Ok, I have this little spyware program or whatever it is, it isn't good. And I don't want it in my computer. I have downloaded, installed, updated, and ran the following with no luck: Ad Aware (this finds it when I open IE, but it only stops the popup, it doesn't delete what is causeing it) SpyBot Norton AntiVirus Norton Firewall I have scanned the computer religiously with the anti spyware programs, which don't return results. What should I do to remove this thing?

You have somehow identified it is there, but it keeps coming back. Is this assumption correct? Do you have "system restore" enabled? Have you tried turning "system restore" off(My Computer>Properties>System Restore>turn it off), restarting the computer and then running your scans for the problem? Have you emtied all yout temp internet files, off line content, and possibly your cookies?

Hi Let's see what's happening.. Download "hijackThis" save it to disk, make a seperate folder for it..eg: c:\hijack\hijackthis.exe D. click hijackthis.exe, click "scan", the scan button changes to "save log" button, click "save log", copy and past the whole log in reply to this thread. Don't fix anything yet as most of what you see in the log is safe or even essential. We will help you sort it out. HijackThis! Direct Download

I didn't start the thread but am experiencing the same problem. any assistance would be appreciated. Logfile of HijackThis v1.97.7 Scan saved at 10:50:09 AM, on 1/29/04 Platform: Windows NT 4 SP6 (WinNT 4.00.1381) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\spoolss.exe C:\PROGRA~1\NavNT\DefWatch.exe C:\PROGRA~1\NavNT\Rtvscan.exe C:\WINNT\system32\RpcSs.exe c:\program files\orl\vnc\WinVNC.exe C:\WINNT\System32\NMSSvc.exe c:\winnt\system32\pstores.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\nddeagnt.exe C:\WINNT\Explorer.exe C:\WINNT\System32\SysTray.exe C:\WINNT\System32\PROMon.exe C:\WINNT\System32\loadwc.exe C:\WINNT\loadqm.exe C:\PROGRA~1\NavNT\vptray.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Microsoft Office\Office\MSOFFICE.exe C:\WINNT\System32\MAPISP32.exe C:\PROGRA~1\Plus!\MICROS~1\iexplore.exe C:\PROGRA~1\Plus!\MICROS~1\iexplore.exe C:\Program Files\Microsoft Office\Office\outlook.exe C:\WINNT\System32\ddhelp.exe C:\Program Files\AcceleRater\Tltx3-48.000\AcceleRater.exe C:\transport programs\shared\ZMN32.exe C:\Transport Programs\Test\NSA-TX Policy Underwriting\NAUSTX30.exe C:\hijack\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///H:/Default.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.kazaa-lite.ws/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.kazaa-lite.ws/results.php?show= R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://server224.smartbotpro.net/7search/?003-nhp R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?hklm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?hklm R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.0.1.30:80 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.kazaa-lite.ws/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.kazaa-lite.ws/ F2 - REG:system.ini: UserInit=userinit,nddeagnt.exe O2 - BHO: (no name) - {000006B1-19B5-414A-849F-2A3C64AE6939} - C:\WINNT\bi.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM\..\Run: [SystemTray] SysTray.exe O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe O4 - HKLM\..\Run: [BrowserWebCheck] loadwc.exe O4 - HKLM\..\Run: [SchedulingAgent] mstinit.exe /logon O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NavNT\vptray.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\WINNT\System32\qttask.exe" -atboottime O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Belt] C:\WINNT\Belt.exe O4 - Startup: Microsoft Office Shortcut Bar.Lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.exe O4 - Global Startup: infinity.bat O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O13 - WWW. Prefix: http:// O16 - DPF: ChatSpace Java Client 2.0.0.66 - http://66.117.5.154:8080/Java/cs4ms066.cab O16 - DPF: {018B7EC3-EECA-11D3-8E71-0000E82C6C0D} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v3.0/0006.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://active.macromedia.com/director/cabs/sw.cab O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_50029/QDow.cab O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe O16 - DPF: {47F946A1-6E7A-D03B-71FF-666ACCFD91A0} (DownloadUL Class) - http://public.searchbarcash.com/cab/024/ffteogys.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/03a63b79c326f6ddce15/netzip/RdxIE601.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {E8EDB60C-951E-4130-93DC-FAF1AD25F8E7} (MoneyTree Dialer) - http://cdn.climaxbucks.com/internet-optimizer/080703/UniDistIOcrack.CAB O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 192.0.1.6 10.48.0.1 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 192.0.1.6 10.48.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 192.0.1.6 10.48.0.1

