Please help me, I got the hijackthis log, here it is:
Logfile of HijackThis v1.99.0
Scan saved at 9:13:24 AM, on 1/14/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Symantec
Shared\ccEvtMgr.exe
C:\WINDOWS\system32\msCMTSrvc.exe
C:\Program Files\Inverse IP InSight\RCN\ARUpld32.exe
C:\Program Files\Inverse IP InSight\RCN\ARMon32a.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Common Files\Symantec
Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec
Shared\ccApp.exe
C:\Program Files\McAfee\McAfee Shared
Components\Guardian\CMGrdian.exe
C:\WINDOWS\system32\peekrhq.exe
C:\Program Files\Common
Files\Real\Update_OB\realsched.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Hewlett-Packard\HP
Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\Digital
Imaging\Unload\hpqcmon.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.
exe
C:\Program Files\Hewlett-Packard\HP
Share-to-Web\hpgs2wnf.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software
Update\HPWuSchd.exe
C:\WINDOWS\system32\hphmon05.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program
Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker1.e
xe
C:\Program
Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.e
xe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary
Directory 1 for hijackthis[1].zip\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Default_Page_URL =
http://qus7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Default_Search_URL =
http://srch-qus7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Search Bar =
http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Search Page =
http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKCU\Software\Microsoft\Internet
Explorer\Main,Start Page =
http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Default_Page_URL =
http://www.comcast.net
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Default_Search_URL =
http://srch-qus7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,SearchAssistant = about:blank
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Search Bar =
http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Search Page =
http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet
Explorer\Main,Start Page =
http://qus7.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet
Explorer\Search,SearchAssistant =
http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet
Explorer\Search,CustomizeSearch =
http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet
Explorer\SearchURL,(Default) =
websearch.drsnsrch.com/q.cgi?q=
R1 - HKCU\Software\Microsoft\Internet Connection
Wizard,ShellNext =
https://www.accountlink.pncbank.com/indexForceLogout.j
sp?timeOut=true
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Window Title = Microsoft Internet Explorer
provided by Comcast
R1 -
HKCU\Software\Microsoft\Windows\CurrentVersion\Inter
net Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: (no name) -
_{8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
O2 - BHO: LocalNRDObj Class -
{00320615-B6C2-40A6-8F99-F1C52D674FAD} -
C:\WINDOWS\localNRD.dll
O2 - BHO: Band Class -
{01F44A8A-8C97-4325-A378-76E68DC4AB2E} -
C:\WINDOWS\systb.dll (file missing)
O2 - BHO: myBar BHO -
{0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program
Files\MyWay\myBar\1.bin\MYBAR.DLL
O2 - BHO: AcroIEHlprObj Class -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program
Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) -
{53707962-6F74-2D53-2644-206D7942484F} -
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard -
{5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} -
C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Viewpoint Toolbar BHO -
{A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program
Files\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll
O2 - BHO: Google Toolbar Helper -
{AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program
files\google\googletoolbar3.dll
O2 - BHO: PCTools Browser Monitor -
{B56A7D7D-6927-48C8-A975-17DF180C71AC} -
C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: CNavExtBho Class -
{BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program
Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus -
{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program
Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) -
{ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O3 - Toolbar: (no name) -
{339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O3 - Toolbar: &SearchBar -
{0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program
Files\MyWay\myBar\1.bin\MYBAR.DLL
O3 - Toolbar: Viewpoint Toolbar -
{F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program
Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll
O3 - Toolbar: (no name) -
{2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O3 - Toolbar: &Google -
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program
files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common
Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common
Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Client Access Service] "C:\Program
Files\IBM\Client Access\CwbSvStr.Exe"
O4 - HKLM\..\Run: [Client Access Help Update] "C:\Program
Files\IBM\Client Access\cwbinhlp.exe"
O4 - HKLM\..\Run: [Client Access Check Version]
"C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN
O4 - HKLM\..\Run: [BJCFD] C:\Program
Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [ComcastSUPPORT] C:\Program
Files\Support.com\bin\tgkill.exe /cleaneahtioga /start
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Program
Files\McAfee\McAfee Shared
Components\Guardian\CMGrdian.exe" /SU
O4 - HKLM\..\Run: [dzvkiev]
C:\WINDOWS\system32\peekrhq.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [conscorr] C:\WINDOWS\conscorr.exe
O4 - HKLM\..\Run: [satmat] C:\WINDOWS\satmat.exe
O4 - HKLM\..\Run: [EbatesMoeMoneyMaker0] "C:\Program
Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.e
xe"
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program
Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon]
C:\Program Files\Hewlett-Packard\HP
Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program
Files\Hewlett-Packard\Digital
Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility]
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.
