Search2web !!!

Yeah, that's a pretty badly infested machine. See THIS TOPIC, review, understand, and print out the proceedure, perform the updates, downloads, and online scans, then follow the proceedure step by step in order. When you've done that, post the logs and any other pertinent info to this thread - just navigate back here, click "Repy", and paste the logs into the message box, along with any questions you might have. You may find it convenient to click "Turn on email updates" down at the bottom right of this page; that will cause an email to be sent to the address you registered when a reply is posted to this topic.

hi again. i did everything that page told me to do but the search2web toolbar still remains. heres my hijack log

Logfile of HijackThis v1.99.1
Scan saved at 18:51:30, on 20/08/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5112.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
D:\www\Apache2\bin\apache.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.40607\aspnet_admin.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
D:\www\mysql\bin\mysqld-max-nt.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\UltraVNC\WinVNC.exe
C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
D:\PopOops\PopOops.exe
D:\www\Apache2\bin\apache.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\WinZip\WZQKPICK.EXE
D:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.icuktiqlcgxfwdepgqhk.net/I2tXe/jSistW0lfBQY/afOZMDjCLYA587AmLXSw958oVWkQ1cJCSpK8eAvIdcHOB.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.accoona.com/search?q=%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {944864A5-3916-46E2-96A9-A2E84F3F1208} - (no file)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [IMONTRAY] C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\UltraVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [PopOops] D:\PopOops\PopOops.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [23EP3tW] migest.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Tsl2] C:\PROGRA~1\COMMON~1\tsa\tsl2.exe
O4 - HKLM\..\Run: [Stop deaf style plan] C:\Documents and Settings\All Users\Application Data\DOG LOAD STOP DEAF\titlemp3.exe
O4 - HKLM\..\Run: [Music Alarm Clock] C:\PROGRA~1\MUSICA~1\mac.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [LDM] \Program\
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [J0xFRjanj] mdttwh32.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [LoveName] C:\DOCUME~1\CHRIST~1\APPLIC~1\SENDMA~1\FindComp.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Open in New &Window (PopOops) - C:\WINDOWS\Web\PopOops.htm
O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~2\Office\1033\phdintl.dll/phdContext.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [TABS] Tabbed Browsing
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://sib1.od2.com/common/Member/ClientInstall/10.20.0002/OCI/setup.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1100030690334
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O18 - Protocol: bw+0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {81FFA9C6-EF05-48F0-8DBA-91D3614B096C} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O23 - Service: Apache2 - Unknown owner - D:\www\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Intel(R) Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
O23 - Service: MySQL - Unknown owner - D:\www\mysql\bin\mysqld-max-nt.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\UltraVNC\WinVNC.exe" -service (file missing)

Please post the two EWIDO logs also requested. I want to help you, but you've gotta help me.

i only managed to get one ewido log.

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 14:26:38, 20/08/2005
+ Report-Checksum: 9D1670E6

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} -> Spyware.GameSpyArcade : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} -> Spyware.GameSpyArcade : Cleaned with backup
HKU\S-1-5-21-515967899-162531612-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} -> Spyware.GameSpyArcade : Cleaned with backup
C:\Documents and Settings\Christopher\Cookies\christopher@lop[2].txt -> Spyware.Cookie.Lop : Cleaned with backup
C:\Documents and Settings\Christopher\Cookies\christopher@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\Christopher\Cookies\christopher@revenue[2].txt -> Spyware.Cookie.Revenue : Cleaned with backup
C:\Documents and Settings\Christopher\Cookies\christopher@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup


::Report End

Bummer - I would really have liked to see the first EWIDO log - there should have been quite a bit to it; it really woulda been helpful. Oh, well, we can work around that.

Review and familiarize yourself with these instructions, then print them out for reference. Much of what will follow will be done while in safe mode. Gather any necessary downloads and/or updates, perform the recommended online scans, then disconnect from the internet. Follow the steps in order. It is best to do them in an unbroken chain, or at least without any browsing, email checking, chatting, or messaging between steps.

Please, as the proceedure directed, place HiJackThis into a dedicated folder of its own on your root drive - the drive on which Windows is installed (in your case that is Drive C: ) - place it either in the Programs file, or directly on the C: drive.

Disable Spybot S&D's "Teatimer" feature. Open Spybot S&D in its "Advanced" mode (if you have it configured only to open in default mode, select "Mode", then select-and-confirm Advanced Mode), select "Tools", select "Resident", then de-select ""Resodent "Tea Timer" (Protection of overall system settings) active. While Spybot S&D is open, check for and apply any available updates.

