Hi everyone.. I've this problem that my computer doesn,t stop downloading..! I used NortanAntiVirus recently, and it found an infected file "C:\Windows\System32\lexbac.exe" with a downloader.trojan... I deleted this file and later I've did some checking with Spybot, Ad-Aware with their latest updates.. Nothing found...! But whenever I connect to the net, my computer won,t stop downloading... I really need some help.. :( Here's a log of my HiJack Scan.. Logfile of HijackThis v1.97.7 Scan saved at 12:41:15, on 18/01/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\DRIVERS\CDANTSRV.exe C:\WINDOWS\system32\drivers\dcfssvc.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\pctspk.exe C:\Program Files\Speed Disk\nopdb.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\RunDll32.exe C:\PROGRA~1\NORTON~2\navapw32.exe C:\WINDOWS\System32\carpserv.exe C:\WINDOWS\System32\SxgTkBar.exe C:\Program Files\Internet Explorer\iexplore.exe D:\Programs\HijackThis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.freeserve.com:8080 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank O1 - Hosts: 212.33.69.3 js1.hitbox.com O1 - Hosts: 212.33.69.3 stats.hitbox.com O1 - Hosts: 212.33.69.3 pagead2.googlesyndication.com O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~2\navapw32.exe O4 - HKLM\..\Run: [CountrySelection] pctptt.exe O4 - HKLM\..\Run: [CARPService] carpserv.exe O4 - HKLM\..\Run: [SxgTkBar] SxgTkBar.exe O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: ICQ Pro (HKLM) O9 - Extra 'Tools' menuitem: ICQ (HKLM) O9 - Extra button: ICQ Lite (HKLM) O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM) O9 - Extra button: Real.com (HKLM) O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38002.0938773148 O17 - HKLM\System\CCS\Services\Tcpip\..\{6BAB998F-393F-4A8B-A7EF-2FA9DC846D21}: NameServer = 195.92.195.94 195.92.195.95 O17 - HKLM\System\CS1\Services\Tcpip\..\{6BAB998F-393F-4A8B-A7EF-2FA9DC846D21}: NameServer = 195.92.195.94 195.92.195.95 Thanks for all your help

Download and run cwshredder, click "fix" to clean. Let me know how it works out, then we can try something else. cwshredder.zip cwshredder.exe abnormal

Hi abnormal.. AS you've said, I've downloaded cwshredder and it said that my computer was totally clear.. ? I'm really gonna get nuts... :)

Your not nuts, I may be soon. Fix these lines and reboot; O1 - Hosts: 212.33.69.3 js1.hitbox.com O1 - Hosts: 212.33.69.3 stats.hitbox.com O1 - Hosts: 212.33.69.3 pagead2.googlesyndication.com You may have something new, try above. Let me know if it helped.

Ok.. I'll do that now.. By the way... When I look at the Running Prosseses on the Task Manager, I've got files like "lsass.exe" "csrss.exe" and "smss.exe" .. and I've read somewhere that those files are result of some viruses.. but when I delete those files, windows won't start.. ? Do you think these contain some sort of viruses..?

Nothing in the run lines pointed to a problem. You can try a freee online scan. http://housecall.trendmicro.com/ Post another log when your done.

Hi buddy, Take a look at http://support.microsoft.com?kbid=816093 You may try to install the latest updates, especially the ones for MS VM BEST OF LUCK