Virus? Adware? I don't know

• the_king_of_hades

  9 Dec 07, 17:34

  I have a problem in my laptop right now..
  
  Whenever I surf the internet and i click on a particular link, Internet Explorer always directs me to this particular search site www.quickbrowsersearch.com. I always have to click the "back" button to go the website that i want.
  
  Also, sometimes this error comes out:
  
  Runtime error
  program c:\Program Files \internet explorer\IEXPLORE.EXE
  This application has requested the Runtime to terminate it in an unusual way. Please contact the application's support team for more information
  
  What can be done..?
  Thanks
• ndmmxiaomayi

  9 Dec 07, 20:46

  [*]Please download the latest copy of HijackThis from Trend Micro and save it to your desktop.
  [*]Double click on HJTInstall.exe to install it. Click on Install. By default, it will install to C:\Program Files\Trend Micro\HijackThis.
  [*]Read through the License Agreement presented to you on the next screen and click on I Accept.
  [*]Once installed, HijackThis will start automatically. If it doesn't, please go to your desktop and double click on the HijackThis shortcut created there.
  [*]Select Do a system scan and save a logfile.
  [*]Close HijackThis.

  Note: Do not click on the AnalyzeThis button.
  
  Do not fix any lines you see in HijackThis as most entries are harmless and needed for the normal functioning of Windows.
  
  Don't close HijackThis yet.
  
  

  [*]Click on the Config... button at the bottom right hand corner.
  [*]At the top, click on the Misc Tools button.
  [*]Look under System tools.
  [*]Click on the Open Uninstall Manager... button.
  [*]Click on the Save list... button.
  [*]It will prompt you to save. Save this log in a convenient location. By default it's named uninstall_list.txt.
  [*]Notepad will open. Please post this log in your next reply.

  
  
  Post back both logs.
• the_king_of_hades

  10 Dec 07, 12:36

  Hijackthis -
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 12:30:58 PM, on 10/12/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16544)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
  C:\Program Files\NewDotNet\nnrun.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\CCM\CcmExec.exe
  C:\WINDOWS\system32\msiexec.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\NewDotNet\nnrun.exe
  C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
  C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
  C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
  C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
  C:\WINDOWS\RTHDCPL.EXE
  C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
  C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
  C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
  C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
  C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
  C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
  C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
  C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
  C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.blackle.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
  O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
  O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
  O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
  O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [WindowBlinds] C:\Program Files\Stardock\Object Desktop\WindowBlinds\WBInstall32.exe
  O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
  O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
  O4 - S-1-5-18 Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe (User 'SYSTEM')
  O4 - .DEFAULT Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe (User 'Default user')
  O4 - .DEFAULT User Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe (User 'Default user')
  O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Bluetooth.lnk = ?
  O4 - Global Startup: MapToPDriveLoopLaunch.bat
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1174874783734
  O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = sd.sp.edu.sg
  O17 - HKLM\Software\..\Telephony: DomainName = sd.sp.edu.sg
  O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = sd.sp.edu.sg
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  O23 - Service: NNServ - New.net, Inc. - C:\Program Files\NewDotNet\nnrun.exe
  
