Rundll32.exe is not a valid win32 application

[swingnat]

Cannot access Add/Remove Programs along with other icons in the Control Panel. Keep getting the rundlll32.exe is not a valid win32 application error message. Below is my hijackthis log.

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 5:29:48 PM, on 3/25/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\Desktop\HiJackThis_v2.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Program Files\DeluxeCommunications\DxcBho.dll
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {393910C6-2D78-4EC6-9611-BDE8349B8FF7} - C:\WINDOWS\System32\wvurs.dll
O2 - BHO: (no name) - {3A081985-C87D-4D37-B52C-97CB59308695} - C:\WINDOWS\System32\iwbqipbj.dll
O2 - BHO: (no name) - {3DA91431-0F3E-407F-A348-4E11449209D7} - C:\WINDOWS\System32\iwbqipbj.dll
O2 - BHO: Ofb11 - {3E1500AC-87A5-416b-A211-82E848649DA9} - (no file)
O2 - BHO: (no name) - {49BBA3D0-86C6-44C4-9A20-4F699ED976FA} - C:\Program Files\Internet Explorer\hopetez.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {689110B9-F630-48F9-9289-645D45578086} - \
O2 - BHO: efHelperModule Class - {739A31D4-4018-43D0-9EE4-ECD71DE0EB95} - C:\PROGRA~1\EFRIEN~1\efHelper.dll
O2 - BHO: A?AIAø¹U - {76BEDF16-5EA5-49af-AFAC-94A201D29B79} - C:\PROGRA~1\UTurnBar\UTurnBar.dll
O2 - BHO: (no name) - {800A0C44-E788-419C-B8B5-1B4964C56785} - C:\WINDOWS\System32\ddcddaw.dll
O2 - BHO: Bad Site Blocker - {92378C0C-4C11-4F44-8127-256FE2F71319} - C:\Program Files\CodeZero\CZeroExp.dll
O2 - BHO: UBMeterObj Class - {95BC5C35-A071-4429-A41D-9079D3DC6608} - C:\Program Files\UBMeter\UBMeter.dll
O2 - BHO: BHO - {9BB5B49C-0D59-418d-A6A5-F6373B8FEF64} - C:\Program Files\BHO Plugin\plugin.dll
O2 - BHO: CTSTPP Class - {B31EA818-462A-4A88-8573-1F59A2FF9872} - C:\WINDOWS\System32\tstpp.dll
O2 - BHO: Plugin - {C318CD44-E327-4377-A28E-6EC16A921AE8} - C:\Program Files\Web Buying\v1.6.8\webbuying.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: V3 - {9E3849D6-41EF-4B2F-86B7-632EF90758E4} - C:\Program Files\AhnLab\V3\V3Bar.dll
O3 - Toolbar: ¿AAI¿A AeCO≫cAu - {DD9C9488-0B2F-435A-8E94-359CED492F64} - C:\Program Files\YBM\AllinAll\ToolBar.dll
O3 - Toolbar: AICA·≫Ai - {26DFF40F-9082-4BDE-A703-D994E345C704} - C:\PROGRA~1\EFRIEN~1\efriends.dll
O3 - Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O3 - Toolbar: AICA·≫Ai(°E≫o/AO¼O) - {4E1377C1-3F95-4F90-976C-148BF6DB11B3} - C:\PROGRA~1\EFRIEN~1\efasbar.dll
O3 - Toolbar: A?AIAø¹U - {76BEDF16-5EA5-49af-AFAC-94A201D29B79} - C:\PROGRA~1\UTurnBar\UTurnBar.dll
O3 - Toolbar: (no name) - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - (no file)
O4 - HKLM\..\Run: [AHNSD] "C:\Program Files\Ahnlab\Smart Update Utility\AhnSD.exe"
O4 - HKLM\..\Run: [dame40] C:\Program Files\Daum\DaumMsg\dame40.exe
O4 - HKLM\..\Run: [ADSpider] C:\Program Fies\ADSPider\ADSpider.exe /start
O4 - HKLM\..\Run: [DrVirus] C:\Program File\DrVirus\DrVirus.exe -sh
O4 - HKLM\..\Run: [SpyDoctor] C:\Program File\SpyDoctor\spydoctor\SpyDoctor.exe -sh
O4 - HKLM\..\Run: [안티스파이] C:\Program File\anti-spy\antispy.exe -update
