Here is my hijack this log - help!

gypsyhowl · March 14, 2009

Hi folks - I cannot get online, can't get mbam.exe to run, can't get randmbam.exe to run, and as a newbie, I am frustrated. I know there is something I am not doing - I first started off with virus melt on the system. I ran regedit to enable my task manager, then deleted the VMelt.exe process, but can't do anything further. I was able to run hijack this - and here is my log - hijack this did tell me to do something with the O1 host google entries but I didn't know what it meant... so here is the whole enchilada - please help, this is hard, but I know there is a way to beat it, hopefully with your help. Thanks ahead of time.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 3:15:20 PM, on 3/14/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe

C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\userinit.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\AGRSMMSG.exe

C:\WINDOWS\System32\keyhook.exe

C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

C:\Program Files\HP\HP Software Update\HPWuSchd.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Qwest\Quickcare\bin\sprtcmd.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\frmwrk32.exe

C:\DOCUME~1\PHILLL~1\LOCALS~1\Temp\winlogqn.exe

C:\WINDOWS\system32\sistray.exe

C:\WINDOWS\system32\ntdll64.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe

C:\WINDOWS\system32\ntdll64.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\system32\ntdll64.exe

F:\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O1 - Hosts: 89.149.227.223 google.ae

O1 - Hosts: 89.149.227.223 google.as

O1 - Hosts: 89.149.227.223 google.at

O1 - Hosts: 89.149.227.223 google.az

O1 - Hosts: 89.149.227.223 google.ba

O1 - Hosts: 89.149.227.223 google.be

O1 - Hosts: 89.149.227.223 google.bg

O1 - Hosts: 89.149.227.223 google.bs

O1 - Hosts: 89.149.227.223 google.ca

O1 - Hosts: 89.149.227.223 google.cd

O1 - Hosts: 89.149.227.223 google.com.gh

O1 - Hosts: 89.149.227.223 google.com.gi

O1 - Hosts: 89.149.227.223 google.com.hk

O1 - Hosts: 89.149.227.223 google.com.jm

O1 - Hosts: 89.149.227.223 google.com.ly

O1 - Hosts: 89.149.227.223 google.com.mx

O1 - Hosts: 89.149.227.223 google.com.my

O1 - Hosts: 89.149.227.223 google.com.na

O1 - Hosts: 89.149.227.223 google.com.nf

O1 - Hosts: 89.149.227.223 google.com.ng

O1 - Hosts: 89.149.227.223 google.ch

O1 - Hosts: 89.149.227.223 google.com.np

O1 - Hosts: 89.149.227.223 google.com.om

O1 - Hosts: 89.149.227.223 google.com.pa

O1 - Hosts: 89.149.227.223 google.com.pr

O1 - Hosts: 89.149.227.223 google.com.qa

O1 - Hosts: 89.149.227.223 google.com.sg

O1 - Hosts: 89.149.227.223 google.com.tj

O1 - Hosts: 89.149.227.223 google.com.tr

O1 - Hosts: 89.149.227.223 google.com.tw

O1 - Hosts: 89.149.227.223 google.com.ua

O1 - Hosts: 89.149.227.223 google.dj

O1 - Hosts: 89.149.227.223 google.com.vc

O1 - Hosts: 89.149.227.223 google.it.ao

O1 - Hosts: 89.149.227.223 google.de

O1 - Hosts: 89.149.227.223 google.dk

O1 - Hosts: 89.149.227.223 google.dm

O1 - Hosts: 89.149.227.223 google.dz

O1 - Hosts: 89.149.227.223 google.ee

O1 - Hosts: 89.149.227.223 google.fi

O1 - Hosts: 89.149.227.223 google.fm

O1 - Hosts: 89.149.227.223 google.fr

O1 - Hosts: 89.149.227.223 google.ge

O1 - Hosts: 89.149.227.223 google.gg

O1 - Hosts: 89.149.227.223 google.gm

O1 - Hosts: 89.149.227.223 google.gr

O1 - Hosts: 89.149.227.223 google.gy

O1 - Hosts: 89.149.227.223 google.ht

O1 - Hosts: 89.149.227.223 google.ie

