I am embarrassed to say it, but I am a recent convert from apples to PC's. Now I have all kinds of spyware/hijackers and can't get rid of them with Spyhunter and Ad-aware. Following is my Hijack This Log. Anyone out there who can help me decipher this? I would be forever indebted! TIA Logfile of HijackThis v1.97.3 Scan saved at 2:18:25 AM, on 10/16/2003 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.exe C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MPREXE.exe C:\WINDOWS\SYSTEM\SSDPSRV.exe C:\PROGRAM FILES\COMMON FILES\EPSON\EBAPI\SAGENT2.exe C:\WINDOWS\SYSTEM\MSTASK.exe C:\WINDOWS\EXPLORER.exe C:\WINDOWS\TASKMON.exe C:\WINDOWS\SYSTEM\SYSTRAY.exe C:\PROGRAM FILES\QUICKEN2002\QAGENT.exe C:\WINDOWS\SYSTEM\DDHELP.exe C:\PROGRAM FILES\AHEAD\INCD\INCD.exe C:\WINDOWS\SYSTEM\MSHTA.exe C:\WINDOWS\SYSTEM\E_S0BIC1.exe C:\WINDOWS\SYSTEM\WMIEXE.exe C:\WINDOWS\SYSTEM\SPOOL32.exe C:\PROGRAM FILES\QUICKEN2002\QWDLLS.exe C:\WINDOWS\SYSTEM\MRTMNGR.exe C:\PROGRAM FILES\SONY HANDHELD\HOTSYNC.exe C:\WINDOWS\SYSTEM\RESTORE\STMGR.exe C:\WINDOWS\SYSTEM\PSTORES.exe C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.exe C:\WINDOWS\DESKTOP\HIJACKTHIS\HIJACKTHIS.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finance.yahoo.com/?u R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://193.125.201.50 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://193.125.201.50 O1 - Hosts: 193.125.201.50 msn.com O1 - Hosts: 193.125.201.50 search.msn.com O1 - Hosts: 193.125.201.50 ie.search.msn.com O1 - Hosts: 193.125.201.46 thehun.net O1 - Hosts: 193.125.201.46 www.thehun.net O1 - Hosts: 193.125.201.46 thehun.com O1 - Hosts: 193.125.201.46 www.thehun.com O1 - Hosts: 193.125.201.50 sitefinder.verisign.com O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s O4 - HKLM\..\Run: [SystemTray] SysTray.exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [SiSAudio] C:\WINDOWS\SYSTEM\MP_S3.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [QAGENT] C:\PROGRAM FILES\QUICKEN2002\QAGENT.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\SYSTEM\E_S0BIC1.exe /P23 "EPSON Stylus C62 Series" /O7 "EPUSB1:" /M "Stylus C62" O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.exe" -atboottime O4 - HKLM\..\Run: [winmain] winmain.exe O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe O4 - HKLM\..\RunServices: [SAgent2ExePath] C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKCU\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\SYSTEM\E_S0BIC1.exe /A "C:\WINDOWS\SYSTEM\E_SC072.TMP" O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe O4 - Startup: Reboot.exe O4 - Startup: Quicken Startup.lnk = C:\Program Files\Quicken2002\QWDLLS.exe O4 - Startup: Billminder.lnk = C:\Program Files\Quicken2002\BILLMIND.exe O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.exe O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html O13 - DefaultPrefix: http://193.125.201.50/?trk= O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37894.2036226852 O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe

First, go here and download and run HTAStop to kill MSHTA. http://www.nsclean.com/freebies.html Run HT again and check the following items. Next, close all browser Windows, and have HT fix all checked. You NEED to restart your computer when you're done. R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://193.125.201.50 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://193.125.201.50 O1 - Hosts: 193.125.201.50 msn.com O1 - Hosts: 193.125.201.50 search.msn.com O1 - Hosts: 193.125.201.50 ie.search.msn.com O1 - Hosts: 193.125.201.46 thehun.net O1 - Hosts: 193.125.201.46 www.thehun.net O1 - Hosts: 193.125.201.46 thehun.com O1 - Hosts: 193.125.201.46 www.thehun.com O1 - Hosts: 193.125.201.50 sitefinder.verisign.com O4 - HKLM\..\Run: [winmain] winmain.exe After restarting, delete winmain.exe

Thanks for your speedy reply! I've done what you suggested. Now, what did I just do? I think I get what HTAstop does, but what are the files found by HT that I just deleted (like winmain.exe)? I'm trying to learn enough to one day become self-sufficient!

Some info for you; HTA DOWNLOAD EXPLOIT

Thanks again. I guess I should be embarrassed that I didn't find that page myself. Just confirms what we all knew already -- Microsoft is evil and has designs on taking over the world.