HELPHELPPP! Can't see anything on my desktop!

• HygieneSetsco

  22 Nov 07, 12:18

  i think i downloaded something wrong, then now, when i restart my computer, my desktop icons briefly appear, and then they disappear. now all i see, is my wallpaper.
  
  can anyone help me? very urgent.
  
  thanks!
• ndmmxiaomayi

  22 Nov 07, 12:19

  Press Ctrl + Shift + Esc to open Task Manager
  
  Click on File > New Task (Run...)
  
  Type in explorer.exe and press Enter
• HygieneSetsco

  22 Nov 07, 12:20

  found it. trying out now.
• HygieneSetsco

  22 Nov 07, 12:22

  wow! godlike!
  
  thanks alot!
  
  any idea what may have caused it?
  
  if it's a virus, any good antivirus to recommend? i'm currently using AVG free
• HygieneSetsco

  22 Nov 07, 12:24

  hmm, don't know whether this is a problem ,but now my desktop appears, then disappears, appears, then disappears, without me doing anything.
  
  I'm running AVG as we speak =/
• ndmmxiaomayi

  22 Nov 07, 12:27

  You've got to scan with AVG and see what is detected first.
• HygieneSetsco

  22 Nov 07, 12:58

  hmm, so it's probably a virus that's closing my explorer.exe?
• HygieneSetsco

  22 Nov 07, 13:43

  wow, i've been scanning many many MANY files in C > Prog files > java
  
  =/
• HygieneSetsco

  22 Nov 07, 14:23

  mayi, AVG detected nothing =X
• ndmmxiaomayi

  22 Nov 07, 14:36

  Hmmm... did you receive any errors? Or did it just suddenly blank out, leaving the wallpaper only?
• HygieneSetsco

  22 Nov 07, 14:51

  errors during?
  
  my AVG completed scanning successfully, but detecting nothing.
  
  my desktop stuff normally appears for some time, then i can click here click there, but later suddenly disappears, only leaving the wallpaper. after some time, the icons appear again, and can use again. later disappear again =/
• ndmmxiaomayi

  22 Nov 07, 14:53

  Errors as in Windows prompts you that something crashed.
  
  If there's no errors... hmm...
• HygieneSetsco

  22 Nov 07, 14:58

  no errors.
  
  but before this happened, i think i downloaded something wrong, then Spyware Doc say got some trojan or something.
  
  i've tried system restore, but i didn't set any restore points before -.- then when i try to change the month also cannot click =/ aiyo.
• HygieneSetsco

  22 Nov 07, 15:04

  okay. i found something using hijackthis
  
  C:\WINDOWS\SYSTEM32\winwil32.dll
  
  how can i remove this? when i want to do manually to system 32, i can't make it in time before my desktop disappears, causing the folder to close too.
• ndmmxiaomayi

  22 Nov 07, 15:19

  Please don't do anything to that first.
• ndmmxiaomayi

  22 Nov 07, 15:25

  Can you please post the full log.
• HygieneSetsco

  22 Nov 07, 15:29

  quite hard to post it here, as my desktop stops frequently, but give me some time, and i'll try.
• HygieneSetsco

  22 Nov 07, 15:44

  Logfile of Trend Micro HijackThis v2.0.0 (BETA)
  Scan saved at 15:43:25, on 22/11/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
  C:\WINDOWS\sm56hlpr.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\WINDOWS\system32\SysMonitor.exe
  C:\Program Files\Acer\Acer eMode Management\AspireService.exe
  C:\Program Files\Acer\Acer eConsole\MediaSync.exe
  C:\Program Files\Acer TV-FM\PCMService.exe
  C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
  C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
  C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
  C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
  C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
  C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe
  C:\WINDOWS\system32\imapi.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\WINDOWS\explorer.exe
  C:\WINDOWS\system32\NOTEPAD.EXE
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Documents and Settings\user\Desktop\HiJackThis_v2.exe
  
