fatpickle?

Comments

• Crunchie Mandurah. Western Australia. Member

  October 2005 edited October 2005

  I do not subscribe to that school of thought regarding running HJT in safe mode. It is less likely that the malware will show up in safe mode.
  
  ==
  
  Can you please do the following.
  
  ===============
  
  Go to Add/Remove programs and remove(uninstall) the following, if present:
  
  MyWebSearch
  
  The above could appear anywhere within the entry. Be careful not to remove any personal or system software.
  
  ===============
  
  Run HiJackThis, click "Scan", then check(tick) the following, if present:
  
  
  R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.s1s1s1search.com/sp2.php
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
  
  R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
  
  O4 - HKLM\..\Run: [6af3d681e073] C:\WINDOWS\system32\cmsetACL.exe
  O4 - Global Startup: Digital Line Detect.lnk = ?
  
  O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZRfox000
  
  
  Now, close all instances of Internet Explorer and any other windows you have open except HiJackThis, click "Fix checked".
  
  ===============
  
  Locate and delete the following item(s), if present. Make sure you are able to view system and hidden files/ folders:
  
  files...
  
  C:\WINDOWS\system32\cmsetACL.exe
  
  -
  
  Note that some of these file(s)/folder(s) may or may not be present. If present, and cannot be deleted because they're 'in use', try deleting them in "Safe Mode".
  
  -
  
  Reboot.
  
  ===============
  
  After rebooting, rescan with hijackthis and post back a new log. Please let me know how your pc is now.

  0
• technochris81

  October 2005 edited October 2005

  still can't delete fatpickle
  
  noticed one of the deleted ones came back
  
  ********************************************
  
  Logfile of HijackThis v1.99.1
  Scan saved at 10:36:15 AM, on 10/26/2005
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
  C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
  C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
  C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\LEXBCES.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\LEXPPS.EXE
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
  C:\WINDOWS\system32\tcpsvcs.exe
  C:\WINDOWS\wanmpsvc.exe
  C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
  C:\Program Files\Apoint\Apoint.exe
  C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
  C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
  C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
  C:\WINDOWS\system32\dla\tfswctrl.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
  C:\Program Files\Dell Support\DSAgnt.exe
  C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  C:\Program Files\Apoint\Apntex.exe
  C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Trillian\trillian.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Documents and Settings\Chris\Desktop\Hijack This!.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
  O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
  O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
  O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
  O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
  O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: America Online 7.0 Tray Icon.lnk = C:\Program Files\America Online 7.0\aoltray.exe
  O4 - Global Startup: dlbcserv.lnk = C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
  O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
  O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
  O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1129259348775
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1129374520640
  O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37370.cab
  O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
  O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
  O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
  O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
  O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
  O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

  0
• Crunchie Mandurah. Western Australia. Member

  October 2005 edited October 2005

  Please download FileFind from Atribune:
  http://www.atribune.org/downloads/FileFind.zip
  
  Unzip the file and save it to your desktop.
  
  To run FileFind, please do the following:
  
  * Click on FileFind.exe
  * In the box labeled "Enter the directory to search"
  o Enter Drive eg.. C:\
  * In the box labeled "Enter the file to search"
  o Enter the file or use *.(file extention) to search for the file(s)
  * Now click on the "Find" button
  * Once the utility has found the files click on "Export"
  * This will save a text file to your C:\ drive as "Export.txt"
  * Double click on Export.txt, copy and paste this information in your next post.
  
  fatpickle is the one to input.
  
  Post back the results.If you know the full path already, skip that.

  0
• technochris81

  October 2005 edited October 2005

  C:\Program Files\Fatpickle Toolbar - 0 Bytes
  C:\Program Files\Fatpickle Toolbar\fatpickle.crc - 100 Bytes
  
  i deleted the "fatpickle toolbar" folder and another suspicious looking "freeprod toolbar" folder that was right next to it.
  
  i also tried to again remove fatpickle from my add/remove programs list. it still just flashes a little brief hourglass.
  
  i also did a "fatpickle" search in the regedit and found about 50 or so matches.
  
