search engine problem

• enzer229

  20 Dec 07, 21:12

  whenever i use search engine regardless yahoo,msn or google, i will face lot problem. it links me to other site. i guess it is a pop up. so any1 here can advise what can i do to remove these pop up.
• abao

  20 Dec 07, 21:38

  scan for adware. can try spybot S&D and AVG Antispyware
• enzer229

  20 Dec 07, 21:40

  i use the avg one. i keep delete those spyware, but the popup will reappear.
  any other metthod?
• mr_sotong

  20 Dec 07, 21:44

  
  Step 1
  
  

  [*]Please download the latest copy of HijackThis from Trend Micro and save it to your desktop.
  [*]Double click on HJTInstall.exe to install it. Click on Install. By default, it will install to C:\Program Files\Trend Micro\HijackThis.
  [*]Read through the License Agreement presented to you on the next screen and click on I Accept.
  [*]Once installed, HijackThis will start automatically. If it doesn't, please go to your desktop and double click on the HijackThis shortcut created there.
  [*]Select Do a system scan and save a logfile.
  [*]Close HijackThis.

  Note: Do not click on the AnalyzeThis button.
  
  Do not fix any lines you see in HijackThis as most entries are harmless and needed for the normal functioning of Windows.
  
  
• enzer229

  20 Dec 07, 21:47

  ogfile of Trend Micro HijackThis v2.0.2
  Scan saved at 9:44:06 PM, on 12/20/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\LEXBCES.EXE
  C:\WINDOWS\system32\LEXPPS.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\igfxtray.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\WINDOWS\ALCWZRD.EXE
  C:\WINDOWS\AGRSMMSG.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  C:\WINDOWS\system32\Rundll32.exe
  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  C:\WINDOWS\system32\CTsvcCDA.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\wdfmgr.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\WINDOWS\System32\alg.exe
  C:\WINDOWS\system32\wscntfy.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  C:\WINDOWS\system32\wbem\wmiprvse.exe
  
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.games-fusion.net/
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = proxy.singnet.com.sg Port: 8080
  R3 - URLSearchHook: Tencent SearchHook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\Program Files\TENCENT\SSPlus\SAddr.dll (file missing)
  F2 - REG:system.ini: UserInit=userinit.exe
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
  O2 - BHO: Tencent Browser Helper - {0C7C23EF-A848-485B-873C-0ED954731014} - C:\Program Files\TENCENT\SSPlus\SAddr.dll (file missing)
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
  O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
  O4 - HKLM\..\Run: [LaunchApp] Alaunch
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
  O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
  O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
  O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
  O4 - HKLM\..\Run: [Windows Messenger Messenger] winmsg.exe
  O4 - HKLM\..\Run: [keyboard] C:\\keyboard25.exe
  O4 - HKLM\..\Run: [newname] C:\\newname25.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [stup.exe] Rundll32.exe C:\PROGRA~1\TENCENT\SSPlus\SPlus.dll,Rundll32 R
  O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
  O4 - HKLM\..\RunServices: [Windows Messenger Messenger] winmsg.exe
  O4 - HKLM\..\RunServices: [Windows Recylinder Check] sryqvwszdc.exe
  O4 - HKCU\..\Run: [Windows Messenger Messenger] winmsg.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
  O4 - HKCU\..\RunServices: [Windows Messenger Messenger] winmsg.exe
  O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
  O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
  O8 - Extra context menu item: ???QQ?? - C:\Program Files\Tencent\QQ\AddEmotion.htm
  O8 - Extra context menu item: ???QQ???? - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
  O8 - Extra context menu item: ???QQ????? - C:\Program Files\Tencent\QQ\AddPanel.htm
  O8 - Extra context menu item: ?QQ MMS????? - C:\Program Files\Tencent\QQ\SendMMS.htm
  O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
  O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
  O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
  O8 - Extra context menu item: ¥ÎQQ±m«Hµo°e¸Ó¹�¤ù - C:\Program Files\Tencent\QQ\SendMMS.htm
  O8 - Extra context menu item: ²K¥[¨ìQQ¦Û©w¸q­±ªO - C:\Program Files\Tencent\QQ\AddPanel.htm
  O8 - Extra context menu item: ²K¥[¨ìQQªí±¡ - C:\Program Files\Tencent\QQ\AddEmotion.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE (file missing)
  O9 - Extra 'Tools' menuitem: ÄË°TQQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE (file missing)
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O11 - Options group: [TBH] SOSO AddressBar Search
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab
  O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_activex/en-US/TSEasyInstallX.CAB
  O17 - HKLM\System\CCS\Services\Tcpip\..\{7DDD1169-CD81-442E-A092-02FCC1341289}: NameServer = 85.255.113.140,85.255.112.93
  O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.140 85.255.112.93
  O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.140 85.255.112.93
  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.140 85.255.112.93
  O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\VXNlcg\command.exe (file missing)
  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
  O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/User/LOCALS~1/Temp/msohtml1/02/clip_image001.jpg
  
