Hello, thanks for helping southwestern french (near Bordeaux) XP user. Sory, for my english who’s not really the best you could read… SO since my Norton update was out of order (end of 1st year – OK I’”ve got to do something with this pb), and specially since early january I saw somme “parasite” links coming into my internet favorite links (2 porn links) and on my “desktop” –“bureau” in french- (in that cas it’s “only” 2 links that lead to mortgage or credit sites). Another pb was thefact that NOTEPAD changed its icon and is called “Mediaload” (from Microsoft (R) Mediaload). So with that new notepad I was no longer able to edit a txt file, nothing was happening… My IE6 Default page changed to aboutblank.biz. Spybot didn’t see anything at that time. It wasjust telling me of “aboutblank.biz”, and I tried to restore my www google fr favourite link 3 days ago, I saw acertain number of new phenomenon : - an internet connexion came into my settings, called TIBS41 - a “live cams” link came onto my “desktop” - some fileswere found by spybot (TIBS, ifr.txt, livecams also, I through out these files) - saw also something called “websiteviewer”(I don’t remember where) Well, I searched around the internet community and found examples of the problems I encounter, and it seems that I’ve got at least two pbs : a virus and atrojaan. I saw that you could help me… NOTICE : before re-starting my PC, I set all the about-blnk.biz to www google fr in order to see what is modified at the start. Logfile of HijackThis v1.97.7 Scan saved at 11:24:14, on 30/01/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.exe C:\WINDOWS\System32\nvsvc32.exe C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ahfp.exe C:\WINDOWS\system32\fxssvc.exe C:\WINDOWS\Explorer.exe C:\Applis.BRT\Applis_Utilitaires\Utilitaires Internet\Suivi_conso-\Netcom\Netcom.exe C:\Applis.BRT\Applis_Utilitaires\Utilitaires.winXP\EffaceHistorique\EffaceHistorique.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe C:\Applis.BRT\Applis_Utilitaires\Utilitaires CPU\DTemp(mesure-temp-DD_alertes-possibles)\DTemp.exe C:\Documents and Settings\ADMIN\Menu Démarrer\Programmes\Démarrage\PureText.exe C:\Applis.BRT\Applis_Utilitaires\Utilitaires CPU\VCool_17\VCool.exe C:\Documents and Settings\ADMIN\Mes documents\HijackThis\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.google.fr/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.fr/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.google.fr/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.libertysurf.fr R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.fr/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Liberty Surf - R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.google.fr/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.google.fr/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.fr/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O1 - Hosts: 69.56.223.196 t.rack.cc O1 - Hosts: 69.56.223.196 www.alfa-search.com O1 - Hosts: 69.56.223.196 webcoolsearch.com O1 - Hosts: 69.56.223.196 in.webcounter.cc O1 - Hosts: 69.56.223.196 i-lookup.com O1 - Hosts: 69.56.223.196 www.hand-book.com O1 - Hosts: 69.56.223.196 www.maxxxhosters.com O1 - Hosts: 69.56.223.196 allneedsearch.com O1 - Hosts: 69.56.223.196 nativehardcore.com O1 - Hosts: 69.56.223.196 teen-biz.com O1 - Hosts: 69.56.223.196 tits.hardcore4ever.net O1 - Hosts: 69.56.223.196 best.royalsearch.net O1 - Hosts: 69.56.223.196 default-homepage-network.com O1 - Hosts: 69.56.223.196 xwebsearch.biz O1 - Hosts: 69.56.223.196 www.rightfinder.net O1 - Hosts: 69.56.223.196 www.search-1.net O1 - Hosts: 69.56.223.196 www.searchv.com O1 - Hosts: 69.56.223.196 