Help! My PC is serious infected by spyware!

last SG · 2006-06-12T22:57:51+00:00

No i don't think you know much about what has transpired. You do not even have the very basic item a computer user have - a backup solution. First - if you...

joeacid SG

ndmmxiaomayi SG

It looks clean now. Smile

Lucario SG

Yup it's mostly clean but there are some files/entries which might be of concern Smile

C:\WINDOWS\System32\dcomcfg.exe

http://www.processlibrary.com/directory/files/dcomcfg/
http://www.liutilities.com/products/wintaskspro/processlibrary/dcomcfg/

O20 - Winlogon Notify: Reliability - C:\WINDOWS\system32\s2pulc791f.dll

Random entry. Looks like Look2me has morphed again

O20 - Winlogon Notify: winjrs32 - C:\WINDOWS\SYSTEM32\winjrs32.dll

Not much info on this one but it should also be fixed

ShutterBug SG

Pull out your hard disk, configure it as slave and plug into another PC with Norton Internet Security 2006 installed and updated, and scan the entire hard disk.

You should be able to weed out whatever is spawning the those reg entries and DLLs, plus the "seed" file.

After scanning and deleting all the detected adware, spyware and viruses with NIS2006, unhide all hidden files delete all that is inside TEMP and Temporary Internet Files folders.

After having done all the above, re-install your hard disk, and you may have a better chance at restoring your platform. But do your restoration with your broadband modem turned off.

To prevent this from happening again, install NIS2006 and keep it updated.
And also, please remove all those FREE software you have downloaded; they are pretty much adware and spyware as well. Those FREE software that claims to remove or prevent Adware or Spyware or Viruses are lame applications. They aren't robust because they aren't a commercial product.

joeacid SG

Hi~ I managed to remove C:\WINDOWS\System32\dcomcfg.exe by going to the safemode. And fixed O20 - Winlogon Notify: winjrs32 - C:\WINDOWS\SYSTEM32\winjrs32.dll using the hijackthis.

Can't find O20 - Winlogon Notify: Reliability - C:\WINDOWS\system32\s2pulc791f.dll

Here's my new logfile

joeacid SG

Thanks, i wish to try out ur method,but i dun hav another PC with an OS

ceecookie SG

and while ur checking his logfile have a go at mine's
Laughing

Logfile of HijackThis v1.99.1
Scan saved at 20:23:26, on 20/06/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\runservice.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\System32\AcerGoto.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\UberIcon\UberIcon Manager.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\BOINC\boincmgr.exe
C:\Program Files\BOINC\boinc.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Motherboard Monitor 5\MBM5.EXE
C:\WINDOWS\boinc.scr
C:\WINDOWS\system32\wisptis.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\BOINC\projects\setiathome.berkeley.edu\setiathome_5.15_windows_intelx86.exe
c:\program files\common files\installshield\updateservice\isuspm.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Default\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr7/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr6/*http://www.yahoo.com
N3 - Netscape 7: user_pref("browser.startup.homepage", "www.yahoo.com"); (C:\Documents and Settings\Default\Application Data\Mozilla\Profiles\default\zed5nycl.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRA%7E1%5CNETSCAPE%5CNETSCA%7E1%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Default\Application Data\Mozilla\Profiles\default\zed5nycl.slt\prefs.js)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\zh-sg\msntb.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\zh-sg\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [AcerGoto] C:\WINDOWS\System32\AcerGoto.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [System Files Updater] C:\WINDOWS\FlyakiteOSX\Tools\System Files Updater.exe /S
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: BOINC Manager.lnk = C:\Program Files\BOINC\boincmgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: www.gunbound.com
O15 - Trusted Zone: www.hotmail.com
O15 - Trusted Zone: http://www.neopets.com
O15 - Trusted Zone: www.superdudes.net
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

ndmmxiaomayi SG

joeacid: Your system is clean now.