  --
  End of file - 9734 bytes
  
• the_king_of_hades

  10 Dec 07, 12:37

  Uninstall_list
  
  Adobe Flash Player ActiveX
  Adobe Reader 7.0.9
  Apple Mobile Device Support
  Apple Software Update
  ArcGIS Desktop
  ArcGIS Explorer
  ArcGIS Explorer SDK for the Microsoft .NET Framework
  ArcGIS Tutorial Data
  ATI - Software Uninstall Utility
  ATI Catalyst Control Center
  ATI Display Driver
  ATI Parental Control & Encoder
  Bentley Architecture (V 08.05.03.56) - 1
  Bentley Architecture US Ncs Dataset (V 08.05.03.19) - 1
  Bentley GEOPAK Rebar - 2004 Edition (V 08.05.02.59)
  Bentley MicroStation (V 08.05.02.35) - 1
  Bentley Structural (V 08.05.03.62) - 1
  Bentley TriForma (V 08.05.03.70) - 1
  Broadcom 802.11 Wireless LAN Adapter
  DivX Codec
  DivX Content Uploader
  DivX Converter
  DivX Player
  DivX Web Player
  EngiLab Beam.2D ML v1.20
  Free YouTube Download 1.2
  Free YouTube to iPod Converter version 2.8
  HDAUDIO Soft Data Fax Modem with SmartCP
  High Definition Audio Driver Package - KB888111
  HijackThis 2.0.2
  Hotfix for Windows XP (KB914440)
  Hotfix for Windows XP (KB915865)
  Hotfix for Windows XP (KB927891)
  Hotfix for Windows XP (KB93544
  HP Integrated Module with Bluetooth wireless technology
  iTunes
  Java(TM) 6 Update 3
  Macromedia Flash 8
  MathCAD
  McAfee VirusScan Enterprise
  Microsoft .NET Framework 1.1
  Microsoft .NET Framework 1.1
  Microsoft .NET Framework 1.1 Hotfix (KB928366)
  Microsoft .NET Framework 2.0
  Microsoft Device Emulator version 1.0 - ENU
  Microsoft Document Explorer 2005
  Microsoft Document Explorer 2005
  Microsoft Internationalized Domain Names Mitigation APIs
  Microsoft National Language Support Downlevel APIs
  Microsoft Office FrontPage 2003
  Microsoft Office Professional Edition 2003
  Microsoft Office Project Professional 2003
  Microsoft Office Visio Professional 2003
  Microsoft SQL Server 2005
  Microsoft SQL Server 2005 Mobile [ENU] Developer Tools
  Microsoft SQL Server 2005 Tools Express Edition
  Microsoft SQL Server Native Client
  Microsoft SQL Server Setup Support Files (English)
  Microsoft SQL Server VSS Writer
  Microsoft Visual C++ 2005 Redistributable
  Microsoft Visual J# 2.0 Redistributable Package
  Microsoft Visual Studio 2005 Professional Edition - ENU
  Microsoft Windows Theme Ontario
  MSXML 4.0 SP2 (KB925672)
  MSXML 4.0 SP2 (KB92797
  MSXML 4.0 SP2 (KB936181)
  MSXML 6.0 Parser (KB933579)
  New.net Domains 8.0 build 832
  Python 2.4.1
  QuickTime
  RealPlayer
  Realtek High Definition Audio Driver
  RelevantKnowledge
  Respondus LockDown Browser
  Security Update for CAPICOM (KB931906)
  Security Update for CAPICOM (KB931906)
  Security Update for Microsoft .NET Framework 2.0 (KB928365)
  Security Update for Microsoft Visual Studio 2005 Professional Edition - ENU (KB925674)
  Security Update for Microsoft Visual Studio 2005 Professional Edition - ENU (KB937060)
  Security Update for Windows Internet Explorer 7 (KB928090)
  Security Update for Windows Internet Explorer 7 (KB93176
  Security Update for Windows Internet Explorer 7 (KB933566)
  Security Update for Windows Internet Explorer 7 (KB937143)
  Security Update for Windows Internet Explorer 7 (KB938127)
  Security Update for Windows Internet Explorer 7 (KB939653)
  Security Update for Windows Media Player 10 (KB936782)
  Security Update for Windows Media Player 6.4 (KB92539
  Security Update for Windows XP (KB901190)
  Security Update for Windows XP (KB921503)
  Security Update for Windows XP (KB923789)
  Security Update for Windows XP (KB925902)
  Security Update for Windows XP (KB928090)
  Security Update for Windows XP (KB929123)
  Security Update for Windows XP (KB93017
  Security Update for Windows XP (KB931261)
  Security Update for Windows XP (KB931784)
  Security Update for Windows XP (KB93216
  Security Update for Windows XP (KB933729)
  Security Update for Windows XP (KB935839)
  Security Update for Windows XP (KB935840)
  Security Update for Windows XP (KB936021)
  Security Update for Windows XP (KB938829)
  Security Update for Windows XP (KB941202)
  Security Update for Windows XP (KB943460)
  Skype 3.0
  Skype add-on for IE
  Skype Plugin Manager
  Uninstall 1.0.0.0
  Update for Windows XP (KB898461)
  Update for Windows XP (KB904942)
  Update for Windows XP (KB92933
  Update for Windows XP (KB930916)
  Update for Windows XP (KB933360)
  Update for Windows XP (KB936357)
  Update for Windows XP (KB93882
  VeohTV BETA
  VideoLAN VLC media player 0.8.6
  Windows Internet Explorer 7
  Windows Live Messenger
  Windows Media Format Runtime
  Windows Media Player 10
  WinRAR archiver
  Yahoo! Widgets
  ZBrush3
  
  
• Shotgun

  10 Dec 07, 13:33

  Lets sticky they HijackThis instructions.
• eagle

  10 Dec 07, 13:37

  from
  http://www.bitdefender.com.au/VIRUS-121058-au--Application.Adware.NewDotNet.B.Dropper.html
  
  The safest way to remove Application.Adware.NewDotNet.B is to use the add/remove software program list or to launch the uninstaller automatically wich is located either in Program Files\NewDotNet\uninstallX_xx.exe or Windows\NDNuninstallX_xx.exe) (where X_xx is the version).
  
  I see that you have it on your comp, so no harm trying this
• ndmmxiaomayi

  10 Dec 07, 13:55

  Download WinsockXP Fix and save it to your desktop. This is important because removing this infection may break your connections. Do not proceed to do anything if you have not download and save the file.
  