www.websearch.com O1 - Hosts: 69.56.223.196 mysearchnow.com O1 - Hosts: 69.56.223.196 www.therealsearch.com O1 - Hosts: 69.56.223.196 www.find-itnow.com O1 - Hosts: 69.56.223.196 find.microgirls.com O1 - Hosts: 69.56.223.196 super-spider.com O1 - Hosts: 69.56.223.196 www.searching-the-net.com O1 - Hosts: 69.56.223.196 www.firstbookmark.com O1 - Hosts: 69.56.223.196 just.find-itnow.com O1 - Hosts: 69.56.223.196 www.find-itnow.com O1 - Hosts: 69.56.223.196 qwertysearch123.biz O1 - Hosts: 69.56.223.196 www.search-space.com O1 - Hosts: 69.56.223.196 www.windowws.cc O1 - Hosts: 69.56.223.196 aifind.info O1 - Hosts: 69.56.223.196 www.find4u.net O1 - Hosts: 69.56.223.196 find4u.net O1 - Hosts: 69.56.223.196 www.lookfor.cc O1 - Hosts: 69.56.223.196 www.008i.com O1 - Hosts: 69.56.223.196 www.viewpornkey.com O1 - Hosts: 69.56.223.196 www.hugesearch.net O1 - Hosts: 69.56.223.196 www.novaf---.com O1 - Hosts: 69.56.223.196 www.seznam.cz O1 - Hosts: 69.56.223.196 aifind.cc O1 - Hosts: 69.56.223.196 www.onet.pl O1 - Hosts: 69.56.223.196 teenhqpics.com O1 - Hosts: 69.56.223.196 www.ttjj.com O1 - Hosts: 69.56.223.196 www.search-dot.com O1 - Hosts: 69.56.223.196 www.search-and-go.com O1 - Hosts: 69.56.223.196 www.slotch.com O1 - Hosts: 69.56.223.196 www.2fastsearch.net O1 - Hosts: 69.56.223.196 awebfind.biz O1 - Hosts: 69.56.223.196 www.power-search.info O1 - Hosts: 69.56.223.196 www.naver.com O1 - Hosts: 69.56.223.196 www.daum.net O1 - Hosts: 69.56.223.196 www.ohcorea.com O1 - Hosts: 69.56.223.196 www.hao123.com O1 - Hosts: 69.56.223.196 58q.com O1 - Hosts: 69.56.223.196 www.hotwebsearch.com O1 - Hosts: 69.56.223.196 www.startium.com O1 - Hosts: 69.56.223.196 www.gajai.com O1 - Hosts: 69.56.223.196 www.wazzupnet.com O1 - Hosts: 69.56.223.196 freshvideogals.com O1 - Hosts: 69.56.223.196 www.xgmm.com O1 - Hosts: 69.56.223.196 searchmyrequest.com O1 - Hosts: 69.56.223.196 yourbookmarks.ws O1 - Hosts: 69.56.223.196 wmmse.com O1 - Hosts: 69.56.223.196 link.startmake.com O1 - Hosts: 69.56.223.196 www.boredlife.com O1 - Hosts: 69.56.223.196 approvedlinks.com O1 - Hosts: 69.56.223.196 www.nkvd.us O1 - Hosts: 69.56.223.196 www.8095.com O1 - Hosts: 69.56.223.196 www.dreamwiz.com O1 - Hosts: 69.56.223.196 ie-search.com O1 - Hosts: 69.56.223.196 auto.ie.searchforge.com O1 - Hosts: 69.56.223.196 search.psn.cn O1 - Hosts: 69.56.223.196 www.couldnotfind.com O1 - Hosts: 69.56.223.196 www.iquicksearch.com O1 - Hosts: 69.56.223.196 1-se.com O1 - Hosts: 69.56.223.196 www.spidersearch.com O1 - Hosts: 69.56.223.196 search.ieplugin.com O1 - Hosts: 69.56.223.196 itseasy.us O1 - Hosts: 69.56.223.196 searchbar.findthewebsiteyouneed.com O1 - Hosts: 69.56.223.196 www.searchxl.com O1 - Hosts: 69.56.223.196 www.hotsearchbox.com O1 - Hosts: 69.56.223.196 www.searchforge.com O1 - Hosts: 69.56.223.196 www.omega-search.com O1 - Hosts: 69.56.223.196 searchcentrix.com O2 - BHO: Microsoft Excel - {17DA0C9E-4A27-4ac5-BB75-5D24B8CDB972} - C:\DOCUME~1\ADMIN\APPLIC~1\MICROS~1\Office\Excel10.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Applis.BRT\APPLIS~1\UTILIT~4\SPYBOT~1\SDHelper.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [Netcom] "C:\Applis.BRT\Applis_Utilitaires\Utilitaires Internet\Suivi_conso-\Netcom\Netcom.exe" O4 - HKLM\..