crunchie: as per your suggestions....

[Aries4]

What, if anything, can you see wrong here. Been having a hard time booting up IE, Windows Explorer, My Computer, Control Panel, etc. after reboot or restart. Thanks in advance!

Here is my HiJack Log:

Logfile of HijackThis v1.99.1
Scan saved at 9:00:50 PM, on 5/30/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5346.0005)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Lexmark 3300 Series\lxccmon.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\lxcccoms.exe
C:\Program Files\MSN\MSNCoreFiles\msn.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\SpyOnThis\SpyOnThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\SpyOnThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.excite.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Link...cid={SUB_CLCID}
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;127.0.0.1;<local>
F2 - REG:system.ini: Shell=
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [lxccmon.exe] "C:\Program Files\Lexmark 3300 Series\lxccmon.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [LXCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll,_RunDLLEntry@16
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Search - http://ka.bar.need2find.com/KA/menusearch.html?p=KA
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.com/Controls/Rovio...liate=LASVEGAS
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/mini...ransporter.cab?
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://gamesoduser.comcast.net/classes/ExentCtl.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1126384698750
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://floridakeysmedia.tv/axiscam/C...CamControl.ocx
O16 - DPF: {928626A3-6B98-11CF-90B4-00AA00A4011F} (SurroundVideoCtrl Object) - http://www.homesteadhotels.com/minis...d/MSSurVid.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/14...2/cpbrkpie.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewor...o.cab34246.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yaho...tocomplete.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O16 - DPF: {FC0A65F2-8DFF-4F0F-B411-D4A50311628D} (XMRADIO.XM_SystemProfiler) - http://xmro.xmradio.com/xstream/regi...xmprofiler.CAB
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/...ampx_en_dl.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxcccoms.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

[crunchie]

Can you please do the following.

===============

Scan with HiJackThis, then check(tick) the following, if present:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

F2 - REG:system.ini: Shell=
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe

O8 - Extra context menu item: &Search - http://ka.bar.need2find.com/KA/menusearch.html?p=KA

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)

O11 - Options group: [INTERNATIONAL] International*

O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/mini...ransporter.cab?
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/14...2/cpbrkpie.cab

Now, close all instances of Internet Explorer and any other windows you have open except HiJackThis, click "Fix checked".

===============

Reboot.

===============

To help protect your system from hostile ActiveX content, or special 'downloadable' files:

Download, install and keep updated, SpywareBlaster. If you've installed it for the first time:

1) Check for any available updates; if present, they'll be automatically downloaded and installed.
2) Next, "Enable all protection".
3) Exit the program.

-

Note: Remember to regularly check for updates.

===============

Please download the trial version of Ewido anti-malware here:
http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Do NOT run a scan yet.
Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.com/support/safemode.shtml

Once in Safe Mode, please run Ewido, and do a full scan. During the scan it will prompt you to clean files, click OK.

Save the logfile from the scan. Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.

[Aries4]

after having IE and Windows Expl. start-up problems, as well as excessive pop-up problems, I did HiJack, SpywareBlaster and Ewido. Here are the results if you could take a quick review. Thanks!