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.yahoo.com/
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
  O1 - Hosts: 209.190.85.230 maplesea.com
  O1 - Hosts: 209.190.85.230 mapleglobal.com
  O1 - Hosts: 209.190.85.230 nexon.net
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
  O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
  O2 - BHO: (no name) - {73E00092-5539-4661-9B61-3A66FC0D772E} - C:\WINDOWS\system32\vtuvwxw.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdmcks.dll
  O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
  O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
  O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
  O4 - HKLM\..\Run: [LaunchApp] Alaunch
  O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
  O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
  O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
  O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
  O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
  O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer TV-FM\PCMService.exe"
  O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
  O4 - HKLM\..\Run: [StatusClient] C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto
  O4 - HKLM\..\Run: [TomcatStartup] C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
  O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
  O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
  O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
  O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
  O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
  O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
  O4 - Global Startup: Acer Empowering Technology.lnk = ?
  O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
  O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
  O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
  O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
  O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
  O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
  O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
  O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
  O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
  O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
  O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {CD79C574-4775-4A42-A66B-D7071AE095AF} (SlideViewerOcx Control) - http://web1.njc.edu.sg/aculearn-idm/dlls/SlideViewer.cab
  O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - http://fdl.msn.com/zone/datafiles/heartbeat.cab
  O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{1864C259-2984-4724-BC4B-25B3033B227D}: NameServer = 202.156.1.68,202.156.1.48
  O17 - HKLM\System\CS1\Services\Tcpip\..\{1864C259-2984-4724-BC4B-25B3033B227D}: NameServer = 202.156.1.68,202.156.1.48
  O17 - HKLM\System\CS2\Services\Tcpip\..\{1864C259-2984-4724-BC4B-25B3033B227D}: NameServer = 202.156.1.68,202.156.1.48
  O20 - Winlogon Notify: vtuvwxw - C:\WINDOWS\SYSTEM32\vtuvwxw.dll
  O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
  O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
  O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
  O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
  O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
  O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
  O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe
  O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
  O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
  O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
  O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
  O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
  O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
  
  --
  End of file - 12407 bytes
  
• ndmmxiaomayi

  22 Nov 07, 15:58

  [*]Please download VundoFix.exe by Atribune from Atribune and save it to your desktop.
  [*]Double click VundoFix.exe to run it.
  [*]Click the Scan for Vundo button.
  [*]Once it's done scanning, click the Remove Vundo button.
  [*]You will receive a prompt asking if you want to remove the files, click YES
  [*]Once you click yes, your desktop will go blank as it starts removing Vundo.
  [*]When completed, it will prompt that it will reboot your computer, click OK.
  [*]Please post the contents of C:\vundofix.txt and a new HiJackThis log.

  Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.
  ____________________
  
  

  [*]Please download the self-extracting version of HijackThis from here. Do Not run it directly via a browser. Save it to your desktop.
  [*]Double click on hijackthis_sfx1991.exe to run it.
  [*]Click on the Unzip button. It will install HijackThis to C:\Program Files\HijackThis.
  [*]Please go to C:\Program Files\HijackThis and right click on HijackThis.exe. Select Rename.
  [*]Type in scanner and press Enter.
  [*]Double click on scanner to run it.
  [*]Select Do a system scan and save a logfile. Please post back this log in your next reply.

  
  ____________________
  
  

  [*]Click on the Config... button at the bottom right hand corner.
  [*]At the top, click on the Misc Tools button.
  [*]Look under System tools.
  [*]Click on the Open Uninstall Manager... button.
  [*]Click on the Save list... button.
  [*]It will prompt you to save. Save this log in a convenient location. By default it's named uninstall_list.txt.
  [*]Notepad will open. Please post this log in your next reply.

  
  
  Please post back the VundoFix log, a new HijackThis log and the Uninstall list.
• HygieneSetsco

  22 Nov 07, 17:30

  NEW HIJACK THIS LOG
  
  Logfile of HijackThis v1.99.1
  Scan saved at 17:28:58, on 22/11/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16544)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
  C:\WINDOWS\sm56hlpr.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\WINDOWS\system32\SysMonitor.exe
  C:\Program Files\Acer\Acer eMode Management\AspireService.exe
  C:\Program Files\Acer\Acer eConsole\MediaSync.exe
  C:\Program Files\Acer TV-FM\PCMService.exe
  C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
  C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
  C:\Program Files\QuickTime\QTTask.exe
  C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
  C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
  C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
  C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe
  C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
  C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
  C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe
  C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\PROGRA~1\FREEDO~1\fdm.exe
  C:\Documents and Settings\user\Desktop\VundoFix.exe
  C:\Program Files\HijackThis\scanner.exe
  C:\WINDOWS\explorer.exe
  