\Run: [Efface Historique 2.0] C:\Applis.BRT\Applis_Utilitaires\Utilitaires.winXP\EffaceHistorique\EffaceHistorique.exe -s O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Startup: DTemp.lnk = C:\Applis.BRT\Applis_Utilitaires\Utilitaires CPU\DTemp(mesure-temp-DD_alertes-possibles)\DTemp.exe O4 - Startup: PureText.exe O4 - Startup: VCool.lnk = C:\Applis.BRT\Applis_Utilitaires\Utilitaires CPU\VCool_17\VCool.exe O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: Ouvrir le cadre dans une nouvelle fenêtre - file://C:\WINDOWS\web\nvcadre.html O8 - Extra context menu item: Télécharger en utilisant Download &Express - file://C:\WINDOWS\System32\MetaProducts\Add_Url.htm O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O9 - Extra button: Real.com (HKLM) O9 - Extra button: MoneySide (HKLM) O14 - IERESET.INF: START_PAGE_URL=http://www.libertysurf.fr O15 - Trusted Zone: *.offshoreclicks.com O15 - Trusted Zone: *.teensguru.com O15 - Trusted Zone: *.xxxtoolbar.com O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37622.5975115741 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Hi jimbart, You have a CoolWebSearch hijacker, Download and run CWShredder to remove it. After running CWShredder, run HijackThis again and post the new log. CWShredder

CWS said : Done! Removed from your system: - CWS.Googlems this is the new log : Logfile of HijackThis v1.97.7 Scan saved at 15:19:10, on 30/01/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.exe C:\WINDOWS\System32\nvsvc32.exe C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ahfp.exe C:\WINDOWS\system32\fxssvc.exe C:\Applis.BRT\Applis_Utilitaires\Utilitaires Internet\Suivi_conso-\Netcom\Netcom.exe C:\Applis.BRT\Applis_Utilitaires\Utilitaires.winXP\EffaceHistorique\EffaceHistorique.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe C:\Applis.BRT\Applis_Utilitaires\Utilitaires CPU\DTemp(mesure-temp-DD_alertes-possibles)\DTemp.exe C:\Documents and Settings\ADMIN\Menu Démarrer\Programmes\Démarrage\PureText.exe C:\Applis.BRT\Applis_Utilitaires\Utilitaires CPU\VCool_17\VCool.exe C:\WINDOWS\system32\ntvdm.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\ADMIN\Mes documents\HijackThis\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.google.fr/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.fr/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.google.fr/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.libertysurf.fr R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.fr/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Liberty Surf - R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.google.fr/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.google.fr/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.fr/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Applis.BRT\APPLIS~1\UTILIT~4\SPYBOT~1\SDHelper.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [Netcom] "C:\Applis.BRT\Applis_Utilitaires\Utilitaires Internet\Suivi_conso-\Netcom\Netcom.exe" O4 - HKLM\..\Run: [Efface Historique 2.0] C:\Applis.BRT\Applis_Utilitaires\Utilitaires.winXP\EffaceHistorique\EffaceHistorique.exe -s O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Startup: DTemp.lnk = C:\Applis.BRT\Applis_Utilitaires\Utilitaires CPU\DTemp(mesure-temp-DD_alertes-possibles)\DTemp.exe O4 - Startup: PureText.exe O4 - Startup: VCool.lnk = C:\Applis.BRT\Applis_Utilitaires\Utilitaires CPU\VCool_17\VCool.exe O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: Ouvrir le cadre dans une nouvelle fenêtre - file://C:\WINDOWS\web\nvcadre.html O8 - Extra context menu item: Télécharger en utilisant Download &Express - file://C:\WINDOWS\System32\MetaProducts\Add_Url.htm O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O9 - Extra button: Real.com (HKLM) O9 - Extra button: MoneySide (HKLM) O14 - IERESET.INF: START_PAGE_URL=http://www.libertysurf.fr O15 - Trusted Zone: *.offshoreclicks.com O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37622.5975115741 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{B087D901-B6AF-4B82-B310-C22CD4118EEC}: NameServer = 213.36.80.1 213.36.80.1 Hope it tells you something !!!