broz You have cool web search hijack Download CWShredder.exe, save it to disk, close all browser windows and windows explorer windows. D. click cwshredder.exe to run, click "fix", allow the tool to remove what it finds. Reboot the machine and run the tool again to ensure all has been removed. CWShredder.exe Direct Download Start hijackthis.exe and place a check in front of the following, close all open windows except hijack and click "fix checked" O2 - BHO: (no name) - {000006B1-19B5-414A-849F-2A3C64AE6939} - C:\WINNT\bi.dll O4 - HKLM\..\Run: [Belt] C:\WINNT\Belt.exe O13 - WWW. Prefix: http:// O16 - DPF: {018B7EC3-EECA-11D3-8E71-0000E82C6C0D} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v3.0/0006.cab O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_50029/QDow.cab O16 - DPF: {47F946A1-6E7A-D03B-71FF-666ACCFD91A0} (DownloadUL Class) - http://public.searchbarcash.com/cab/024/ffteogys.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/03a63b79c326f6ddce15/netzip/RdxIE601.cab O16 - DPF: {E8EDB60C-951E-4130-93DC-FAF1AD25F8E7} (MoneyTree Dialer) - http://cdn.climaxbucks.com/internet-optimizer/080703/UniDistIOcrack.CAB Reboot the machine again and delete the following: c:\winnt\belt.exe <- this file If you havn't already Download Spybot Search and Destroy, check for and install all updates, run the scan and let it remove all items in Red To prevent conflicts during it's scan; temporarily disable your antivirus. Reboot the machine once more and post new hijack log.

Thank you so much for your prompt assistance. This appears to have fixed it! You have been bookmarked and I will certainly use you again if needed. Thanks Again! Logfile of HijackThis v1.97.7 Scan saved at 2:00:33 PM, on 1/29/04 Platform: Windows NT 4 SP6 (WinNT 4.00.1381) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\spoolss.exe C:\PROGRA~1\NavNT\DefWatch.exe C:\PROGRA~1\NavNT\Rtvscan.exe C:\WINNT\system32\RpcSs.exe c:\program files\orl\vnc\WinVNC.exe C:\WINNT\System32\NMSSvc.exe c:\winnt\system32\pstores.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\nddeagnt.exe C:\WINNT\Explorer.exe C:\WINNT\System32\SysTray.exe C:\WINNT\System32\PROMon.exe C:\WINNT\System32\loadwc.exe C:\WINNT\loadqm.exe C:\PROGRA~1\NavNT\vptray.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Microsoft Office\Office\MSOFFICE.exe C:\hijack\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///H:/Default.htm R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.0.1.30:80 F2 - REG:system.ini: UserInit=userinit,nddeagnt.exe O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM\..\Run: [SystemTray] SysTray.exe O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe O4 - HKLM\..\Run: [BrowserWebCheck] loadwc.exe O4 - HKLM\..\Run: [SchedulingAgent] mstinit.exe /logon O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NavNT\vptray.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\WINNT\System32\qttask.exe" -atboottime O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - Startup: Microsoft Office Shortcut Bar.Lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.exe O4 - Global Startup: infinity.bat O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O16 - DPF: ChatSpace Java Client 2.0.0.66 - http://66.117.5.154:8080/Java/cs4ms066.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://active.macromedia.com/director/cabs/sw.cab O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 192.0.1.6 10.48.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 192.0.1.6 10.48.0.1

broz Glad to hear it worked out ok.. I would soon visit Windows update and download all the critical updates listed including sp1...it will help prevent alot of these issues from happening again. Good luck and all the best!