  -so that's one issue-
  
  the other issue is this file that you told me to delete that came back on HJT:
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
  
  thanks a bunch for your help so far,
  -chris

  0
• Crunchie Mandurah. Western Australia. Member

  October 2005 edited October 2005

  Create a restore point.
  
  
  Click Start > Run > Type or copy & paste regedit. The registry editor will open.
  Then go to;HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall and delete the fatpickle entry in the right hand pane.
  
  ==
  
  Go here http://www.billsway.com/vbspage/ and download, unzip and run the Registry Search Tool. Type fatpickle in the dialog box. Let it run and after a few minutes, a prompt will appear. Click OK to write the results to Notepad and post them here.

  0
• technochris81

  October 2005 edited October 2005

  i was able to remove the registry entries for fatpickle until the registry search tool found no entries.
  fatpickle is also gone from the add/remove list.
  the main reason i wanted to get rid of fatpickle, was because i thought it was responsible for the random IE popups i get when i don't even have any browser open at all.
  i've researched all the running processes and all of the entries under startup in msconfig and none of them are suspicious.
  i still see "myway" entries in the registry though.
  and i don't know if this is the cause.
  i used the registry search tool to look for "myway".
  below are the results.
  
  *********************************************
  
  REGEDIT4
  ; RegSrch.vbs © Bill James
  
  ; Registry search results for string "myway" 10/28/2005 10:11:46 AM
  
  ; NOTE: This file will be deleted when you close WordPad.
  ; You must manually save this file to a new location if you want to refer to it again later.
  ; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)
  
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\MyWaySearchAssistantDE]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
  "C:\\Program Files\\MyWaySA\\SrchAsDe\\"=""
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
  "C:\\Program Files\\MyWaySA\\"=""
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B40BC6C649F2F7C4687C4B3131C6A7D3]
  "7D449D87B79A4004BAA05BDA60389904"="C:\\Program Files\\MyWaySA\\SrchAsDe\\deSrcAs.dll"
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\7D449D87B79A4004BAA05BDA60389904\InstallProperties]
  "Publisher"="MyWay.com"
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{78D944D7-A97B-4004-AB0A-B5AD06839940}]
  "Publisher"="MyWay.com"
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\MyWaySA]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\MyWaySA\SearchAssistantDE]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\MyWaySA\SearchAssistantDE]
  "Dir"="C:\\Program Files\\MyWaySA\\SrchAsDe\\"
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main]
  "First Home Page"="http://www.dell4me.com/myway"
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main]
  "Default_Page_URL"="http://www.dell4me.com/myway"
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main]
  "Start Page"="http://www.dell4me.com/myway"
  
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main]
  "Search Bar"="http://bfc.myway.com/search/de_srchlft.html"
  
  [HKEY_USERS\.DEFAULT\Software\MyWaySA]
  
  [HKEY_USERS\.DEFAULT\Software\MyWaySA\SearchAssistantDE]
  
  [HKEY_USERS\S-1-5-21-313187058-2185590998-1978285008-1006\Software\GIANTCompany\AntiSpyware\Alerts\C8458BD4-F26C-413B-AB2A-22B605]
  "StringData2"="http://www.dell4me.com/myway"
  
  [HKEY_USERS\S-1-5-21-313187058-2185590998-1978285008-1006\Software\MyWaySA]
  
  [HKEY_USERS\S-1-5-21-313187058-2185590998-1978285008-1006\Software\MyWaySA\SearchAssistantDE]
  
  [HKEY_USERS\S-1-5-21-313187058-2185590998-1978285008-1006\Software\MyWaySA\SearchAssistantDE]
  "ABS"="http://mysearch.myway.com/jsp/cfg_redir2.jsp?id=DE&psa=npl.GdlG0lG9yTmWFOiSKA&url=http://mysearch.myway.com/jsp/barsearch.jsp&st=kwd&ptnrS=DE&PG=SEASUSH&SEC=ABMANY&searchfor="
  