Logfile of HijackThis v1.99.1
Scan saved at 9:37:26 PM, on 6/7/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Ewido anti-malware\ewidoctrl.exe
C:\Program Files\Ewido anti-malware\ewidoguard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Lexmark 3300 Series\lxccmon.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ScanSoft\OmniPage15.0\Opware15.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\ScanSoft\OmniPage15.0\OpAgent.exe
C:\Program Files\AIM95\aim.exe
C:\WINDOWS\system32\lxcccoms.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HiJack\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.excite.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;127.0.0.1;<local>
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [lxccmon.exe] "C:\Program Files\Lexmark 3300 Series\lxccmon.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [LXCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [Opware15] "C:\Program Files\ScanSoft\OmniPage15.0\Opware15.exe"
O4 - HKLM\..\Run: [OpScheduler] "C:\Program Files\ScanSoft\OmniPage15.0\OpScheduler.exe"
O4 - HKLM\..\Run: [ScanSoft OmniPage 15.0-reminder] "C:\Program Files\ScanSoft\OmniPage15.0\Ereg\ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\OmniPage15.0\Ereg\ereg.ini"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [OpAgent] "C:\Program Files\ScanSoft\OmniPage15.0\OpAgent.exe" /agent
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI9191~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI9191~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.com/Controls/Rovion.cab?affiliate=LASVEGAS
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://gamesoduser.comcast.net/classes/ExentCtl.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1126384698750
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://floridakeysmedia.tv/axiscam/Codebase/AxisCamControl.ocx
O16 - DPF: {928626A3-6B98-11CF-90B4-00AA00A4011F} (SurroundVideoCtrl Object) - http://www.homesteadhotels.com/minisite/accommodations/surround/MSSurVid.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O16 - DPF: {FC0A65F2-8DFF-4F0F-B411-D4A50311628D} (XMRADIO.XM_SystemProfiler) - http://xmro.xmradio.com/xstream/registration/dell/xmprofiler.CAB
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\Ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\Ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxcccoms.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------
+ Created on: 9:32:44 PM, 6/7/2006
+ Report-Checksum: BBCC253D
+ Scan result:
HKLM\SOFTWARE\Classes\CLSID\{4DA4616D-7E6E-4FD9-A2D5-B6C535733E22} -> Adware.Generic : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{68FF9E0F-2E96-4467-87FA-1A8B9734C7E7} -> Adware.SpyBlocs : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objecta\{4da4616d-7e6e-4fd9-a2d5-b6c535733e22} -> Adware.Generic : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4da4616d-7e6e-4fd9-a2d5-b6c535733e22} -> Adware.Generic : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Euroclick : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Specificclick : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Realcastmedia : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Tacoda : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen hansel@blindscom.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen hansel@bzresults.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen hansel@cbs.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen hansel@chefscatalog.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [EMAIL="hansel@com"]hansel@com[/EMAIL][2].txt -> TrackingCookie.Com : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Overture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Overture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Overture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][1].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Karen Hansel\Cookies\karen [e-mail][2].txt -> TrackingCookie.Esomniture : Cleaned with backup

[crunchie]

Your hijackthis log looks ok. Has Ewido fixed the popups?

PS. Please reply in this thread and not start a new one :).

[Aries4]

Actually when I first rebooted in regular mode everything started right up perfectly. BUt, when I only had Windows Explorer opened, an IE window opened with a pop-up from a SpyWare advertiser. That pop-up advertiser seemed to have been the first that started it all and has been the most frequent the whole time. The first PU says "you may have spyware -- download our product." When I close that window, another pops-up that looks like a Windows error box that says "are you sure? you may be infected. click OK to download." I close that window without downloading and a third IE window comes up telling me that downloading has commenced! Luckily, the IE security settings block the download and I can close that window.

From then on, I haven't seemed to have had anymore pop-ups. I planned to give it a day and see if it happens to my wife while she uses the computer while I'm at work. I'll let you know.

Regardless, all of the other glitches and problems have stopped completely and I can't thank you enough for the fix and software suggestions!

[crunchie]

Ok. Keep me posted :).

[Aries4]

well, the pop-ups are back in force! primarily from a company called sysprotect.com telling me my computer "may be infected." No, really? You think? But if I download their program all will be right with the world again. Needless to say, I haven't done that. Other pop-ups come up less frequently but they will always be related to the topic of whatever real webpage I am on at the time (i.e., travel, finance, books, etc.)

Help! any further ideas?

Thanks in advance!

[crunchie]

Another hijackthis log please.

[Aries4]

here's the latest:

Logfile of HijackThis v1.99.1
Scan saved at 1:41:10 PM, on 6/17/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Ewido anti-malware\ewidoctrl.exe
C:\Program Files\Ewido anti-malware\ewidoguard.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Lexmark 3300 Series\lxccmon.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ScanSoft\OmniPage15.0\Opware15.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\ScanSoft\OmniPage15.0\OpAgent.exe
C:\Program Files\AIM95\aim.exe
C:\WINDOWS\system32\lxcccoms.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HiJack\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.excite.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;127.0.0.1;<local>
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [lxccmon.exe] "C:\Program Files\Lexmark 3300 Series\lxccmon.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [LXCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [Opware15] "C:\Program Files\ScanSoft\OmniPage15.0\Opware15.exe"
O4 - HKLM\..\Run: [OpScheduler] "C:\Program Files\ScanSoft\OmniPage15.0\OpScheduler.exe"
O4 - HKLM\..\Run: [ScanSoft OmniPage 15.0-reminder] "C:\Program Files\ScanSoft\OmniPage15.0\Ereg\ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\OmniPage15.0\Ereg\ereg.ini"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [OpAgent] "C:\Program Files\ScanSoft\OmniPage15.0\OpAgent.exe" /agent
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI9191~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI9191~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.com/Controls/Rovion.cab?affiliate=LASVEGAS
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://gamesoduser.comcast.net/classes/ExentCtl.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1126384698750
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://floridakeysmedia.tv/axiscam/Codebase/AxisCamControl.ocx
O16 - DPF: {928626A3-6B98-11CF-90B4-00AA00A4011F} (SurroundVideoCtrl Object) - http://www.homesteadhotels.com/minisite/accommodations/surround/MSSurVid.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O16 - DPF: {FC0A65F2-8DFF-4F0F-B411-D4A50311628D} (XMRADIO.XM_SystemProfiler) - http://xmro.xmradio.com/xstream/registration/dell/xmprofiler.CAB
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\Ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\Ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxcccoms.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

[crunchie]

Just try this for me please;

Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will shutdown your computer, click OK.
• Turn your computer back on.
• Please post the contents of C:\vundofix.txt and a new HijackThis log.

