Ok, I have done everything you guys have said, and here is what I have in my HijackThis log. Is the trojan or other problems still there? Logfile of HijackThis v1.97.7 Scan saved at 7:55:37 PM, on 1/22/2004 Platform: Windows 2000 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINNT\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashserv.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\Explorer.exe C:\Program Files\WMPCI54G WLAN Monitor\WMP54G.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINNT\CSRSS.exe C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\RAM Idle LE\RAM_XP.exe C:\program files\umsd tools2.33\umsd.exe C:\Program Files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe C:\Program Files\Ahead\InCD\InCD.exe C:\Program Files\Microsoft Hardware\Keyboard\type32.exe C:\WINNT\loadqm.exe C:\DOCUME~1\cody1\LOCALS~1\Temp\ztv1\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = O2 - BHO: (no name) - {014DA6 - (no file) O2 - BHO: (no name) - {014DA6C - (no file) O2 - BHO: (no name) - {06 - (no file) O2 - BHO: (no name) - {068 - (no file) O2 - BHO: (no name) - {0684 - (no file) O2 - BHO: (no name) - {06849 - (no file) O2 - BHO: (no name) - {06849E - (no file) O2 - BHO: (no name) - {06849E9 - (no file) O2 - BHO: (no name) - {06849E9F - (no file) O2 - BHO: (no name) - {06849E9F- - (no file) O2 - BHO: (no name) - {06849E9F-C - (no file) O2 - BHO: (no name) - {06849E9F-C8 - (no file) O2 - BHO: (no name) - {06849E9F-C8D - (no file) O2 - BHO: (no name) - {06849E9F-C8D7 - (no file) O2 - BHO: (no name) - {06849E9F-C8D7- - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4 - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D5 - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59 - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59- - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B8 - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87 - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D- - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-7 - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-78 - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784 - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7 - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6B - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0 - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3 - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {3F0 - (no file) O2 - BHO: (no name) - {3F07 - (no file) O2 - BHO: (no name) - {3F070 - (no file) O2 - BHO: (no name) - {3F0700 - (no file) O2 - BHO: (no name) - {3F0700C - (no file) O2 - BHO: (no name) - {3F0700CA - (no file) O2 - BHO: (no name) - {3F0700CA- - (no file) O2 - BHO: (no name) - {3F0700CA-4 - (no file) O2 - BHO: (no name) - {3F0700CA-43 - (no file) O2 - BHO: (no name) - {3F0700CA-43D - (no file) O2 - BHO: (no name) - {3F0700CA-43D9 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9- - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-4 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1- - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F2 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21- - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21-0 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21-04 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21-048 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21-0488 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21-04880 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21-048803 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21-048803E - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21-048803ED - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21-048803ED6 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21-048803ED6A - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21-048803ED6A2 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21-048803ED6A23 - (no file) O2 - BHO: (no name) - {6 - (no file) O2 - BHO: (no name) - {65 - (no file) O2 - BHO: (no name) - {65C - (no file) O2 - BHO: (no name) - {65C8 - (no file) O2 - BHO: (no name) - {65C8C - (no file) O2 - BHO: (no name) - {65C8C1 - (no file) O2 - BHO: (no name) - {65C8C1F - (no file) O2 - BHO: (no name) - {65C8C1F5 - (no file) O2 - BHO: (no name) - {65C8C1F5- - (no file) O2 - BHO: (no name) - {65C8C1F5-2 - (no file) O2 - BHO: (no name) - {65C8C1F5-23 - (no file) O2 - BHO: (no name) - {65C8C1F5-230 - (no file) O2 - BHO: (no name) - {65C8C1F5-230E - (no file) O2 - BHO: (no name) - {65C8C1F5-230E- - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4 - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4D - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9 - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9- - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9 - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0 - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D- - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3 - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F31 - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F315 - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159 - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5 - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5E - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5E7 - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5E77 - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5E777 - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5E7778 - (no file) O2 - BHO: (no name) - {6A - (no file) O2 - BHO: (no name) - {6A6 - (no file) O2 - BHO: (no name) - {6A61 - (no file) O2 - BHO: (no name) - {6A615 - (no file) O2 - BHO: (no name) - {6A615B - (no file) O2 - BHO: (no name) - {6A615B8 - (no file) O2 - BHO: (no name) - {6A615B83 - (no file) O2 - BHO: (no name) - {6A615B83- - (no file) O2 - BHO: (no name) - {6A615B83-8 - (no file) O2 - BHO: (no name) - {6A615B83-89 - (no file) O2 - BHO: (no name) - {6A615B83-899 - (no file) O2 - BHO: (no name) - {6A615B83-8995 - (no file) O2 - BHO: (no name) - {6A615B83-8995- - (no file) O2 - BHO: (no name) - {6A615B83-8995-4 - (no file) O2 - BHO: (no name) - {6A615B83-8995-4F - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3 - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3- - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-A - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5 - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C- - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C-F - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C-F4 - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C-F43 - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C-F437 - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C-F4373 - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C-F43731 - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C-F43731C - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C-F43731CF - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C-F43731CFD - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C-F43731CFD6 - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C-F43731CFD60 - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C-F43731CFD60A - (no file) O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: (no name) - {80E81A0E-9741-4FBC-8EE3-3B78C04ADA1D} - (no file) O3 - Toolbar: (no name) - {2CF0B992-5EEB-4143-99C0-5297EF71F444} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [WMLAN54G.exe] C:\Program Files\WMPCI54G WLAN Monitor\WMP54G.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [CSRSS] C:\WINNT\CSRSS.exe O4 - HKLM\..\Run: [ToPicks Starter] C:\Program Files\ToPicks\Bin\Idhost.exe O4 - HKLM\..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Bsx3] RunDLL32.exe C:\WINNT\bs3.dll,DllRun O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [RAM Idle Professional] C:\Program Files\RAM Idle LE\RAM_XP.exe O4 - HKLM\..\Run: [PLoader] c:\program files\umsd tools2.33\umsd.exe sys_auto_run C:\Program Files\UMSD Tools2.33 O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\\NeroCheck.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe" O4 - HKLM\..\Run: [LoadQM] loadqm.exe O8 - Extra context menu item: &Define - C:\WINNT\Web\ERS_DEF.HTM O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Search the Web - C:\WINNT\Web\ERS_SRC.HTM O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Look Up in &Encyclopedia - C:\WINNT\Web\ERS_ENC.HTM O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: AIM (HKLM) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://active.macromedia.com/director/cabs/sw.cab O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.142/code/PWActiveXImgCtl.CAB O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.0) - O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0) - O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab O16 - DPF: {E6D5237D-A6C7-4C83-A67F-F9F15586FA62} - http://www.spyblast.com/download/SBFull.cab O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab

0

Hi Yes it look's like you removed peper sucessfully however we do have several other malware problems to take care of. The first thing we need to do is place hijack in its own folder c:\hijackthis\hijackthis.exe because it makes backups of what we remove and if run from the temporary folder recovery is not possible if a mistake is made. ToPicks is spyware and will track you where you browse online, push ads and popups during browsing sessions. Go to add/remove programs in the control panel, scroll down the list until you find "ToPicks", click it and click the remove button. Start HijackThis and check the following items, close all browser windows and explorer windows, click "fix checked" All 02 items ending in -(no file) O3 - Toolbar: (no name) - {80E81A0E-9741-4FBC-8EE3-3B78C04ADA1D} - (no file) O3 - Toolbar: (no name) - {2CF0B992-5EEB-4143-99C0-5297EF71F444} - (no file) O4 - HKLM\..\Run: [ToPicks Starter] C:\Program Files\ToPicks\Bin\Idhost.exe (if still present) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.0) - O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0) - O16 - DPF: {E6D5237D-A6C7-4C83-A67F-F9F15586FA62} - http://www.spyblast.com/download/SBFull.cab Reboot the computer and delete the following: c:\program files\ToPicks <-this folder Post a new log to this thread. There is still some work to do, I am researching the best procedures for the rest of the cleanup.

