Sabertooth, Per your request, here is my log file from HijackThis v1.97.7 Ref: http://www.computing.net/windowsxp/wwwboard/forum/104222.html Logfile of HijackThis v1.97.7 Scan saved at 8:01:01 PM, on 5/10/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\WINDOWS\System32\GEARSEC.exe C:\PROGRA~1\Iomega\System32\AppServices.exe c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Iomega\AutoDisk\ADService.exe C:\WINDOWS\Explorer.exe C:\Program Files\Common files\WinTools\WToolsA.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\Program Files\Sony Handheld\HOTSYNC.exe C:\Program Files\Common files\WinTools\WToolsS.exe C:\Program Files\Common files\WinTools\WSup.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Luis\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ O1 - Hosts: 207.36.196.189 auto.search.msn.com O1 - Hosts: 207.36.196.189 search.netscape.com O1 - Hosts: 207.36.196.189 ieautosearch O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe files\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.exe O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Ad-aware] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-aware.exe" +c O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.exe O9 - Extra button: Control Pad (HKLM) O9 - Extra 'Tools' menuitem: Control Pad (HKLM) O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,81/mcinsctl.cab O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,19/mcgdmgr.cab Greater is HE that is in me, that he that is in the world.

Snake_eyes1, Close all browsers and have HijackThis fix the following: O1 - Hosts: 207.36.196.189 auto.search.msn.com O1 - Hosts: 207.36.196.189 search.netscape.com O1 - Hosts: 207.36.196.189 ieautosearch O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe. Then reboot in safemode and delete C:\Program Files\Common files\WinTools folder. You can also run this to make sure you have no VX2 hiding within your PC. ____________________________ The greatest risk is not taking one

I ran the small applicatin that you asked and it found a couple of files. Do i highlight and delete these files? Greater is HE that is in me, that he that is in the world.

Yep, delete them, and run it again till nothing is found. ____________________________ The greatest risk is not taking one

Sabertooth, I have ran the scan several times. I am able to delete eveything except C\Windows\System32\Azlui.dll. What is this file and is there any other way to delete it? Greater is HE that is in me, that he that is in the world.

You can use the recovery console to delete the file or search for and download MoveOnBoot to remove it. ____________________________ The greatest risk is not taking one

Sabertooth, I have installed the Moveonboot software and I was able to remove the file. Thanks. Would you happen to know what the "Flash Player Debug Console" is. I seem to get this popup window when ever I am in IE. Greater is HE that is in me, that he that is in the world.