You have some entries there that need removing.
===============
Please visit at least two of the following sites for an online virus scan:
BitDefender Free Online Virus Scan
http://www.bitdefender.com/scan/licence.php
Make sure you tick AutoClean under Scan Options.
Panda ActiveScan
http://www.pandasoftware.com/activescan/com/activescan_principal.htm
Make sure you tick Disinfect automatically under Scan Options.
Housecall at TrendMicro
http://housecall.trendmicro.com/housecall/start_corp.asp
Make sure you tick Auto Clean.
eTrust Antivirus Web Scanner
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
==
Open a command prompt by going to the start menu and then select 'Run'.
In the box that pops up type in 'cmd'. The command prompt will open.
OR
You can go to Start -> Programs -> Accessories -> Command Prompt. Unregister the dll(s) we're going to remove, by entering the following:
regsvr32 /u cxtpls.dll
It's ok, if these aren't found or 'error' out. If you want, just copy and paste the individual lines to the command prompt to save typing them in.
===============
Let's look for, and delete, any program segments (prefetches) that might be present, and are associated with the 'problems' we're trying to remove from your PC. To do this, let's:
1) Click "Start | Search", then search for each of these program's base name(s), in all files and folders:
ntvexec.exe*
nwwedia.exe*
CxtPls.exe*
2) Then if any are found in the 'prefetch' folder, delete them.
Look closely, since the 'base' name will have a bunch of random numbers and letters attached to it.
===============
Run HiJackThis then:
1. Click "Open the Misc Tools Section"
2. Click "Open Process manager"
-
Next, while holding down the CTRL key, locate (if present) and click on (highlight) each of the following:
G:\WINDOWS\System32\ntvexec.exe
G:\WINDOWS\System32\nwwedia.exe
G:\WINDOWS\system32\94D.tmp
C:\Program Files\Aprps\CxtPls.exe
Now double-check and make sure that only those item(s) above are highlighted, then click "Kill process". Now, click "Refresh", check again, and repeat this step if any remain.
===============
Still in HiJackThis, click "Scan", then check(tick) the following, if present:
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - G:\WINDOWS\cfgmgr52.dll (file missing)
O2 - BHO: (no name) - {016235BE-59D4-4CEB-ADD5-E2378282A1D9} - C:\Program Files\Aprps\cxtpls.dll
O2 - BHO: ohb - {9ADE0443-2AB2-4B23-A3F8-AC520773DE12} - G:\WINDOWS\System32\nse2F.dll (file missing)
O4 - HKLM\..\Run: [Services] G:\WINDOWS\system32\94D.tmp
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE G:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [version] G:\WINDOWS\System32\Uzsmtk.exe
O4 - HKLM\..\Run: [4F4Q3ti] nwwedia.exe
O4 - HKCU\..\Run: [Windows-XP-Service-Pack] xpspz.exe
O4 - HKCU\..\Run: [Lov4RjGFj] ntvexec.exe
O4 - HKCU\..\RunServices: [Windows-XP-Service-Pack] xpspz.exe
O9 - Extra button: Microsoft AntiSpyware helper - {D6F92D2B-C454-4554-8863-F9D809E53568} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {D6F92D2B-C454-4554-8863-F9D809E53568} - (no file) (HKCU)
O23 - Service: Windows lsass Service (lsass) - Unknown owner - G:\WINDOWS\lsass.exe
O23 - Service: ssdfghjkl - Unknown owner - G:\WINDOWS\netddf.exe
Now, close all instances of Internet Explorer and any other windows you have open except HiJackThis, click "Fix checked".
===============
Locate and delete the following item(s), if present. Make sure you are able to view system and hidden files/ folders:
folders...
C:\Program Files\Aprps
files...
G:\WINDOWS\System32\ntvexec.exe
G:\WINDOWS\System32\nwwedia.exe
G:\WINDOWS\system32\94D.tmp
G:\WINDOWS\cfgmgr52.dll
G:\WINDOWS\System32\Uzsmtk.exe
G:\WINDOWS\lsass.exe
G:\WINDOWS\netddf.exe
Search for...
xpspz.exe
...using "Start | Search...".
-
Note that some of these file(s)/folder(s) may or may not be present. If present, and cannot be deleted because they're 'in use', try deleting them in " Safe Mode ".
-
Reboot.
===============
After rebooting, rescan with hijackthis and post back a new log. Please let me know how your pc is now.
==
I cannot find any information on this file:
G:\WINDOWS\tsecure.exe
Please find it and right click on it. Choose Properties. Click the version tab and get the manufacturer and original filename please. Maybe that will give a clue.