O4 - HKLM\..\Run: [CodeZero] C:\Program File\CodeZero\CZlntro.exe
O4 - HKLM\..\Run: [SpyDelete] C:\Program File\PCClean\nd.exe
O4 - HKLM\..\Run: [ADCatchPro] C:\Programs File\ADCatch\adcatch.exe hidden
O4 - HKLM\..\Run: [PCZiggyV4] C:\Program File\VPower\PCZiggyV4\Naver\Update.exe /launch/run/hide
O4 - HKLM\..\Run: [PCadCop] C:\Program File\PCAd\ACAd.exe /h
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1137758832\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [PCSpy] C:\Program Files\PCSpy\PCSpyMain.exe
O4 - HKLM\..\Run: [CMem] C:\WINDOWS\System32\CMem.exe
O4 - HKLM\..\Run: [Personal Security Center Monitor] C:\WINDOWS\System32\psc_mon.exe
O4 - HKLM\..\Run: [FPM Exe] "C:\Program Files\Fasoo DRM\fpm.exe"
O4 - HKLM\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\System32\qwinsodv.exe SKY004
O4 - HKLM\..\Run: [sysinter] C:\WINDOWS\System32\adirss.exe
O4 - HKLM\..\Run: [lnwin.exe] C:\WINDOWS\System32\lnwin.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [SoundService] rundll32.exe "C:\WINDOWS\System32\xoyldeqw.dll",setvm
O4 - HKLM\..\Run: [syswin] C:\WINDOWS\System32\v6.exe
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\CTFMON.EXE
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB3834] command /c del "C:\Program Files\NewDotNet\newdotnet6_38.dll_tobedeleted_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3368] cmd /c del "C:\Program Files\NewDotNet\newdotnet6_38.dll_tobedeleted_old"
O4 - HKUS\S-1-5-19\..\Run: [Microsoft Windows Installer] C:\DOCUME~1\LOCALS~1\LOCALS~1\Temp\stdrun6.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Microsoft Windows Installer] C:\DOCUME~1\NETWOR~1\LOCALS~1\Temp\stdrun6.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Microsoft Windows Installer] C:\WINDOWS\TEMP\stdrun6.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [{E02ED1E1-0A61-1042-0108-040305130001}] "C:\Program Files\Common Files\{E02ED1E1-0A61-1042-0108-040305130001}\Update.exe" mc-110-12-0000501 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Microsoft Windows Installer] C:\WINDOWS\TEMP\stdrun6.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [{E02ED1E1-0A61-1042-0108-040305130001}] "C:\Program Files\Common Files\{E02ED1E1-0A61-1042-0108-040305130001}\Update.exe" mc-110-12-0000501 (User 'Default user')
O9 - Extra button: ¸Þ¸ð¸® AOAuE* - {02D4A5A4-1f77-13b0-1391-121FDF023F95} - C:\WINDOWS\System32\CMemChk.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: rsvp32_2.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.atfile.com
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://www.activation.rr.com/install/download/tgctlcm.cab
O16 - DPF: {091CDD73-1401-4643-9B9C-65B091C88685} (MyLinker Control) - http://san.contents.mylinker.co.kr/module/MyLinker.cab
O16 - DPF: {0B96BF84-DA5C-46F4-A7FC-5319CFF74163} (MnetLauncher Control) - http://player.mnet.com/package/cjmuset.cab
O16 - DPF: {1DE9BB01-B121-401D-8877-BCD5ED5B7EE5} (Tpwin Control) - http://www.crezio.com/test/leeyunho/AlwaysOn/AlwaysOn.CAB
O16 - DPF: {240F0899-15BB-49AE-B820-62CEB9116C0F} (SkyCom Control) - http://www.skylove.com/connect/skycom.cab
