hello please help me

hello every please help me to read this hijackthis log for me.

Logfile of HijackThis v1.99.1

Scan saved at 10:37:00 PM, on 1/19/2007

Platform: Windows XP  (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)



Running processes:

C:\windows\System32\smss.exe

C:\windows\system32\winlogon.exe

C:\windows\system32\services.exe

C:\windows\system32\lsass.exe

C:\windows\system32\svchost.exe

C:\windows\System32\svchost.exe

C:\windows\system32\spoolsv.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

C:\windows\Explorer.EXE

C:\windows\System32\svchost.exe

C:\windows\System32\RUNDLL32.EXE

C:\windows\System32\svchost.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Hijackthis\HijackThis.exe



O1 - Hosts: 202.109.114.142 survey88.allyes.com

O1 - Hosts: 202.109.114.142 adtaobao.allyes.com

O1 - Hosts: 202.109.114.142 code.qihoo.com

O1 - Hosts: 202.109.114.142 union.mop.com

O1 - Hosts: 202.109.114.142 js.kkunion.com

O1 - Hosts: 202.109.114.142 v.kkunion.com

O1 - Hosts: 202.109.114.142 v.21cn.com

O1 - Hosts: 202.109.114.142 iplusms.allyes.com

O1 - Hosts: 202.109.114.142 mms.t2t2.com

O1 - Hosts: 202.109.114.142 ivr.dobig.net

O1 - Hosts: 202.109.114.142 www.u8u.com

O1 - Hosts: 202.109.114.142 u.u8u.com

O1 - Hosts: 202.109.114.142 img.zhangxiu.com

O1 - Hosts: 202.109.114.142 tl.linktone.com

O1 - Hosts: 202.109.114.142 channel.e78.com

O1 - Hosts: 202.109.114.142 u.7town.com

O1 - Hosts: 202.109.114.142 union.95ol.com.cn

O1 - Hosts: 202.109.114.142 mms1.95ol.com.cn

O1 - Hosts: 202.109.114.142 mfs.95ol.com.cn

O1 - Hosts: 202.109.114.142 tl.a8.com

O1 - Hosts: 202.109.114.142 ad01.a8.com

O1 - Hosts: 202.109.114.142 u2.caiku.com

O1 - Hosts: 202.109.114.142 mms.caiku.com

O1 - Hosts: 202.109.114.142 code1.caiku.com

O1 - Hosts: 202.109.114.142 pub.lele.com

O1 - Hosts: 202.109.114.142 u.lele.com

O1 - Hosts: 202.109.114.142 7town.com

O1 - Hosts: 202.109.114.142 tvsend.7town.com

O1 - Hosts: 202.109.114.142 ivrsend.7town.com

O1 - Hosts: 202.109.114.142 tlt.7town.com

O1 - Hosts: 202.109.114.142 gsend.7town.com

O1 - Hosts: 202.109.114.142 smssend.7town.com

O1 - Hosts: 202.109.114.142 mmssend.moyu.com

O1 - Hosts: 202.109.114.142 91ivr.com

O1 - Hosts: 202.109.114.142 myad.91ivr.com

O1 - Hosts: 202.109.114.142 u.91ivr.com

O1 - Hosts: 202.109.114.142 union.91ivr.com

O1 - Hosts: 202.109.114.142 cm.p4p.cn.yahoo.com

O1 - Hosts: 202.109.114.142 un.265.com

O1 - Hosts: 202.109.114.142 union.qq.com

O1 - Hosts: 202.109.114.142 view.aliunion.cn.yahoo.com

O1 - Hosts: 202.109.114.142 union.narrowad.com

O1 - Hosts: 202.109.114.142 ln.heima8.com

O1 - Hosts: 202.109.114.142 www.fboat.cn

O1 - Hosts: 202.109.114.142 cpro.baidu.com

O1 - Hosts: 202.109.114.142 unstat.baidu.com

O1 - Hosts: 202.109.114.142 y.cnxad.com

O1 - Hosts: 202.109.114.142 www.ewowo.com

O1 - Hosts: 202.109.114.142 template.union.163.com

O1 - Hosts: 202.109.114.142 new.is686.com

O1 - Hosts: 202.109.114.142 creative.unionsys.bolaa.com

O1 - Hosts: 202.109.114.142 www.qyule.com

O1 - Hosts: 202.109.114.142 99e.cc

O1 - Hosts: 202.109.114.142 www.91ivr.com

O1 - Hosts: 202.109.114.142 mg.ukaka.com

O1 - Hosts: 202.109.114.142 kooxoo2.ad4all.net

O1 - Hosts: 202.109.114.142 www.8fff.com

O1 - Hosts: 202.109.114.142 union.pomoho.com

O1 - Hosts: 202.109.114.142 202.107.233.211

O1 - Hosts: 202.109.114.142 www.end123.com

O1 - Hosts: 202.109.114.142 w1.7clink.com

O1 - Hosts: 202.109.114.142 w2.7clink.com

O1 - Hosts: 202.109.114.142 union01.com

O1 - Hosts: 202.109.114.142 click.8le8le.com

O1 - Hosts: 202.109.114.142 stbanner.allyes.com

