Please take a look at malwarebytes and hjthis log!

T

T.N.G.A!!

New Member
Hey everyone, here's a fresh malwarebytes and hjthis log, Ive had a LOT of problems with spyware, because of some friends of mine not browsing or downloading very safely. :mad:

In any case, thanks in advance if anyone could be kind enough to interpret the results and let me know how to fix em, Thanks!! :D

Malwarebytes' Anti-Malware 1.39
Database version: 2432
Windows 5.1.2600 Service Pack 3

7/16/2009 1:29:44 AM
mbam-log-2009-07-16 (01-29-44).txt

Scan type: Full Scan (C:\|)
Objects scanned: 227851
Time elapsed: 54 minute(s), 13 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 16
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 22
Files Infected: 34

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\explorerbar.funexplorer

(Adware.DoubleD) -> Quarantined and deleted

successfully.
HKEY_CLASSES_ROOT\TypeLib\{ac5ab953-ed25-4f9c-87

f0-b086b0178ffa} (Adware.DoubleD) -> Quarantined

and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6160f76a-1992-4b17-

a32d-0c706d159105} (Adware.DoubleD) ->

Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{25b8d58c-b0cb-46b0-ba64

-05b3804e4e86} (Adware.DoubleD) -> Quarantined

and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Cur

rentVersion\Ext\Stats\{25b8d58c-b0cb-46b0-ba64-0

5b3804e4e86} (Adware.DoubleD) -> Quarantined and

deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Cu

rrentVersion\Explorer\Browser Helper

Objects\{25b8d58c-b0cb-46b0-ba64-05b3804e4e86}

(Adware.DoubleD) -> Quarantined and deleted

successfully.
HKEY_CLASSES_ROOT\explorerbar.funexplorer.1

(Adware.DoubleD) -> Quarantined and deleted

successfully.
HKEY_CLASSES_ROOT\explorerbar.funredirector

(Adware.DoubleD) -> Quarantined and deleted

successfully.
HKEY_CLASSES_ROOT\explorerbar.funredirector.1

(Adware.DoubleD) -> Quarantined and deleted

successfully.
HKEY_CLASSES_ROOT\CLSID\{cdbfb47b-58a8-4111-bf95

-06178dce326d} (Adware.DoubleD) -> Quarantined

and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{35b8d58c-b0cb-46b0-ba64

-05b3804e4e86} (Adware.DoubleD) -> Quarantined

and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Cur

rentVersion\Ext\Stats\{cdbfb47b-58a8-4111-bf95-0

6178dce326d} (Adware.DoubleD) -> Quarantined and

deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Cur

rentVersion\Ext\Stats\{5617eca9-488d-4ba2-8562-9

710b9ab78d2} (Adware.DoubleD) -> Quarantined and

deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Cur

rentVersion\Ext\Stats\{35b8d58c-b0cb-46b0-ba64-0

5b3804e4e86} (Adware.DoubleD) -> Quarantined and

deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Cu

rrentVersion\Explorer\Browser Helper

Objects\{cdbfb47b-58a8-4111-bf95-06178dce326d}

(Adware.DoubleD) -> Quarantined and deleted

successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Cu

rrentVersion\Explorer\Browser Helper

Objects\{35b8d58c-b0cb-46b0-ba64-05b3804e4e86}

(Adware.DoubleD) -> Quarantined and deleted

successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet

Explorer\Toolbar\WebBrowser\{5617eca9-488d-4ba2-

8562-9710b9ab78d2} (Adware.DoubleD) ->

Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\DoubleD (Adware.DoubleD) ->

Quarantined and deleted successfully.
c:\program files\DoubleD\GamingHarbor Toolbar

(Adware.DoubleD) -> Quarantined and deleted

successfully.
C:\Program Files\Media Access Startup

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\media access startup\1.3.0.790_

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\media access

startup\1.3.0.790_\FF (Adware.DoubleD) ->

Quarantined and deleted successfully.
c:\program files\media access

startup\1.3.0.790_\FF\components

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\media access startup\1.5.0.850