exe
O4 - HKLM\..\Run: [HPHUPD05] C:\Program
Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457
517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program
Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program
Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPHmon05]
C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe
nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor]
"C:\Program Files\McAfee\McAfee Shared
Components\Instant Updater\RuLaunch.exe"
/STARTMONITOR
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program
Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program
Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search -
res://c:\program
files\google\GoogleToolbar3.dll/cmsearch.html
O8 - Extra context menu item: &Viewpoint Search -
res://C:\Program Files\Viewpoint\Viewpoint
Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: Backward Links -
res://c:\program
files\google\GoogleToolbar3.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page -
res://c:\program
files\google\GoogleToolbar3.dll/cmcache.html
O8 - Extra context menu item: Ebates -
file://C:\Program
Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm
O8 - Extra context menu item: Similar Pages -
res://c:\program
files\google\GoogleToolbar3.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English -
res://c:\program
files\google\GoogleToolbar3.dll/cmtrans.html
O9 - Extra button: Spyware Doctor -
{2D663D1A-8670-49D9-A1A5-4C56B4E14E84} -
C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O9 - Extra button: Support -
{1CFE5C17-8234-4DED-B4F9-0153F19C7359} -
http://www.comcastsupport.com (file missing) (HKCU)
O9 - Extra button: Ebates -
{6685509E-B47B-4f47-8E16-9A5F3A62F683} -
file://C:\Program
Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm
(HKCU)
O9 - Extra button: Help -
{859C7D5A-4022-49ED-9D80-FC2B2B4B5D5E} -
http://www.comcast.net/memberservices/ (file missing)
(HKCU)
O9 - Extra button: ComcastHSI -
{F6ED6547-07A6-444F-8E45-A88CBB27E61B} -
http://www.comcast.net (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\program
files\neoteris\secure application manager\gapsp.dll
O10 - Unknown file in Winsock LSP: c:\program
files\neoteris\secure application manager\gapsp.dll
O10 - Unknown file in Winsock LSP: c:\program
files\neoteris\secure application manager\gapsp.dll
O10 - Unknown file in Winsock LSP: c:\program
files\neoteris\secure application manager\gapsp.dll
O10 - Unknown file in Winsock LSP: c:\program
files\neoteris\secure application manager\gapsp.dll
O12 - Plugin for .spop: C:\Program Files\Internet
Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .TIF: C:\Program Files\Internet
Explorer\PLUGINS\npqtplugin5.dll
O14 - IERESET.INF:
START_PAGE_URL=http://www.comcast.net
O16 - DPF: ConferenceRoom Java Client -
http://glass.webmaster.com:8000/java/cr.cab
O16 - DPF: JT's Blocks -
http://download.games.yahoo.com/games/clients/y/blt1_
x.cab
O16 - DPF: Yahoo! Bingo -
http://download.games.yahoo.com/games/clients/y/xt0_x.
cab
O16 - DPF: Yahoo! Dice -
http://download.games.yahoo.com/games/clients/y/dct2_
x.cab
O16 - DPF: Yahoo! Dots -
http://download.games.yahoo.com/games/clients/y/dtt1_
x.cab
O16 - DPF: Yahoo! Exploder -
http://download.games.yahoo.com/games/clients/y/vtk_x.