  [HKEY_USERS\S-1-5-21-313187058-2185590998-1978285008-1006\Software\MyWaySA\SearchAssistantDE]
  "DES"="http://mysearch.myway.com/jsp/cfg_redir2.jsp?id=DE&psa=npl.GdlG0lG9yTmWFOiSKA&url=http://mysearch.myway.com/jsp/barsearch.jsp&st=dns&ptnrS=DE&PG=SEASUSH&SEC=DNS&searchfor="
  
  [HKEY_USERS\S-1-5-21-313187058-2185590998-1978285008-1006\Software\Neuber GbR\Security Task Manager\Cache]
  "C:\\Program Files\\MyWaySA\\SrchAsDe\\1.bin\\deSrcAs.dll"="32"
  
  [HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main]
  "First Home Page"="http://www.dell4me.com/myway"
  
  [HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main]
  "Default_Page_URL"="http://www.dell4me.com/myway"
  
  [HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main]
  "Start Page"="http://www.dell4me.com/myway"
  
  [HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main]
  "Search Bar"="http://bfc.myway.com/search/de_srchlft.html"
  
  [HKEY_USERS\S-1-5-18\Software\MyWaySA]
  
  [HKEY_USERS\S-1-5-18\Software\MyWaySA\SearchAssistantDE]

  0
• Crunchie Mandurah. Western Australia. Member

  October 2005 edited October 2005

  If you have any entries in add or remove programs for MyWay, Mywebsearch or Mysearch, uninstall them.
  Set a system restore point and delete those entries you found. Dell has been installing this on their PC's for a while.
  Here is a good read regarding this;
  
  http://castlecops.com/t135256-Dell_MyWay_Discussion.html
  
  There is an option somewhere on the PC to uninstall this, but I cannot remember where it is nor what it's called. It may tell you in that discussion.

  0
• technochris81

  October 2005 edited October 2005

  -i made a restore point
  -i used the registry seach tool
  -i found and deleted all instances of myway, mywebsearch, & mysearch with the registry
  -i restarted my computer
  -i searched under all 3 again and found zero instances
  -i'm still getting popups
  
  thanks again for your help,
  -chris

  0
• Crunchie Mandurah. Western Australia. Member

  October 2005 edited October 2005

  Go to Start/Run and type in services.msc and locate the messenger service.
  Stop the service and then disable it. See if the pop ups stop.

  0
• technochris81

  October 2005 edited October 2005

  that was already disabled.
  
  -chris

  0
• Crunchie Mandurah. Western Australia. Member

  October 2005 edited October 2005

  Run hijackthis and hit the Open the Misc Tools Section and then the Open Uninstall Manager.
  
  Then hit the Save List button. Save to the desktop for easy access. Open the log file and copy the entire list and paste it here please.
  
  ===========
  
  Copy the bold text below and paste it into notepad. Save it to your desktop as find.bat and make sure type is set to All Files.
  
  
  cd\
  cd Program Files
  DIR /AD /B /P > ProgramFiles.txt
  start ProgramFiles.txt
  cls
  exit
  
  
  Double click find.bat and let it run for a minute. It will open up a report in notepad. Please copy that text and post it here in your next reply.
  
  ==
  
  Go here and download then run Silent Runners.vbs. It generates a log, please post the information back in this thread.
  If you have a script blocking program, please allow the file to run. It is not malicious.

  0
• technochris81

  October 2005 edited October 2005

  the post was too big. i had to put it in an attachment.

  THREAD.txt 280K

  0
• Crunchie Mandurah. Western Australia. Member

  October 2005 edited October 2005

  Go to add or remove programs and uninstall InetGet2 if there. Go to your Program Files folder and delete the InetGet2 folder.
  Also uninstall AdwareAlert and delete the folder from Program Files, as false positives are given to entice you to purchase it. http://www.spywarewarrior.com/rogue_anti-spyware.htm
  Also uninstall MyWaySA and delete the folder from Program Files.
  Spybot is out of date. Install the latest version. 1.4
  
  The silent runners came out wrong. Go back to my link and try right clicking on the file and select 'Save As.' Save it to the desktop. Now run it again. It will create a log after a couple of minutes. The log will appear wherever you are running silent runners from.

