - HKCU\..\Run: [PPLiveVA] C:\Program Files\PPLiveVA\PPLiveVA.exe /LoadModule PPVA.DLL /M REAL /S 0 /T 0 O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [iDMan] C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IDMan.exe /onboot O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" O4 - HKCU\..\Run: [ares vista] "C:\Program Files\Ares\Ares.exe" -h O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - Startup: systemID.pif = ? O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8 - Extra context menu item: Download all links with IDM - C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IEGetAll.htm O8 - Extra context menu item: Download FLV video content with IDM - C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IEGetVL.htm O8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Crux P2P\Plugins\RazaWebHook.dll/3000 O8 - Extra context menu item: Download with IDM - C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IEExt.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button:

Hi, again here's the log --------------------\\ Lop S&D 4.2.4-9b XP/Vista Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3 X86-based PC ( Multiprocessor Free : Intel® Core2 Duo CPU E6750 @ 2.66GHz ) BIOS : Default System BIOS USER : Zj ( Administrator ) BOOT : Normal boot C:\ (Local Disk) - NTFS - Total:298 Go (Free:29 Go) D:\ (CD or DVD) E:\ (CD or DVD) F:\ (CD or DVD) "C:\Lop SD" ( MAJ : 01-11-2008|04:15 ) Option : [1] ( Sat 11/01/2008|23:56 ) --------------------\\ Listing folders in APPLIC~1 [10/25/2008|08:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> {0691F710-1ECA-4B5A-9727-25554F1BFDC6} [10/27/2008|05:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> {3276BE95_AF08_429F_A64F_CA64CB79BCF6} [10/18/2008|12:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Adobe [08/21/2008|02:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Apple [08/21/2008|02:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Apple Computer [09/26/2008|11:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Creative [09/30/2008|10:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> DAEMON Tools Pro [09/27/2008|07:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Jlcm [08/25/2008|10:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Kodak [10/16/2008|10:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> KONAMI [08/20/2008|10:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Malwarebytes [09/11/2008|10:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Microsoft [10/16/2008|03:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Microsoft Help [09/29/2008|01:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Naked Brothers Band [10/01/2008|04:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> PPLive [10/12/2008|08:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> PPLiveVA [11/01/2008|04:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> PPLiveVAPPLiveVAShareFlv [11/01/2008|03:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Spybot - Search & Destroy [10/31/2008|11:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> SUPERAntiSpyware.com [09/23/2008|11:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Thunder Network [10/31/2008|02:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> thunder_vod_cache [10/12/2008|03:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> TVU Networks [08/24/2008|02:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Windows Genuine Advantage [09/11/2008|10:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> WLInstaller [10/30/2008|10:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Yahoo! Companion [08/20/2008|10:03] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Microsoft [08/20/2008|10:03] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> Microsoft [08/20/2008|10:03] C:\DOCUME~1\NETWOR~1\APPLIC~1\<DIR> Microsoft [10/18/2008|12:22] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Adobe [08/22/2008|02:24] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Apple Computer [08/22/2008|12:10] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Bearshare Premium P2P [09/11/2008|02:14] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Carnival