O1 - Hosts: 89.149.227.223 google.im

O1 - Hosts: 89.149.227.223 google.in

O1 - Hosts: 89.149.227.223 google.it

O1 - Hosts: 89.149.227.223 google.ki

O1 - Hosts: 89.149.227.223 google.kz

O1 - Hosts: 89.149.227.223 google.la

O1 - Hosts: 89.149.227.223 google.li

O1 - Hosts: 89.149.227.223 google.lk

O1 - Hosts: 89.149.227.223 google.lv

O1 - Hosts: 89.149.227.223 google.ma

O1 - Hosts: 89.149.227.223 google.md

O1 - Hosts: 89.149.227.223 google.ms

O1 - Hosts: 89.149.227.223 google.mu

O1 - Hosts: 89.149.227.223 google.mv

O1 - Hosts: 89.149.227.223 google.mw

O1 - Hosts: 89.149.227.223 google.nl

O1 - Hosts: 89.149.227.223 google.no

O1 - Hosts: 89.149.227.223 google.nr

O1 - Hosts: 89.149.227.223 google.nu

O1 - Hosts: 89.149.227.223 google.pl

O1 - Hosts: 89.149.227.223 google.pn

O1 - Hosts: 89.149.227.223 google.pt

O1 - Hosts: 89.149.227.223 google.ro

O1 - Hosts: 89.149.227.223 google.ru

O1 - Hosts: 89.149.227.223 google.rw

O1 - Hosts: 89.149.227.223 google.sc

O1 - Hosts: 89.149.227.223 google.se

O1 - Hosts: 89.149.227.223 google.sh

O1 - Hosts: 89.149.227.223 google.si

O1 - Hosts: 89.149.227.223 google.sm

O1 - Hosts: 89.149.227.223 google.sn

O1 - Hosts: 89.149.227.223 google.st

O1 - Hosts: 89.149.227.223 google.tl

O1 - Hosts: 89.149.227.223 google.tm

O1 - Hosts: 89.149.227.223 google.tt

O1 - Hosts: 89.149.227.223 google.us

O1 - Hosts: 89.149.227.223 google.vg

O1 - Hosts: 89.149.227.223 google.vu

O1 - Hosts: 89.149.227.223 google.ws

O1 - Hosts: 89.149.227.223 google.co.bw

O1 - Hosts: 89.149.227.223 google.co.ck

O1 - Hosts: 89.149.227.223 google.co.id

O1 - Hosts: 89.149.227.223 google.co.il

O1 - Hosts: 89.149.227.223 google.co.in

O1 - Hosts: 89.149.227.223 google.co.jp

O1 - Hosts: 89.149.227.223 google.co.ke

O1 - Hosts: 89.149.227.223 google.co.kr

O1 - Hosts: 89.149.227.223 google.co.ls

O1 - Hosts: 89.149.227.223 google.co.ma

O1 - Hosts: 89.149.227.223 google.co.mz

O1 - Hosts: 89.149.227.223 google.co.nz

O1 - Hosts: 89.149.227.223 google.co.th

O2 - BHO: (no name) - {2765f56e-bd26-4719-a77a-dd09184f02c7} - C:\WINDOWS\system32\lijuhidi.dll

O2 - BHO: C:\WINDOWS\system32\kjr3iorojdnbfi43unjfd.dll - {c5bf40a2-94f3-42bd-f434-1604812c8955} - C:\WINDOWS\system32\kjr3iorojdnbfi43unjfd.dll (file missing)

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [siS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe

O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"

O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"

O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [storageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r

O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [sadirozusi] Rundll32.exe "C:\WINDOWS\system32\yumifesu.dll",s

O4 - HKLM\..\Run: [QuickCare] C:\Program Files\Qwest\Quickcare\bin\sprtcmd.exe /P QuickCare

O4 - HKLM\..\Run: [00abcf24] rundll32.exe "C:\WINDOWS\system32\bagahone.dll",b

O4 - HKLM\..\Run: [Kxawo] rundll32.exe "C:\WINDOWS\Qyucepinukonejiq.dll",e

O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe

O4 - HKLM\..\Run: [kjahrfoi37rljanfaw3il7fhjd3f] C:\DOCUME~1\PHILLL~1\LOCALS~1\Temp\winlogqn.exe

O4 - HKLM\..\Run: [CPM0398fcb8] Rundll32.exe "c:\windows\system32\yihuhote.dll",a

O4 - HKLM\..\Run: [Ggijixa] rundll32.exe "C:\WINDOWS\eqowusuyanami.dll",e

O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Virus Melt] "C:\Documents and Settings\All Users\Application Data\fe61ef9\VMelt.exe" /s

O4 - HKCU\..\Run: [kjahrfoi37rljanfaw3il7fhjd3f] C:\DOCUME~1\PHILLL~1\LOCALS~1\Temp\winlogqn.exe