  Uninstall these programs:
  
  1. New.net Domains 8.0 build 832
  2. RelevantKnowledge
  
  If you can't remove New.Net, download the removal tool from here: http://www.newdotnet.com/removal.html
  
  After that, post back a new HijackThis log.
• the_king_of_hades

  10 Dec 07, 22:10

  Adobe Flash Player ActiveX
  Adobe Reader 7.0.9
  Apple Mobile Device Support
  Apple Software Update
  ArcGIS Desktop
  ArcGIS Explorer
  ArcGIS Explorer SDK for the Microsoft .NET Framework
  ArcGIS Tutorial Data
  ATI - Software Uninstall Utility
  ATI Catalyst Control Center
  ATI Display Driver
  ATI Parental Control & Encoder
  Bentley Architecture (V 08.05.03.56) - 1
  Bentley Architecture US Ncs Dataset (V 08.05.03.19) - 1
  Bentley GEOPAK Rebar - 2004 Edition (V 08.05.02.59)
  Bentley MicroStation (V 08.05.02.35) - 1
  Bentley Structural (V 08.05.03.62) - 1
  Bentley TriForma (V 08.05.03.70) - 1
  Broadcom 802.11 Wireless LAN Adapter
  DivX Codec
  DivX Content Uploader
  DivX Converter
  DivX Player
  DivX Web Player
  EngiLab Beam.2D ML v1.20
  Free YouTube Download 1.2
  Free YouTube to iPod Converter version 2.8
  HDAUDIO Soft Data Fax Modem with SmartCP
  High Definition Audio Driver Package - KB888111
  HijackThis 2.0.2
  Hotfix for Windows XP (KB914440)
  Hotfix for Windows XP (KB915865)
  Hotfix for Windows XP (KB927891)
  Hotfix for Windows XP (KB93544
  HP Integrated Module with Bluetooth wireless technology
  iTunes
  Java(TM) 6 Update 3
  Macromedia Flash 8
  MathCAD
  McAfee VirusScan Enterprise
  Microsoft .NET Framework 1.1
  Microsoft .NET Framework 1.1
  Microsoft .NET Framework 1.1 Hotfix (KB928366)
  Microsoft .NET Framework 2.0
  Microsoft Device Emulator version 1.0 - ENU
  Microsoft Document Explorer 2005
  Microsoft Document Explorer 2005
  Microsoft Internationalized Domain Names Mitigation APIs
  Microsoft National Language Support Downlevel APIs
  Microsoft Office FrontPage 2003
  Microsoft Office Professional Edition 2003
  Microsoft Office Project Professional 2003
  Microsoft Office Visio Professional 2003
  Microsoft SQL Server 2005
  Microsoft SQL Server 2005 Mobile [ENU] Developer Tools
  Microsoft SQL Server 2005 Tools Express Edition
  Microsoft SQL Server Native Client
  Microsoft SQL Server Setup Support Files (English)
  Microsoft SQL Server VSS Writer
  Microsoft Visual C++ 2005 Redistributable
  Microsoft Visual J# 2.0 Redistributable Package
  Microsoft Visual Studio 2005 Professional Edition - ENU
  Microsoft Windows Theme Ontario
  MSXML 4.0 SP2 (KB925672)
  MSXML 4.0 SP2 (KB92797
  MSXML 4.0 SP2 (KB936181)
  MSXML 6.0 Parser (KB933579)
  Python 2.4.1
  QuickTime
  RealPlayer
  Realtek High Definition Audio Driver
  Respondus LockDown Browser
  Security Update for CAPICOM (KB931906)
  Security Update for CAPICOM (KB931906)
  Security Update for Microsoft .NET Framework 2.0 (KB928365)
  Security Update for Microsoft Visual Studio 2005 Professional Edition - ENU (KB925674)
  Security Update for Microsoft Visual Studio 2005 Professional Edition - ENU (KB937060)
  Security Update for Windows Internet Explorer 7 (KB928090)
  Security Update for Windows Internet Explorer 7 (KB93176
  Security Update for Windows Internet Explorer 7 (KB933566)
  Security Update for Windows Internet Explorer 7 (KB937143)
  Security Update for Windows Internet Explorer 7 (KB938127)
  Security Update for Windows Internet Explorer 7 (KB939653)
  Security Update for Windows Media Player 10 (KB936782)
  Security Update for Windows Media Player 6.4 (KB92539
  Security Update for Windows XP (KB901190)
  Security Update for Windows XP (KB921503)
  Security Update for Windows XP (KB923789)
  Security Update for Windows XP (KB925902)
  Security Update for Windows XP (KB928090)
  Security Update for Windows XP (KB929123)
  Security Update for Windows XP (KB93017
  Security Update for Windows XP (KB931261)
  Security Update for Windows XP (KB931784)
  Security Update for Windows XP (KB93216
  Security Update for Windows XP (KB933729)
  Security Update for Windows XP (KB935839)
  Security Update for Windows XP (KB935840)
  Security Update for Windows XP (KB936021)
  Security Update for Windows XP (KB938829)
  Security Update for Windows XP (KB941202)
  Security Update for Windows XP (KB943460)
  Skype 3.0
  Skype add-on for IE
  Skype Plugin Manager
  Uninstall 1.0.0.0
  Update for Windows XP (KB898461)
  Update for Windows XP (KB904942)
  Update for Windows XP (KB92933
  Update for Windows XP (KB930916)
  Update for Windows XP (KB933360)
  Update for Windows XP (KB936357)
  Update for Windows XP (KB93882
  VeohTV BETA
  VideoLAN VLC media player 0.8.6
  Windows Internet Explorer 7
  Windows Live Messenger
  Windows Media Format Runtime
  Windows Media Player 10
  WinRAR archiver
  Yahoo! Widgets
  ZBrush3
  