  0
• technochris81

  October 2005 edited October 2005

  so you wanted me to delete ad-aware from the add/remove list too? (i already did. i was just wondering if it was safe to download it again. the false positives thing i don't completely understand.)
  
  V silent runners below V
  **********************************************
  
  "Silent Runners.vbs", revision 41, http://www.silentrunners.org/
  Operating System: Windows XP SP2
  Output limited to non-default values, except where indicated by "{++}"
  
  
  Startup items buried in registry:

  ---

  
  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
  "Apoint" = "C:\Program Files\Apoint\Apoint.exe" ["Alps Electric Co., Ltd."]
  "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
  "nwiz" = "nwiz.exe /installquiet" ["NVIDIA Corporation"]
  "SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" ["Sun Microsystems, Inc."]
  "IntelWireless" = "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless" ["Intel Corporation"]
  "DVDLauncher" = ""C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"" ["CyberLink Corp."]
  "ISUSPM Startup" = "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup" ["InstallShield Software Corporation"]
  "ISUSScheduler" = ""C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start" ["InstallShield Software Corporation"]
  "dla" = "C:\WINDOWS\system32\dla\tfswctrl.exe" ["Sonic Solutions"]
  "QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
  "AVG7_CC" = "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP" ["GRISOFT, s.r.o."]
  "AVG7_EMC" = "C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe" ["GRISOFT, s.r.o."]
  "TkBellExe" = ""C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]
  "gcasServ" = ""C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"" [MS]
  
  HKLM\Software\Microsoft\Active Setup\Installed Components\
  >{881dd1c5-3dcf-431b-b061-f3f88e8be88a}\(Default) = "Outlook Express"
  \StubPath = "C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigOE" [MS]
  {8b15971b-5355-4c82-8c07-7e181ea07608}\(Default) = "Fax"
  \StubPath = "rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.UnInstall.PerUser" [MS]
  {94de52c8-2d59-4f1b-883e-79663d2d9a8c}\(Default) = "Fax Provider"
  \StubPath = "rundll32.exe C:\WINDOWS\system32\Setup\FxsOcm.dll,XP_UninstallProvider" [MS]
  
  HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
  {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]
  
  HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
  "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension"
  -> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
  "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
  "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}" = "Directory Query UI"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\dsquery.dll" [MS]
  "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}" = "DfsShell"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\dfsshlex.dll" [MS]
  "{60fd46de-f830-4894-a628-6fa81bc0190d}" = "%DESC_PublishDropTarget%"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\photowiz.dll" [MS]
  "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}" = "MMC Icon Handler"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\mmcshext.dll" [MS]
  "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}" = ".CAB file viewer"
  -> {CLSID}\InProcServer32\(Default) = "cabview.dll" [MS]
  "{8DD448E6-C188-4aed-AF92-44956194EB1F}" = "Windows Media Player Play as Playlist Context Menu Handler"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\wmpshell.dll" [MS]
  "{1D2680C9-0E2A-469d-B787-065558BC7D43}" = "Fusion Cache"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\mscoree.dll" [MS]
  "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
  "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
  "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
  "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
  "{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
  "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
  "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
  "{955B7B84-5308-419c-8ED8-0B9CA3C56985}" = "America Online"
  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\aolshare\shell\us\shellext.dll" ["America Online, Inc."]
  "{5464D816-CF16-4784-B9F3-75C0DB52B499}" = "Yahoo! Mail"
  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\Yahoo!\Common\ymmapi.dll" ["Yahoo! Inc."]
  "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
  "{5CA3D70E-1895-11CF-8E15-001234567890}" = "DriveLetterAccess"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\dla\tfswshx.dll" ["Sonic Solutions"]
  "{e57ce731-33e8-4c51-8354-bb4de9d215d1}" = "Universal Plug and Play Devices"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\upnpui.dll" [MS]
  "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
  "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}" = "Channel File"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\cdfview.dll" [MS]
  "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension"
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
  "{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension"
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
  "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]
  
  HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
  INFECTION WARNING! "{9EF34FF2-3396-4527-9D27-04C8C1C67806}" = "Microsoft AntiSpyware Service Hook"
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft AntiSpyware\shellextension.dll" [MS]
  
  HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
  INFECTION WARNING! IntelWireless\DLLName = "C:\Program Files\Intel\Wireless\Bin\LgNotify.dll" ["Intel Corporation"]
  
  HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
  AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
  WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
  Yahoo! Mail\(Default) = "{5464D816-CF16-4784-B9F3-75C0DB52B499}"
  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\Yahoo!\Common\ymmapi.dll" ["Yahoo! Inc."]
  
  HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
  WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
  
  HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
  AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
  WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
  
  
  Active Desktop and Wallpaper:

  ---

  
  Active Desktop is disabled at this entry:
  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
  
  HKCU\Control Panel\Desktop\
  "Wallpaper" = "C:\Documents and Settings\Chris\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"
  
  
  Enabled Screen Saver:

  ---

  
  HKCU\Control Panel\Desktop\
  "SCRNSAVE.EXE" = "C:\WINDOWS\system32\ss3dfo.scr" [MS]
  
  
  Startup items in "Chris" & "All Users" startup folders:

  ---

  
  C:\Documents and Settings\All Users\Start Menu\Programs\Startup
  "dlbcserv" -> shortcut to: "C:\Program Files\Dell Photo Printer 720\dlbcserv.exe" [null data]
  
  
  Winsock2 Service Provider DLLs:

  ---

  
  Namespace Service Providers
  
  HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
  000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
  000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
  000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
  000000000004\LibraryPath = "C:\WINDOWS\system32\pnrpnsp.dll" [MS]
  000000000005\LibraryPath = "C:\WINDOWS\system32\pnrpnsp.dll" [MS]
  
  Transport Service Providers
  
  HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
  0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
  %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 28
  %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05
  
  
  Toolbars, Explorer Bars, Extensions:

  ---

  
  Explorer Bars
  
  HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
  {FE54FA40-D68C-11D2-98FA-00C0F0318AFE}\ = "Real.com" [from CLSID]
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Shdocvw.dll" [MS]
  
  Extensions (Tools menu items, main toolbar menu buttons)
  
  HKLM\Software\Microsoft\Internet Explorer\Extensions\
  {CD67F990-D8E9-11D2-98FE-00C0F0318AFE}\
  "ButtonText" = "Real.com"
  
  {FB5F1910-F110-11D2-BB9E-00C04F795683}\
  "ButtonText" = "Messenger"
  "MenuText" = "Windows Messenger"
  "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]
  
  
  Running Services (Display Name, Service Name, Path {Service DLL}):

  ---

  
  AVG7 Alert Manager Server, Avg7Alrt, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe" ["GRISOFT, s.r.o."]
  AVG7 Update Service, Avg7UpdSvc, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe" ["GRISOFT, s.r.o."]
  EvtEng, EvtEng, "C:\Program Files\Intel\Wireless\Bin\EvtEng.exe" ["Intel Corporation"]
  HTTP SSL, HTTPFilter, "C:\WINDOWS\System32\svchost.exe -k HTTPFilter" {"C:\WINDOWS\System32\w3ssl.dll" [MS]}
  IPv6 Helper Service, 6to4, "C:\WINDOWS\system32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\6to4svc.dll" [MS]}
  LexBce Server, LexBceS, "C:\WINDOWS\system32\LEXBCES.EXE" ["Lexmark International, Inc."]
  NICCONFIGSVC, NICCONFIGSVC, "C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe" ["Dell Inc."]
  NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
  RegSrvc, RegSrvc, "C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe" ["Intel Corporation"]
  RIP Listener, Iprip, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\iprip.dll" [MS]}
  Simple TCP/IP Services, SimpTcp, "C:\WINDOWS\system32\tcpsvcs.exe" [MS]
  Spectrum24 Event Monitor, S24EventMonitor, "C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe" ["Intel Corporation "]
  WAN Miniport (ATW) Service, WANMiniportService, ""C:\WINDOWS\wanmpsvc.exe"" ["America Online, Inc."]
  WLANKEEPER, WLANKEEPER, "C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe" ["Intel® Corporation"]
  
  
  Print Monitors:

  ---

  
  HKLM\System\CurrentControlSet\Control\Print\Monitors\
  Dell Network Port\Driver = "LEXLMPM.DLL" ["Lexmark International, Inc."]
  