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.yahoo.com/
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
  O1 - Hosts: 209.190.85.230 maplesea.com
  O1 - Hosts: 209.190.85.230 mapleglobal.com
  O1 - Hosts: 209.190.85.230 nexon.net
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
  O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
  O2 - BHO: (no name) - {73E00092-5539-4661-9B61-3A66FC0D772E} - C:\WINDOWS\system32\vtuvwxw.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: (no name) - {C20066AF-48A1-4001-AD76-78F336B000CD} - C:\WINDOWS\system32\mllji.dll
  O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdmcks.dll
  O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
  O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
  O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
  O4 - HKLM\..\Run: [LaunchApp] Alaunch
  O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
  O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
  O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
  O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
  O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
  O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer TV-FM\PCMService.exe"
  O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
  O4 - HKLM\..\Run: [StatusClient] C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto
  O4 - HKLM\..\Run: [TomcatStartup] C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
  O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
  O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
  O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
  O4 - Global Startup: Acer Empowering Technology.lnk = ?
  O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
  O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
  O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
  O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
  O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
  O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
  O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
  O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
  O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
  O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
  O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O11 - Options group: [INTERNATIONAL] International*
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {CD79C574-4775-4A42-A66B-D7071AE095AF} (SlideViewerOcx Control) - http://web1.njc.edu.sg/aculearn-idm/dlls/SlideViewer.cab
  O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - http://fdl.msn.com/zone/datafiles/heartbeat.cab
  O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{1864C259-2984-4724-BC4B-25B3033B227D}: NameServer = 202.156.1.68,202.156.1.48
  O17 - HKLM\System\CS1\Services\Tcpip\..\{1864C259-2984-4724-BC4B-25B3033B227D}: NameServer = 202.156.1.68,202.156.1.48
  O17 - HKLM\System\CS2\Services\Tcpip\..\{1864C259-2984-4724-BC4B-25B3033B227D}: NameServer = 202.156.1.68,202.156.1.48
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O20 - Winlogon Notify: klogon - C:\WINDOWS\
  O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
  O20 - Winlogon Notify: vtuvwxw - C:\WINDOWS\SYSTEM32\vtuvwxw.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
  O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
  O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
  O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
  O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
  O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe
  O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
  O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
  O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
  O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
  O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
  O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
  