  
• ndmmxiaomayi

  10 Dec 07, 22:11

  A new HijackThis log please.
• the_king_of_hades

  10 Dec 07, 22:36

  This one..?
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 10:33:44 PM, on 10/12/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16544)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
  C:\Program Files\NewDotNet\nnrun.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\CCM\CcmExec.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\NewDotNet\nnrun.exe
  C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
  C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
  C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
  C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
  C:\WINDOWS\RTHDCPL.EXE
  C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
  C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
  C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
  C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
  C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
  C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
  C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
  C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.blackle.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
  O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
  O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
  O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
  O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [WindowBlinds] C:\Program Files\Stardock\Object Desktop\WindowBlinds\WBInstall32.exe
  O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
  O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
  O4 - S-1-5-18 Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe (User 'SYSTEM')
  O4 - .DEFAULT Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe (User 'Default user')
  O4 - .DEFAULT User Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe (User 'Default user')
  O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Bluetooth.lnk = ?
  O4 - Global Startup: MapToPDriveLoopLaunch.bat
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1174874783734
  O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = sd.sp.edu.sg
  O17 - HKLM\Software\..\Telephony: DomainName = sd.sp.edu.sg
  O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = sd.sp.edu.sg
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  O23 - Service: NNServ - New.net, Inc. - C:\Program Files\NewDotNet\nnrun.exe
  
  --
  End of file - 9701 bytes
  
• the_king_of_hades

  10 Dec 07, 22:39

  And also, i seem to have another problem..
  
  Sometimes when I am surfing the internet and i click on the "back" button to go back, the whole window gets closed. And this has happened for many times already. And when the window is closed, the error message Internet Explorer has encountered an error and keeps asking me to send or don't send an email to microsoft about it..
• ndmmxiaomayi

  10 Dec 07, 22:40

  It's still not uninstalled yet.
  
  NewDotNet is still present. This can cause Internet Explorer to crash.
  
  Try the uninstaller: http://www.new.net/support/NNuninstall.exe
• the_king_of_hades

  10 Dec 07, 22:53

  Is it out yet?
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 10:50:50 PM, on 10/12/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16544)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\CCM\CcmExec.exe
  C:\WINDOWS\system32\msiexec.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
  C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
  C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
  C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
  C:\WINDOWS\RTHDCPL.EXE
  C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
  C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
  C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
  C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
  C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
  C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
  C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
  C:\WINDOWS\system32\wbem\wmiapsrv.exe
  C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
  C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.blackle.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
  O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
  O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
  O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
  O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [WindowBlinds] C:\Program Files\Stardock\Object Desktop\WindowBlinds\WBInstall32.exe
  O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
  O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
  O4 - S-1-5-18 Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe (User 'SYSTEM')
  O4 - .DEFAULT Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe (User 'Default user')
  O4 - .DEFAULT User Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe (User 'Default user')
  O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Bluetooth.lnk = ?
  O4 - Global Startup: MapToPDriveLoopLaunch.bat
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1174874783734
  O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = sd.sp.edu.sg
  O17 - HKLM\Software\..\Telephony: DomainName = sd.sp.edu.sg
  O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = sd.sp.edu.sg
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  O23 - Service: NNServ - Unknown owner - C:\Program Files\NewDotNet\nnrun.exe (file missing)
  
  --
  End of file - 9696 bytes
  
• ndmmxiaomayi

  10 Dec 07, 23:01

  OK, finally gone. It left orphans though.
  
  Copy and paste the following blue lines into Notepad:
  
  sc stop NNServ
  sc delete NNServ
  if exist "%programfiles%\NewDotNet"
  rmdir /s /q "%programfiles%\NewDotNet"
  
  Click on File > Save As....
  
  In the File Name box, copy and paste in fix.bat
  
  In the Save As Type box, select All Files from the drop-down list.
  
  Click Save.
  
  Double click on fix.bat to run it. Command Prompt will open and close quickly; this is normal.
  