O16 - DPF: {27AAC9F7-A327-4ABE-A361-C39744135D07} (EHtml Control) - http://www3.edaily.co.kr/efriends/efActiveX/LiveUp.CAB
O16 - DPF: {316ED558-1FBB-4975-BE33-5C1D294BD0C2} (YBMFonts Control) - http://allinall.ybmsisa.com/cab/YBMFonts.CAB
O16 - DPF: {32CE8465-2D18-4AEE-9098-837844E6E926} (OcxChart Control) - http://version.edaily.co.kr/version/EDACHART/OcxChart.cab
O16 - DPF: {3450032D-92DA-4033-8672-4E0A2E7C4A7C} (SliderControl Control) - http://imusic.imbc.com/admin/DBUpload/ocx/SliderControl.ocx
O16 - DPF: {3F0EECCE-E138-11D1-8712-0060083D83F5} (LPViewer Class) - http://www.mgisoft.com/ActiveX/LPControl.cab
O16 - DPF: {43208B73-3783-4B4D-88C8-539314D9E70F} (Afinit Control) - http://www.spyoneshot.co.kr/app/cab/Afinit.cab
O16 - DPF: {49EA1597-4149-42FC-A01D-A03E07980D37} (WiseInstaller Class) - http://imbc.booktopia.com/booktopia/mylibrary/WiseInstaller/WiseInstaller.dll
O16 - DPF: {4A24F185-7D23-4B06-A5AF-8EE376C9AFFB} (InusAD Control) - http://www.homenlife.com/res/InusAD.cab
O16 - DPF: {51C99F40-9E0E-4BF1-A92A-77121CC01AD0} (IMBCClient Control) - http://touch.imbc.com/ocx/Online.cab
O16 - DPF: {5876CAD0-1636-42EA-AC50-4C06F3196089} (HanGamePlugin19 Class) - http://down.hangame.com/dist/activex/HanGamePlugin19.cab
O16 - DPF: {61D32533-ACAA-4972-90F5-10702D0558EB} (UbwebUtil Control) - http://211.216.47.82/ubmark/admin/ubwebUtil_2004060405.cab
O16 - DPF: {66121389-3168-4B2B-BC11-03D973983E45} (Pcspy_activex Control) - http://www.pcspy.co.kr/program/pcspy.cab
O16 - DPF: {6A2E758A-028B-46BB-A11D-0608AB5A4ED3} (DaumBGMCtrl Class) - http://listen.daum.net/52st/bgmplayer/Daum52stBGMPlayer.cab
O16 - DPF: {6AC91A18-1DC6-4DC6-B247-6F69FEA13250} (Icon0150 Control) - http://1un.co.kr/icon0150.cab
O16 - DPF: {7B80EA87-4DDA-447C-8CF7-97191D9F5FEB} - http://spymap.co.kr/dn/activex/spinst.cab
O16 - DPF: {7B990F65-94B7-4F9F-88F3-D1FF89995D68} (S1Shot Control) - http://blogfile.paran.com/BLOG_172258/200505/1115691209_s1shotcode.cab
O16 - DPF: {7FC751A9-492D-41B1-9F8D-D2C8809D8907} (EmoWebInstallerCtl Class) - http://pimg.hanmail.net/tv/cabs/MyTVInstaller.cab
O16 - DPF: {84F7A3A9-B92A-41F4-890F-83F2DC0ADB7E} (ToolBarInstall Control) - http://toolbar.imbc.com/toolbar/MBCToolBar.cab
O16 - DPF: {913BF18F-672D-4676-9855-F9A192A88886} (IMBCContents Control) - http://touch.imbc.com/ocx/Online.cab
O16 - DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} (Cdmcco Class) - http://cafeimg.hanmail.net/cab9/dmcc2.cab
O16 - DPF: {9658F2EC-3A20-48C1-9442-23CFEBE18334} (LiveLauncher Control) - http://live.pdbox.co.kr:8057/LiveLauncher.cab
O16 - DPF: {9BDBC41E-C335-4263-83C0-ECE78EE28A33} (SysMonOCX Control) - http://ahnlabdownload.nefficient.co.kr/plugin/myfirewall/myfirewall20.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
O16 - DPF: {A1832535-5218-42F9-8959-19E2BCABFABF} (INIwallet50 Control) - https://plugin.inicis.com/wallet50/INIwallet50.cab
O16 - DPF: {A4124121-2F0E-4132-A1DB-192F45CE7287} (BxLuncher Control) - http://boxgame.pdbox.co.kr/common/cab/BxLuncher.cab
O16 - DPF: {AB1A9D27-39B6-48D3-AB67-B95E7B66F312} (CSessionClient Object) - http://down.ontang.com/OntangSCWeb.cab