==

Run hijackthis and hit the Open the Misc Tools Section and then the Open Uninstall Manager.

Then hit the Save List button. Save to the desktop for easy access. Open the log file and copy the entire list and paste it here please.

===========

Copy the bold text below and paste it into notepad. Save it to your desktop as find.bat and make sure type is set to All Files.

cd\
cd Program Files
DIR /AD /B /P > ProgramFiles.txt
start ProgramFiles.txt
cls
exit

Double click find.bat and let it run for a minute. It will open up a report in notepad. Please copy that text and post it here in your next reply.

[Aries4]

OK, here's the stuff:

VundoFix:
VundoFix V4.2.84
Checking Java version...
Java version is 1.4.2.5
Java version is 1.5.0.2
Java version is 1.5.0.6
Scan started at 6:00:37 PM 6/18/2006
Listing files found while scanning....

C:\WINDOWS\system32\klkkj.bak1
C:\WINDOWS\system32\klkkj.bak2
C:\WINDOWS\system32\klkkj.tmp
C:\WINDOWS\system32\klkkj.ini
C:\WINDOWS\system32\klkkj.ini2
C:\WINDOWS\system32\jkklk.dll
C:\WINDOWS\system32\klkkj.ini2
C:\WINDOWS\system32\klkkj.bak2
C:\WINDOWS\system32\klkkj.tmp
C:\WINDOWS\system32\klkkj.ini
C:\WINDOWS\system32\klkkj.ini2
C:\WINDOWS\system32\jkklk.dll
Attempting to delete C:\WINDOWS\system32\klkkj.bak1
C:\WINDOWS\system32\klkkj.bak1 Has been deleted!
Attempting to delete C:\WINDOWS\system32\klkkj.bak2
C:\WINDOWS\system32\klkkj.bak2 Has been deleted!
Attempting to delete C:\WINDOWS\system32\klkkj.tmp
C:\WINDOWS\system32\klkkj.tmp Has been deleted!
Attempting to delete C:\WINDOWS\system32\klkkj.ini
C:\WINDOWS\system32\klkkj.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\klkkj.ini2
C:\WINDOWS\system32\klkkj.ini2 Has been deleted!
Attempting to delete C:\WINDOWS\system32\jkklk.dll
C:\WINDOWS\system32\jkklk.dll Has been deleted!
Performing Repairs to the registry.
Done!