  Then post back a new HijackThis log.
• the_king_of_hades

  10 Dec 07, 23:08

  Here it is:
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 11:06:08 PM, on 10/12/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16544)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\CCM\CcmExec.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
  C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
  C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
  C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
  C:\WINDOWS\RTHDCPL.EXE
  C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
  C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
  C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
  C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
  C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
  C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
  C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
  C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
  C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\Program Files\VideoLAN\VLC\vlc.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.blackle.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
  O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
  O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
  O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
  O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [WindowBlinds] C:\Program Files\Stardock\Object Desktop\WindowBlinds\WBInstall32.exe
  O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
  O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
  O4 - S-1-5-18 Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe (User 'SYSTEM')
  O4 - .DEFAULT Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe (User 'Default user')
  O4 - .DEFAULT User Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe (User 'Default user')
  O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Bluetooth.lnk = ?
  O4 - Global Startup: MapToPDriveLoopLaunch.bat
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1174874783734
  O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = sd.sp.edu.sg
  O17 - HKLM\Software\..\Telephony: DomainName = sd.sp.edu.sg
  O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = sd.sp.edu.sg
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  
  --
  End of file - 9537 bytes
  
• ndmmxiaomayi

  11 Dec 07, 13:19

  Step 1
  
  

  [*]Please download AVG Anti-Spyware and save it to your desktop.
  [*]Double click on avgas-setup-7.5.0.50.exe to install AVG Anti-Spyware. Install it in the default location.
  [*]Once installed, start AVG Anti-Spyware by going to Start > All Programs > AVG Anti-Spyware 7.5 > AVG Anti-Spyware.
  [*]In the main screen, you should see Your Computer's Security.
  [*]Next to Resident Shield, click on Change state. It should now be Inactive.
  [*]Next to Automatic Updates, click on Change state. It should now be Inactive.
  [*]Next to Last Update, click on Update now. If your firewall prompts you, tell your firewall to allow it. Should you be unable to update it, download the updates from here. Save it to your desktop. Double click to run the installation and the updates will be installed. Make sure AVG Anti-Spyware is closed during the installation.
  [*]Right-click the AVG Anti-Spyware icon near the clock and uncheck (untick) Start with Windows. Confirm by clicking Yes.
  [*]Now click on the Scanner button at the top.
  [*]Select the Settings tab.
  [*]Under How to act?, click on Recommended actions and select Quarantine.
  [*]Under How to scan?, check (tick) all the boxes.
  [*]Under Possibly unwanted software:, check (tick) all the boxes.
  [*]Under Reports:, uncheck (untick) the Only if threats were found box and select Do not automatically generate report.
  [*]Under What to scan?, select Scan every file.

  
  
  Do not run a scan yet. You will run a scan later.
  
  Step 2
  
  Please download ATF Cleaner by Atribune.
  
  

  [*]Double-click ATF-Cleaner.exe to run the program.
  [*]Under Main choose: Select All.
  [*]Click the Empty Selected button.

  
  
  If you use Firefox browser
  
  

  [*]Click Firefox at the top and choose: Select All.
  [*]Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.

  
  
  If you use Opera browser
  
  

  [*]Click Opera at the top and choose: Select All.
  [*]Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.

  
  
  Step 3
  
  Please print out or save this set of instructions as you will not have internet access during the fix.
  
  Reboot into Safe Mode by following the instructions below:
  
  

  [*]When you see BIOS screen, start pressing F8.
  [*]A boot menu will appear shortly.
  [*]Using the up down arrows, select Safe Mode and press the Enter key.
  [*]Windows will now load.
  [*]Log in to your usual account.

  
  
  Step 4
  
  

  [*]Start AVG Anti-Spyware by going to Start > All Programs > AVG Anti-Spyware 7.5 > AVG Anti-Spyware.
  [*]Click on the Scanner button at the top.
  [*]Select the Scan tab.
  [*]Click on Complete System Scan to start the scan.
  [*]When the scan has finished, follow the instructions below.
  IMPORTANT: Don't click on the Save Scan Report button before you did hit the Apply all Actions button.
  
  [*]Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
  [*]At the bottom of the window click on the Apply all Actions button. (3)
  
  
  [*]When done, click the Save Scan Report button. (4)
  
  [*]Click the Save Report as button.
  [*]Save the report to your Desktop.
  
  [*]Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

  
  
  Restart your computer in Normal Mode.
  
  Please post the AVG Antispyware scan report and a new HijackThis log.
• the_king_of_hades

  11 Dec 07, 21:34

  An error message pops out, it says :
  
  It has been detected that ewido anti-spyware is installed on this system. ewido anti-spyware must be uninstalled before you can install AVG Anti-spyware 7.5. Your existing code of ewido anti-spyware will also work in AVG anti-spyware 7.5. Please uninstall ewido anti-spyware, reboot your computer and try again. Do you want to do this now?
  