O1 - Hosts: 202.109.114.142 mms1.moyu.com

O1 - Hosts: 202.109.114.142 u.moyu.com

O1 - Hosts: 202.109.114.142 mmsu.moyu.com

O1 - Hosts: 202.109.114.142 show.moyu.com

O1 - Hosts: 202.109.114.142 ivrsend.moyu.com

O1 - Hosts: 202.109.114.142 ivru.moyu.com

O1 - Hosts: 202.109.114.142 ivr1.moyu.com

O1 - Hosts: 203.191.146.205 corep.dmcast.com

O1 - Hosts: 203.191.146.205 m081.dmcast.com

O1 - Hosts: 203.191.146.205 dcww.dmcast.com

O1 - Hosts: 203.191.146.205 renren.dmcast.com

O1 - Hosts: 203.191.146.205 files.henbang.net

O1 - Hosts: 203.191.146.205 bannerbox.cn

O1 - Hosts: 203.191.146.205 www.bannerbox.cn

O1 - Hosts: 203.191.146.205 action.coopen.cn

O1 - Hosts: 203.191.146.205 u4.sky99.cn

O1 - Hosts: 203.191.146.205 u1.sky99.cn

O1 - Hosts: 203.191.146.205 u2.sky99.cn

O1 - Hosts: 203.191.146.205 u3.sky99.cn

O1 - Hosts: 203.191.146.205 sky99.cn

O1 - Hosts: 203.191.146.205 u.sky99.cn

O1 - Hosts: 203.191.146.205 u.ete.cn

O1 - Hosts: 203.191.146.205 ip.alexaanywhere.com

O1 - Hosts: 203.191.146.205 www.365tan.com

O1 - Hosts: 203.191.146.205 www.winopen.cn

O1 - Hosts: 203.191.146.205 www.tanip.com

O1 - Hosts: 203.191.146.205 alexaanywhere.com

O1 - Hosts: 203.191.146.205 jssb.alexaanywhere.com

O1 - Hosts: 203.191.146.205 ns250.alexaanywhere.com

O1 - Hosts: 203.191.146.205 sb.alexaanywhere.com

O1 - Hosts: 203.191.146.205 ip.alexaanywhere.com

O1 - Hosts: 203.191.146.205 pop.9v.cn

O1 - Hosts: 203.191.146.205 xuni.myad.cn

O1 - Hosts: 203.191.146.205 iebar.t2t2.com

O1 - Hosts: 203.191.146.205 error.newcell.cn

O1 - Hosts: 203.191.146.205 auto.search.msn.com

O2 - BHO: Info cache - {385AB8C6-FB22-4D17-8834-064E2BA0A6F0} - C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O10 - Unknown file in Winsock LSP: c:\program files\armor2net\armor2net personal firewall\netdog.dll

O10 - Unknown file in Winsock LSP: c:\program files\armor2net\armor2net personal firewall\netdog.dll

O17 - HKLM\System\CCS\Services\Tcpip\..\{196BB9EE-06F0-44DF-9106-20FF15A3F455}: NameServer = 202.47.96.146,202.47.96.147

O17 - HKLM\System\CS6\Services\Tcpip\..\{196BB9EE-06F0-44DF-9106-20FF15A3F455}: NameServer = 202.47.96.146,202.47.96.147

O17 - HKLM\System\CS7\Services\Tcpip\..\{196BB9EE-06F0-44DF-9106-20FF15A3F455}: NameServer = 202.47.96.146,202.47.96.147

O17 - HKLM\System\CS8\Services\Tcpip\..\{196BB9EE-06F0-44DF-9106-20FF15A3F455}: NameServer = 202.47.96.146,202.47.96.147

O23 - Service: Ati HotKey Poller - Unknown owner - C:\windows\System32\Ati2evxx.exe (file missing)

O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

O23 - Service: DepExMTLstHTML (ExMTLstHTML) - Unknown owner - C:\Windows\system32\MQTWBEH.EXE (file missing)

O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - Unknown owner - C:\Program Files\TuneUp WinStyler\WinStylerThemeSvc.exe (file missing)

-----------------------------------------------------------
Update Your Windows XP.
You are currently using an unpatched version of Windows XP.
Before attempting to remove malware, it is CRITICAL that you update to Service Pack 1a.
Get SP1a here : http://www.microsoft.com/windowsxp/downloads/updates/sp1/default.mspx
You should also get SP2, but NOT NOW, rather only after your machine is clean.
After updating your Windows to SP1a, post a new HijackThis log please, using the Reply button.

This topic is now closed due to inactivity. If you wish it reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

You can help support this site from this link :
Donations For Malware Removal

Please do not contact us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.