  
• HygieneSetsco

  22 Nov 07, 17:31

  UNINSTALL LIST
  
  µTorrent
  Acer eConsole
  Acer eMode Management
  Acer Empowering Technology
  Acer ePerformance Management
  Acer WLAN 11g USB Dongle
  Ad-Aware 2007
  Adobe Flash Player 9 ActiveX
  Adobe Flash Player Plugin
  Adobe Reader 7.0.9
  Adobe Shockwave Player
  Advanced WindowsCare 2.55 Personal
  AI RoboForm (All Users)
  Apple Mobile Device Support
  Apple Software Update
  AusLogics Disk Defrag
  AVG 7.5
  Blade 2.4.0
  Compatibility Pack for the 2007 Office system
  Free Download Manager 2.1
  HijackThis 1.99.1
  Hotfix for Windows Media Format 11 SDK (KB929399)
  Hotfix for Windows Media Player 11 (KB939683)
  Hotfix for Windows XP (KB893357)
  Hotfix for Windows XP (KB896256)
  Hotfix for Windows XP (KB906569)
  Hotfix for Windows XP (KB914440)
  Hotfix for Windows XP (KB915865)
  Hotfix for Windows XP (KB926239)
  hp LaserJet 1010 Series
  J2SE Runtime Environment 5.0 Update 11
  J2SE Runtime Environment 5.0 Update 6
  J2SE Runtime Environment 5.0 Update 9
  Java(TM) 6 Update 2
  Java(TM) 6 Update 3
  Java(TM) SE Development Kit 6 Update 1
  Java(TM) SE Runtime Environment 6 Update 1
  K-Lite Mega Codec Pack 1.53
  LiveUpdate 2.6 (Symantec Corporation)
  Megaupload Toolbar
  Messenger Plus! Live
  Microsoft .NET Framework 1.1
  Microsoft .NET Framework 2.0 Service Pack 1
  Microsoft .NET Framework 3.0 Service Pack 1
  Microsoft .NET Framework 3.5 (Pre-Release Version)
  Microsoft .NET Framework 3.5 (Pre-Release Version)
  Microsoft Compression Client Pack 1.0 for Windows XP
  Microsoft Internationalized Domain Names Mitigation APIs
  Microsoft National Language Support Downlevel APIs
  Microsoft Office XP Professional
  Microsoft User-Mode Driver Framework Feature Pack 1.0
  Microsoft Visual C++ 2005 Redistributable
  Microsoft Visual J# 2.0 Redistributable Package - SE
  Microsoft Windows Journal Viewer
  Minilyrics(remove only)
  Motorola SM56 Speakerphone Modem
  Mozilla Firefox (2.0.0.9)
  MSXML 4.0 SP2 (KB925672)
  MSXML 4.0 SP2 (KB936181)
  MSXML 6.0 Parser (KB933579)
  Neocodex Check V3.3.1.0
  Nero 7
  NTI Backup NOW! 4
  NTI CD & DVD-Maker
  NTI HomeVideo-Maker
  Obliter AutoBuyer
  Obliter AutoBuyer
  OCA Client history tool install
  PowerDVD
  PSP Video 9 2.25
  QuickTime
  Rainlendar2 (remove only)
  Realtek AC'97 Audio
  Security Update for CAPICOM (KB931906)
  Security Update for CAPICOM (KB931906)
  Security Update for Step By Step Interactive Training (KB89845
  Security Update for Windows Internet Explorer 7 (KB928090)
  Security Update for Windows Internet Explorer 7 (KB929969)
  Security Update for Windows Internet Explorer 7 (KB93176
  Security Update for Windows Internet Explorer 7 (KB933566)
  Security Update for Windows Internet Explorer 7 (KB937143)
  Security Update for Windows Internet Explorer 7 (KB938127)
  Security Update for Windows Internet Explorer 7 (KB939653)
  Security Update for Windows Media Player (KB911564)
  Security Update for Windows Media Player 11 (KB936782)
  Security Update for Windows Media Player 6.4 (KB92539
  Security Update for Windows Media Player 9 (KB917734)
  Security Update for Windows XP (KB883939)
  Security Update for Windows XP (KB890046)
  Security Update for Windows XP (KB893756)
  Security Update for Windows XP (KB89635
  Security Update for Windows XP (KB896422)
  Security Update for Windows XP (KB896423)
  Security Update for Windows XP (KB896424)
  Security Update for Windows XP (KB89642
  Security Update for Windows XP (KB899587)
  Security Update for Windows XP (KB89958
  Security Update for Windows XP (KB899589)
  Security Update for Windows XP (KB899591)
  Security Update for Windows XP (KB900725)
  Security Update for Windows XP (KB901017)
  Security Update for Windows XP (KB901190)
  Security Update for Windows XP (KB901214)
  Security Update for Windows XP (KB902400)
  Security Update for Windows XP (KB903235)
  Security Update for Windows XP (KB904706)
  Security Update for Windows XP (KB905414)
  Security Update for Windows XP (KB905749)
  Security Update for Windows XP (KB905915)
  Security Update for Windows XP (KB908519)
  Security Update for Windows XP (KB911562)
  Security Update for Windows XP (KB911567)
  Security Update for Windows XP (KB911927)
  Security Update for Windows XP (KB912919)
  Security Update for Windows XP (KB913446)
  Security Update for Windows XP (KB913580)
  Security Update for Windows XP (KB91438
  Security Update for Windows XP (KB914389)
  Security Update for Windows XP (KB917159)
  Security Update for Windows XP (KB917344)
  Security Update for Windows XP (KB917422)
  Security Update for Windows XP (KB917953)
  Security Update for Windows XP (KB91811
  Security Update for Windows XP (KB918439)
  Security Update for Windows XP (KB918899)
  Security Update for Windows XP (KB919007)
  Security Update for Windows XP (KB920213)
  Security Update for Windows XP (KB920214)
  Security Update for Windows XP (KB920670)
  Security Update for Windows XP (KB920683)
  Security Update for Windows XP (KB920685)
  Security Update for Windows XP (KB92139
  Security Update for Windows XP (KB921503)
  Security Update for Windows XP (KB921883)
  Security Update for Windows XP (KB922616)
  Security Update for Windows XP (KB922760)
  Security Update for Windows XP (KB922819)
  Security Update for Windows XP (KB923191)
  Security Update for Windows XP (KB923414)
  Security Update for Windows XP (KB923689)
  Security Update for Windows XP (KB923694)
  Security Update for Windows XP (KB923980)
  Security Update for Windows XP (KB924191)
  Security Update for Windows XP (KB924270)
  Security Update for Windows XP (KB924496)
  Security Update for Windows XP (KB924667)
  Security Update for Windows XP (KB925486)
  Security Update for Windows XP (KB925902)
  Security Update for Windows XP (KB926255)
  Security Update for Windows XP (KB926436)
  Security Update for Windows XP (KB927779)
  Security Update for Windows XP (KB927802)
  Security Update for Windows XP (KB928255)
  Security Update for Windows XP (KB928843)
  Security Update for Windows XP (KB929123)
  Security Update for Windows XP (KB93017
  Security Update for Windows XP (KB931261)
  Security Update for Windows XP (KB931784)
  Security Update for Windows XP (KB93216
  Security Update for Windows XP (KB933729)
  Security Update for Windows XP (KB935839)
  Security Update for Windows XP (KB935840)
  Security Update for Windows XP (KB936021)
  Security Update for Windows XP (KB938829)
  Security Update for Windows XP (KB941202)
  Security Update for Windows XP (KB943460)
  SiSAGP driver
  Spyware Doctor 5.1
  Unlocker 1.8.5
  Update for Windows XP (KB894391)
  Update for Windows XP (KB896727)
  Update for Windows XP (KB898461)
  Update for Windows XP (KB900485)
  Update for Windows XP (KB904942)
  Update for Windows XP (KB908531)
  Update for Windows XP (KB910437)
  Update for Windows XP (KB911280)
  Update for Windows XP (KB912945)
  Update for Windows XP (KB916595)
  Update for Windows XP (KB920872)
  Update for Windows XP (KB922582)
  Update for Windows XP (KB925720)
  Update for Windows XP (KB927891)
  Update for Windows XP (KB92933
  Update for Windows XP (KB930916)
  Update for Windows XP (KB931836)
  Update for Windows XP (KB933360)
  Update for Windows XP (KB936357)
  Update for Windows XP (KB93882
  VideoLAN VLC media player 0.8.6c
  Viewpoint Media Player
  WC3Banlist
  Windows Defender
  Windows Imaging Component
  Windows Installer 3.1 (KB893803)
  Windows Internet Explorer 7
  Windows Live Messenger
  Windows Live Sign-in Assistant
  Windows Media Format 11 runtime
  Windows Media Format 11 runtime
  Windows Media Player 11
  Windows Media Player 11
  Windows XP Hotfix - KB867282
  Windows XP Hotfix - KB873333
  Windows XP Hotfix - KB873339
  Windows XP Hotfix - KB885250
  Windows XP Hotfix - KB885835
  Windows XP Hotfix - KB885836
  Windows XP Hotfix - KB885884
  Windows XP Hotfix - KB886185
  Windows XP Hotfix - KB887472
  Windows XP Hotfix - KB888113
  Windows XP Hotfix - KB888302
  Windows XP Hotfix - KB890047
  Windows XP Hotfix - KB890175
  Windows XP Hotfix - KB890859
  Windows XP Hotfix - KB890923
  Windows XP Hotfix - KB891781
  Windows XP Hotfix - KB893086
  WinPcap 3.1
  WinRAR archiver
  