  So should i uninstall this?
• ndmmxiaomayi

  12 Dec 07, 00:42

  Yes, you should. It has been bought over by AVG anyway.
• the_king_of_hades

  12 Dec 07, 13:21

  ---------------------------------------------------------
  AVG Anti-Spyware - Scan Report
  ---------------------------------------------------------
  
  + Created at: 1:07:34 PM 12/12/2007
  
  + Scan result:
  
  C:\Documents and Settings\p0730398\Local Settings\Temporary Internet Files\Content.IE5\OSZC1JPI\NNuninstall[1].exe -> Adware.NewDotNet : Cleaned with backup (quarantined).
  C:\WINDOWS\NDNuninstall6_38.exe -> Adware.NewDotNet : Cleaned with backup (quarantined).
  C:\WINDOWS\NDNuninstall7_48.exe -> Adware.NewDotNet : Cleaned with backup (quarantined).
  D:\NNuninstall.exe -> Adware.NewDotNet : Cleaned with backup (quarantined).
  HKLM\SOFTWARE\New.net -> Adware.NewDotNet : Cleaned with backup (quarantined).
  HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E} -> Adware.NewDotNet : Cleaned with backup (quarantined).
  HKU\.DEFAULT\Software\New.net -> Adware.NewDotNet : Cleaned with backup (quarantined).
  HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E} -> Adware.NewDotNet : Cleaned with backup (quarantined).
  HKU\S-1-5-18\Software\New.net -> Adware.NewDotNet : Cleaned with backup (quarantined).
  HKU\S-1-5-21-448539723-884357618-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E} -> Adware.NewDotNet : Cleaned with backup (quarantined).
  HKU\S-1-5-21-448539723-884357618-1801674531-500\Software\New.net -> Adware.NewDotNet : Cleaned with backup (quarantined).
  C:\System Volume Information\_restore{CA04B3D2-AC33-44E2-9B8C-024D0CAF7348}\RP145\A0078195.dll -> Adware.RK : Cleaned with backup (quarantined).
  C:\System Volume Information\_restore{CA04B3D2-AC33-44E2-9B8C-024D0CAF7348}\RP145\A0078196.dll -> Adware.RK : Cleaned with backup (quarantined).
  C:\System Volume Information\_restore{CA04B3D2-AC33-44E2-9B8C-024D0CAF7348}\RP145\A0079159.exe -> Adware.RK : Cleaned with backup (quarantined).
  C:\WINDOWS\system32\rlls.dl_ -> Adware.RK : Cleaned with backup (quarantined).
  D:\Cookies\administrator@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
  D:\Cookies\administrator@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned.
  D:\Cookies\administrator@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned.
  D:\Cookies\[email protected][2].txt -> TrackingCookie.Hitbox : Cleaned.
  D:\Cookies\administrator@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
  D:\Cookies\[email protected][1].txt -> TrackingCookie.Skype : Cleaned.
  D:\Cookies\administrator@skype[1].txt -> TrackingCookie.Skype : Cleaned.
  
  ::Report end
  
  
• ndmmxiaomayi

  12 Dec 07, 13:24

  Please go to Kaspersky website and perform an online antivirus scan. Please use Internet Explorer as it uses ActiveX.
  
  

  [*]Click on Kaspersky Online Scanner button.
  [*]Read through the requirements and privacy statement and click on Accept button.
  [*]It will start downloading and installing the scanner and virus definitions. You will be prompted to install an ActiveX from Kaspersky. Click Yes.
  [*]When the downloads have finished, click on Next button.
  [*]Click on Scan Settings button.
  [*]Select extended under Scan using the following antivirus database:
  [*]Check (tick) these boxes under Scan options:
  [*]Scan Archives
  [*]Scan Mail Bases
  [*]Click OK
  [*]Click on My Computer under Please select a target to scan:
  [*]Once the scan is complete it will display if your system has been infected. Click on Save as text button and save it to your desktop.
  [*]Copy and paste this log in your next reply.
• the_king_of_hades

  12 Dec 07, 23:17

  -------------------------------------------------------------------------------
  KASPERSKY ONLINE SCANNER REPORT
  Wednesday, 12 December, 2007 11:13:59 PM
  Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
  Kaspersky Online Scanner version: 5.0.98.0
  Kaspersky Anti-Virus database last update: 12/12/2007
  Kaspersky Anti-Virus database records: 480744
  -------------------------------------------------------------------------------
  
  Scan Settings:
  Scan using the following antivirus database: extended
  Scan Archives: true
  Scan Mail Bases: true
  
  Scan Target - My Computer:
  C:\
  D:\
  
  Scan Statistics:
  Total number of scanned objects: 141827
  Number of viruses found: 3
  Number of infected objects: 4
  Number of suspicious objects: 0
  Duration of the scan process: 02:37:27
  