Upgate Ad-Aware SE, and download and install Ad-Aware SE's Latest VX2 CleanerPlugin. Don't run either yet, just perform the updates, and review the documentation for the new VX2 Cleaner version.

Update EWIDO and Microsoft Antispyware, don't run them yet; just have each check for updates and apply them if available, then exit the app once the update process has been completed.

Locate and launch AboutBuster, and have it check for updates, apply them if available, then exit the application without running it.

Locate and launch CWShredder, and have it check for updates, apply them if available, then exit the application without running it.

Create a folder on your desktop (right-click anywhere on blank area of the desktop - that is any area not occupied by web item, a toolbar or an icon, select "New", select "Folder", when the new folder appears, name it appropriately in the highlighted dialog box, in this case, the folder name shoud be HSFix), then click again anywhere on a blank area of the desktop.) Download into that newly created and named folder HSFix. When it has downloaded, open the folder, right-click on the folder named HSFix.zip, select "Extract all", and follow the prompts. Once the files have extracted, don't do anything with them, just close out of the folder, We'll use that tool in a bit.

Disable/deactivate any resident security/privacy software you may have, such as antivirus, antispyware, adblocker, and/or popupblocker. Run the free antivirus scan-and-remove proceedure Panda Activescan and save the log when it has completed.

I don't suggest breaking the chain of proceedures here, but if you must, remember to re-enable/reactivate your resident security/privacy software before doing any email checking, messaging, chatting, or general web browsing.

Go to HOUSECALL and, with your resident privacy/security software deactivated or disabled, run the Antispyware scan-and-remove tool per the instructions provided there. I would suggest you also run the HOUSECALL online virus scan-and-remove proceedure as well, per its instructions, but thats up to you. In any event, note the full filename and path of any file either app reports it was unable to deal with, if any such are reported at the end of the relevant scan-and-remove proceedure. Please note the exact, verbatim, full filename and path.

When you have finished with those steps, boot into safe mode, locate and launch HJT, with no other windows or browsers open or other applications running, and place a checkmark next to ONLY the following entiries, if found:

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.AUTO SPAM FILTER.com/search?q=%s (note- you will not see "AUTO SPAM FILTER; there will be a URL - a web address - in your view)
O2 - BHO: (no name) - {944864A5-3916-46E2-96A9-A2E84F3F1208} - (no file)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKCU\..\Run: [LDM] \Program\
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
018 - Place a check by each of these items, all of them, don't miss any of them
O23 - Service: Apache2 - Unknown owner - D:\www\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\UltraVNC\WinVNC.exe" -service (file missing)

Do not reboot.

Locate and launch CWShredder, select "Fix", and let the process complete. Do not reboot. Immediately run CWShredder a second time, again selecting "Fix", and again do not reboot.

Locate and double-click HSFix.reg, which will be in the folder extracted from HSFix.zip. When it asks you to merge the information to the registry click "Yes" and if prompted, confirm. Reboot back into safe mode.

Locate and launch AboutBuster, reboot back into safe mode when it has completed, and run it one more time, then reboot back into safe mode. Please save both reports and post them here.\ with the other requested logs.

Locate Ad-Aware SE and run the new VX2 Cleaner Plugin. As per the updated instructions for the new plugin, you should run the cleaner several times in succsession, rebooting back into safe mode, performing an Ad-Aware SE scan upon reboot, then repeating the VX2 Cleaner Plugin then rebooting back into safe mode. This should be repeated until the process reports "System Clean" . When the process reports "System Clean", locate and launch CCleaner, and perform a full scan-and-clean, then reboot, again back into safe mode.

Locate and launch Microsoft Antispyware, select "Advanced Tools", then select "Browser Restore", select "Check all", then click "Restore" and confirm. When that has been done, select "Spyware Scan", make sure it is set to scan all drives, run a full scan and allow it to repair anything it finds. When it has completed, reboot back into safe mode.

Locate and launch Spybot S&D, run a full scan, and allow Spybot S&D to repair anything if lists in RED. Do not reboot unless Spybot S&D requests permission to run again at next boot to complete removal. If it does ask, let it do so, reboot normally, let it complete its process, then reboot back into safe mode.

Locate and launch EWIDO, run a full scan-and-clean, and save the log. Do not reboot.

Locate and launch CCleaner, select "Cleaner", and run a full scan-and-clean. When CCleaner has completed, reboot normally.

When your machine has rebooted, immediately run another HJT scan, fixing nothing, just saving the log. Locate and launch EWIDO, again run a full scan-and-clean, and save the log.

Be sure your resident security/privacy software is active and functioning, then connect to the internet, navigate back here, and post ALL the requested logs and any other pertinent info.



Oh, and I'd like to know why you would have Apache Webserver running.