cab
O16 - DPF: Yahoo! Go -
http://download.games.yahoo.com/games/clients/y/gt1_x.
cab
O16 - DPF: Yahoo! Literati -
http://download.games.yahoo.com/games/clients/y/tt0_x.
cab
O16 - DPF: Yahoo! Spelldown -
http://download.games.yahoo.com/games/clients/y/sdt1_
x.cab
O16 - DPF: Yahoo! Towers 2.0 -
http://download.games.yahoo.com/games/clients/y/ywt0_
x.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED}
(Support.com Configuration Class) -
http://www.comcastsupport.com/sdccommon/download/t
gctlcm.cab
O16 - DPF: {041FA6AB-BA33-498F-AD6D-5913F66801D2}
(AClientX Class) -
https://firepass.casinowindsor.com/activexshare/urxcli.ca
b
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540002}
(CInstall Class) -
http://www.wildtangent.com/webdrivers/webinstall/shock
wave/Install.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498}
(Yahoo! Audio Conferencing) -
http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/
yacscom.cab
O16 - DPF: {2BCDB465-81F9-41CB-832C-8037A4064446} (F5
Networks VPN Manager) -
https://firepass.casinowindsor.com/vdesk/terminal/urxvp
n.cab#version=2003,11,21,1
O16 - DPF: {4CC35DAD-40EA-4640-ACC2-A1A3B6FB3E06}
(NeoterisSetup Control) -
https://extranet.alliancegaming.com/dana-cached/setup/
NeoterisSetup.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455}
(ExentInf Class) -
http://us.games2.yimg.com/download.games.yahoo.com/g
ames/play/client/exentctl_0_0_0_1.ocx
O16 - DPF: {6C275925-A1ED-4DD2-9CEE-9823F5FDAA10} (F5
Networks SSLTunnel) -
https://firepass.casinowindsor.com/vdesk/terminal/urTer
mProxy.cab#version=2003,12,9,2
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73}
(Yahoo! Audio UI1) -
http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} -
http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {97438FE9-D361-4279-BA82-98CC0877A717}
(Cubis Control) -
http://mirror.worldwinner.com/games/v48/cubis/cubis.ca
b
O16 - DPF: {9F9D2D68-4980-4763-B769-510A30F2C7BC}
(SvrWrapperCtl Control) -
https://targetrewards.target.com/targetrewardsWeb/jsp/S
vrWrapperCtl.cab
O16 - DPF: {CC85ACDF-B277-486F-8C70-2C9B2ED2A4E7} (F5
Networks SuperHost Class) -
https://firepass.casinowindsor.com/vdesk/terminal/urxsh
ost.cab
O16 - DPF: {E0FF21FA-B857-45C5-8621-F120A0C17FF2} (F5
Networks Host Control) -
https://firepass.casinowindsor.com/vdesk/terminal/urxho
st.cab#version=2003,12,9,2
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} -
http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/y
iebio5_1_3_0.cab
O18 - Protocol: cetihpz -
{CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program
Files\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: pcAnywhere Host Service - Symantec
Corporation - C:\Program
Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager - Symantec
Corporation - C:\Program Files\Common Files\Symantec
Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service -
Symantec Corporation - C:\Program Files\Common
Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Client Access Express Remote Command -
IBM Corporation - C:\WINDOWS\CWBRXD.EXE
O23 - Service: Inverse IP InSight Client (RCN) - Inverse
Network Technology - C:\Program Files\Inverse IP
InSight\RCN\LaunchIPI.exe
O23 - Service: LexBce Server - Lexmark International, Inc. -
C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Content Monitoring Tool - Unknown -
C:\WINDOWS\system32\msCMTSrvc.exe
O23 - Service: Norton AntiVirus Auto Protect Service -
Symantec Corporation - C:\Program Files\Norton
AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service - NVIDIA
Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP -
C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SymWMI Service - Symantec Corporation -
C:\Program Files\Common Files\Symantec
Shared\Security Center\SymWSC.exe
Thank you in advance