O4 - HKUS\S-1-5-19\..\Run: [sadirozusi] Rundll32.exe "C:\WINDOWS\system32\yumifesu.dll",s (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sadirozusi] Rundll32.exe "C:\WINDOWS\system32\yumifesu.dll",s (User 'NETWORK SERVICE')

O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE

O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\docume~1\philll~1\locals~1\temp\ntdll64.dll

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O17 - HKLM\System\CCS\Services\Tcpip\..\{4CAE0260-F926-4FB2-94D1-83BF3EB976F8}: NameServer = 205.171.3.65,205.171.2.65

O20 - AppInit_DLLs: C:\WINDOWS\system32\pigofube.dll ainmgw.dll pdpbpt.dll c:\windows\system32\yihuhote.dll

O20 - Winlogon Notify: crypt - C:\WINDOWS\SYSTEM32\crypts.dll

O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\yihuhote.dll

O22 - SharedTaskScheduler: klj3r93iorkemnfaja93riemef - {C5BF40A2-94F3-42BD-F434-1604812C8955} - C:\WINDOWS\system32\kjr3iorojdnbfi43unjfd.dll (file missing)

O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\yihuhote.dll

O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\

O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\icf.exe.exe:ext.exe (file missing)

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe

O23 - Service: SupportSoft Listener Service (sprtlisten) - SupportSoft, Inc. - C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe

O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\supportsoft\bin\ssrc.exe

--

End of file - 10709 bytes

AdvancedSetup · March 15, 2009

STEP 01

Reconfigure Windows XP to show hidden files:

To enable the viewing of Hidden files follow these steps:

* Close all programs so that you are at your desktop.

* Double-click on the My Computer icon.

* Select the Tools menu and click Folder Options.

* After the new window appears select the View tab.

* Put a checkmark in the checkbox labeled Display the contents of system folders.

* Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.

* Remove the checkmark from the checkbox labeled Hide file extensions for known file types.

* Remove the checkmark from the checkbox labeled Hide protected operating system files.

* Press the Apply button and then the OK button and exit My Computer.

* Now your computer is configured to show all hidden files.

STEP 02

It may not let you, but if it will please delete the following file.

C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts

STEP 03

With all other applications closed (Taskbar empty), open HijackThis again

and run Do a system scan only and place a check mark on the following items.

O2 - BHO: (no name) - {2765f56e-bd26-4719-a77a-dd09184f02c7} - C:\WINDOWS\system32\lijuhidi.dll
O2 - BHO: C:\WINDOWS\system32\kjr3iorojdnbfi43unjfd.dll - {c5bf40a2-94f3-42bd-f434-1604812c8955} - C:\WINDOWS\system32\kjr3iorojdnbfi43unjfd.dll (file missing)
O4 - HKLM\..\Run: [sadirozusi] Rundll32.exe "C:\WINDOWS\system32\yumifesu.dll",s
O4 - HKLM\..\Run: [QuickCare] C:\Program Files\Qwest\Quickcare\bin\sprtcmd.exe /P QuickCare
O4 - HKLM\..\Run: [00abcf24] rundll32.exe "C:\WINDOWS\system32\bagahone.dll",b
O4 - HKLM\..\Run: [Kxawo] rundll32.exe "C:\WINDOWS\Qyucepinukonejiq.dll",e
O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe
O4 - HKLM\..\Run: [kjahrfoi37rljanfaw3il7fhjd3f] C:\DOCUME~1\PHILLL~1\LOCALS~1\Temp\winlogqn.exe
O4 - HKLM\..\Run: [CPM0398fcb8] Rundll32.exe "c:\windows\system32\yihuhote.dll",a
O4 - HKLM\..\Run: [Ggijixa] rundll32.exe "C:\WINDOWS\eqowusuyanami.dll",e
O4 - HKCU\..\Run: [Virus Melt] "C:\Documents and Settings\All Users\Application Data\fe61ef9\VMelt.exe" /s
O4 - HKCU\..\Run: [kjahrfoi37rljanfaw3il7fhjd3f] C:\DOCUME~1\PHILLL~1\LOCALS~1\Temp\winlogqn.exe
O4 - HKUS\S-1-5-19\..\Run: [sadirozusi] Rundll32.exe "C:\WINDOWS\system32\yumifesu.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [sadirozusi] Rundll32.exe "C:\WINDOWS\system32\yumifesu.dll",s (User 'NETWORK SERVICE')
O10 - Unknown file in Winsock LSP: c:\docume~1\philll~1\locals~1\temp\ntdll64.dll
O10 - Unknown file in Winsock LSP: c:\docume~1\philll~1\locals~1\temp\ntdll64.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{4CAE0260-F926-4FB2-94D1-83BF3EB976F8}: NameServer = 205.171.3.65,205.171.2.65
O20 - AppInit_DLLs: C:\WINDOWS\system32\pigofube.dll ainmgw.dll pdpbpt.dll c:\windows\system32\yihuhote.dll
O20 - Winlogon Notify: crypt - C:\WINDOWS\SYSTEM32\crypts.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\yihuhote.dll
O22 - SharedTaskScheduler: klj3r93iorkemnfaja93riemef - {C5BF40A2-94F3-42BD-F434-1604812C8955} - C:\WINDOWS\system32\kjr3iorojdnbfi43unjfd.dll (file missing)
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\yihuhote.dll
Then Quit All Browsers including the one you're reading this in now.
Then click on Fix checked and then quit HJT