Run HijackThis again and fix the following entry: O15 - Trusted Zone: *.offshoreclicks.com

Thanks tim here's the result of the hijack jury : Logfile of HijackThis v1.97.7 Scan saved at 20:52:24, on 30/01/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.exe C:\WINDOWS\System32\nvsvc32.exe C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ahfp.exe C:\WINDOWS\system32\fxssvc.exe C:\Applis.BRT\Applis_Utilitaires\Utilitaires Internet\Suivi_conso-\Netcom\Netcom.exe C:\Applis.BRT\Applis_Utilitaires\Utilitaires.winXP\EffaceHistorique\EffaceHistorique.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe C:\Applis.BRT\Applis_Utilitaires\Utilitaires CPU\DTemp(mesure-temp-DD_alertes-possibles)\DTemp.exe C:\Documents and Settings\ADMIN\Menu Démarrer\Programmes\Démarrage\PureText.exe C:\Applis.BRT\Applis_Utilitaires\Utilitaires CPU\VCool_17\VCool.exe C:\WINDOWS\system32\appsys.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\ADMIN\Mes documents\HijackThis\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.google.fr/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.fr/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.google.fr/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.libertysurf.fr R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.fr/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Liberty Surf - R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.google.fr/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.google.fr/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.fr/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Applis.BRT\APPLIS~1\UTILIT~4\SPYBOT~1\SDHelper.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [Netcom] "C:\Applis.BRT\Applis_Utilitaires\Utilitaires Internet\Suivi_conso-\Netcom\Netcom.exe" O4 - HKLM\..\Run: [Efface Historique 2.0] C:\Applis.BRT\Applis_Utilitaires\Utilitaires.winXP\EffaceHistorique\EffaceHistorique.exe -s O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Startup: DTemp.lnk = C:\Applis.BRT\Applis_Utilitaires\Utilitaires CPU\DTemp(mesure-temp-DD_alertes-possibles)\DTemp.exe O4 - Startup: PureText.exe O4 - Startup: VCool.lnk = C:\Applis.BRT\Applis_Utilitaires\Utilitaires CPU\VCool_17\VCool.exe O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: Ouvrir le cadre dans une nouvelle fenêtre - file://C:\WINDOWS\web\nvcadre.html O8 - Extra context menu item: Télécharger en utilisant Download &Express - file://C:\WINDOWS\System32\MetaProducts\Add_Url.htm O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O9 - Extra button: Real.com (HKLM) O9 - Extra button: MoneySide (HKLM) O14 - IERESET.INF: START_PAGE_URL=http://www.libertysurf.fr O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37622.5975115741 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{B087D901-B6AF-4B82-B310-C22CD4118EEC}: NameServer = 213.36.80.1 213.36.80.1 Note : MEDIALOAD 5IT INSTALLED ITSELF ON MY COMPUTER ON the 040116 dissaperead, but i didn't really do something...Notepad (66ko 28/1/2001) is back in windows/system32. I heard about viruses dissapearing .... In fact there's a trace of Mediaload....its icon has become the icon of notepad... This doesn't bother me but, when looking at small icons, I cannot see any icon ...txt and inf files have an invisible icon....

Hi Jim, Locate the following file and right click on it and choose properties. Is there any copyright info listed? C:\WINDOWS\system32\appsys.exe

Thanks Tom for helping me.. appsys.exe appears to have acreation date on the 19th of january it's an application without any copyright... I'm sure this isn't surprising you...