  

  ---

  + This report excludes default entries except where indicated.
  + To see *everywhere* the script checks and *everything* it finds,
  launch it from a command prompt or a shortcut with the -all parameter.
  + The search for DESKTOP.INI DLL launch points on all local fixed drives
  took 78 seconds.
  + The search for all Registry CLSIDs containing dormant Explorer Bars
  took 9 seconds.

  ---

  (total run time: 125 seconds)

  0
• Crunchie Mandurah. Western Australia. Member

  October 2005 edited October 2005

  technochris81 wrote:

  so you wanted me to delete ad-aware from the add/remove list too? (i already did. i was just wondering if it was safe to download it again. the false positives thing i don't completely understand.)

  
  Not Adaware, but AdwareAlert. What it does is tell you that you have spyware/malware on your PC, when in fact, you don't. This is meant to encourage you to purchase it.
  
  Not seeing anything bad in that log.

  0
• technochris81

  October 2005 edited October 2005

  this info might help.
  
  i had "security task manager" recommended to me. it keeps finding these things called "process id". i keep quarantining them but they keep coming back with higher numbers after them.
  
  they're always under the same two directories:
  C\:windows\system32\hhaole32.exe
  C\:programfiles\anaadcom\smsledit.exe
  
  hope that helps
  
  thanks again,
  -chris

  0
• Crunchie Mandurah. Western Australia. Member

  November 2005 edited November 2005

  Please go to Jotti's and have those files scanned. Post the results back here.

  0
• technochris81

  November 2005 edited November 2005

  http://virusscan.jotti.org/ couldn't see the files at all. it looked like it was having no problem seeing other hidden files though. the only way i even know the files are there is through "security task manager". if i go hunt for them in the c drive, they're not there at all.
  
  -chris

  0
• Crunchie Mandurah. Western Australia. Member

  November 2005 edited November 2005

  What else is in the C\Programfiles\anaadcom folder? Is there any way you can rename those files? If so, rename them and reboot and see how the pc is.

  0
• technochris81

  November 2005 edited November 2005

  the program files folder doesn't even show an anaadcom folder. i told it to show everything that was hidden and it still wasn't there. i can find it with "security task manager" or "regsrch.vbs". but when i look for it manually, it's not there.
  
  the haaole one goes as far as the systerm32 folder
  
  but the anaadcom one only goes as far as the program files folder.
  
  i hope i'm making sense.

  0
• Crunchie Mandurah. Western Australia. Member

  November 2005 edited November 2005

  Run hijackthis and go to misc tools\delete a file on reboot and enter the full path to the files. If more than 1 file needs to be entered, when asked to reboot, do so only after the last file entered.
  
  C:\windows\system32\hhaole32.exe
  C:\Programfiles\anaadcom\smsledit.exe
  
  After the reboot, check if they still exist.

  0
• technochris81

  November 2005 edited November 2005

  that seemed to do the trick.
  
  i'll get back to you if i get popups again. just leave this thread open for like another week if you can.
  
  thanks a million,
  -chris

  0
• Crunchie Mandurah. Western Australia. Member

  November 2005 edited November 2005

  No worries .

  0
• technochris81

  November 2005 edited November 2005

  yeah they both came back.
  
  :0(

  0
• Crunchie Mandurah. Western Australia. Member

  November 2005 edited November 2005

  Go into safe mode and delete them again. Reboot.
  
  
  Go to Start>Run and type msconfig.
  
  Press enter.
  
  When msconfig opens, click the Launch System Restore Button.
  
  On the next page, click the System Restore Settings link on the left.
  
  Check the box labeled Turn off System restore.
  
  Reboot.
  
  Go back in and turn System Restore Back on. A new Restore Point will be created.
  
  Note that all previous restore points will be lost.

