Hi all, I need your help coz I’ m extra extra frustrated. I keep scanning and downloading all updates but the antivirus (F-Prot) finds nothing and so the story goes on. Additionally, I have used Ad-aware 6.0, CWShredder, HijackThis, Spybot S& D, and Registry Mechanic. I got some findings through Spybot but didn’t help at all. The super dubious thing is that at the time I click on Search from the Windows Explorer, nothing happens, which makes me think that I have a virus or whatever similar. It also stops me from downloading F-Prot updates and I have to try several times until I get them although I don’t really know If it gets them or it acts as if. As soon as I connect to the net, I get a major interference by getting interrupted while I type. Then, all of sudden the program I work with becomes inactive and I am switched to another application that I have open without however the window to open at all. To continue working with the program one wants, s/he should click on the application open to activate it again. Meanwhile, it keeps acting as if it's downloading something. Word and Excel do not open anymore.L To top it, I get some other windows like Runtime Microsoft Library C++ error and Automation Error Library not registered. Further, icons like F-Secure Back Web and Java web start (by now it disappeared) change colors and get double or triple. Here's my log just in case anyone has the time and is in the mood to have a look. Logfile of HijackThis v1.97.7 Scan saved at 6:57:50 PM, on 1/30/2004 Platform: Windows 2000 SP3 (WinNT 5.00.2195) MSIE: Internet Explorer v5.00 SP1 (5.00.2920.0000) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.exe C:\WINNT\System32\svchost.exe C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe C:\Program Files\F-Secure\Anti-Virus\FSGK32.exe C:\Program Files\F-Secure\Anti-Virus\fssm32.exe C:\Program Files\WS_FTP Pro\ftpsched.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\mspmspsv.exe C:\WINNT\system32\svchost.exe C:\Program Files\F-Secure\Common\FSMA32.exe C:\Program Files\F-Secure\Common\FSMB32.exe C:\Program Files\F-Secure\Common\FCH32.exe C:\Program Files\F-Secure\Common\FAMEH32.exe C:\WINNT\Explorer.exe C:\Program Files\F-Secure\Common\FNRB32.exe C:\T-ONLINE\BSW4\ToADiMon.exe C:\Program Files\F-Secure\Common\FIH32.exe C:\Program Files\F-Secure\Anti-Virus\fsav32.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\F-Secure\Common\FSM32.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\WINNT\System32\wuauclt.exe C:\Program Files\MSN Messenger\MsnMsgr.exe C:\Program Files\Teledat\IWatch.exe C:\Program Files\Plextor\PlexTool.exe C:\WINNT\system32\ntvdm.exe C:\T-ONLINE\BSW4\ToDuCAlC.exe C:\PROGRA~1\INTERN~1\IEXPLORE.exe C:\Documents and Settings\Administrator\My Documents\HijackThis.exe C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.linksummary.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.linksummary.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.linksummary.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.t-online.de R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer von T-Online R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://searchbar.linksummary.com/ O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM\..\Run: [ToADiMon.exe] C:\T-ONLINE\BSW4\ToADiMon.exe -TOnlineAutodialStart O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.exe" /splash O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.exe" /background O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: ISDNWatch.lnk = C:\Program Files\Teledat\IWatch.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe O4 - Global Startup: PlexTools.lnk = C:\Program Files\Plextor\PlexTool.exe O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll O14 - IERESET.INF: START_PAGE_URL=http://www.t-online.de O17 - HKLM\System\CCS\Services\Tcpip\..\{1078063E-5435-429A-9322-0179CBA8CAD4}: NameServer = 212.185.252.201 194.25.2.129 O17 - HKLM\System\CCS\Services\Tcpip\..\{CB22FF48-2A7A-4AD8-91EA-9B51D9F415F0}: NameServer = 192.168.121.252,192.168.121.253 O17 - HKLM\System\CS1\Services\Tcpip\..\{1078063E-5435-429A-9322-0179CBA8CAD4}: NameServer = 212.185.252.201 194.25.2.129 Anybody any suggestions? Thank you callie

Gutentag Ich spreche nur un bischen duetsch, und deiner anglais es sehr gut also The following is all I view as suspicious and should be checked and fixed. I don't think any of it will solve your problem though sorry R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.linksummary.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.linksummary.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.linksummary.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://searchbar.linksummary.com/ O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe Definitely spyware O4 - Global Startup: PlexTools.lnk = C:\Program Files\Plextor\PlexTool.exe Internet optimizer or so it says, get rid O17 - HKLM\System\CCS\Services\Tcpip\..\{1078063E-5435-429A-9322-0179CBA8CAD4}: NameServer = 212.185.252.201 194.25.2.129 O17 - HKLM\System\CCS\Services\Tcpip\..\{CB22FF48-2A7A-4AD8-91EA-9B51D9F415F0}: NameServer = 192.168.121.252,192.168.121.253 O17 - HKLM\System\CS1\Services\Tcpip\..\{1078063E-5435-429A-9322-0179CBA8CAD4}: NameServer = 212.185.252.201 194.25.2.129 Really not sure about these

Thanx G_B1 the plextool is a sw for a certain hardware I have on and the webshots I use for a number of years as screensaver behind a big intl company's firewall which is really waterproof. Well, unfortunately, you were right that the prob wouldn't be solved. I really get desperate with this situation. I'll give it a shot with the Trend Micro Office Scan and hope it's over. My comp starts getting more and more unstable. :(( Could you think of sth else? Thank you very very much that you took time to look at my log and answer. Callie