Software [09/26/2008|11:00] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Creative [08/20/2008|11:11] C:\DOCUME~1\Zj\APPLIC~1\<DIR> DAEMON Tools [09/30/2008|10:07] C:\DOCUME~1\Zj\APPLIC~1\<DIR> DAEMON Tools Pro [11/01/2008|04:32] C:\DOCUME~1\Zj\APPLIC~1\<DIR> DMCache [09/23/2008|04:26] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Gearbox Software [09/25/2008|03:19] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Hamachi [09/28/2008|07:13] C:\DOCUME~1\Zj\APPLIC~1\<DIR> HTML Executable [08/20/2008|10:09] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Identities [09/17/2008|01:29] C:\DOCUME~1\Zj\APPLIC~1\<DIR> IDM [08/25/2008|01:22] C:\DOCUME~1\Zj\APPLIC~1\<DIR> ImgBurn [10/02/2008|03:48] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Leadertech [08/20/2008|08:39] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Macromedia [08/20/2008|10:41] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Malwarebytes [08/22/2008|02:28] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Media Player Classic [09/22/2008|01:42] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Microsoft [09/28/2008|12:04] C:\DOCUME~1\Zj\APPLIC~1\<DIR> mIRC [08/20/2008|10:27] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Mozilla [09/24/2008|03:31] C:\DOCUME~1\Zj\APPLIC~1\<DIR> PPLive [09/27/2008|08:04] C:\DOCUME~1\Zj\APPLIC~1\<DIR> PPLiveVA [10/02/2008|03:16] C:\DOCUME~1\Zj\APPLIC~1\<DIR> PPStream [08/22/2008|10:04] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Real [08/20/2008|08:07] C:\DOCUME~1\Zj\APPLIC~1\<DIR> SecuROM [09/11/2008|06:28] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Shareaza [08/24/2008|05:45] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Skinux [09/11/2008|06:24] C:\DOCUME~1\Zj\APPLIC~1\<DIR> SPORE [09/17/2008|01:34] C:\DOCUME~1\Zj\APPLIC~1\<DIR> Sun [10/31/2008|11:24] C:\DOCUME~1\Zj\APPLIC~1\<DIR> SUPERAntiSpyware.com [08/20/2008|08:30] C:\DOCUME~1\Zj\APPLIC~1\<DIR> TmpRecentIcons [09/27/2008|08:19] C:\DOCUME~1\Zj\APPLIC~1\<DIR> TVU Networks [11/01/2008|11:52] C:\DOCUME~1\Zj\APPLIC~1\<DIR> uTorrent [09/24/2008|03:48] C:\DOCUME~1\Zj\APPLIC~1\<DIR> vlc [08/20/2008|10:36] C:\DOCUME~1\Zj\APPLIC~1\<DIR> WinRAR --------------------\\ Scheduled Tasks located in C:\WINDOWS\Tasks [10/27/2008 05:30 PM][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job [11/01/2008 04:13 PM][--ah-----] C:\WINDOWS\tasks\SA.DAT [08/24/2001 04:00 AM][-r-h-----] C:\WINDOWS\tasks\desktop.ini --------------------\\ Listing Folders in C:\Program Files [10/08/2008|11:02] C:\Program Files\<DIR> 7-Zip [10/14/2008|11:42] C:\Program Files\<DIR> Activision [10/18/2008|12:22] C:\Program Files\<DIR> Adobe [09/21/2008|06:52] C:\Program Files\<DIR> AGEIA Technologies [09/11/2008|06:14] C:\Program Files\<DIR> Apple Software Update [08/22/2008|05:09] C:\Program Files\<DIR> Ares [09/02/2008|03:16] C:\Program Files\<DIR> AviSynth 2.5 [09/28/2008|07:46] C:\Program Files\<DIR> Bonjour [09/11/2008|02:14] C:\Program Files\<DIR> Caricature Studio Green 3.6 [08/20/2008|11:19] C:\Program Files\<DIR> CCleaner [10/18/2008|12:22] C:\Program Files\<DIR> Common Files [09/27/2008|03:14] C:\Program Files\<DIR> Creative [09/30/2008|10:08] C:\Program Files\<DIR> DAEMON Tools Pro [09/02/2008|01:13] C:\Program Files\<DIR> Devious Codeworks [08/25/2008|01:00] C:\Program Files\<DIR> DVD Decrypter [09/11/2008|11:13] C:\Program Files\<DIR> EA GAMES [10/02/2008|03:38] C:\Program Files\<DIR> EA Sports [10/25/2008|08:40] C:\Program Files\<DIR> Electronic Arts [11/01/2008|09:01] C:\Program Files\<DIR> eMule [09/02/2008|03:16] C:\Program Files\<DIR> eRightSoft [09/06/2008|11:11] C:\Program Files\<DIR> Hamachi [08/25/2008|01:05] C:\Program Files\<DIR> ImgBurn [10/25/2008|08:40] C:\Program Files\<DIR> InstallShield Installation Information [08/20/2008|10:16] C:\Program Files\<DIR> Intel [08/20/2008|08:28] C:\Program Files\<DIR> Internet Download Manager [10/16/2008|03:02] C:\Program Files\<DIR> Internet Explorer [10/27/2008|05:54] C:\Program Files\<DIR> iPod [10/25/2008|08:36] C:\Program Files\<DIR> Irrational Games [10/27/2008|05:55] C:\Program Files\<DIR> iTunes [09/02/2008|03:15] C:\Program Files\<DIR> IVMLAB [10/31/2008|11:21] C:\Program Files\<DIR> Java [09/11/2008|06:28] C:\Program Files\<DIR> KCeasy [08/22/2008|02:26] C:\Program Files\<DIR> K-Lite Codec Pack [08/25/2008|10:01] C:\Program Files\<DIR> Kodak [09/09/2008|02:15] C:\Program Files\<DIR> Koei [10/27/2008|12:21] C:\Program Files\<DIR> KONAMI [09/08/2008|07:49] C:\Program Files\<DIR> Lionhead Studios [09/02/2008|03:52] C:\Program Files\<DIR> MagicISO [10/30/2008|11:04] C:\Program Files\<DIR> Malwarebytes' Anti-Malware [09/26/2008|03:00] C:\Program Files\<DIR> Messenger [08/20/2008|10:03] C:\Program Files\<DIR> microsoft frontpage [08/28/2008|06:09] C:\Program Files\<DIR> Microsoft Office [08/28/2008|06:09] C:\Program Files\<DIR> Microsoft Visual Studio [08/28/2008|06:07] C:\Program Files\<DIR> Microsoft Visual Studio 8 [08/28/2008|06:09] C:\Program Files\<DIR> Microsoft Works [08/28/2008|06:08] C:\Program Files\<DIR> Microsoft.NET [09/28/2008|12:04] C:\Program Files\<DIR> mIRC [09/25/2008|03:12] C:\Program Files\<DIR> Movie Maker [11/01/2008|11:21] C:\Program Files\<DIR> Mozilla Firefox [08/28/2008|06:09] C:\Program Files\<DIR> MSBuild [08/20/2008|09:59] C:\Program Files\<DIR> MSN [08/20/2008|10:00] C:\Program Files\<DIR> MSN Gaming Zone [09/25/2008|03:10] C:\Program Files\<DIR> NetMeeting [09/17/2008|04:22] C:\Program Files\<DIR> Night Watch [08/20/2008|10:00] C:\Program Files\<DIR> Online Services [09/25/2008|03:10] C:\Program Files\<DIR> Outlook Express [09/13/2008|09:50] C:\Program Files\<DIR> P2P_Energy [11/01/2008|04:39] C:\Program Files\<DIR> Panda Security [10/05/2008|10:29] C:\Program Files\<DIR> PPLive [11/01/2008|04:33] C:\Program Files\<DIR> PPLiveVA [10/12/2008|03:50] C:\Program Files\<DIR> PPStream [09/11/2008|12:12] C:\Program Files\<DIR> QuickTime [08/22/2008|10:03] C:\Program Files\<DIR> Real [09/05/2008|04:20] C:\Program Files\<DIR> Reality Pump [08/20/2008|10:17] C:\Program Files\<DIR> Realtek [09/28/2008|08:16] C:\Program Files\<DIR> SatelliteTVforPC [11/01/2008|03:27] C:\Program Files\<DIR> Spybot - Search & Destroy [10/31/2008|11:24] C:\Program Files\<DIR> SUPERAntiSpyware [09/11/2008|08:39] C:\Program Files\<DIR> The Adventure Company [10/01/2008|09:58] C:\Program Files\<DIR> The Witcher [09/23/2008|11:41] C:\Program Files\<DIR> Thunder Network [11/01/2008|05:44] C:\Program Files\<DIR> Trend Micro [09/28/2008|08:17] C:\Program Files\<DIR> TVAnts [10/12/2008|03:52] C:\Program Files\<DIR> TVUPlayer [09/23/2008|04:09] C:\Program Files\<DIR> Ubisoft [08/20/2008|10:09] C:\Program Files\<DIR> Uninstall Information [10/01/2008|12:20] C:\Program Files\<DIR> Universal Extractor [10/03/2008|05:10] C:\Program Files\<DIR> USB Vibration [08/20/2008|10:29] C:\Program Files\<DIR> uTorrent [09/24/2008|03:46] C:\Program Files\<DIR> VideoLAN [11/01/2008|11:21] C:\Program Files\<DIR> Warcraft III [09/11/2008|10:15] C:\Program Files\<DIR> Windows Live [09/11/2008|10:18] C:\Program Files\<DIR> Windows Live Safety Center [10/09/2008|06:41] C:\Program Files\<DIR> Windows Media Player [09/25/2008|03:10] C:\Program Files\<DIR> Windows NT [08/20/2008|10:02] C:\Program Files\<DIR> WindowsUpdate [08/20/2008|10:36] C:\Program Files\<DIR> WinRAR [08/20/2008|10:03] C:\Program Files\<DIR> xerox [10/30/2008|09:46] C:\Program Files\<DIR> Yahoo! [09/08/2008|10:30] C:\Program Files\<DIR> ZincPlay --------------------\\ Listing Folders in C:\Program Files\Common Files [10/18/2008|12:21] C:\Program Files\Common Files\<DIR> Adobe [10/18/2008|12:22] C:\Program Files\Common Files\<DIR> Adobe AIR [09/11/2008|12:11] C:\Program Files\Common Files\<DIR> Apple [08/28/2008|06:09] C:\Program Files\Common Files\<DIR> DESIGNER [09/22/2008|01:44] C:\Program Files\Common Files\<DIR> INCA Shared [10/25/2008|08:36] C:\Program Files\Common Files\<DIR> InstallShield [08/21/2008|11:53] C:\Program Files\Common Files\<DIR> Java [09/11/2008|10:15] C:\Program Files\Common Files\<DIR> Microsoft Shared [08/20/2008|10:01] C:\Program Files\Common Files\<DIR> MSSoap [08/20/2008|01:22] C:\Program Files\Common Files\<DIR> ODBC [08/22/2008|10:03] C:\Program Files\Common Files\<DIR> Real [08/20/2008|10:01] C:\Program Files\Common Files\<DIR> Services [08/20/2008|01:22] C:\Program Files\Common