0

Still some cleaning required. The first thing we need to do is extract Hijackthis to it's own folder, C:\Hijackthis,then run it from that folder without doing this we have no means of recovery should a mistake occur. Close all browser and explorer windows and have Hijackthis fix the following by putting a tick in the box next to them and hitting the 'Fix Checked' button. O2 - BHO: (no name) - {014DA6 - (no file) O2 - BHO: (no name) - {014DA6C - (no file) O2 - BHO: (no name) - {06 - (no file) O2 - BHO: (no name) - {068 - (no file) O2 - BHO: (no name) - {0684 - (no file) O2 - BHO: (no name) - {06849 - (no file) O2 - BHO: (no name) - {06849E - (no file) O2 - BHO: (no name) - {06849E9 - (no file) O2 - BHO: (no name) - {06849E9F - (no file) O2 - BHO: (no name) - {06849E9F- - (no file) O2 - BHO: (no name) - {06849E9F-C - (no file) O2 - BHO: (no name) - {06849E9F-C8 - (no file) O2 - BHO: (no name) - {06849E9F-C8D - (no file) O2 - BHO: (no name) - {06849E9F-C8D7 - (no file) O2 - BHO: (no name) - {06849E9F-C8D7- - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4 - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D5 - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59 - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59- - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B8 - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87 - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D- - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-7 - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-78 - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784 - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7 - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6B - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0 - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3 - (no file) O2 - BHO: (no name) - {3F0 - (no file) O2 - BHO: (no name) - {3F07 - (no file) O2 - BHO: (no name) - {3F070 - (no file) O2 - BHO: (no name) - {3F0700 - (no file) O2 - BHO: (no name) - {3F0700C - (no file) O2 - BHO: (no name) - {3F0700CA - (no file) O2 - BHO: (no name) - {3F0700CA- - (no file) O2 - BHO: (no name) - {3F0700CA-4 - (no file) O2 - BHO: (no name) - {3F0700CA-43 - (no file) O2 - BHO: (no name) - {3F0700CA-43D - (no file) O2 - BHO: (no name) - {3F0700CA-43D9 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9- - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-4 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1- - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F2 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21- - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21-0 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21-04 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21-048 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21-0488 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21-04880 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21-048803 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21-048803E - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21-048803ED - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21-048803ED6 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21-048803ED6A - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21-048803ED6A2 - (no file) O2 - BHO: (no name) - {3F0700CA-43D9-45C1-8F21-048803ED6A23 - (no file) O2 - BHO: (no name) - {6 - (no file) O2 - BHO: (no name) - {65 - (no file) O2 - BHO: (no name) - {65C - (no file) O2 - BHO: (no name) - {65C8 - (no file) O2 - BHO: (no name) - {65C8C - (no file) O2 - BHO: (no name) - {65C8C1 - (no file) O2 - BHO: (no name) - {65C8C1F - (no file) O2 - BHO: (no name) - {65C8C1F5 - (no file) O2 - BHO: (no name) - {65C8C1F5- - (no file) O2 - BHO: (no name) - {65C8C1F5-2 - (no file) O2 - BHO: (no name) - {65C8C1F5-23 - (no file) O2 - BHO: (no name) - {65C8C1F5-230 - (no file) O2 - BHO: (no name) - {65C8C1F5-230E - (no file) O2 - BHO: (no name) - {65C8C1F5-230E- - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4 - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4D - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9 - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9- - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9 - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0 - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D- - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3 - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F31 - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F315 - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159 - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5 - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5E - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5E7 - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5E77 - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5E777 - (no file) O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5E7778 - (no file) O2 - BHO: (no name) - {6A - (no file) O2 - BHO: (no name) - {6A6 - (no file) O2 - BHO: (no name) - {6A61 - (no file) O2 - BHO: (no name) - {6A615 - (no file) O2 - BHO: (no name) - {6A615B - (no file) O2 - BHO: (no name) - {6A615B8 - (no file) O2 - BHO: (no name) - {6A615B83 - (no file) O2 - BHO: (no name) - {6A615B83- - (no file) O2 - BHO: (no name) - {6A615B83-8 - (no file) O2 - BHO: (no name) - {6A615B83-89 - (no file) O2 - BHO: (no name) - {6A615B83-899 - (no file) O2 - BHO: (no name) - {6A615B83-8995 - (no file) O2 - BHO: (no name) - {6A615B83-8995- - (no file) O2 - BHO: (no name) - {6A615B83-8995-4 - (no file) O2 - BHO: (no name) - {6A615B83-8995-4F - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3 - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3- - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-A - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5 - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C- - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C-F - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C-F4 - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C-F43 - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C-F437 - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C-F4373 - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C-F43731 - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C-F43731C - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C-F43731CF - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C-F43731CFD - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C-F43731CFD6 - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C-F43731CFD60 - (no file) O2 - BHO: (no name) - {6A615B83-8995-4FD3-AD5C-F43731CFD60A - (no file) O3 - Toolbar: (no name) - {80E81A0E-9741-4FBC-8EE3-3B78C04ADA1D} - (no file) O3 - Toolbar: (no name) - {2CF0B992-5EEB-4143-99C0-5297EF71F444} - (no file) O4 - HKLM\..\Run: [CSRSS] C:\WINNT\CSRSS.exe O4 - HKLM\..\Run: [ToPicks Starter] C:\Program Files\ToPicks\Bin\Idhost.exe O16 - DPF: {E6D5237D-A6C7-4C83-A67F-F9F15586FA62} - http://www.spyblast.com/download/SBFull.cab reboot then find and delete these files and folders C:\Program Files\ ToPicks <----folder C:\WINNT\ CSRSS.exe <-----file Then post a fresh Hijackthis log.

