hijack this please

mrigoni · September 26, 2010

Logfile of IObit HijackScan v1.0.2.0

Scan saved at 19:10:41, on 2010-9-25

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program

Files\NetRatingsNetSight\NetSight\NielsenOnline.ex

e

C:\Program

Files\NetRatingsNetSight\NetSight\NielsenOnline.ex

e

C:\Program Files\IObit\Advanced SystemCare 3

\AWC.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Siber Systems\AI

RoboForm\RoboTaskBarIcon.exe

C:\Program

Files\W3i\InstallIQUpdater\InstallIQUpdater.exe

C:\Documents and

Settings\Owner.ANONYMOUS\Application Data\CBS

Interactive\CNET TechTracker\TechTracker.exe

C:\Program Files\Gacela\Gacela-Reporting.exe

C:\Program Files\Gacela\Gacela-Updater.exe

C:\Program Files\IObit\IObit Security 360

\IS360srv.exe

C:\Program Files\Google\Update\GoogleUpdate.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\UPHClean\uphclean.exe

C:\Program Files\Common Files\Microsoft

Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Microsoft

Shared\Windows Live\WLIDSvcM.exe

C:\WINDOWS\System32\alg.exe

C:\Program Files\Paint.NET\PaintDotNet.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\IObit\IObit Security 360\is360.exe

C:\Program Files\IObit\IObit Security 360

\IS360tray.exe

C:\Program Files\Absolute Poker\mainclient.exe

C:\Program Files\Absolute Poker\aphh.exe

C:\Program Files\GameHouse\Candy\cruncher.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Gacela\Gacela-Process-

Connector.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\IObit\IObit Security 360

\a_hijackscan.exe

O2 - BHO: Gacela - {4BEEA052-726D-4A6E-B65D-

A6BD07C263F3} - C:\Program

Files\Gacela\Gacela2.dll

O2 - BHO: Unknown - {724d43a9-0d85-11d4-9908-

00400523e39a} - C:\Program Files\Siber Systems\AI

RoboForm\roboform.dll

O2 - BHO: Windows Live ID Sign-in Helper -

{9030D464-4C02-4ABF-8ECC-5164760863C6} -

C:\Program Files\Common Files\Microsoft

Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-

4740-988e-03dc2f38c34f} - C:\Program

Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll

O2 - BHO: Ask Toolbar - {D4027C7F-154A-4066-

A1AD-4243D8127440} - C:\Program

Files\Ask.com\GenericAskToolbar.dll

O2 - BHO: Java Plug-In 2 SSV Helper -

{DBC80044-A445-435b-BC74-9C25C1C588A9} -

C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl Class -

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} -

C:\Program Files\Java\jre6

\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6

-B9E9-AB4C880C8414} - C:\Program

Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll

O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-

9908-00400523e39a} - C:\Program Files\Siber

Systems\AI RoboForm\roboform.dll

O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-

A1AD-4243D8127440} - C:\Program

Files\Ask.com\GenericAskToolbar.dll

O3 - Toolbar: ShopAtHome Toolbar - {98279C38-

DE4B-4bcf-93C9-8EC26069D6F4} -

O3 - Toolbar: Gacela - {5F6E2508-41C4-4D4B-8AC3

-D7ED6E4EB2AE} - C:\Program

Files\Gacela\Gacela2.dll

O4 -

HKCU|\Software\Microsoft\Windows\CurrentVersio

n\Run\: [Advanced SystemCare 3] "C:\Program

Files\IObit\Advanced SystemCare 3\AWC.exe"

/startup

O4 -

HKCU|\Software\Microsoft\Windows\CurrentVersio

n\Run\: [ctfmon.exe] C:\WINDOWS\system32

\ctfmon.exe

O4 -

HKCU|\Software\Microsoft\Windows\CurrentVersio

n\Run\: [RoboForm] "C:\Program Files\Siber

Systems\AI RoboForm\RoboTaskBarIcon.exe"

O4 -

HKCU|\Software\Microsoft\Windows\CurrentVersio

n\Run\: [installIQUpdater] "C:\Program

Files\W3i\InstallIQUpdater\InstallIQUpdater.exe"

/silent /autorun

O4 -