Files\<DIR> SpeechEngines [09/25/2008|03:10] C:\Program Files\Common Files\<DIR> System [09/23/2008|11:41] C:\Program Files\Common Files\<DIR> Thunder Network [09/11/2008|10:15] C:\Program Files\Common Files\<DIR> WindowsLiveInstaller [10/31/2008|11:23] C:\Program Files\Common Files\<DIR> Wise Installation Wizard [08/22/2008|10:03] C:\Program Files\Common Files\<DIR> xing shared --------------------\\ Process ( 37 Processes ) ... OK ! --------------------\\ Searching with S_Lop No Lop folder found ! --------------------\\ Searching for Lop Files - Folders No Lop folder found ! --------------------\\ Searching within the Registry ..... OK ! --------------------\\ Checking the Hosts file Hosts file CLEAN --------------------\\ Searching for hidden files with Catchme catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-01 23:56:46 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden files: 0 --------------------\\ Searching for other infections --------------------\\ Cracks & Keygens .. C:\DOCUME~1\Zj\Application Data\uTorrent\Crysis Warhead Crack.torrent C:\DOCUME~1\Zj\Application Data\uTorrent\FIFA.09.Crackfix-RELOADED.torrent C:\DOCUME~1\Zj\Application Data\uTorrent\Pro Evolution Soccer 2008 (Crack and Serial) by SMoKE (FIXED).torrent C:\DOCUME~1\Zj\Application Data\uTorrent\Pro Evolution Soccer 2009 Keygen Serial FIXED - Play Online PC PES 2009.torrent C:\DOCUME~1\Zj\Application Data\uTorrent\SporeCrack.torrent C:\DOCUME~1\Zj\Application Data\uTorrent\The two worlds keygen.rar.torrent [F:41][D:14]-> C:\DOCUME~1\Zj\LOCALS~1\Temp [F:21][D:0]-> C:\DOCUME~1\Zj\Cookies [F:432][D:4]-> C:\DOCUME~1\Zj\LOCALS~1\TEMPOR~1\content.IE5 1 - "C:\Lop SD\LopR_1.txt" - Sat 11/01/2008|23:25 - Option : [1] 2 - "C:\Lop SD\LopR_2.txt" - Sat 11/01/2008|23:49 - Option : [1] 3 - "C:\Lop SD\LopR_3.txt" - Sat 11/01/2008|23:53 - Option : [1] 4 - "C:\Lop SD\LopR_4.txt" - Sat 11/01/2008|23:57 - Option : [1] --------------------\\ Scan completed at 23:57:08

Hi to everyone out there, i hav a problem with task manger, whenever i press Clt, alt, delete, instead of the task manager, windows pop up a message saying task manager have been disable by the administrator, also when try to run regedit, the same message came out. if anyone knows hw to solve this pls help me out, thx in advance. MBAM Log - ----------------------------------- Malwarebytes' Anti-Malware 1.30 Database version: 1349 Windows 5.1.2600 Service Pack 3 11/1/2008 6:15:03 PM mbam-log-2008-11-01 (18-15-03).txt Scan type: Full Scan (C:\|) Objects scanned: 123766 Time elapsed: 28 minute(s), 28 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ---------------------------------- Panda scan ;******************************************************************************* ******************************************************************************** * ******************* ANALYSIS: 2008-11-01 17:42:36 PROTECTIONS: 0 MALWARE: 9 SUSPECTS: 1 ;******************************************************************************* ******************************************************************************** * ******************* PROTECTIONS Description Version Active Updated ;=============================================================================== ================================================================================ = =================== ;=============================================================================== ================================================================================ = =================== MALWARE Id Description Type Active Severity Disinfectable Disinfected Location ;=============================================================================== ================================================================================ = =================== 00020994 W32/Bagle.pwdzip Virus No 0 Yes No C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinDisableri1.zip 00055170 mIRC/Gen Virus/Worm No 0 Yes No C:\Program Files\ZincPlay\Zion\mirc.ini 00055170 mIRC/Gen Virus/Worm No 0 Yes No C:\Program Files\ZincPlay\Zion\defaults\mirc.ini 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Zj\Cookies\zj@atdmt[1].txt 00172825 Joke/Stress Jokes No 0 Yes No