joeacid SG

haha thanks, i dunno but the is still around and my webpage always cannot be loaded. Hijackers nowadays seems to be powerful and more hidden Sad

joeacid SG

Erm… guys~ need help~ can help me look at my log file? ~ Not sure why but i got quite a number of adware again~ i din surf anywhere this time…

joeacid SG

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\devldr32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\WINDOWS\System32\CTSvcCDA.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Creative\SBLive2k\AudioHQ\AHQTB.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Nevo\NevoMedia Player\NevoMediaPlayer.exe
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\eMule\eMule.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\ishost.exe
C:\WINDOWS\System32\ismon.exe
C:\WINDOWS\System32\isnotify.exe
C:\WINDOWS\System32\issearch.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\conime.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\joeling\Desktop\HijackThis.exe

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive2k\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NevoMedia Server.lnk = C:\Program Files\Nevo\NevoMedia Server\NevoMediaServer.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: gp FlashGet ºÚ - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Sgp FlashGet ºÚ - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Instant Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
O16 - DPF: WebControlDeploy - https://grouper.com/v1/GrouperSetup.cab
O18 - Protocol: bw+0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: offline-8876480 - {CBF3B8B8-09A9-43D8-85CF-0D9FA1DAD04A} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - Winlogon Notify: BITS - C:\WINDOWS\system32\irnsl5571.dll
O20 - Winlogon Notify: ldr64 - C:\WINDOWS\SYSTEM32\ldr64.dll
O20 - Winlogon Notify: winjrs32 - C:\WINDOWS\SYSTEM32\winjrs32.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: cinnamomum - {93ac7c30-3878-4eaa-9420-7977285df5b1} - C:\WINDOWS\System32\pmnqguh.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

R3SsH|n SG

how u know is adware?

ndmmxiaomayi SG

C:\WINDOWS\System32\ishost.exe
C:\WINDOWS\System32\ismon.exe
C:\WINDOWS\System32\isnotify.exe
C:\WINDOWS\System32\issearch.exe
C:\WINDOWS\System32\conime.exe

You sure you didn't do anything wrong this time? You got some very nasty stuff...

Did you download any anti-spywares lately? What about your BitComet and eMule?

ndmmxiaomayi SG

Either you download Ewido Anti-spyware and scan offline or you scan online at http://www.ewido.net/

Also update your antivirus and do a full system scan.

Remove anything found.

To remove issearch.exe, try using this fix. Restart your computer after this.

Go to registry editor. (Start, Run, regedit)

Find and delete the keys in red.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\ishost
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ishost
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\PornMag Pass
HKEY_CURRENT_USER\Software\PornMag Pass
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\isnotify
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\isnotify
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\issearch
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\issearch

Restart your computer in Safe Mode. Delete these files if they are found. You need to enable hidden files in order to delete them. My Computer, Tools, Folder Options. Select View tab. Under Hidden files and folders, tick Show hidden files and folders.