STEP 04

CCleaner

CCleaner
Double-click on the downloaded file "ccsetup217.exe" and install the application.
Keep the default installation folder "C:\Program Files\CCleaner"
Uncheck "Add CCleaner Yahoo! Toolbar and use CCleaner from your browser"
Click finish when done and close ALL PROGRAMS
Start the CCleaner program.
Click on Registry and Uncheck Registry Integrity so that it does not run (basically the very top, uncheck it)
Click on Options - Advanced and Uncheck "Only delete files in Windows Temp folders older than 48 hours"
Click back to Cleaner and under SYSTEM uncheck the Memory Dumps and Windows Log Files
Click on Run Cleaner button on the bottom right side of the program.
Click OK to any prompts

STEP 05

Restart the computer now and see if MBAM will install or run.

Update and Scan with Malwarebytes' Anti-Malware

Start MalwareBytes AntiMalware (Vista users must Right click and choose RunAs Admin)
Please DO NOT run MBAM in Safe Mode unless requested to, you MUST run it in normal Windows mode.
- Update Malwarebytes' Anti-Malware
- Select the Update tab
- Click Update
[*]When the update is complete, select the Scanner tab
[*]Select Perform quick scan, then click Scan.
[*]When the scan is complete, click OK, then Show Results to view the results.
[*]Be sure that everything is checked, and click Remove Selected.
[*]When completed, a log will open in Notepad. please copy and paste the log into your next reply
- If you accidently close it, the log file is saved here and will be named like this:
- C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Then post back the MBAM log and a new Hijackthis log.

gypsyhowl · March 15, 2009

I followed all your instructions - however, I cannot get online to download malwarebytes directly, and when I copy over the mbam.exe to disk then to its desktop, I get an error code 707(3) - please advise me? BTW, thank you for your quick response!

AdvancedSetup · March 17, 2009

Please see if one of these options helps or not.

http://www.malwarebytes.org/forums/index.php?showtopic=12709

http://www.malwarebytes.org/forums/index.php?showtopic=12713

If not then please try to run this.

Please visit this webpage for instructions for downloading ComboFix to your

DESKTOP

:

how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:

You must save and run

ComboFix.exe

on your DESKTOP and not from any other folder.

Also,

DO NOT

click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

ComboFix.exe

Note:

The

Windows Recovery Console

will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click
Yes
to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please post the
C:\ComboFix.txt
along with a
new HijackThis log
so we may continue cleaning the system.

gypsyhowl · March 18, 2009

When running the Combofix program the system gave me feedback that I had an incompatible OS, but continued to run... until the point of making a log file. At that point the system crashed, citing a physical memory dump, and then told me to restart the computer. I did, and got a couple of .dll errors as it started up, now I am reloaded, but don't know which way to go... do I re-run Combofix to try to get a log file? Or should I run HJT for a current log file to show you?

gypsyhowl · March 18, 2009

I decided to run another HJT log for you - thank you for helping me with this B)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 13:11, on 2009-03-18

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe

C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\AGRSMMSG.exe

C:\WINDOWS\System32\keyhook.exe

C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

C:\Program Files\HP\HP Software Update\HPWuSchd.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\Program Files\QuickTime\qttask.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\sistray.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe

C:\Documents and Settings\Phil Llapitan\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: (no name) - {2765f56e-bd26-4719-a77a-dd09184f02c7} - C:\WINDOWS\system32\lijuhidi.dll (file missing)