O16 - DPF: {B104A4D5-3D64-4D7A-A4F9-3E6B4A2D4E00} (SBSToolBar Control) - http://toolbar.sbs.co.kr/toolbar/SBSToolBar.cab
O16 - DPF: {C044CD87-DFB0-4130-A5E4-49361106FBC8} (HanSetupCtrl1008 Class) - http://cdn.hangame.com/hangame/hansetup/HanSetup1008.cab
O16 - DPF: {C2C16510-10F4-46FE-A82C-4846435EBDEB} (p3muzset Class) - http://player.muz.co.kr/package/p3muzset.cab
O16 - DPF: {C6BEC3B9-3446-49E1-BCE7-2B5D3CBAA32B} (Mcicon Control) - http://www.meincam.com/gabicon/mcicon.cab
O16 - DPF: {CD947CA5-4C7E-48F4-897A-CE5E7E2CEDC6} (Nshort Control) - http://www.unsebogi.com/unsebogi.cab
O16 - DPF: {CF362BDB-4EA2-11D5-AB47-000102913414} (SetGlb Control) - http://touch.imbc.com/ocx/SetGlb.cab
O16 - DPF: {D63FAB25-1142-4958-A6C8-6879B52FD126} - http://blogfile.paran.com/BLOG_167195/200504/1113635233_viewstart.cab
O16 - DPF: {D8F001C6-43B1-4CFD-9DAF-C8BEAE0E2B6D} (Touch Control) - http://touch.imbc.com/ocx/test/Online.cab
O16 - DPF: {EADBDB84-2341-4AD0-9FAF-4F1F31CF4A46} (LoginForm Class) - http://pointsok.okcashbag.com/skmpp/SKMPPClient2.cab
O16 - DPF: {F1F07506-6CB4-44AC-8615-66D1234EFD05} (WebCtl Class) - http://www.carnation.co.kr/initech/plugin/INIS50.cab
O16 - DPF: {FC67BB52-AAB6-4282-9D51-2DAFFE73AFD0} - http://download.spyspotter.com/spyspotter/SpSp29952.22opt/SpySpotterInstall.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{22688B9C-E25B-4179-AA48-BFB6A2CA63D9}: NameServer = 200.14.104.52
O17 - HKLM\System\CCS\Services\Tcpip\..\{57A68B17-E754-43F3-97B9-6AC80611E8B3}: NameServer = 200.14.104.52
O17 - HKLM\System\CCS\Services\Tcpip\..\{5E3B13AF-A8BB-4134-99E5-10C73A61FF10}: NameServer = 200.14.104.52
O17 - HKLM\System\CCS\Services\Tcpip\..\{72B4C040-AD81-4A29-932E-802D9C111AFD}: NameServer = 200.14.104.52
O17 - HKLM\System\CCS\Services\Tcpip\..\{C8251B19-0829-4DE7-A328-13C700A78A6F}: NameServer = 200.14.104.52
O17 - HKLM\System\CS1\Services\Tcpip\..\{22688B9C-E25B-4179-AA48-BFB6A2CA63D9}: NameServer = 200.14.104.52
O20 - AppInit_DLLs: dxclib303562752.dll
O20 - Winlogon Notify: A3dxq - C:\WINDOWS\System32\a3dxq.dll
O20 - Winlogon Notify: ddcddaw - C:\WINDOWS\SYSTEM32\ddcddaw.dll
O20 - Winlogon Notify: mallocator - C:\WINDOWS\
O20 - Winlogon Notify: wineek32 - C:\WINDOWS\SYSTEM32\wineek32.dll
O20 - Winlogon Notify: winsys2freg - C:\Documents and Settings\All Users\Documents\Settings\winsys2f.dll
O20 - Winlogon Notify: wvurs - C:\WINDOWS\System32\wvurs.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ahnlab Task Scheduler - AhnLab, Inc. - C:\Program Files\Ahnlab\Smart Update Utility\Ahnsdsv.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Common Files\AOL\AOL Spyware Protection\\aolserv.exe (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Client IP-IPX - Unknown owner - C:\WINDOWS\
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MonSvcNT - Ahnlab, Inc. - C:\Program Files\Ahnlab\V3\MonSvcNT.EXE
O23 - Service: reco service (QRECOM) - Unknown owner - C:\Program Files\QRECO\App\SQCORE.exe (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 16491 bytes