C:\Windows\System32\ishost.exe
C:\Program Files\PornMagPass\isinst.exe
C:\Program Files\PornMagPass\PornMagPass.exe
C:\Program Files\PornMagPass\PornMag Pass.url
C:\Program Files\PornMagPass\uninst.exe
C:\Documents and Settings\username\Start Menu\PornMag Pass\PornMag Pass Login.lnk
C:\Documents and Settings\username\Start Menu\PornMag Pass\PornMag Pass.lnk
C:\Documents and Settings\username\Desktop\PornMag Pass.lnk
C:\Windows\System32\ishost.exe
C:\Windows\System32\ismon.exe
C:\WINDOWS\Temp\iservice.dll
C:\Windows\System32\isnotify.exe
C:\Windows\Application Data\81f71843.exe
C:\Documents and Settings\username\Local Settings\Temp\runsvc32.exe
C:\Program Files\\security toolbar\security toolbar.dll
C:\Windows\System32\81f71843.exe
C:\Windows\System32\acvgxw.dll
C:\Windows\System32\appmagr.dll
C:\Windows\System32\atmclk.exe
C:\Windows\System32\autodisc32.dll
C:\Windows\System32\bbgif32.dll
C:\Windows\System32\bggif32.dll
C:\Windows\System32\bgif32.dll
C:\Windows\System32\bpkwb.dll
C:\Windows\System32\cd_clint.dll
C:\Windows\System32\cd_gif.dll
C:\Windows\System32\cd_htm.dll
C:\Windows\System32\cd_load.exe
C:\Windows\System32\cd_swf.dll
C:\Windows\System32\clsemixer.dll
C:\Windows\System32\cmesys.exe
C:\Windows\System32\cmeupd.exe
C:\Windows\System32\components\flx1.dll
C:\Windows\System32\components\flx2.dll
C:\Windows\System32\components\flx3.dll
C:\Windows\System32\components\flx4.dll
C:\Windows\System32\components\flx5.dll
C:\Windows\System32\components\flx6.dll
C:\Windows\System32\components\flx7.dll
C:\Windows\System32\components\flx8.dll
C:\Windows\System32\cws_iestart.exe
C:\Windows\System32\dbf065d3.exe
C:\Windows\System32\dbgif32.dll
C:\Windows\System32\dcomcfg.exe
C:\Windows\System32\ddm_d.exe
C:\Windows\System32\ddmp.dll
C:\Windows\System32\dfrgsrv.exe
C:\Windows\System32\dxmpp.dll
C:\Windows\System32\gator.exe
C:\Windows\System32\ginuerep.dll
C:\Windows\System32\gmt.exe
C:\Windows\System32\guxxa.dll
C:\Windows\System32\hvcycg.dll
C:\Windows\System32\hzclqhc.dll
C:\Windows\System32\iedriver.exexplore.exe
C:\Windows\System32\imfdfcj.dll
C:\Windows\System32\intxt.exe
C:\Windows\System32\iqzv.dll
C:\Windows\System32\ishost.exe
C:\Windows\System32\ismon.exe
C:\Windows\System32\isnotify.exe
C:\Windows\System32\issearch.exe
C:\Windows\System32\ixt0.dll
C:\Windows\System32\ixt1.dll
C:\Windows\System32\ixt2.dll
C:\Windows\System32\ixt3.dll
C:\Windows\System32\ixt4.dll
C:\Windows\System32\ixt5.dll
C:\Windows\System32\ixt6.dll
C:\Windows\System32\johnwb.dll
C:\Windows\System32\lwpfwjb.dll
C:\Windows\System32\mscornet.exe
C:\Windows\System32\mssearchnet.exe
C:\Windows\System32\mswinb32.dll
C:\Windows\System32\mswinb32.exe
C:\Windows\System32\mswinf32.exe
C:\Windows\System32\mswinup32.dll
C:\Windows\System32\mswinxml.dll
C:\Windows\System32\mtc.dll
C:\Windows\System32\mzoeut.dll
C:\Windows\System32\netwrap.dll
C:\Windows\System32\notifysb.dll
C:\Windows\System32\nvctrl.exe
C:\Windows\System32\qrucmr.dll
C:\Windows\System32\redirect.dll
C:\Windows\System32\reglogs.dll
C:\Windows\System32\regperf.exe
C:\Windows\System32\repigsp.exe
C:\Windows\System32\replmap.dll
C:\Windows\System32\rmzdzx.dll
C:\Windows\System32\runsrv32.dll
C:\Windows\System32\runsrv32.exe
C:\Windows\System32\shell386.exe
C:\Windows\System32\shellgui32.dll
C:\Windows\System32\sivudro.dll
C:\Windows\System32\spoolsrv32.exe
C:\Windows\System32\srpcsrv32.dll
C:\Windows\System32\stickrep.dll
C:\Windows\System32\suprox.dll
C:\Windows\System32\svchosts.dll
C:\Windows\System32\systemwb.dll
C:\Windows\System32\sysu.exe
C:\Windows\System32\thlwin32.dll
C:\Windows\System32\twain32.dll
C:\Windows\System32\txfdb32.dll
C:\Windows\System32\udpmod.dll
C:\Windows\System32\ulztc.dll
C:\Windows\System32\vhywj.dll
C:\Windows\System32\viwpzla.dll
C:\Windows\System32\vpxnk.dll
C:\Windows\System32\wbeconm.dll
C:\Windows\System32\wfkduei.dll
C:\Windows\System32\wiatwain.dll
C:\Windows\System32\winapi32.dll
C:\Windows\System32\winbl32.dll
C:\Windows\System32\winlfl32.dll
C:\Windows\System32\winsrv32.exe
C:\Windows\System32\xenadot.dll
C:\Windows\System32\xt0.dll
C:\Windows\System32\xt1.dll
C:\Windows\System32\xuefh.dll
C:\Windows\System32\xxxdialer.exe
C:\Windows\System32\yhbdupd.dll
C:\Windows\dpe.dll
C:\Windows\fsg_4203.exe
C:\Windows\runsvc32.exe
C:\Windows\sdfje.exe
002211.exe
a.exe
a0000037.exe
appmagr.dll
atmclk.exe
atmclk2.exe
c:\exefile.exe
c:\ntpnt.exe
c:\r.exe
dcomcfg.exe
dfrgsrv.exe
dxmpp.dll
exe.exe
exefile.exe
ginuerep.dll
ioctrl.dll
iubm.exe
l.exe
load01.exe
loader138.exe
main.exe
mscornet.exe
mssearchnet.exe
mw_wbeconm.dll
netwrap.dll
notifysb.dll
nvctrl.exe
reger.exe
regperf.exe
repigsp.exe
scam.a.exe
scam.alexaie.dll
Scam.alxie328.dll
Scam.alxres.dll
Scam.alxtb1.dll
scam.bridge.dll
Scam.btgrab.dll
Scam.dailytoolbar.dll
scam.dlmax.dll
Scam.jao.dll
scam.pynix.dll
Scam.questmod.dll
scam.susp.exe
scam.tcpservice2.exe
Scam.wstart.dll
Scam.zserv.dll
security toolbar.dll
sivudro.dll
sss_bot.exe
suprox.dll
svchosts.dll
twain32.dll
wbeconm.dll
wiatwain.dll
winapi32.dll
winbl32.dll
xenadot.dll
yhbdupd.dll