  Infected Object Name / Virus Name / Last Action
  C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Network Associates\BOPDATA\_Date-20071212_Time-195953843_EnterceptExceptions.dat Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Network Associates\BOPDATA\_Date-20071212_Time-195953843_EnterceptRules.dat Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Db\Agent_DBE-NB0730398.log Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Db\PrdMgr_DBE-NB0730398.log Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\AccessProtectionLog.txt Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\BufferOverflowProtectionLog.txt Object is locked skipped
  C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\OnAccessScanLog.txt Object is locked skipped
  C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
  C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
  C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
  C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
  C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
  C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
  C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
  C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
  C:\Documents and Settings\p0730398\Cookies\index.dat Object is locked skipped
  C:\Documents and Settings\p0730398\Local Settings\Application Data\ApplicationHistory\cli.exe.c88dbd71.ini.inuse Object is locked skipped
  C:\Documents and Settings\p0730398\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
  C:\Documents and Settings\p0730398\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped
  C:\Documents and Settings\p0730398\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\pending.dat Object is locked skipped
  C:\Documents and Settings\p0730398\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Working\database_8270_5F0F_705F_975\dfsr.db Object is locked skipped
  C:\Documents and Settings\p0730398\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Working\database_8270_5F0F_705F_975\fsr.log Object is locked skipped
  C:\Documents and Settings\p0730398\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Working\database_8270_5F0F_705F_975\fsrtmp.log Object is locked skipped
  C:\Documents and Settings\p0730398\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Working\database_8270_5F0F_705F_975\tmp.edb Object is locked skipped
  C:\Documents and Settings\p0730398\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
  C:\Documents and Settings\p0730398\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
  C:\Documents and Settings\p0730398\Local Settings\Application Data\Microsoft\Windows Live Contacts\[email protected]\real\members.stg Object is locked skipped
  C:\Documents and Settings\p0730398\Local Settings\Application Data\Microsoft\Windows Live Contacts\[email protected]\shadow\members.stg Object is locked skipped
  C:\Documents and Settings\p0730398\Local Settings\Application Data\Yahoo\Widget Engine\Widgets DB\widgets.db Object is locked skipped
  C:\Documents and Settings\p0730398\Local Settings\History\History.IE5\index.dat Object is locked skipped
  C:\Documents and Settings\p0730398\Local Settings\History\History.IE5\MSHist012007121220071213\index.dat Object is locked skipped
  C:\Documents and Settings\p0730398\Local Settings\Temp\Perflib_Perfdata_468.dat Object is locked skipped
  C:\Documents and Settings\p0730398\Local Settings\Temp\Perflib_Perfdata_5d8.dat Object is locked skipped
  C:\Documents and Settings\p0730398\Local Settings\Temp\Perflib_Perfdata_66c.dat Object is locked skipped
  C:\Documents and Settings\p0730398\Local Settings\Temp\~DF3BF4.tmp Object is locked skipped
  C:\Documents and Settings\p0730398\Local Settings\Temp\~DF7B7.tmp Object is locked skipped
  C:\Documents and Settings\p0730398\Local Settings\Temp\~DF7DC5.tmp Object is locked skipped
  C:\Documents and Settings\p0730398\Local Settings\Temp\~DF7E15.tmp Object is locked skipped
  C:\Documents and Settings\p0730398\Local Settings\Temp\~DF9A7.tmp Object is locked skipped
  C:\Documents and Settings\p0730398\Local Settings\Temp\~DFB75C.tmp Object is locked skipped
  C:\Documents and Settings\p0730398\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
  C:\Documents and Settings\p0730398\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
  C:\Documents and Settings\p0730398\NTUSER.DAT Object is locked skipped
  C:\Documents and Settings\p0730398\NTUSER.DAT.LOG Object is locked skipped
  C:\Program Files\Veoh Networks\Veoh\client.log Object is locked skipped
  C:\Program Files\Veoh Networks\Veoh\upload.log Object is locked skipped
  C:\System Volume Information\_restore{CA04B3D2-AC33-44E2-9B8C-024D0CAF7348}\RP145\A0079199.exe Infected: not-a-virus:AdWare.Win32.OneStep.c skipped
  C:\System Volume Information\_restore{CA04B3D2-AC33-44E2-9B8C-024D0CAF7348}\RP146\A0079366.exe Infected: not-a-virus:AdWare.Win32.NewDotNet skipped
  C:\System Volume Information\_restore{CA04B3D2-AC33-44E2-9B8C-024D0CAF7348}\RP146\A0079367.exe Infected: not-a-virus:AdWare.Win32.NewDotNet.e skipped
  C:\System Volume Information\_restore{CA04B3D2-AC33-44E2-9B8C-024D0CAF7348}\RP146\change.log Object is locked skipped
  C:\WINDOWS\CSC\00000001 Object is locked skipped
  C:\WINDOWS\Debug\Netlogon.log Object is locked skipped
  C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
  C:\WINDOWS\SchedLgU.Txt Object is locked skipped
  C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
  C:\WINDOWS\Sti_Trace.log Object is locked skipped
  C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
  C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\CcmExec.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\CertificateMaintenance.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\ClientIDManagerStartup.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\DataTransferService.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\execmgr.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\LocationServices.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\mtrmgr.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\PatchInstall.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\PatchUIMonitor.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\PolicyAgent.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\PolicyAgentProvider.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\PolicyEvaluator.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\Scheduler.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\SrcUpdateMgr.log Object is locked skipped