Uninstall_List:
ABBYY FineReader 6.0 Sprint
Ad-Aware SE Personal
Adobe Acrobat 6.0 Standard
Adobe Atmosphere Player for Acrobat and Adobe Reader
Adobe Download Manager 2.0 (Remove Only)
Adobe Reader 7.0.8
AOL Instant Messenger
ArcSoft Camera Suite 2.1
Broadcom 440x 10/100 Integrated Controller
Canon Camera Support Core Library
Canon Camera Window for ZoomBrowser EX
Canon MovieEdit Task for ZoomBrowser EX
Canon PhotoRecord
Canon RAW Image Task for ZoomBrowser EX
Canon RemoteCapture Task for ZoomBrowser EX
Canon Utilities PhotoStitch 3.1
ccCommon
Dell ResourceCD
DivX
DivX Player
DivX Web Player
ewido anti-malware
Google Earth
HijackThis 1.99.1
Hotfix for Windows XP (KB896344)
Hotfix for Windows XP (KB915865)
ICQ
Intel(R) 537EP V9x DF PCI Modem
Intel(R) Extreme Graphics Driver
InterActual Player
Internet Worm Protection
J2SE Runtime Environment 5.0 Update 2
J2SE Runtime Environment 5.0 Update 6
Java 2 Runtime Environment, SE v1.4.2_05
Lexmark 3300 Series
Lexmark Fax Solutions
Linksys Wireless-G USB Network Adapter
LiveReg (Symantec Corporation)
LiveUpdate 3.0 (Symantec Corporation)
Macromedia Flash Player 8
Macromedia Shockwave Player
Microsoft Money 2004
Microsoft Money 2004 System Pack
Microsoft Office 2000 SR-1 Professional
Microsoft Office Excel Viewer 2003
Microsoft Office Professional Edition 2003
Microsoft Picture It! Library 9
Microsoft Picture It! Photo Premium 9
Microsoft User-Mode Driver Framework Feature Pack 1.0.0 (Pre-Release 5348)
Microsoft Word 2002
Microsoft Works
Microsoft Works 2004 Setup Launcher
Microsoft Works Suite Add-in for Microsoft Word
MSN
MSN Encarta Plus Support Files
MSN Messenger 7.5
MSN Music Assistant
Norton AntiVirus 2005
Norton AntiVirus 2005 (Symantec Corporation)
Norton AntiVirus Help
Norton AntiVirus Parent MSI
Norton AntiVirus SCSSDist MSI
Norton AntiVirus SYMLT MSI
Norton WMI Update
Official Guide To J. Michael Straczynski's Babylon 5
Photo Explosion SE 2.0
PowerDVD
QuickTime
RealArcade
RealPlayer
ScanSoft OmniPage 15.0
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918439)
Shockwave
Sonic DLA
Sonic RecordNow!
Sonic Update Manager
SoundMAX
SPBBC
SpyOnThis 1.1
SpywareBlaster v3.5.1
Symantec
Symantec Script Blocking Installer
SymNet
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB900930)
Update for Windows XP (KB904942)
Update for Windows XP (KB910437)
URGE
Viewpoint Manager (Remove Only)
Viewpoint Media Player
Windows Genuine Advantage v1.3.0254.0
Windows Installer 3.1 (KB893803)
Windows Installer 3.1 (KB893803)
Windows Installer Clean Up
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB887797
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Service Pack 2
WinRAR archiver
XLS Converter 1.5.8

HiJackThis Log:
Logfile of HijackThis v1.99.1
Scan saved at 6:09:54 PM, on 6/18/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Lexmark 3300 Series\lxccmon.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ScanSoft\OmniPage15.0\Opware15.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\ScanSoft\OmniPage15.0\OpAgent.exe
C:\Program Files\AIM95\aim.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Ewido anti-malware\ewidoctrl.exe
C:\Program Files\Ewido anti-malware\ewidoguard.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\lxcccoms.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HiJack\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.excite.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;127.0.0.1;<local>
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {D2AE2239-AE28-42A7-808D-C38D7BE2F963} - C:\WINDOWS\system32\jkklk.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [lxccmon.exe] "C:\Program Files\Lexmark 3300 Series\lxccmon.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [LXCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [Opware15] "C:\Program Files\ScanSoft\OmniPage15.0\Opware15.exe"
O4 - HKLM\..\Run: [OpScheduler] "C:\Program Files\ScanSoft\OmniPage15.0\OpScheduler.exe"
O4 - HKLM\..\Run: [ScanSoft OmniPage 15.0-reminder] "C:\Program Files\ScanSoft\OmniPage15.0\Ereg\ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\OmniPage15.0\Ereg\ereg.ini"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [OpAgent] "C:\Program Files\ScanSoft\OmniPage15.0\OpAgent.exe" /agent
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI9191~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI9191~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.com/Controls/Rovion.cab?affiliate=LASVEGAS
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://gamesoduser.comcast.net/classes/ExentCtl.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1126384698750
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://floridakeysmedia.tv/axiscam/Codebase/AxisCamControl.ocx
O16 - DPF: {928626A3-6B98-11CF-90B4-00AA00A4011F} (SurroundVideoCtrl Object) - http://www.homesteadhotels.com/minisite/accommodations/surround/MSSurVid.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O16 - DPF: {FC0A65F2-8DFF-4F0F-B411-D4A50311628D} (XMRADIO.XM_SystemProfiler) - http://xmro.xmradio.com/xstream/registration/dell/xmprofiler.CAB
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\Ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\Ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxcccoms.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Find.bat Log:
Abbyy FineReader 6.0 Sprint
Adobe
AIM95
America Online 9.0
Analog Devices
AOD
ArcSoft
AWS
Broadcom
Canon
CCChat
Common Files
ComPlus Applications
CyberLink
Design Science
directx
DivX
Ewido anti-malware
Google
HighMAT CD Writing Wizard
HiJack
ICQ
ICQLite
ICQToolbar
InstallShield Installation Information
Intel
InterActual
Internet Explorer
Java
Lavasoft
Lexmark 3300 Series
Lexmark Fax Solutions
Linksys Wireless-G USB Wireless Network Monitor
Lx_cats
MasterSplitter
Messenger
Microsoft ActiveSync
microsoft frontpage
Microsoft Money
Microsoft Office
Microsoft Office2k3
Microsoft Picture It! 9
Microsoft Visual Studio
Microsoft Works
Microsoft Works Suite 2004
Movie Maker
MSN
MSN Apps
MSN Gaming Zone
MSN Messenger
MsnMusic
MTV Networks
MUSICMATCH
NetMeeting
Norton AntiVirus
Nova Development
OfficeUpdate11
Online Services
Outlook Express
Plus!
QuickTime
Real
ScanSoft
ScreenMates
Snapshot Viewer
Sonic
Splitter
SpyOnThis
SpywareBlaster
Symantec
SymNetDrv
Uninstall Information
VideoLAN
Viewpoint
Windows Installer Clean Up
Windows Media Player
Windows NT
WindowsUpdate
WinRAR
WinZip
xerox
Yahoo!
yEnc32
Zero G Registry