C:\Documents and Settings\Zj\Desktop\Mass Folder\Desktop Pet\stress reducers.exe 00249874 application/alfacleaner HackTools No 0 Yes No c:\documents and settings\zj\application data\skinux 00366659 Trj/Flashy.B Virus/Trojan Yes 1 Yes No C:\Documents and Settings\Zj\Start Menu\Programs\Startup\systemID.pif 00366659 Trj/Flashy.B Virus/Trojan No 0 Yes No c:\windows\system32\flashy.exe 00366659 Trj/Flashy.B Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{C8F90F4F-756E-44D6-A309-0118A669550F}\RP127\A0019276.exe 00437348 Trj/Multidropper.ROJ Virus/Trojan No 1 No No C:\System Volume Information\_restore{C8F90F4F-756E-44D6-A309-0118A669550F}\RP127\A0018953.exe[C:\System Volume Information\_restore{C8F90F4F-756E-44D6-A309-0118A669550F}\RP127\A0018953.exe][keygen.exe] 03939461 Trj/Downloader.MDW Virus/Trojan No 1 No No C:\System Volume Information\_restore{C8F90F4F-756E-44D6-A309-0118A669550F}\RP127\A0018953.exe[C:\System Volume Information\_restore{C8F90F4F-756E-44D6-A309-0118A669550F}\RP127\A0018953.exe][serial.exe] 03955213 Trj/Downloader.MDW Virus/Trojan No 1 No No C:\System Volume Information\_restore{C8F90F4F-756E-44D6-A309-0118A669550F}\RP127\A0018953.exe[C:\System Volume Information\_restore{C8F90F4F-756E-44D6-A309-0118A669550F}\RP127\A0018953.exe][install.exe] ;=============================================================================== ================================================================================ = =================== SUSPECTS Sent Location ;=============================================================================== ================================================================================ = =================== No C:\Program Files\ZincPlay\Zion\mirc.exe ;=============================================================================== ================================================================================ = =================== VULNERABILITIES Id Severity Description ;=============================================================================== ================================================================================ = =================== ;=============================================================================== ================================================================================ = =================== HiJack This Scan Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 5:44:30 PM, on 11/1/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\PPStream\ppsap.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IDMan.exe C:\Program Files\DAEMON Tools Pro\DTProAgent.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Documents and Settings\Zj\Start Menu\Programs\Startup\systemID.pif C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - (no file) O2 - BHO: ThunderAtOnce Class - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: (no name) - {0EEDB912-C5FA-486F-8334-57288578C627} - (no file) O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Thunder Browser Helper - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: PPVADownloader - {A986E409-30CC-4185-89BB-AB212C104524} - C:\Program Files\PPLiveVA\DownloaderManager.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [sW24] C:\WINDOWS\system32\sw24.exe O4 - HKLM\..\Run: [sW20] C:\WINDOWS\system32\sw20.exe O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Flashy Bot] C:\WINDOWS\system32\Flashy.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [PPS Accelerator] C:\Program Files\PPStream\ppsap.exe O4 - HKCU\..\Run: [PPLiveVA] C:\Program Files\PPLiveVA\PPLiveVA.exe /LoadModule PPVA.DLL /M REAL /S 0 /T 0 O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [iDMan] C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IDMan.exe /onboot O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" O4 - HKCU\..\Run: [ares vista] "C:\Program Files\Ares\Ares.exe" -h O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - Startup: systemID.pif = ? O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8 - Extra context menu item: Download all links with IDM - C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IEGetAll.htm O8 - Extra context menu item: Download FLV video content with IDM - C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IEGetVL.htm O8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Crux P2P\Plugins\RazaWebHook.dll/3000 O8 - Extra context menu item: Download with IDM - C:\DOCUME~1\Zj\LOCALS~1\Temp\IXP002.TMP\IEExt.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button:

Thx alot, finally get rid of the spyware, the link which you provide me for my systerm set-up, maybe a broken link, i cant get inside,i will try it next time... anyway thanks again.

hi, Heres the logfile: Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at AM 3:59:51, on 6/4/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\runservice.exe D:\Program Files\McAfee\Common Framework\FrameworkService.exe D:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe D:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe D:\Program Files\McAfee\Common Framework\naPrdMgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\System32\alg.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Spyware Doctor\swdoctor.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe D:\Program Files\Internet Download Manager\IDMan.exe C:\Program Files\MSN Messenger\usnsvc.exe D:\Program Files\Steam\Steam.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Zhijie RulZ!!!!\My Documents\Downloads\Programs\HiJackThis_v2.exe C:\WINDOWS\system32\wbem\wmiprvse.exe F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll O2 - BHO: Alcohol Toolbar Helper - {0ACF00E0-C1E4-4F6B-B290-10AC7505C47A} - C:\Program Files\Alcohol Toolbar\v3.0.0.0\AudioGizmo_Toolbar.dll (file missing) O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - D:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: Alcohol Toolbar - {DC59A0D4-0ED6-4A73-B356-1B977F2A7725} - C:\Program Files\Alcohol Toolbar\v3.0.0.0\AudioGizmo_Toolbar.dll (file missing) O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [iDMan] D:\Program Files\Internet Download Manager\IDMan.exe /onboot O4 - HKCU\..\Run: [spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'Default user') O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: Download All Links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1150540872109 O17 - HKLM\System\CCS\Services\Tcpip\..\{879F9B7E-EF4A-4057-9213-B919BF0D6B2A}: NameServer = 192.168.254.254 O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: curdler - {bd0fc212-0a36-4232-83cc-2063fb9282e0} - C:\WINDOWS\system32\qzviz.dll O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod ?? (iPod Service) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing) O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - D:\Program Files\McAfee\Common Framework\FrameworkService.exe O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - D:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - D:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Martial_Kingdoms_II_CD Drivers Auto Removal (pr2ah3jb) (pr2ah3jb) - T-Time Technology - C:\WINDOWS\system32\pr2ah3jb.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - Unknown owner - C:\Program Files\Spyware Doctor\sdhelp.exe -- End of file - 7396 bytes

Thx alot for spending your time with me, yap i already done checking the add/remove, its not there, heres the log: Logfile of HijackThis v1.99.1 Scan saved at AM 2:42:26, on 6/4/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16414) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\runservice.exe D:\Program Files\McAfee\Common Framework\FrameworkService.exe D:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe D:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe D:\Program Files\McAfee\Common Framework\naPrdMgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\System32\alg.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Spyware Doctor\swdoctor.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\Program Files\Internet Download Manager\IDMan.exe C:\Documents and Settings\Zhijie RulZ!!!!