  
• HygieneSetsco

  22 Nov 07, 17:35

  
  VundoFix V6.6.2
  
  Checking Java version...
  
  Java version is 1.5.0.6
  Old versions of java are exploitable and should be removed.
  
  Java version is 1.5.0.9
  Old versions of java are exploitable and should be removed.
  
  Java version is 1.5.0.11
  
  Scan started at 17:22:41 22/11/2007
  
  Listing files found while scanning....
  
  No infected files were found.
  
  Beginning removal...
  
• HygieneSetsco

  22 Nov 07, 18:00

  any idea if mllji.dll is malicious?
• ndmmxiaomayi

  22 Nov 07, 18:44

  Disable Windows Defender temporarily
  
  

  [*]Go to Start > All Programs > Windows Defender.
  [*]Click on Tools at the top.
  [*]Under Settings, click on Options.
  [*]Under Automatic scanning, uncheck (untick) Automatically scan my computer (recommended) box.
  [*]Under Real-time protection options, uncheck (untick) Use real-time protection (recommended) box.
  [*]Click on the Save button at the bottom right hand corner.

  
  ____________________
  
  

  [*]Please open VundoFix.
  [*]In the blank white space above the Scan For Vundo and Remove Vundo buttons, right click and select Add more files?.
  [*]Add in the following files:
  [*]C:\WINDOWS\system32\vtuvwxw.dll
  [*]C:\WINDOWS\system32\mllji.dll
  [*]Click Add Files, then Close Window.
  [*]Click on Remove Vundo.
  [*]You will receive a prompt asking if you want to remove the files, click YES.
  [*]Once you click yes, your desktop will go blank as it starts removing Vundo.
  [*]When completed, it will prompt that it will reboot your computer, click OK.
  [*]Please post the contents of C:\vundofix.txt and a new HijackThis log.

  Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.
  
  In your next reply, please post:
  
  

  [*]The VundoFix log (C:\VundoFix.txt)
  [*]A new HijackThis log
• HygieneSetsco

  22 Nov 07, 20:08

  zxcvzxcv wait a while ^.^