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\media access

startup\1.5.0.850\Data (Adware.DoubleD) ->

Quarantined and deleted successfully.
c:\program files\media access

startup\1.5.0.850\FF (Adware.DoubleD) ->

Quarantined and deleted successfully.
c:\program files\media access

startup\1.5.0.850\FF\chrome (Adware.DoubleD) ->

Quarantined and deleted successfully.
c:\program files\media access

startup\1.5.0.850\FF\chrome\content

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\media access

startup\1.5.0.850\FF\components (Adware.DoubleD)

-> Quarantined and deleted successfully.
C:\Program Files\Internet Saving Optimizer

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\internet saving

optimizer\3.3.0.4160 (Adware.DoubleD) ->

Quarantined and deleted successfully.
c:\program files\internet saving

optimizer\3.3.0.4160\Data (Adware.DoubleD) ->

Quarantined and deleted successfully.
c:\program files\internet saving

optimizer\3.3.0.4160\FF (Adware.DoubleD) ->

Quarantined and deleted successfully.
c:\program files\internet saving

optimizer\3.3.0.4160\FF\chrome (Adware.DoubleD)

-> Quarantined and deleted successfully.
c:\program files\internet saving

optimizer\3.3.0.4160\FF\chrome\content

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\internet saving

optimizer\3.3.0.4160\FF\components

(Adware.DoubleD) -> Quarantined and deleted

successfully.
C:\Program Files\System Search Dispatcher

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\system search

dispatcher\1.2.0.750 (Adware.DoubleD) ->

Quarantined and deleted successfully.
c:\program files\system search

dispatcher\1.2.0.750\Data (Adware.DoubleD) ->

Quarantined and deleted successfully.

Files Infected:
C:\Program Files\Media Access

Startup\1.5.0.850\HPIEAddOn.dll (Adware.DoubleD)

-> Quarantined and deleted successfully.
c:\system volume

information\_restore{dde3eb95-4b24-44d8-ad38-1f9

74b96c2f0}\RP68\A0030405.exe (Password.Stealer)

-> Quarantined and deleted successfully.
c:\program files\media access

startup\1.3.0.790_\HPCommon.dll (Adware.DoubleD)

-> Quarantined and deleted successfully.
c:\program files\media access

startup\1.3.0.790_\FF\components\HPFFAddOn.dll

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\media access

startup\1.5.0.850\HPCommon.dll (Adware.DoubleD)

-> Quarantined and deleted successfully.
c:\program files\media access

startup\1.5.0.850\hppx.exe (Adware.DoubleD) ->

Quarantined and deleted successfully.
c:\program files\media access

startup\1.5.0.850\MAHelper.exe (Adware.DoubleD)

-> Quarantined and deleted successfully.
c:\program files\media access

startup\1.5.0.850\unins000.dat (Adware.DoubleD)

-> Quarantined and deleted successfully.
c:\program files\media access

startup\1.5.0.850\unins000.exe (Adware.DoubleD)

-> Quarantined and deleted successfully.
c:\program files\media access

startup\1.5.0.850\Data\config.md

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\media access

startup\1.5.0.850\FF\chrome.manifest

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\media access

startup\1.5.0.850\FF\install.rdf

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\media access

startup\1.5.0.850\FF\chrome\HPAddOn.jar

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\media access

startup\1.5.0.850\FF\chrome\content\HPAddOn.js

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\media access

startup\1.5.0.850\FF\chrome\content\HPAddOn.xul

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\media access

startup\1.5.0.850\FF\components\HPFFAddOn.dll

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\media access

startup\1.5.0.850\FF\components\HPFFAddOn.xpt

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\media access

startup\1.5.0.850\FF\components\HPFFHelperCompon

ent.js (Adware.DoubleD) -> Quarantined and

deleted successfully.
c:\program files\internet saving

optimizer\3.3.0.4160\unins000.dat

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\internet saving

optimizer\3.3.0.4160\unins000.exe

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\internet saving

optimizer\3.3.0.4160\Data\config.md

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\internet saving

optimizer\3.3.0.4160\FF\chrome.manifest

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\internet saving

optimizer\3.3.0.4160\FF\install.rdf

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\internet saving

optimizer\3.3.0.4160\FF\chrome\NPAddOn.jar

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\internet saving

optimizer\3.3.0.4160\FF\chrome\content\NPAddOn.j

s (Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\internet saving

optimizer\3.3.0.4160\FF\chrome\content\NPAddOn.x

ul (Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\internet saving

optimizer\3.3.0.4160\FF\components\NPFFAddOn.dll

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\internet saving

optimizer\3.3.0.4160\FF\components\NPFFAddOn.xpt

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\internet saving

optimizer\3.3.0.4160\FF\components\NPFFHelperCom

ponent.js (Adware.DoubleD) -> Quarantined and

deleted successfully.
c:\program files\system search

dispatcher\1.2.0.750\unins000.dat

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\system search

dispatcher\1.2.0.750\unins000.exe

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\system search

dispatcher\1.2.0.750\Data\eacore.mx

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\system search

dispatcher\1.2.0.750\Data\URLDynamic.mx

(Adware.DoubleD) -> Quarantined and deleted

successfully.
c:\program files\system search

dispatcher\1.2.0.750\Data\URLStatic.mx

(Adware.DoubleD) -> Quarantined and deleted

successfully.

________________________________________________________________

HJTHIS LOG :

Logfile of HijackThis v1.99.1
Scan saved at 1:39:36 AM, on 7/16/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jucheck.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\hphmon06.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\ALCMTR.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\HP_Owner.YOUR-4F1261A8E5\Desktop\Anti Spyware and Virus software\Hjthis\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_CA&c=Q105&bd=pavilion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_CA&c=Q105&bd=pavilion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ca.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://ca.search.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.gamingharbor.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_CA&c=Q105&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ca.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://ca.search.yahoo.com
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: UrlHelper Class - {474597C5-AB09-49d6-A4D5-2E8D7341384E} - C:\Program Files\iMesh Applications\iMesh\iMeshIEHelper.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpywareBlaster] C:\Program Files\SpywareBlaster\spywareblaster.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\HP Game Console\GameConsoleService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
 
You need to do a few things.

1. Go into add/remove programs and uninstall all versions of Java, usually labeled either java or J2SE runtime. After uninstalling all older version, go here and install the latest version.

http://www.java.com/en/download/index.jsp

2. Download and run combofix. Follow the instructions closely. Get it here.

http://www.bleepingcomputer.com/combofix/how-to-use-combofix




3. Uninstall the older version of hijackthis and download the newest version of hijackthis here.

http://download.cnet.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html

Now post both logs of combofix and hijackthis and an update on how your computer is running.
 
Uninstalled and got latest java

Combofix :

ComboFix 09-07-14.08 - HP_Owner 07/16/2009 22:06.1.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.594 [GMT -4:00]
Running from: c:\documents and settings\HP_Owner.YOUR-4F1261A8E5\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-3016025500-50032120-3907511567-1009
c:\windows\Installer\10375.msi
c:\windows\Installer\124e3b1.msi
c:\windows\Installer\124e3b8.msp
c:\windows\Installer\146b21c.msp
c:\windows\Installer\146b241.msp
c:\windows\Installer\146b25b.msp
c:\windows\Installer\146b281.msp
c:\windows\Installer\146b2a6.msp
c:\windows\Installer\146b2cd.msp
c:\windows\Installer\153541d.msp
c:\windows\Installer\15a8837.msp
c:\windows\Installer\1919ea7.msi
c:\windows\Installer\191a085.msi
c:\windows\Installer\1d3997.msi
c:\windows\Installer\1daa25e.msi
c:\windows\Installer\1e92265.msi
c:\windows\Installer\1f33afd.msp
c:\windows\Installer\1f33b24.msp
c:\windows\Installer\1f33b4a.msp
c:\windows\Installer\1fb4940.msp
c:\windows\Installer\21f18f8.msp
c:\windows\Installer\21f191f.msp
c:\windows\Installer\24c5f3e.msp
c:\windows\Installer\24c5f57.msi
c:\windows\Installer\24c5f6c.msp
c:\windows\Installer\25e4f39.msp
c:\windows\Installer\263524d.msi
c:\windows\Installer\2763297.msi
c:\windows\Installer\27632ab.msp
c:\windows\Installer\27632d2.msp
c:\windows\Installer\2affe4.msi
c:\windows\Installer\2b002e.msp
c:\windows\Installer\2c10db.msp
c:\windows\Installer\2f2f8.msp
c:\windows\Installer\33e12bb.msp
c:\windows\Installer\437f30.msi
c:\windows\Installer\450294.msi
c:\windows\Installer\462e71.msp
c:\windows\Installer\462e97.msp
c:\windows\Installer\4722562.msp
c:\windows\Installer\4c536.msi
c:\windows\Installer\5f66e1.msi
c:\windows\Installer\71a393c.msi
c:\windows\Installer\795e34.msp
c:\windows\Installer\795e6d.msp
c:\windows\Installer\795e92.msp
c:\windows\Installer\795eb8.msp
c:\windows\Installer\795edd.msp
c:\windows\Installer\795f1b.msp
c:\windows\Installer\795f44.msp
c:\windows\Installer\795f5a.msp
c:\windows\Installer\795f7f.msp
c:\windows\Installer\85e3451.msi
c:\windows\Installer\8f525.msi
c:\windows\Installer\a10f0.msi
c:\windows\Installer\a10f6.msi
c:\windows\Installer\a10fc.msi
c:\windows\Installer\a956c.msi
c:\windows\Installer\b29103.msi
c:\windows\Installer\bf03ab.msi
c:\windows\Installer\d044b9.msp
c:\windows\Installer\d044e0.msp
c:\windows\Installer\d04506.msp
c:\windows\Installer\d7dbf.msp
c:\windows\Installer\dbf808.msi
c:\windows\Installer\f162b5.msi

.
((((((((((((((((((((((((( Files Created from 2009-06-17 to 2009-07-17 )))))))))))))))))))))))))))))))
.

2009-07-17 02:01 . 2009-07-17 02:01 152576 ----a-w- c:\documents and settings\HP_Owner.YOUR-4F1261A8E5\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-07-16 18:26 . 2009-07-16 18:26 -------- d-----w- c:\documents and settings\HP_Owner.YOUR-4F1261A8E5\Local Settings\Application Data\BingoLiner
2009-07-16 12:18 . 2009-07-17 02:01 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-07-15 06:59 . 2009-07-15 06:59 -------- d-sh--w- c:\documents and settings\HP_Owner.YOUR-4F1261A8E5\IECompatCache
2009-07-10 13:44 . 2009-06-22 14:01 327688 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgldx86.sys
2009-07-10 13:44 . 2009-06-22 14:01 493336 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgtbapi.dll
2009-07-10 13:44 . 2009-06-22 14:01 2052376 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
2009-07-10 13:44 . 2009-06-22 14:01 2167576 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgresf.dll
2009-07-10 13:44 . 2009-06-22 14:01 3402008 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgui.exe
2009-07-10 13:44 . 2009-06-22 14:01 337176 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avglogx.dll
2009-07-10 13:44 . 2009-06-22 14:01 1204504 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgabout.dll
2009-07-10 13:44 . 2009-06-22 14:01 829208 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcfgx.dll
2009-07-10 13:44 . 2009-06-22 14:01 3298072 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\setup.exe
2009-07-10 13:44 . 2009-06-22 14:00 1454360 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.dll
2009-07-10 13:44 . 2009-06-22 14:00 1085208 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.exe
2009-07-02 16:18 . 2009-07-02 16:18 -------- d-sh--w- c:\documents and settings\HP_Owner.YOUR-4F1261A8E5\PrivacIE
2009-07-02 16:11 . 2009-07-02 16:11 -------- d-sh--w- c:\documents and settings\HP_Owner.YOUR-4F1261A8E5\IETldCache
2009-07-02 01:04 . 2009-06-02 10:12 102912 ------w- c:\windows\system32\dllcache\iecompat.dll
2009-07-02 01:04 . 2009-07-02 01:04 -------- d-----w- c:\windows\ie8updates
2009-07-02 01:02 . 2009-04-30 21:22 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2009-07-02 01:02 . 2009-04-30 21:22 1985024 ------w- c:\windows\system32\dllcache\iertutil.dll
2009-07-02 01:02 . 2009-04-30 21:22 11064832 ------w- c:\windows\system32\dllcache\ieframe.dll
2009-07-02 01:02 . 2009-04-30 21:22 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll
2009-07-02 01:00 . 2009-07-02 01:02 -------- dc-h--w- c:\windows\ie8
2009-06-26 23:08 . 2009-06-26 23:18 -------- d-----w- C:\CASINO
2009-06-25 03:17 . 2001-08-17 17:56 7552 ----a-w- c:\windows\system32\drivers\SONYPVU1.SYS
2009-06-25 03:17 . 2001-08-17 17:56 7552 ----a-w- c:\windows\system32\dllcache\sonypvu1.sys
2009-06-22 15:06 . 2009-06-14 20:07 1004800 ----a-w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar\IEToolbar.dll
2009-06-22 14:56 . 2009-07-15 07:01 3775176 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-06-22 14:55 . 2009-06-22 14:55 -------- d-----w- c:\documents and settings\HP_Owner.YOUR-4F1261A8E5\Local Settings\Application Data\AVG Security Toolbar
2009-06-22 14:02 . 2009-06-22 14:01 832144 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\AVGToolbarInstall.exe
2009-06-22 14:02 . 2009-07-02 07:19 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-06-22 14:02 . 2009-06-22 14:02 -------- d-----w- c:\documents and settings\LocalService\Application Data\AVGTOOLBAR
2009-06-17 19:17 . 2009-06-17 19:17 -------- d-----w- c:\documents and settings\HP_Owner.YOUR-4F1261A8E5\Application Data\aAvgApi

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-17 02:01 . 2005-03-04 21:15 -------- d-----w- c:\program files\Java
2009-07-17 01:28 . 2008-12-17 05:16 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-07-16 05:49 . 2005-09-05 23:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-07-15 15:03 . 2008-12-17 05:17 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-07-15 08:08 . 2009-04-29 05:48 -------- d-----w- c:\program files\Hotmail & MSN Password Recovery
2009-07-15 07:01 . 2008-12-17 23:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-13 17:36 . 2009-05-09 18:16 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 17:36 . 2009-05-09 18:16 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-10 13:44 . 2009-05-09 18:20 335752 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-07-06 17:44 . 2009-05-10 00:23 -------- d-----w- c:\documents and settings\HP_Owner.YOUR-4F1261A8E5\Application Data\Azureus
2009-06-26 23:08 . 2008-12-30 02:10 -------- d-----w- c:\documents and settings\All Users\Application Data\DVD Shrink
2009-06-26 18:56 . 2005-03-04 21:54 -------- d-----w- c:\program files\Easy Internet signup
2009-06-22 14:01 . 2009-05-09 18:20 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-06-22 14:01 . 2009-05-09 18:20 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-06-19 02:16 . 2009-03-21 03:33 -------- d-----w- c:\program files\Warcraft III
2009-06-16 14:36 . 2004-08-04 11:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2004-08-04 11:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-10 22:43 . 2009-06-10 22:43 15256 ----a-w- c:\documents and settings\HP_Owner.YOUR-4F1261A8E5\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll
2009-06-10 22:43 . 2009-04-29 02:37 -------- d-----w- c:\program files\MSN Messenger
2009-06-07 17:26 . 2009-04-30 03:45 1700416 ----a-w- c:\documents and settings\All Users\Application Data\WildTangent\My HP Game Console\Downloads\en\Installers\SetupGamesClient.exe
2009-06-07 17:22 . 2008-12-29 21:05 -------- d-----w- c:\program files\Yahoo!
2009-06-07 17:17 . 2009-05-28 03:13 -------- d-----w- c:\program files\Outspark
2009-06-07 17:16 . 2009-05-27 20:04 -------- d-----w- c:\program files\BearShare Applications
2009-06-03 19:09 . 2004-08-04 11:00 1291264 ----a-w- c:\windows\system32\quartz.dll
2009-05-29 18:27 . 2009-05-29 18:27 -------- d-----w- c:\program files\Common Files\DirectX
2009-05-28 03:31 . 2008-12-17 05:16 -------- d-----w- c:\program files\SpywareBlaster
2009-05-28 03:13 . 2005-03-04 21:40 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-25 04:37 . 2009-05-25 04:37 -------- d-----w- c:\documents and settings\HP_Owner.YOUR-4F1261A8E5\Application Data\Yahoo!
2009-05-25 04:37 . 2008-12-29 21:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-05-13 05:15 . 2004-08-04 11:00 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-10 00:23 . 2009-04-27 19:59 43792 ----a-w- c:\documents and settings\HP_Owner.YOUR-4F1261A8E5\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-09 18:20 . 2009-05-09 18:20 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-05-07 15:32 . 2004-08-04 11:00 345600 ----a-w- c:\windows\system32\localspl.dll
2009-05-06 15:56 . 2004-10-15 10:37 82691 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-05-06 15:56 . 2009-05-06 15:56 44032 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\HPQ\XPXWWPP5\LocalContent\Attachments\devcon.exe
2009-05-06 15:56 . 2009-05-06 15:56 307200 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\HPQ\XPXWWPP5\plugin\bin\pchnotify.exe
2009-05-06 15:56 . 2009-05-06 15:56 3072 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\HPQ\XPXWWPP5\plugin\bin\jsharpde\pchealthde.exe
2009-05-06 15:56 . 2009-05-06 15:56 159744 ----a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\HPQ\XPXWWPP5\plugin\bin\PCHButton.exe
2009-05-04 16:21 . 2009-05-04 16:21 1915520 ----a-w- c:\documents and settings\HP_Owner.YOUR-4F1261A8E5\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2009-05-03 16:57 . 2009-04-27 17:53 147 ----a-w- c:\documents and settings\HP_Owner.YOUR-4F1261A8E5\Local Settings\Application Data\fusioncache.dat
2009-04-29 02:34 . 2009-05-09 17:46 58952 ----a-w- c:\windows\system32\MsgPlusLoader.dll
2006-09-18 08:51 . 2006-09-18 08:51 604 ---ha-w- c:\program files\STLL Notifier
2009-06-12 04:24 . 2008-08-11 03:31 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-14 1004800]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{474597C5-AB09-49d6-A4D5-2E8D7341384E}]
2009-05-04 10:54 398768 ----a-w- c:\program files\iMesh Applications\iMesh\iMeshIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-06-14 20:07 1004800 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-14 1004800]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-06-14 1004800]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SpywareBlaster"="c:\program files\SpywareBlaster\spywareblaster.exe" [2009-04-10 1340944]
"FreeRAM XP"="c:\program files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" [2006-03-23 1591808]
"msnmsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2005-07-14 7057408]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976]
"HPHUPD06"="c:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 49152]
"HPHmon06"="c:\windows\system32\hphmon06.exe" [2004-06-07 659456]
"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-11 61440]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"PS2"="c:\windows\system32\ps2.exe" [2004-10-25 90112]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2004-12-14 663552]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-22 1948440]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-03-04 98304]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-17 148888]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2004-06-29 88363]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-10-13 77824]
"AlcWzrd"="ALCWZRD.EXE" - c:\windows\ALCWZRD.EXE [2004-10-13 2742272]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-5-15 217193]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-5 258048]
Updates from HP.lnk - c:\program files\Updates from HP\309731\Program\Updates from HP.exe [2005-3-4 45056]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-06-22 14:01 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\MsgPlusLoader.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Updates from HP\\309731\\Program\\Updates from HP.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\BitTornado\\btdownloadgui.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Documents and Settings\\HP_Owner.YOUR-4F1261A8E5\\Desktop\\Games\\Mupen and Project 64k Online Smash\\Pj64k\\Project64k.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [5/9/2009 2:20 PM 335752]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [5/9/2009 2:20 PM 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [12/17/2008 1:17 AM 298776]
S3 pnx;PS NGC XBOX Filter Service;c:\windows\system32\drivers\pnx.sys [4/30/2009 7:50 PM 13824]
S3 XDva273;XDva273;\??\c:\windows\system32\XDva273.sys --> c:\windows\system32\XDva273.sys [?]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - JAVAQUICKSTARTERSERVICE