0

my turn to apologise, blender. :-(

0

Thats ok mark2a...I see you got the one I was not sure on how to handle...the: c:\winnt\csrss.exe Thanks!

0

Ok, here is the new log. Everything seems to be running really good now. Am I able to delete all the back ups I made from HiJackThis? Thanks. Logfile of HijackThis v1.97.7 Scan saved at 4:00:23 PM, on 1/24/2004 Platform: Windows 2000 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINNT\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashserv.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\Explorer.exe C:\Program Files\WMPCI54G WLAN Monitor\WMP54G.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\RAM Idle LE\RAM_XP.exe C:\program files\umsd tools2.33\umsd.exe C:\Program Files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe C:\Program Files\Ahead\InCD\InCD.exe C:\Program Files\Microsoft Hardware\Keyboard\type32.exe C:\WINNT\loadqm.exe C:\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [WMLAN54G.exe] C:\Program Files\WMPCI54G WLAN Monitor\WMP54G.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Bsx3] RunDLL32.exe C:\WINNT\bs3.dll,DllRun O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [RAM Idle Professional] C:\Program Files\RAM Idle LE\RAM_XP.exe O4 - HKLM\..\Run: [PLoader] c:\program files\umsd tools2.33\umsd.exe sys_auto_run C:\Program Files\UMSD Tools2.33 O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\\NeroCheck.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe" O4 - HKLM\..\Run: [LoadQM] loadqm.exe O8 - Extra context menu item: &Define - C:\WINNT\Web\ERS_DEF.HTM O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Search the Web - C:\WINNT\Web\ERS_SRC.HTM O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Look Up in &Encyclopedia - C:\WINNT\Web\ERS_ENC.HTM O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: AIM (HKLM) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://active.macromedia.com/director/cabs/sw.cab O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.142/code/PWActiveXImgCtl.CAB O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.0) - O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0) - O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab

0

You can clear the backups now if you want, personally, I'd leave it for a few days for safety once sure everything is running correctly, I'd then delete them. Visit http://forums.net-integration.net/index.php?showtopic=3051 to find out how to help prevent further problems. Happy surfing. :-)

0

My friend accidentally installed this thing while I was sleeping. Now that I'm trying to pick up the pieces, it says that Soy734V2.exe and Upws.exe don't exist. Help!!

0