  --
  End of file - 9610 bytes
  
• LatecomerX

  21 Dec 07, 00:37

  Originally posted by mr_sotong:
  
  [b]Step 1
  
  

  [*]Please download the latest copy of HijackThis from Trend Micro and save it to your desktop.
  [*]Double click on HJTInstall.exe to install it. Click on Install. By default, it will install to C:\Program Files\Trend Micro\HijackThis.
  [*]Read through the License Agreement presented to you on the next screen and click on I Accept.
  [*]Once installed, HijackThis will start automatically. If it doesn't, please go to your desktop and double click on the HijackThis shortcut created there.
  [*]Select Do a system scan and save a logfile.
  [*]Close HijackThis.

  Note: Do not click on the AnalyzeThis button.
  
  Do not fix any lines you see in HijackThis as most entries are harmless and needed for the normal functioning of Windows.
  
  [/b]

  Got pay copyright fees to anty ma?
  
  (I remember someone suggested to sticky the instructions a while ago. Does anyone violently object this?)
  
• abao

  21 Dec 07, 00:42

  
  O4 - HKLM\..\Run: [keyboard] C:\\keyboard25.exe
  O4 - HKLM\..\Run: [newname] C:\\newname25.exe
  

  Someone better help the person. I think these are the root cause.
• ndmmxiaomayi

  21 Dec 07, 03:07

  There are others.
  
  I'll get back to you in a moment when I've done with the checking. Please don't PM me.
• ndmmxiaomayi

  21 Dec 07, 03:08

  Originally posted by LatecomerX:

  Got pay copyright fees to anty ma?
  
  (I remember someone suggested to sticky the instructions a while ago. Does anyone violently object this?)
  

  LOL, copyright fees to Trend Micro.
  
• ndmmxiaomayi

  21 Dec 07, 03:14

  Stay disconnected from the Net except when downloading tools and posting the logs.
  
  If you already have SDFix, please delete this copy and download it again as it's being updated regularly.
  
  

  [*]Please download SDFix by AndyManchesta and save it to your desktop.
  [*]Double click on SDFix.exe. By default, it will install to C:\.
  [*]Click on Install.

  
  
  Please print out or save this set of instructions as you will not have internet access during the fix.
  
  Next, boot into Safe Mode.
  
  

  [*]When you see BIOS screen, start pressing F8.
  [*]A boot menu will appear shortly.
  [*]Using the up down arrows, select Safe Mode and press the Enter key.
  [*]Windows will now load.
  [*]Log in to your usual account.
  [*]Navigate to C:\SDfix (if you installed it to the default location, otherwise, locate where you installed it) [*]Double click on RunThis.bat
  [*]Type Y to begin the cleanup process.
  [*]It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  [*]Press any key to reboot.
  [*]When the PC restarts the tool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  [*]Once the desktop icons load, the SDFix report will open on screen. You can also find the report in SDFix folder, named Report.txt.