\Desktop\HijackThis.exe F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll O2 - BHO: Alcohol Toolbar Helper - {0ACF00E0-C1E4-4F6B-B290-10AC7505C47A} - C:\Program Files\Alcohol Toolbar\v3.0.0.0\AudioGizmo_Toolbar.dll (file missing) O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - D:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: Alcohol Toolbar - {DC59A0D4-0ED6-4A73-B356-1B977F2A7725} - C:\Program Files\Alcohol Toolbar\v3.0.0.0\AudioGizmo_Toolbar.dll (file missing) O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [iDMan] D:\Program Files\Internet Download Manager\IDMan.exe /onboot O4 - HKCU\..\Run: [spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: Download All Links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [iNTERNATIONAL] International* O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1150540872109 O17 - HKLM\System\CCS\Services\Tcpip\..\{879F9B7E-EF4A-4057-9213-B919BF0D6B2A}: NameServer = 192.168.254.254 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod ?? (iPod Service) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing) O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - D:\Program Files\McAfee\Common Framework\FrameworkService.exe" /ServiceStart (file missing) O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - D:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - D:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Martial_Kingdoms_II_CD Drivers Auto Removal (pr2ah3jb) (pr2ah3jb) - T-Time Technology - C:\WINDOWS\system32\pr2ah3jb.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

thx alot for your help, but spylocked is still not removed.... plz check this log: SmitFraudFix v2.162 Scan done at 2:12:20.67, ??? 06/04/2007 Run from C:\Documents and Settings\Zhijie RulZ!!!!\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode

I have already read the post that was posted a few days before, and i tried to follow, but i can't seems to find the files that needs to be deleted. can anyone help me thx alot. Heres my logfile: Logfile of HijackThis v1.99.1 Scan saved at AM 12:44:11, on 6/4/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16414) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\runservice.exe D:\Program Files\McAfee\Common Framework\FrameworkService.exe D:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe D:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe D:\Program Files\McAfee\Common Framework\naPrdMgr.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\System32\svchost.exe D:\Program Files\Internet Download Manager\IDMan.exe C:\Program Files\Spyware Doctor\swdoctor.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\LimeWire\LimeWire.exe C:\Documents and Settings\Zhijie RulZ!!!!\My Documents\Downloads\Programs\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll O2 - BHO: Alcohol Toolbar Helper - {0ACF00E0-C1E4-4F6B-B290-10AC7505C47A} - C:\Program Files\Alcohol Toolbar\v3.0.0.0\AudioGizmo_Toolbar.dll (file missing) O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - D:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: Alcohol Toolbar - {DC59A0D4-0ED6-4A73-B356-1B977F2A7725} - C:\Program Files\Alcohol Toolbar\v3.0.0.0\AudioGizmo_Toolbar.dll (file missing) O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [iDMan] D:\Program Files\Internet Download Manager\IDMan.exe /onboot O4 - HKCU\..\Run: [spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: Download All Links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [iNTERNATIONAL] International* O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://pooh1329bear.spaces.msn.com//PhotoUpload/MsnPUpld.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1150540872109 O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{879F9B7E-EF4A-4057-9213-B919BF0D6B2A}: NameServer = 192.168.254.254 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod ?? (iPod Service) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing) O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - D:\Program Files\McAfee\Common Framework\FrameworkService.exe" /ServiceStart (file missing) O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - D:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - D:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Martial_Kingdoms_II_CD Drivers Auto Removal (pr2ah3jb) (pr2ah3jb) - T-Time Technology - C:\WINDOWS\system32\pr2ah3jb.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe