I think that I finally got it and I replaced the letters by *** let's see if now it  will work.

 

Logfile of HijackThis v1.97.7
Scan saved at 11:19:06 PM, on 5/4/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\kernels32.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\2Wire\2PortalMon.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\vxh8jkdq2.exe
C:\WINDOWS\System32\vxh8jkdq7.exe
C:\WINDOWS\System32\dmcio600.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\dlbepad.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\America Online 9.0\aoltray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\vxgame3.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\WebSiteViewer\126376.dlr
C:\Documents and Settings\Shirley Ferreira\Local Settings\Temp\Temporary Directory 8 for hijackthis.zip\HijackThis.exe
C:\Program Files\Windows NT\Accessories\wordpad.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nytimes.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/sbcydsl/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
F0 - system.ini: Shell=Explorer.exe C:\WINDOWS\System32\kernels32.exe
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\kernels32.exe
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {094D2F77-E7D2-4689-92FB-29822B2C4611} - (no file)
O2 - BHO: (no name) - {A0269420-A638-4509-889C-8FC3CC85DA7E} - C:\WINDOWS\drexinit.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\WINDOWS\System32\PRISMSVR.EXE" /APPLY
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [2wSysTray] C:\Program Files\2Wire\2PortalMon.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [System] C:\WINDOWS\System32\kernels32.exe
O4 - HKLM\..\Run: [Lrt] C:\WINDOWS\System32\Pqm.exe
O4 - HKLM\..\Run: [WindowsUpdate] C:\WINDOWS\System\svchost.exe /s
O4 - HKLM\..\Run: [sac] c:\program files\180searchassistant\sac.exe
O4 - HKLM\..\Run: [Oea] C:\WINDOWS\Nuk.exe
O4 - HKLM\..\Run: [Sst] C:\WINDOWS\System32\Rpv.exe
O4 - HKLM\..\Run: [Jiv] C:\WINDOWS\Jfe.exe
O4 - HKLM\..\Run: [Lfh] C:\WINDOWS\System32\Opg.exe
O4 - HKLM\..\Run: [Fmf] C:\WINDOWS\Cvt.exe
O4 - HKLM\..\Run: [Las] C:\WINDOWS\System32\Jmm.exe
O4 - HKLM\..\Run: [Qea] C:\WINDOWS\Qmf.exe
O4 - HKLM\..\Run: [Lgt] C:\WINDOWS\System32\Cgc.exe
O4 - HKLM\..\Run: [Cur] C:\WINDOWS\System32\Jrk.exe
O4 - HKLM\..\Run: [Ojn] C:\WINDOWS\System32\Ilv.exe
O4 - HKLM\..\Run: [Qrc] C:\WINDOWS\Vnr.exe
O4 - HKLM\..\Run: [Bqn] C:\WINDOWS\Fsc.exe
O4 - HKLM\..\Run: [Pgn] C:\WINDOWS\System32\Vdu.exe
O4 - HKLM\..\Run: [Ccb] C:\WINDOWS\Ikg.exe
O4 - HKLM\..\Run: [Hkn] C:\WINDOWS\System32\Gdo.exe
O4 - HKLM\..\Run: [23mk3mQ] dmcio600.exe
O4 - HKLM\..\Run: [Ndi] C:\WINDOWS\Imr.exe
O4 - HKLM\..\Run: [Ifr] C:\WINDOWS\Sqg.exe
O4 - HKLM\..\Run: [Ice] C:\WINDOWS\Fss.exe
O4 - HKLM\..\Run: [Dvp] C:\WINDOWS\Tjo.exe
O4 - HKLM\..\Run: [Ifs] C:\WINDOWS\System32\Lov.exe
O4 - HKLM\..\Run: [***] C:\WINDOWS\System32\Abr.exe
O4 - HKLM\..\Run: [Hgj] C:\WINDOWS\Kku.exe
O4 - HKLM\..\Run: [Rme] C:\WINDOWS\Ofa.exe
O4 - HKLM\..\Run: [Udf] C:\WINDOWS\System32\Uvp.exe
O4 - HKLM\..\Run: [Mkh] C:\WINDOWS\Ocb.exe
O4 - HKLM\..\Run: [Srn] C:\WINDOWS\Dvp.exe
O4 - HKLM\..\Run: [Arl] C:\WINDOWS\Chr.exe
O4 - HKLM\..\Run: [Djs] C:\WINDOWS\System32\Tvm.exe
O4 - HKLM\..\Run: [Jdp] C:\WINDOWS\System32\Ijd.exe
O4 - HKLM\..\Run: [Puh] C:\WINDOWS\Oqm.exe
O4 - HKLM\..\Run: [Eqq] C:\WINDOWS\Sus.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Hkn] C:\WINDOWS\System32\Gdo.exe
O4 - HKCU\..\Run: [J05qRgcEP] dlbepad.exe
O4 - HKCU\..\Run: [Ndi] C:\WINDOWS\Imr.exe
O4 - HKCU\..\Run: [Ifr] C:\WINDOWS\Sqg.exe
O4 - HKCU\..\Run: [Ice] C:\WINDOWS\Fss.exe
O4 - HKCU\..\Run: [Dvp] C:\WINDOWS\Tjo.exe
O4 - HKCU\..\Run: [Ifs] C:\WINDOWS\System32\Lov.exe
O4 - HKCU\..\Run: [***] C:\WINDOWS\System32\Abr.exe
O4 - HKCU\..\Run: [Hgj] C:\WINDOWS\Kku.exe
O4 - HKCU\..\Run: [Rme] C:\WINDOWS\Ofa.exe
O4 - HKCU\..\Run: [Udf] C:\WINDOWS\System32\Uvp.exe
O4 - HKCU\..\Run: [Eqq] C:\WINDOWS\Sus.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Yahoo! Login (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Login (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/yinst/yinst_current.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.av.aol.com/molbin/shared/mcinsctl/en-us/4,0,0,83/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by18fd.bay18.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://download.yahoo.com/dl/installs/ymail/ymmapi.dll
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://download.yahoo.com/dl/installs/yab_af.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.av.aol.com/molbin/shared/mcgdmgr/en-us/1,0,0,20/mcgdmgr.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www5.incredimail.com/contents/setup/downloader_sp1/imloader.cab

 

 

Please notice that [Jo*]   * =o , the prohibited word!!!

O4 - HKLM\..\Run: [Jo*] C:\WINDOWS\System32\Abr.exe

O4 - HKCU\..\Run: [Jo*] C:\WINDOWS\System32\Abr.exe

Thanks again:  

                        Mineira

 

 

 

Logfile of HijackThis v1.99.1
Scan saved at 11:05:47 PM, on 5/5/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\kernels32.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\Program Files\2Wire\2PortalMon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\Pqm.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\WINDOWS\System32\dmcio600.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\vxh8jkdq7.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\dlbepad.exe
C:\Program Files\America Online 9.0\aoltray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\vxgame3.exe
C:\WINDOWS\System32\rundll32.exe
C:\HJT\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nytimes.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/sbcydsl/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\kernels32.exe
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {094D2F77-E7D2-4689-92FB-29822B2C4611} - (no file)
O2 - BHO: (no name) - {A0269420-A638-4509-889C-8FC3CC85DA7E} - C:\WINDOWS\drexinit.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\WINDOWS\System32\PRISMSVR.EXE" /APPLY
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [2wSysTray] C:\Program Files\2Wire\2PortalMon.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [System] C:\WINDOWS\System32\kernels32.exe
O4 - HKLM\..\Run: [Lrt] C:\WINDOWS\System32\Pqm.exe
O4 - HKLM\..\Run: [WindowsUpdate] C:\WINDOWS\System\svchost.exe /s
O4 - HKLM\..\Run: [sac] c:\program files\180searchassistant\sac.exe
O4 - HKLM\..\Run: [Oea] C:\WINDOWS\Nuk.exe
O4 - HKLM\..\Run: [Sst] C:\WINDOWS\System32\Rpv.exe
O4 - HKLM\..\Run: [Jiv] C:\WINDOWS\Jfe.exe
O4 - HKLM\..\Run: [Lfh] C:\WINDOWS\System32\Opg.exe
O4 - HKLM\..\Run: [Fmf] C:\WINDOWS\Cvt.exe
O4 - HKLM\..\Run: [Las] C:\WINDOWS\System32\Jmm.exe
O4 - HKLM\..\Run: [Qea] C:\WINDOWS\Qmf.exe
O4 - HKLM\..\Run: [Lgt] C:\WINDOWS\System32\Cgc.exe
O4 - HKLM\..\Run: [Cur] C:\WINDOWS\System32\Jrk.exe
O4 - HKLM\..\Run: [Ojn] C:\WINDOWS\System32\Ilv.exe
O4 - HKLM\..\Run: [Qrc] C:\WINDOWS\Vnr.exe
O4 - HKLM\..\Run: [Bqn] C:\WINDOWS\Fsc.exe
O4 - HKLM\..\Run: [Pgn] C:\WINDOWS\System32\Vdu.exe
O4 - HKLM\..\Run: [Ccb] C:\WINDOWS\Ikg.exe
O4 - HKLM\..\Run: [Hkn] C:\WINDOWS\System32\Gdo.exe
O4 - HKLM\..\Run: [23mk3mQ] dmcio600.exe
O4 - HKLM\..\Run: [Ndi] C:\WINDOWS\System32\Mbs.exe
O4 - HKLM\..\Run: [Ifr] C:\WINDOWS\Sqg.exe
O4 - HKLM\..\Run: [Ice] C:\WINDOWS\Fss.exe
O4 - HKLM\..\Run: [Dvp] C:\WINDOWS\Tjo.exe
O4 - HKLM\..\Run: [Ifs] C:\WINDOWS\System32\Lov.exe
O4 - HKLM\..\Run: [Jo*] C:\WINDOWS\System32\Abr.exe
O4 - HKLM\..\Run: [Hgj] C:\WINDOWS\Kku.exe
O4 - HKLM\..\Run: [Rme] C:\WINDOWS\Ofa.exe
O4 - HKLM\..\Run: [Udf] C:\WINDOWS\System32\Uvp.exe
O4 - HKLM\..\Run: [Mkh] C:\WINDOWS\Ocb.exe
O4 - HKLM\..\Run: [Srn] C:\WINDOWS\Dvp.exe
O4 - HKLM\..\Run: [Arl] C:\WINDOWS\Chr.exe
O4 - HKLM\..\Run: [Djs] C:\WINDOWS\System32\Tvm.exe
O4 - HKLM\..\Run: [Jdp] C:\WINDOWS\System32\Ijd.exe
O4 - HKLM\..\Run: [Puh] C:\WINDOWS\Oqm.exe
O4 - HKLM\..\Run: [Eqq] C:\WINDOWS\Sus.exe
O4 - HKLM\..\Run: [Tsm] C:\WINDOWS\Jmn.exe
O4 - HKLM\..\Run: [Vhf] C:\WINDOWS\System32\Cak.exe
O4 - HKLM\..\Run: [Eii] C:\WINDOWS\System32\Hgd.exe
O4 - HKLM\..\Run: [Gje] C:\WINDOWS\System32\Sts.exe
O4 - HKLM\..\Run: [Emt] C:\WINDOWS\Rhn.exe
O4 - HKLM\..\Run: [Rav] C:\WINDOWS\Cts.exe
O4 - HKLM\..\Run: [Mnu] C:\WINDOWS\Isu.exe
O4 - HKLM\..\Run: [Aev] C:\WINDOWS\System32\Rcb.exe
O4 - HKLM\..\Run: [Sdu] C:\WINDOWS\System32\Nlj.exe
O4 - HKLM\..\Run: [Dbs] C:\WINDOWS\Qeo.exe
O4 - HKLM\..\Run: [Luv] C:\WINDOWS\Nqv.exe
O4 - HKLM\..\Run: [Mdj] C:\WINDOWS\Cts.exe
O4 - HKLM\..\Run: [Hjk] C:\WINDOWS\Nqc.exe
O4 - HKLM\..\Run: [Uqv] C:\WINDOWS\System32\Utl.exe
O4 - HKLM\..\Run: [Dkd] C:\WINDOWS\System32\Ahk.exe
O4 - HKLM\..\Run: [Kfk] C:\WINDOWS\System32\Dpi.exe
O4 - HKLM\..\Run: [Nhu] C:\WINDOWS\Tek.exe
O4 - HKLM\..\Run: [Faj] C:\WINDOWS\Iam.exe
O4 - HKLM\..\Run: [Doi] C:\WINDOWS\Gec.exe
O4 - HKLM\..\Run: [Rjh] C:\WINDOWS\Bng.exe
O4 - HKLM\..\Run: [Car] C:\WINDOWS\System32\Vke.exe
O4 - HKLM\..\Run: [Jqa] C:\WINDOWS\Fcg.exe
O4 - HKLM\..\Run: [Lhf] C:\WINDOWS\System32\Obm.exe
O4 - HKLM\..\Run: [Jgn] C:\WINDOWS\System32\Fqf.exe
O4 - HKLM\..\Run: [Rga] C:\WINDOWS\Tha.exe
O4 - HKLM\..\Run: [Kpc] C:\WINDOWS\Muo.exe
O4 - HKLM\..\Run: [Ulo] C:\WINDOWS\Bcv.exe
O4 - HKLM\..\Run: [Nkr] C:\WINDOWS\Evc.exe
O4 - HKLM\..\Run: [Mvv] C:\WINDOWS\Lbi.exe
O4 - HKLM\..\Run: [Vqn] C:\WINDOWS\Nql.exe
O4 - HKLM\..\Run: [Epk] C:\WINDOWS\System32\Qdc.exe
O4 - HKLM\..\Run: [Gvo] C:\WINDOWS\System32\Hfl.exe
O4 - HKLM\..\Run: [Pof] C:\WINDOWS\System32\Qsf.exe
O4 - HKLM\..\Run: [Epa] C:\WINDOWS\System32\Jtt.exe
O4 - HKLM\..\Run: [Ssd] C:\WINDOWS\Giq.exe
O4 - HKLM\..\Run: [Btm] C:\WINDOWS\Sjl.exe
O4 - HKLM\..\Run: [Bhn] C:\WINDOWS\System32\Tql.exe
O4 - HKLM\..\Run: [Pbs] C:\WINDOWS\Lnm.exe
O4 - HKLM\..\Run: [Gan] C:\WINDOWS\System32\Qds.exe
O4 - HKLM\..\Run: [Qap] C:\WINDOWS\System32\Tpa.exe
O4 - HKLM\..\Run: [Dko] C:\WINDOWS\Vkh.exe
O4 - HKLM\..\Run: [Gcn] C:\WINDOWS\Vou.exe
O4 - HKLM\..\Run: [Vjn] C:\WINDOWS\System32\Duk.exe
O4 - HKLM\..\Run: [Fil] C:\WINDOWS\Flg.exe
O4 - HKLM\..\Run: [Ocl] C:\WINDOWS\Cju.exe
O4 - HKLM\..\Run: [Rfl] C:\WINDOWS\Ata.exe
O4 - HKLM\..\Run: [Njn] C:\WINDOWS\System32\Ger.exe
O4 - HKLM\..\Run: [Qop] C:\WINDOWS\Vfb.exe
O4 - HKLM\..\Run: [Ugv] C:\WINDOWS\Tmc.exe
O4 - HKLM\..\Run: [Lml] C:\WINDOWS\System32\Qoh.exe
O4 - HKLM\..\Run: [Kvl] C:\WINDOWS\Faj.exe
O4 - HKLM\..\Run: [Isl] C:\WINDOWS\Pli.exe
O4 - HKLM\..\Run: [Ujq] C:\WINDOWS\System32\Iih.exe
O4 - HKLM\..\Run: [Jnk] C:\WINDOWS\Fpv.exe
O4 - HKLM\..\Run: [Qet] C:\WINDOWS\Qpm.exe
O4 - HKLM\..\Run: [Ncv] C:\WINDOWS\System32\Qjf.exe
O4 - HKLM\..\Run: [Gtb] C:\WINDOWS\System32\Lcj.exe
O4 - HKLM\..\Run: [Rvm] C:\WINDOWS\System32\Juc.exe
O4 - HKLM\..\Run: [Rrk] C:\WINDOWS\System32\Cmi.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Hkn] C:\WINDOWS\System32\Gdo.exe
O4 - HKCU\..\Run: [J05qRgcEP] dlbepad.exe
O4 - HKCU\..\Run: [Ndi] C:\WINDOWS\System32\Mbs.exe
O4 - HKCU\..\Run: [Ifr] C:\WINDOWS\Sqg.exe
O4 - HKCU\..\Run: [Ice] C:\WINDOWS\Fss.exe
O4 - HKCU\..\Run: [Dvp] C:\WINDOWS\Tjo.exe
O4 - HKCU\..\Run: [Ifs] C:\WINDOWS\System32\Lov.exe
O4 - HKCU\..\Run: [Jo*] C:\WINDOWS\System32\Abr.exe
O4 - HKCU\..\Run: [Hgj] C:\WINDOWS\Kku.exe
O4 - HKCU\..\Run: [Rme] C:\WINDOWS\Ofa.exe
O4 - HKCU\..\Run: [Udf] C:\WINDOWS\System32\Uvp.exe
O4 - HKCU\..\Run: [Eqq] C:\WINDOWS\Sus.exe
O4 - HKCU\..\Run: [Tsm] C:\WINDOWS\Jmn.exe
O4 - HKCU\..\Run: [Vhf] C:\WINDOWS\System32\Cak.exe
O4 - HKCU\..\Run: [Eii] C:\WINDOWS\System32\Hgd.exe
O4 - HKCU\..\Run: [Gje] C:\WINDOWS\System32\Sts.exe
O4 - HKCU\..\Run: [Emt] C:\WINDOWS\Rhn.exe
O4 - HKCU\..\Run: [Rav] C:\WINDOWS\Cts.exe
O4 - HKCU\..\Run: [Mnu] C:\WINDOWS\Isu.exe
O4 - HKCU\..\Run: [Aev] C:\WINDOWS\System32\Rcb.exe
O4 - HKCU\..\Run: [Sdu] C:\WINDOWS\System32\Nlj.exe
O4 - HKCU\..\Run: [Dbs] C:\WINDOWS\Qeo.exe
O4 - HKCU\..\Run: [Gan] C:\WINDOWS\System32\Qds.exe
O4 - HKCU\..\Run: [Qap] C:\WINDOWS\System32\Tpa.exe
O4 - HKCU\..\Run: [Dko] C:\WINDOWS\Vkh.exe
O4 - HKCU\..\Run: [Gcn] C:\WINDOWS\Vou.exe
O4 - HKCU\..\Run: [Vjn] C:\WINDOWS\System32\Duk.exe
O4 - HKCU\..\Run: [Fil] C:\WINDOWS\Flg.exe
O4 - HKCU\..\Run: [Ocl] C:\WINDOWS\Cju.exe
O4 - HKCU\..\Run: [Rfl] C:\WINDOWS\Ata.exe
O4 - HKCU\..\Run: [Njn] C:\WINDOWS\System32\Ger.exe
O4 - HKCU\..\Run: [Qop] C:\WINDOWS\Vfb.exe
O4 - HKCU\..\Run: [Ugv] C:\WINDOWS\Tmc.exe
O4 - HKCU\..\Run: [Lml] C:\WINDOWS\System32\Qoh.exe
O4 - HKCU\..\Run: [Kvl] C:\WINDOWS\Faj.exe
O4 - HKCU\..\Run: [Isl] C:\WINDOWS\Pli.exe
O4 - HKCU\..\Run: [Ujq] C:\WINDOWS\System32\Iih.exe
O4 - HKCU\..\Run: [Jnk] C:\WINDOWS\Fpv.exe
O4 - HKCU\..\Run: [Qet] C:\WINDOWS\Qpm.exe
O4 - HKCU\..\Run: [Rvm] C:\WINDOWS\System32\Juc.exe
O4 - HKCU\..\Run: [Rrk] C:\WINDOWS\System32\Cmi.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/yinst/yinst_current.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.av.aol.com/molbin/shared/mcinsctl/en-us/4,0,0,83/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by18fd.bay18.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.av.aol.com/molbin/shared/mcgdmgr/en-us/1,0,0,20/mcgdmgr.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www5.incredimail.com/contents/setup/downloader_sp1/imloader.cab
O20 - Winlogon Notify: f3dsl - C:\WINDOWS\SYSTEM32\MSplg7.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\SYSTEM32\YPCSER~1.EXE
O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe (file missing)