  0
• technochris81

  November 2005 edited November 2005

  they still came back, but their numbers were lower this time, as if they had started all over.
  
  for instance, they were both called process id 1500something before. now they're both around 600something.
  
  thanks for all your help again,
  -chris

  0
• Crunchie Mandurah. Western Australia. Member

  November 2005 edited November 2005

  Go to your Prefetch folder and delete the contents there. Delete those files again, do a system search for just the files without the extension and remove any found.
  Use the file find tool I linked you to earlier.

  0
• technochris81

  November 2005 edited November 2005

  these keep coming back:
  
  [HKEY_USERS\S-1-5-21-313187058-2185590998-1978285008-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*]
  "b"="C:\\smsledit.exe"
  
  [HKEY_USERS\S-1-5-21-313187058-2185590998-1978285008-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe]
  "c"="C:\\smsledit.exe"
  
  [HKEY_USERS\S-1-5-21-313187058-2185590998-1978285008-1006\Software\Microsoft\Windows\ShellNoRoam\MUICache]
  "C:\\PROGRAM FILES\\ANAADCOM\\SMSLEDIT.EXE"="SMSLEDIT"
  
  [HKEY_USERS\S-1-5-21-313187058-2185590998-1978285008-1006\Software\Neuber GbR\Security Task Manager\Cache]
  "C:\\PROGRAM FILES\\ANAADCOM\\SMSLEDIT.EXE"="32"
  
  [HKEY_USERS\S-1-5-21-313187058-2185590998-1978285008-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*]
  "a"="C:\\hhaole32.exe"
  
  [HKEY_USERS\S-1-5-21-313187058-2185590998-1978285008-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe]
  "b"="C:\\hhaole32.exe"
  
  [HKEY_USERS\S-1-5-21-313187058-2185590998-1978285008-1006\Software\Neuber GbR\Security Task Manager\Cache]
  "C:\\WINDOWS\\SYSTEM32\\HHAOLE32.EXE"="32"
  
  **********************************************
  
  the process ids keep coming back too
  
  and so do the prefetch files
  
  thanks again,
  -chris

  0
• Crunchie Mandurah. Western Australia. Member

  November 2005 edited November 2005

  Try deleting those keys manually after setting a system restore point. Also try running these two excellent tools;
  
  Please download the trial version of Ewido Security Suite here:
  http://www.ewido.net/en/download/
  Install it, and update the definitions to the newest files. Do NOT run a scan yet.
  Next, please reboot your computer in Safe Mode by doing the following:
  1) Restart your computer
  2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
  3) Instead of Windows loading as normal, a menu should appear
  4) Select the first option, to run Windows in Safe Mode.
  
  For additional help in booting into Safe Mode, see the following site:
  http://www.pchell.com/support/safemode.shtml
  
  Once in Safe Mode, please run Ewido, and do a full scan. During the scan it will prompt you to clean files, click OK.
  
  Save the logfile from the scan. Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.
  
  ==
  
  Please download WebRoot SpySweeper from HERE (It's a 2 week trial):
  Click the Free Trial link under to "SpySweeper" to download the program.
  Install it. Once the program is installed, it will open.
  It will prompt you to update to the latest definitions, click Yes.
  Once the definitions are installed, click Options on the left side.
  Click the Sweep Options tab.
  Under What to Sweep please put a check next to the following:
  Sweep Memory
  Sweep Registry
  Sweep Cookies
  Sweep All User Accounts
  Enable Direct Disk Sweeping
  Sweep Contents of Compressed Files
  Sweep for Rootkits
  Please UNCHECK Do not Sweep System Restore Folder.
  Click Sweep Now on the left side.
  Click the Start button.
  When it's done scanning, click the Next button.
  Make sure everything has a check next to it, then click the Next button.
  It will remove all of the items found.
  Click Session Log in the upper right corner, copy everything in that window.
  Click the Summary tab and click Finish.
  Paste the contents of the session log you copied into your next reply.

  0
• technochris81

  November 2005 edited November 2005

  i just ended up reforrmatting because i was spending way too much time trying all the different things.
  
  but i still wanted to thank you for all of your help.
  
  -chris

  0