Detecting new files created, but not the creator

Nod32 2.5, updated 4/13/06

I was plagued with Baidu Bar before January. But I thought I was able to get it cleaned. I have Microsoft AntiSpyware installed, and just recently, beginning on April 6th, my home URL has been trying to change to , Microsoft detects and prevents it, but I want the files that are trying to make it do that, gone.

Nod32 is detecting two things as well.

~snip~ Links to possible malware removed - Ron

4/13/2006 20:24:11 AMON file C:\Documents and Settings\-------\Local Settings\Temporary Internet Files\Content.IE5\8XGHOV83\mputoo[1].exe a variant of Win32/TrojanDownloader.QQHelper trojan quarantined - deleted ----- Event occurred on a new file created by the application: C:\WINDOWS\Explorer.EXE. The file was moved to quarantine. You may close this window.

4/13/2006 20:24:05 AMON file C:\WINDOWS\SYSTEM32\WBEM\setup7.exe a variant of Win32/TrojanDownloader.QQHelper trojan quarantined - deleted ----- Event occurred on a new file created by the application: C:\WINDOWS\Explorer.EXE. The file was moved to quarantine. You may close this window.

4/13/2006 20:23:35 IMON self-extracting archive a variant of Win32/TrojanDownloader.QQHelper trojan -----

From the above logs, it seems my browser is randomly going out and redownloading QQHelper trojan. Then explorer tries to open it and run it and Nod32 detects, quarantines and deletes it?

Any suggestions?

ESET's Nod32 (A,D,E,IMON all active), Microsoft AntiSpyware (All Checkpoints Active), Javacoolsoftware's Spyware Blaster (All Protection Enabled) are all I run. I use Firefox 1.5 on XP Pro SP2.

 

Please send a log from Hijackthis (http://216.180.233.162/~merijn/files/HijackThis.exe) to support[at]eset.com with a link to this thread.

 

Done.

 

Bump?

 

Ehm, didn't you get a reply by email? PM me the email address you sent it from.

 

Your inbox is too full.

 

Another Baidu component not caught by Nod32?

Just found this in my services.

http://img207.imageshack.us/img207/1999/b8py.th.jpg

C:\WINDOWS\SYSTEM32\RUNDLL32.EXE C:\WINDOWS\SYSTEM32\WBEM\IRJIT.DLL,Export 1087

http://img214.imageshack.us/img214/7205/c1ya.th.jpg

C:\WINDOWS\System32\svchost.exe -k netsvcs