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-06-26 c:\windows\Tasks\Easy Internet Sign-up.job
- c:\program files\Easy Internet signup\HPSdpApp.exe [2004-08-13 16:50]

2009-07-17 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-15 21:05]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://home.gamingharbor.com/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_CA&c=Q105&bd=pavilion&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_CA&c=Q105&bd=pavilion&pf=desktop
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://ca.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://ca.search.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-16 22:12
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(568)
c:\windows\system32\MsgPlusLoader.dll

- - - - - - - > 'lsass.exe'(624)
c:\windows\system32\MsgPlusLoader.dll
.
Completion time: 2009-07-17 22:15
ComboFix-quarantined-files.txt 2009-07-17 02:15
ComboFix2.txt 2008-12-19 01:02
ComboFix3.txt 2008-12-17 22:40

Pre-Run: 43,084,972,032 bytes free
Post-Run: 43,100,475,392 bytes free

268 --- E O F --- 2009-07-16 01:40


Fresh HJthis log :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:30:17 PM, on 7/16/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\AGRSMMSG.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\ALCMTR.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_CA&c=Q105&bd=pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.gamingharbor.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_CA&c=Q105&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ca.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://ca.search.yahoo.com
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: UrlHelper Class - {474597C5-AB09-49d6-A4D5-2E8D7341384E} - C:\Program Files\iMesh Applications\iMesh\iMeshIEHelper.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpywareBlaster] C:\Program Files\SpywareBlaster\spywareblaster.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\MsgPlusLoader.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\HP Game Console\GameConsoleService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Common Files\LightScribe\LSSrvc.exe

--
End of file - 6994 bytes

Computer is running pretty well at the moment. Thanks again :)
 
Please do another hijackthis scan and place a check next to this item and then click on fix checked at the bottom.

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)


I'm going to make a recommendation and tell you to uninstall that Freeram XP program. XP is good about utilizing and releasing ram when finished with it, you don't need a separate program. Those programs are nothing but gimmicks, making you think its a great program when its not.
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:44:09 PM, on 7/17/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\hphmon06.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_CA&c=Q105&bd=pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.gamingharbor.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_CA&c=Q105&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ca.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://ca.search.yahoo.com
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: UrlHelper Class - {474597C5-AB09-49d6-A4D5-2E8D7341384E} - C:\Program Files\iMesh Applications\iMesh\iMeshIEHelper.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpywareBlaster] C:\Program Files\SpywareBlaster\spywareblaster.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\MsgPlusLoader.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\HP Game Console\GameConsoleService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Common Files\LightScribe\LSSrvc.exe

--
End of file - 7082 bytes


Fixed what you told me to fix, and I didnt know that about freeramxpro. So Ill just uninstall that later.

Are there any other problems? Computer works great now :)
 
haha I have no idea how to reformat :P

But I think I know someone who does so Ill get him to do it one of these days

For the moment the computer is usable. I only really use it for facebook and forums these days with the occasional online emulator game.
 
yeah you would have to know what you are doing and I just do it it ssecond nature to me so I would have to be there to do it
 
You must log in or register to reply here.
Back
Top