For conime.exe, I'm not too sure what it is. It can be a malicious file. On the hand, it is used by Windows as well. Scan with antivirus to double check.

After all these are done, reboot. Do a full system scan with all your anti-spywares and antivirus. For safety sake, try not to use eMule and BitComet when you are not using them.

If you need more help, you may refer to these links:
Removing ishost, isnotify, issearch and ismon.exe
About rogue anti-spywares
Symantec's writeup on conime.exe

You may want to do an online scan at Panda and TrendMicro to make sure that your antivirus and anti-spywares don't miss anything.

Next time don't surf porn sites... Laughing

ndmmxiaomayi SG

I know my answer is too long... because you really have too much to clear. Laughing

R3SsH|n SG

lolx..next time already please clean your mouth…

joeacid SG

Hey Thanks alot~ i think i've much to clean....
I haven't been surfing porn site for a few years btw =X hehe~

joeacid SG

Wahh i fixed those things le~ but my PC completely died off the other day!
Now using my laptop Sad

joeacid SG

Tadaima!!!!! I'm BACK!!!!!!! Finally~ i ended up formatinh my HDD and here, i'm back! ~lol~ But i spent on a new 250GB HDD to transfer all my things over 1st~ ZZZzzzz in the end, i still spend money lol~

But thanks anyway guys! I know it takes u alot of time to look thru my log files~ and becoz of that, i was able to hold on until i finishes my school assignment hehe~ Thanks!

« Previous Page Next Page »