i have done what you said
i can not find anything that says paytime.exe but i found the other. here's the new hijack log:
Logfile of HijackThis v1.99.1
Scan saved at 8:11:18 AM, on 11/16/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Common Files\Microsoft
Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\system32\ScsiAccess.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\WINDOWS\LTMSG.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Intel\Intel(R) Active Monitor\IMonTray.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Documents and Settings\Pam\Desktop\My
Games\miscellaneous\1\saving\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Search Page =
www.google.com
R0 - HKCU\Software\Microsoft\Internet
Explorer\Main,Start Page =
http://www.pogo.com/home/home-pogop.jsp ... ogop&sls=3
&lkey=Q3m5hQKMOJfDlK7ECmb3ogAAKDw.
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Search Page =
www.google.com
R1 -
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet
Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat
6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: UberButton Class -
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} -
C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class -
{65D886A2-7CA7-479B-BB95-14D1EFB7946A} -
C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: Toolbar Helper -
{D44BBB61-E17F-4AE6-A502-8D7E0B29E616} -
C:\WINDOWS\system32\s1930.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program
Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft
AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program
Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program
Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program
Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVGCtrl] C:\Program
Files\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [avast!]
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [BootSkin Startup Jobs]
"C:\PROGRA~1\Stardock\WINCUS~1\BootSkin\BootSkin.exe"
/StartupJobs
O4 - HKCU\..\Run: [ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN
Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager]
"C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" -quiet
O4 - HKCU\..\Run: [IncrediMail] C:\Program
Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [Intel Active Monitor] "C:\Program
Files\Intel\Intel(R) Active Monitor\IMonTray.exe"
O4 - HKCU\..\Run: [Lexmark X1150 Taskbar] "C:\Program
Files\Lexmark X1100 Series\lxbkbmon.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program
Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Add animation to IncrediMail
Style Box -
C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &eBay Search -
res://C:\Program Files\eBay\eBay
Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &Yahoo! Search -
file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: StumbleUpon: &Blog This -
res://C:\WINDOWS\system32\s1930.dll/blogimage
O8 - Extra context menu item: Yahoo! &Dictionary -
file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps -
file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS -
file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O16 - DPF: 6th Street Omaha Poker by pogo -
http://game1.pogo.com/applet-6.1.5.21/omaha/omaha-ob-as
sets.cab
O16 - DPF: Aces Up! by pogo -
http://game1.pogo.com/applet-6.1.5.21/a ... -ob-assets
.cab
O16 - DPF: Backgammon by pogo -
http://gammon.pogo.com/applet-6.1.0.39/backgammon/backg
ammon-ob-assets.cab
O16 - DPF: Blackjack by pogo -
http://game1.pogo.com/applet-6.1.5.21/b ... blackjack-
ob-assets.cab
O16 - DPF: Buckaroo Blackjack TM by pogo -
http://game1.pogo.com/applet-6.2.0.37/v ... jack/video
blackjack-ob-assets.cab
O16 - DPF: Canasta by pogo -
http://game1.pogo.com/applet-6.3.1.26/c ... anasta-ob-
assets.cab
O16 - DPF: Checkers by pogo -
http://game3.pogo.com/applet-6.1.2.25/c ... /checkers-
ob-assets.cab
O16 - DPF: Chess by pogo -
http://game1.pogo.com/applet-6.1.5.21/c ... hess2-ob-a
ssets.cab
O16 - DPF: Dice Derby by pogo -
http://game1.pogo.com/applet-6.1.4.22/c ... flag/check
eredflag-ob-assets.cab
O16 - DPF: Dominoes by pogo -
http://game5.pogo.com/applet-6.1.3.21/d ... mino-ob-as
sets.cab
O16 - DPF: First Class Solitaire by pogo -
http://game1.pogo.com/applet-6.1.4.29/s ... olitaire2-
ob-assets.cab
O16 - DPF: Fortune Bingo by pogo -
http://game1.pogo.com/applet-6.3.0.46/s ... /superbing
o-ob-assets.cab
O16 - DPF: Greenback Bayou by pogo -
http://greenback.pogo.com/applet-6.0.4. ... back/green
back-ob-assets.cab
O16 - DPF: Harvest Mania by pogo -
http://game1.pogo.com/applet-6.1.5.21/h ... arvest-ob-
assets.cab
O16 - DPF: Hearts by pogo -
http://game1.pogo.com/applet-6.1.4.22/h ... earts-ob-a
ssets.cab
O16 - DPF: High Stakes Poker by pogo -
http://game1.pogo.com/applet-6.2.0.37/d ... r/drawpoke
r-ob-assets.cab
O16 - DPF: High Stakes Pool by pogo -
http://game1.pogo.com/applet-6.1.3.28/p ... -ob-assets
.cab
O16 - DPF: Jigsaw Detective by pogo -
http://game1.pogo.com/applet-6.1.4.22/j ... gsaw-ob-as
sets.cab
O16 - DPF: Jungle Gin by pogo -
http://gin.pogo.com/applet-6.0.4.37/gin ... assets.cab
O16 - DPF: Lottso by pogo -
http://game1.pogo.com/applet-6.3.0.46/l ... tso-ob-ass
ets.cab
O16 - DPF: Mah Jong Garden by pogo -
http://game1.pogo.com/applet-6.1.4.29/m ... mahjong-ob
-assets.cab