  C:\WINDOWS\system32\CCM\Logs\StatusAgent.log Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\CertificateMaintenanceEndpoint\0000000V.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\CertificateMaintenanceEndpoint\0000000V.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\CTMDTSReply\0000000E.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\CTMDTSReply\0000000E.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\execmgr\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\execmgr\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\InventoryAgent\00000002.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\InventoryAgent\00000002.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\LS_ReplyLocations\0000000D.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\LS_ReplyLocations\0000000D.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\LS_ScheduledCleanup\0000001C.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\LS_ScheduledCleanup\0000001C.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\MtrMgr\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\MtrMgr\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PatchUIMonitor\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PatchUIMonitor\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_Cleanup\0000000L.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_Cleanup\0000000L.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_PolicyDownload\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_PolicyDownload\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_PolicyEvaluator\0000004Y.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_PolicyEvaluator\0000004Y.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_ReplyAssignments\0000000L.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_ReplyAssignments\0000000L.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_RequestAssignments\0000005B.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_RequestAssignments\0000005B.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_ReRequestPolicy\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\PolicyAgent_ReRequestPolicy\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\RemoteToolsAgent\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\RemoteToolsAgent\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\SrcUpdateMgr\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\SrcUpdateMgr\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\SWMTRReportGen\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\SWMTRReportGen\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\UpdatesInstallMgr\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\UpdatesInstallMgr\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\UploadProtocol\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\EndpointQueues\UploadProtocol\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\amp_[http]mp_locationmanager\00000017.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\amp_[http]mp_locationmanager\00000017.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_mp_ddrendpoint\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_mp_ddrendpoint\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_mp_hinvendpoint\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_mp_hinvendpoint\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_mp_relayendpoint\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_mp_relayendpoint\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_mp_sinvendpoint\00000001.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_mp_sinvendpoint\00000001.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_statusreceiver\00000002.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_statusreceiver\00000002.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_[http]mp_locationmanager\00000004.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_[http]mp_locationmanager\00000004.que Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_[http]mp_policymanager\0000004Q.msg Object is locked skipped
  C:\WINDOWS\system32\CCM\ServiceData\Messaging\OutgoingQueues\mp_[http]mp_policymanager\0000004Q.que Object is locked skipped
  C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped
  C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
  C:\WINDOWS\system32\config\default Object is locked skipped
  C:\WINDOWS\system32\config\default.LOG Object is locked skipped
  C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
  C:\WINDOWS\system32\config\SAM Object is locked skipped
  C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
  C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
  C:\WINDOWS\system32\config\SECURITY Object is locked skipped
  C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
  C:\WINDOWS\system32\config\software Object is locked skipped
  C:\WINDOWS\system32\config\software.LOG Object is locked skipped
  C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
  C:\WINDOWS\system32\config\system Object is locked skipped
  C:\WINDOWS\system32\config\system.LOG Object is locked skipped
  C:\WINDOWS\system32\h323log.txt Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
  C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
  C:\WINDOWS\wiadebug.log Object is locked skipped
  C:\WINDOWS\wiaservc.log Object is locked skipped
  C:\WINDOWS\WindowsUpdate.log Object is locked skipped
  D:\System Volume Information\_restore{CA04B3D2-AC33-44E2-9B8C-024D0CAF7348}\RP146\A0079368.exe Infected: not-a-virus:AdWare.Win32.NewDotNet.e skipped
  
  Scan process completed.
  
• ndmmxiaomayi

  13 Dec 07, 01:30

  Flush the system restore points
  
  

  [*]Right click on My Computer and select Properties.
  [*]Select the System Restore tab.
  [*]Check (tick) Turn off system restore on all drives box.
  [*]Click OK.
  [*]Restart your computer.

  
  After restarting your computer, follow these steps:
  
  

  [*]Right click on My Computer and select Properties.
  [*]Select the System Restore tab.
  [*]Uncheck (untick) Turn off system restore on all drives box.
  [*]Click OK.
  [*]Restart your computer.

  
  Note: Do this only ONCE, don't flush it regularly.
  
  Then see the sticky thread on Adware/Spyware Prevention...
• the_king_of_hades

  13 Dec 07, 10:59

  Will all my data in the computer be lost?
• ndmmxiaomayi

  13 Dec 07, 13:15

  Clearing system restore is not formatting... your data will still be around.