  
  
  Post back the SDFix log and a new HijackThis log.
• enzer229

  21 Dec 07, 07:14

  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 7:12:28 AM, on 12/21/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\LEXBCES.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\LEXPPS.EXE
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\igfxtray.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\WINDOWS\ALCWZRD.EXE
  C:\WINDOWS\AGRSMMSG.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
  C:\Program Files\ThreatFire\TFTray.exe
  C:\Program Files\Spyware Doctor\SDTrayApp.exe
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  C:\WINDOWS\system32\CTsvcCDA.exe
  C:\Program Files\Spyware Doctor\svcntaux.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
  C:\Program Files\Spyware Doctor\swdsvc.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\ThreatFire\TFService.exe
  C:\WINDOWS\system32\wdfmgr.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\WINDOWS\system32\wscntfy.exe
  C:\WINDOWS\System32\alg.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  C:\WINDOWS\system32\wbem\wmiprvse.exe
  
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.games-fusion.net/
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = proxy.singnet.com.sg Port: 8080
  R3 - URLSearchHook: (no name) - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - (no file)
  F2 - REG:system.ini: UserInit=userinit.exe
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
  O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
  O4 - HKLM\..\Run: [LaunchApp] Alaunch
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
  O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
  O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
  O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
  O4 - HKLM\..\Run: [Windows Messenger Messenger] winmsg.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [stup.exe] Rundll32.exe C:\PROGRA~1\TENCENT\SSPlus\SPlus.dll,Rundll32 R
  O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
  O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe
  O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
  O4 - HKLM\..\RunServices: [Windows Messenger Messenger] winmsg.exe
  O4 - HKLM\..\RunServices: [Windows Recylinder Check] sryqvwszdc.exe
  O4 - HKCU\..\Run: [Windows Messenger Messenger] winmsg.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  O4 - HKCU\..\Run: [Anti-AD Guard 2.1] C:\Program Files\Anti-AD Guard 2.1\adguard.exe
  O4 - HKCU\..\RunServices: [Windows Messenger Messenger] winmsg.exe
  O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: sQusi Tracking Plus.lnk = C:\Program Files\sQusi\sQusi Tracking Plus\sQusiLaunch.exe
  O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
  O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
  O8 - Extra context menu item: ???QQ?? - C:\Program Files\Tencent\QQ\AddEmotion.htm
  O8 - Extra context menu item: ???QQ???? - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
  O8 - Extra context menu item: ???QQ????? - C:\Program Files\Tencent\QQ\AddPanel.htm
  O8 - Extra context menu item: ?QQ MMS????? - C:\Program Files\Tencent\QQ\SendMMS.htm
  O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
  O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
  O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
  O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
  O8 - Extra context menu item: ¥ÎQQ±m«Hµo°e¸Ó¹�¤ù - C:\Program Files\Tencent\QQ\SendMMS.htm
  O8 - Extra context menu item: ²K¥[¨ìQQ¦Û©w¸q­±ªO - C:\Program Files\Tencent\QQ\AddPanel.htm
  O8 - Extra context menu item: ²K¥[¨ìQQªí±¡ - C:\Program Files\Tencent\QQ\AddEmotion.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE (file missing)
  O9 - Extra 'Tools' menuitem: ÄË°TQQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE (file missing)
  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O11 - Options group: [TBH] SOSO AddressBar Search
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab
  O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_activex/en-US/TSEasyInstallX.CAB
  O17 - HKLM\System\CCS\Services\Tcpip\..\{7DDD1169-CD81-442E-A092-02FCC1341289}: NameServer = 208.67.220.220,208.67.222.222
  O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
  O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
  O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\VXNlcg\command.exe (file missing)
  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
  O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
  O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
  O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe
  O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/User/LOCALS~1/Temp/msohtml1/02/clip_image001.jpg
  
  --
  End of file - 10622 bytes
  
• enzer229

  21 Dec 07, 07:32

  i press F12 to enter boot menu.
  
  i see all those
  
  1. 1st floppy disk
  2.generic usb sd reader
  3.generic usb cf reader
  4.generic sm reader
  5.generic ms reader
  6.wdc wd800jd-22jnao
  7.hl-dt-st rw/dvd gcc-452ib
  
  canot find safe mode
• ndmmxiaomayi

  21 Dec 07, 17:18

  Press F8, not F12.
  
  If F8 doesn't work, use F5.
• enzer229

  22 Dec 07, 11:52

  lol i reformat my computer
• ndmmxiaomayi

  22 Dec 07, 12:56

  OK. Read the sticky thread on Spyware/Adware Prevention.