Thanks for taking the pains to look through all this!

[crunchie]

How are the popups now? Looks like it was Vundo causing them.

Can you please do the following.

===============

Scan with HiJackThis, then check(tick) the following, if present:

O2 - BHO: (no name) - {D2AE2239-AE28-42A7-808D-C38D7BE2F963} - C:\WINDOWS\system32\jkklk.dll (file missing)

Now, close all instances of Internet Explorer and any other windows you have open except HiJackThis, click "Fix checked".

===============

After rebooting, rescan with hijackthis and post back a new log.

[Aries4]

I got rid of that BHO and here's the newest log. There haven't been any pop-ups since I ran the vundo:

Logfile of HijackThis v1.99.1
Scan saved at 12:47:25 PM, on 6/24/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Ewido anti-malware\ewidoctrl.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\lxcccoms.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Lexmark 3300 Series\lxccmon.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ScanSoft\OmniPage15.0\Opware15.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\ScanSoft\OmniPage15.0\OpAgent.exe
C:\Program Files\AIM95\aim.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HiJack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.excite.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;127.0.0.1;<local>
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Symantec NetDriver Monitor]
C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common
Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [lxccmon.exe] "C:\Program Files\Lexmark 3300
Series\lxccmon.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax
Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
Shared\ccApp.exe"
O4 - HKLM\..\Run: [LXCCCATS] rundll32
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft
Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [Opware15] "C:\Program
Files\ScanSoft\OmniPage15.0\Opware15.exe"
O4 - HKLM\..\Run: [OpScheduler] "C:\Program
Files\ScanSoft\OmniPage15.0\OpScheduler.exe"
O4 - HKLM\..\Run: [ScanSoft OmniPage 15.0-reminder] "C:\Program
Files\ScanSoft\OmniPage15.0\Ereg\ereg.exe" -r "C:\Documents and Settings\All
Users\Application Data\ScanSoft\OmniPage15.0\Ereg\ereg.ini"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe"
-atboottime
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe"
/background
O4 - HKCU\..\Run: [OpAgent] "C:\Program
Files\ScanSoft\OmniPage15.0\OpAgent.exe" /agent
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat
6.0\Distillr\acrotray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MI9191~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} -
C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} -
C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
C:\PROGRA~1\MI9191~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program
Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} -
C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) -
http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner
Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage
Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) -
http://www.rovion.com/Controls/Rovion.cab?affiliate=LASVEGAS
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
http://gamesoduser.comcast.net/classes/ExentCtl.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb
_site.cab?1126384698750
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) -
http://floridakeysmedia.tv/axiscam/Codebase/AxisCamControl.ocx
O16 - DPF: {928626A3-6B98-11CF-90B4-00AA00A4011F} (SurroundVideoCtrl Object)
- http://www.homesteadhotels.com/minisite/accommodations/surround/MSSurVid.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF}
(MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) -
http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) -
http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) -
http://chat.msn.com/bin/msnchat45.cab
O16 - DPF: {FC0A65F2-8DFF-4F0F-B411-D4A50311628D} (XMRADIO.XM_SystemProfiler)
- http://xmro.xmradio.com/xstream/registration/dell/xmprofiler.CAB
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) -
http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} -
"C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} -
C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation -
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation
- C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation -
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program
Files\Ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel
32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation -
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: lxcc_device - Lexmark International, Inc. -
C:\WINDOWS\system32\lxcccoms.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec
Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) -
Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton
AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation -
C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec
Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation -
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program
Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

[crunchie]

All looks good to me now. Somehow though the formatting of the log has changed and it is harder to read.