[Mr_JAk3]

Hello swingnat :)

You have a HUGE amount of infections there :fear:

Also one or more of the identified infections is a backdoor trojan :sick:

This allows hackers to remotely control your computer, steal critical system information and Download and Execute files

I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the infection has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud? (http://www.dslreports.com/faq/10451)
When Should I Format, How Should I Reinstall (http://www.dslreports.com/faq/10063)

I can help you in the cleaning if you don't want to reformat but there is a possibility that we can't get you 100% clean.

Please let us know what you have decided to do in your next post:bigthumb:

[swingnat]

Thanks for the response. I am going to restore.

[Mr_JAk3]

Hi again, I'll respect you decicion to do a clean install.

Please make sure that you know what to do before beginning the operation.

Here are a few links that propably help.

Reformatting Windows XP by wng_z3r0 (http://spyware-free.us/tutorials/reformat/mainnopics.html)
When should I re-format? How should I reinstall? (http://www.dslreports.com/faq/10063)
Windows XP Clean install (http://windowsxp.mvps.org/XPClean.htm)

Then there are a couple of things you should do immediately after installing Windows and before surfing the net... Install an antivirus and firewall (you should download and have those on a CD or USB drive, all ready to be installed).

These are good (free) firewalls:
- Kerio (http://www.sunbelt-software.com/Kerio.cfm)
- Sygate (http://http://www.majorgeeks.com/download.php?det=3356)
- Outpost (http://www.majorgeeks.com/download.php?det=1056)

These are good (free) antiviruses:
- Antivir (http://www.free-av.com)
- Avast (http://www.avast.com)
- AVG (http://free.grisoft.com)

Get all Windows updates installed!
Please ask me if you have any questions :)

Then here are a few things that you can do in order to make your fresh computer more secure:
Use ATF Cleaner (http://www.atribune.org/ccount/click.php?id=1)
Download and install ATF Cleaner. Clean your temporary files & folders with it regularly.

Use Ad-Aware (http://www.bleepingcomputer.com/forums/?showtutorial=48)
Download and install Ad-Aware. Update it and scan your computer regularly with it.

Use Ewido (http://www.ewido.net/en/)
Update it and scan your computer regularly with it.

Use Spybot S&D (http://www.bleepingcomputer.com/forums/?showtutorial=43)
Download and install Spybot S&D. Update it and scan your computer regularly with it.

Install SpywareBlaster (http://www.javacoolsoftware.com/spywareblaster.html)
SpywareBlaster will prevent spyware from being installed.

Install MVPS Hosts file (http://mvps.org/winhelp2002/hosts.htm)
This prevents your computer from connecting to harmful sites.

Use Firefox browser (http://www.mozilla.org)
Firefox is faster, safer and better browser than Internet Explorer.

Keep your systen up-to-date (http://windowsupdate.microsoft.com)
Visit Windows Update regularly.

Keep your antivirus and firewall up-to-date
Scan your computer regularly with your antivirus.

Read this article by TonyKlein (http://castlecops.com/postlite7736-.html)
So how did I get infected in the first place?

[tashi]

This topic has been archived.

If you need it re-opened please send me a private message (pm) and provide a link to the thread. Applies only to the original poster, anyone else with similar problems please start a new topic.

Good luck swingnat. :)