O16 - DPF: Multiline Slots by pogo -
http://game6.pogo.com/applet-6.0.4.37/m ... slots-ob-a
ssets.cab
O16 - DPF: Pai Gow by pogo -
http://game3.pogo.com/applet-6.1.0.39/p ... igow-ob-as
sets.cab
O16 - DPF: Payday FreeCell by pogo -
http://game1.pogo.com/applet-6.2.0.30/f ... eecell-ob-
assets.cab
O16 - DPF: Perfect Pair Solitaire by pogo -
http://waterwheel.pogo.com/applet-6.1.1 ... rwheel/wat
erwheel-ob-assets.cab
O16 - DPF: Phlinx by pogo -
http://game1.pogo.com/applet-6.1.4.29/f ... nger-ob-as
sets.cab
O16 - DPF: Pinochle by pogo -
http://game4.pogo.com/applet-6.1.1.29/p ... nochle-ob-
assets.cab
O16 - DPF: Pop Fu by pogo -
http://game1.pogo.com/applet-6.1.3.21/p ... fu-ob-asse
ts.cab
O16 - DPF: Poppit TM by pogo -
http://game5.pogo.com/applet-6.1.1.29/p ... ppit-ob-as
sets.cab
O16 - DPF: Showbiz Slots by pogo -
http://game1.pogo.com/applet-6.2.0.37/s ... wbiz-ob-as
sets.cab
O16 - DPF: Spades by pogo -
http://game3.pogo.com/applet-6.1.2.32/s ... pades-ob-a
ssets.cab
O16 - DPF: Spider Solitaire by pogo -
http://game1.pogo.com/applet-6.3.1.26/s ... ider-ob-as
sets.cab
O16 - DPF: Squelchies by pogo -
http://game1.pogo.com/applet-6.1.5.21/s ... squelchies
-ob-assets.cab
O16 - DPF: Texas Hold'em Poker by pogo -
http://game1.pogo.com/applet-6.2.0.30/h ... oldem-ob-a
ssets.cab
O16 - DPF: Tri-Peaks by pogo -
http://game1.pogo.com/applet-6.3.0.46/p ... aks-ob-ass
ets.cab
O16 - DPF: TruePass EPF 7,0,100,684 -
https://blrscr3.egs-seg.gc.ca/applets/e ... passapplet
-epf.cab
O16 - DPF: Tumble Bees by pogo -
http://game1.pogo.com/applet-6.1.4.29/j ... umbee-ob-a
ssets.cab
O16 - DPF: Turbo 21 TM by pogo -
http://game1.pogo.com/applet-6.2.0.37/t ... turbo21-ob
-assets.cab
O16 - DPF: Word Whomp by pogo -
http://game1.pogo.com/applet-6.1.5.21/wordwhomp/wordwho
mp-ob-assets.cab
O16 - DPF: Word Whomp Whackdown by pogo -
http://game1.pogo.com/applet-6.1.3.28/w ... n/whackdow
n-ob-assets.cab
O16 - DPF: WordJong by pogo -
http://game1.pogo.com/applet-6.1.3.28/w ... wordjong-o
b-assets.cab
O16 - DPF: World Class Solitaire by pogo -
http://game1.pogo.com/applet-6.3.0.46/w ... worldclass
-ob-assets.cab
O16 - DPF: Yahoo! Chat -
http://us.chat1.yimg.com/us.yimg.com/i/ ... t/c381/cha
t.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02}
(HouseCall Control) -
http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94}
(PCPitstop Utility) -
http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700}
(Windows Genuine Advantage Validation Tool) -
http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1B9935E4-8A50-4DD8-BD09-A7518723BF97}
(Talisma NetAgent Customer ActiveX Control version 3) -
https://intuitcanada.ehosts.net/netagen ... ustappx3.c
ab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab}
(YInstStarter Class) - C:\Program
Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537}
(MSN Photo Upload Tool) -
http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3}
(MUWebControl Class) -
http://update.microsoft.com/microsoftup ... Controls/e
n/x86/client/muweb_site.cab?1131986524640
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61}
(HouseCall Control) -
http://a840.g.akamai.net/7/840/537/2004061001/housecall.
trendmicro.com/housecall/xscan53.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A}
(MJLauncherCtrl Class) -
http://www.shockwave.com/content/luxor/mjolauncher.cab
O16 - DPF: {A031D222-B496-11D2-9CC8-00105A10AAF6}
-
http://hoylegames.sierra.com/cab/WONWeb ... rControl.c
ab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2}
(FlashXControl Object) -
https://riverbelle.microgaming.com/rive ... lashAX.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A}
-
http://www.pogo.com/game/deluxe/insaniq ... pcaploader
_v6.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6}
(MSN Chat Control 4.5) -
http://chat.msn.com/bin/msnchat45.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) -
Unknown owner - C:\Program Files\Alwil
Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner -
C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner -
C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner -
C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner -
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe"
/service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner -
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe"
/service (file missing)
O23 - Service: AntiVir Update (AVWUpSrv) - Unknown
owner - C:\Program Files\AVPersonal\AVWUPSRV.EXE (file
missing)
O23 - Service: InstallDriver Table Manager (IDriverT) -
Macrovision Corporation - C:\Program Files\Common
Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intel(R) Active Monitor (imonNT) - Intel
Corp. - C:\Program Files\Intel\Intel(R) Active
Monitor\imonnt.exe
O23 - Service: Kodak Camera Connection Software
(KodakCCS) - Eastman Kodak Company -
C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark
International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton Unerase Protection (NProtectService)
- Symantec Corporation - C:\Program Files\Norton
Utilities\NPROTECT.EXE
O23 - Service: ScsiAccess - Unknown owner -
C:\WINDOWS\system32\ScsiAccess.EXE
O23 - Service: Speed Disk service - Symantec Corporation -
C:\Program Files\Speed Disk\nopdb.exe
i ran my antivirus to start on bootup and it found the following:
