Alright so this started about a week ago. I didn't do anything different ((that I know of)) and all of a sudden I'm getting these random pop-up ads. Well, not really random, they're usually all the same. There's this "Stop Pop Ups!" one, an ebay one, a tickle.com one, and a whole bunch of others about accepting flash and all this other s---. I'd leave the computer for a half an hour and come back and there will be 51+. I can't stand it. I've done everything: Adware, SpyBot, SpySweeper, Hijack This, I've even used my Norton SystemWorks 2002. Nothing is working. What should I do? I ran that HijackThis thing and this is the first log: Logfile of HijackThis v1.97.7 Scan saved at 1:07:35 AM, on 3/15/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.exe C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\Tablet.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\System32\DSentry.exe C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.exe C:\WINDOWS\System32\CTHELPER.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.exe C:\Program Files\ScanSoft\OmniPageSE\opware32.exe C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe C:\Documents and Settings\Sara Rose\Application Data\ttuh.exe C:\WINDOWS\System32\wnscpsu.exe C:\Program Files\Wacom\TabUserW.exe C:\Program Files\AIM\aim.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Internet Explorer\iexplore.exe C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Trillian\trillian.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Sara Rose\My Documents\Downloaded Applications and Drivers\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr/*http://www.yahoo.com/ext/search/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.melodramatic.com/mymelo R3 - Default URLSearchHook is missing O1 - Hosts: 66.159.20.52 agreathost.net O1 - Hosts: 66.159.20.52 www.agreathost.net O1 - Hosts: 66.159.20.52 hotfreehost.com O1 - Hosts: 66.159.20.52 www.hotfreehost.com O1 - Hosts: 66.159.20.52 greatfreehost.com O1 - Hosts: 66.159.20.52 www.greatfreehost.com O1 - Hosts: 66.159.20.52 freesmutpages.com O1 - Hosts: 66.159.20.52 www.freesmutpages.com O1 - Hosts: 66.159.20.52 apornhost.com O1 - Hosts: 66.159.20.52 www.apornhost.com O1 - Hosts: 66.159.20.52 nasty-pages.com O1 - Hosts: 66.159.20.52 www.nasty-pages.com O1 - Hosts: 66.159.20.52 sexyfreehost.com O1 - Hosts: 66.159.20.52 www.sexyfreehost.com O1 - Hosts: 66.159.20.52 x4web.com O1 - Hosts: 66.159.20.52 www.x4web.com O1 - Hosts: 66.159.20.52 sexplanets.com O1 - Hosts: 66.159.20.52 www.sexplanets.com O1 - Hosts: 66.159.20.52 maxismut.com O1 - Hosts: 66.159.20.52 www.maxismut.com O1 - Hosts: 66.159.20.52 tgpfriendly.com O1 - Hosts: 66.159.20.52 www.tgpfriendly.com O1 - Hosts: 66.159.20.52 tgp-server.com O1 - Hosts: 66.159.20.52 www.tgp-server.com O1 - Hosts: 66.159.20.52 magnaplza.com O1 - Hosts: 66.159.20.52 www.magnaplza.com O1 - Hosts: 66.159.20.52 free-xxx-server.com O1 - Hosts: 66.159.20.52 www.free-xxx-server.com O1 - Hosts: 66.159.20.52 libereco.net O1 - Hosts: 66.159.20.52 www.libereco.net O1 - Hosts: 66.159.20.52 0190-dialer.com O1 - Hosts: 66.159.20.52 www.0190-dialer.com O1 - Hosts: 66.159.20.52 xxxod.net O1 - Hosts: 66.159.20.52 www.xxxod.net O1 - Hosts: 66.159.20.52 altsights.com O1 - Hosts: 66.159.20.52 www.altsights.com O1 - Hosts: 66.159.20.52 adulthosting.com O1 - Hosts: 66.159.20.52 www.adulthosting.com O1 - Hosts: 66.159.20.52 superhova.com O1 - Hosts: 66.159.20.52 www.superhova.com O1 - Hosts: 66.159.20.52 bestpornhost.com O1 - Hosts: 66.159.20.52 www.bestpornhost.com O1 - Hosts: 66.159.20.52 hostingfree.com O1 - Hosts: 66.159.20.52 www.hostingfree.com O1 - Hosts: 66.159.20.52 xfreehosting.com O1 - Hosts: 66.159.20.52 www.xfreehosting.com O1 - Hosts: 66.159.20.52 x-x-x-hosting.com O1 - Hosts: 66.159.20.52 www.x-x-x-hosting.com O1 - Hosts: 66.159.20.52 pornparks.com O1 - Hosts: 66.159.20.52 www.pornparks.com O1 - Hosts: 66.159.20.52 sexls.com O1 - Hosts: 66.159.20.52 www.sexls.com O1 - Hosts: 66.159.20.52 royalfreehost.com O1 - Hosts: 66.159.20.52 www.royalfreehost.com O1 - Hosts: 66.159.20.52 pleasuremedia.com O1 - Hosts: 66.159.20.52 www.pleasuremedia.com O1 - Hosts: 66.159.20.52 www.mtree.com O1 - Hosts: 66.159.20.52 mtree.com O1 - Hosts: 66.159.20.52 www.dialacom.com O1 - Hosts: 66.159.20.52 dialacom.com O1 - Hosts: 66.159.20.52 nocreditcard.com O1 - Hosts: 66.159.20.52 alehina.com O1 - Hosts: 66.159.20.52 allowednet.com O1 - Hosts: 66.159.20.52 amateurnudephoto.com O1 - Hosts: 66.159.20.52 amateursgonebad.com O1 - Hosts: 66.159.20.52 badbimbo.com O1 - Hosts: 66.159.20.52 beautifulbondage.com O1 - Hosts: 66.159.20.52 big-xxx-movies.com O1 - Hosts: 66.159.20.52 bizshura.com O1 - Hosts: 66.159.20.52 boyanxxx.com O1 - Hosts: 66.159.20.52 cleanpornhost.com O1 - Hosts: 66.159.20.52 cyberxxxhost.com O1 - Hosts: 66.159.20.52 discretesex.com O1 - Hosts: 66.159.20.52 easythumbs.com O1 - Hosts: 66.159.20.52 exscapeporn.com O1 - Hosts: 66.159.20.52 free-freeporn.com O1 - Hosts: 66.159.20.52 freepornofreeporn.com O1 - Hosts: 66.159.20.52 glamourmodelsgonebad.com O1 - Hosts: 66.159.20.52 hot3movie.com O1 - Hosts: 66.159.20.52 hot-adult-clips.com O1 - Hosts: 66.159.20.52 hottestbabes.net O1 - Hosts: 66.159.20.52 huge-cock-big-cock.com O1 - Hosts: 66.159.20.52 hyperfree.com O1 - Hosts: 66.159.20.52 inaughty.com O1 - Hosts: 66.159.20.52 lady-love.com O1 - Hosts: 66.159.20.52 liquidservers.com O1 - Hosts: 66.159.20.52 newsexmovies.com O1 - Hosts: 66.159.20.52 nohiddenfaces.com O1 - Hosts: 66.159.20.52 only10s.com O1 - Hosts: 66.159.20.52 pinkcenterfold.com O1 - Hosts: 66.159.20.52 porn-movies-quality.com O1 - Hosts: 66.159.20.52 pornwarp.com O1 - Hosts: 66.159.20.52 pwgalleries.com O1 - Hosts: 66.159.20.52 sex.com O1 - Hosts: 66.159.20.52 sex-toy-teen-gallery.com O1 - Hosts: 66.159.20.52 sicfreehost.com O1 - Hosts: 66.159.20.52 simplycute.com O1 - Hosts: 66.159.20.52 skilfulhands.tv O1 - Hosts: 66.159.20.52 sleazydream.com O1 - Hosts: 66.159.20.52 sluttyteenporn.com O1 - Hosts: 66.159.20.52 smutfun.com O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.exe O4 - HKLM\..\Run: [CTHelper] CTHELPER.exe O4 - HKLM\..\Run: [AsioReg] REGSVR32.exe /S CTASIO.DLL O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A O4 - HKLM\..\Run: [LVComs] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.exe O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe O4 - HKCU\..\Run: [SB Audigy 2 Startup Menu] /L:ENG O4 - HKCU\..\Run: [Aida] C:\Documents and Settings\Sara Rose\Application Data\ttuh.exe O4 - HKCU\..\Run: [WNSI] C:\WINDOWS\System32\wnscpsu.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: TabUserW.lnk = C:\Program Files\Wacom\TabUserW.exe O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) O9 - Extra button: AIM (HKLM) O9 - Extra button: Real.com (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Messenger (HKLM) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Then I deleted some of those s--- websites and this is the log now, and the pop ups are STILL coming: Logfile of HijackThis v1.97.7 Scan saved at 1:18:44 AM, on 3/15/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.exe C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\Tablet.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\System32\DSentry.exe C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.exe C:\WINDOWS\System32\CTHELPER.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.exe C:\Program Files\ScanSoft\OmniPageSE\opware32.exe C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe C:\Documents and Settings\Sara Rose\Application Data\ttuh.exe C:\WINDOWS\System32\wnscpsu.exe C:\Program Files\Wacom\TabUserW.exe C:\Program Files\AIM\aim.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Internet Explorer\iexplore.exe C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Trillian\trillian.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\rundll32.exe C:\Documents and Settings\Sara Rose\My Documents\Downloaded Applications and Drivers\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr/*http://www.yahoo.com/ext/search/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.melodramatic.com/mymelo O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.exe O4 - HKLM\..\Run: [CTHelper] CTHELPER.exe O4 - HKLM\..\Run: [AsioReg] REGSVR32.exe /S CTASIO.DLL O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A O4 - HKLM\..\Run: [LVComs] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.exe O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe O4 - HKCU\..\Run: [SB Audigy 2 Startup Menu] /L:ENG O4 - HKCU\..\Run: [Aida] C:\Documents and Settings\Sara Rose\Application Data\ttuh.exe O4 - HKCU\..\Run: [WNSI] C:\WINDOWS\System32\wnscpsu.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: TabUserW.lnk = C:\Program Files\Wacom\TabUserW.exe O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) O9 - Extra button: AIM (HKLM) O9 - Extra button: Real.com (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Messenger (HKLM) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab PLEASE someone help me! P.S. I'm the ONLY one who can get on this computer and not once in my life have I been to a porn site. How did they get on my computer???

Hi, Submit these files to Lavasoft, so you can help others; ttuh.exe wnscpsu.exe http://www.lavahelp.com/submit/ Next,move Hijack This to a permanent directory like c:\program files\hijack this\hijackthis.exe. This way you can undo any changes if something goes wrong. Put a check next to these, click "fix checked" and reboot. O4 - HKCU\..\Run: [Aida] C:\Documents and Settings\Sara Rose\Application Data\ttuh.exe O4 - HKCU\..\Run: [WNSI] C:\WINDOWS\System32\wnscpsu.exe After a restart, delete these files: C:\Documents and Settings\Liam\Application Data\ttuh.exe C:\WINDOWS\System32\wnscpsu.exe Good luck

Hi sararose, For starters, I could see where all these pop-ups come from. Scan with hijack-this again and fix these items for R3: - O1 - Hosts: 66.159.20.52 agreathost.net O1 - Hosts: 66.159.20.52 www.agreathost.net O1 - Hosts: 66.159.20.52 hotfreehost.com O1 - Hosts: 66.159.20.52 www.hotfreehost.com O1 - Hosts: 66.159.20.52 greatfreehost.com O1 - Hosts: 66.159.20.52 www.greatfreehost.com O1 - Hosts: 66.159.20.52 freesmutpages.com O1 - Hosts: 66.159.20.52 www.freesmutpages.com O1 - Hosts: 66.159.20.52 apornhost.com O1 - Hosts: 66.159.20.52 www.apornhost.com O1 - Hosts: 66.159.20.52 nasty-pages.com O1 - Hosts: 66.159.20.52 www.nasty-pages.com O1 - Hosts: 66.159.20.52 sexyfreehost.com O1 - Hosts: 66.159.20.52 www.sexyfreehost.com O1 - Hosts: 66.159.20.52 x4web.com O1 - Hosts: 66.159.20.52 www.x4web.com O1 - Hosts: 66.159.20.52 sexplanets.com O1 - Hosts: 66.159.20.52 www.sexplanets.com O1 - Hosts: 66.159.20.52 maxismut.com O1 - Hosts: 66.159.20.52 www.maxismut.com O1 - Hosts: 66.159.20.52 tgpfriendly.com O1 - Hosts: 66.159.20.52 www.tgpfriendly.com O1 - Hosts: 66.159.20.52 tgp-server.com O1 - Hosts: 66.159.20.52 www.tgp-server.com O1 - Hosts: 66.159.20.52 magnaplza.com O1 - Hosts: 66.159.20.52 www.magnaplza.com O1 - Hosts: 66.159.20.52 free-xxx-server.com O1 - Hosts: 66.159.20.52 www.free-xxx-server.com O1 - Hosts: 66.159.20.52 libereco.net O1 - Hosts: 66.159.20.52 www.libereco.net O1 - Hosts: 66.159.20.52 0190-dialer.com O1 - Hosts: 66.159.20.52 www.0190-dialer.com O1 - Hosts: 66.159.20.52 xxxod.net O1 - Hosts: 66.159.20.52 www.xxxod.net O1 - Hosts: 66.159.20.52 altsights.com O1 - Hosts: 66.159.20.52 www.altsights.com O1 - Hosts: 66.159.20.52 adulthosting.com O1 - Hosts: 66.159.20.52 www.adulthosting.com O1 - Hosts: 66.159.20.52 superhova.com O1 - Hosts: 66.159.20.52 www.superhova.com O1 - Hosts: 66.159.20.52 bestpornhost.com O1 - Hosts: 66.159.20.52 www.bestpornhost.com O1 - Hosts: 66.159.20.52 hostingfree.com O1 - Hosts: 66.159.20.52 www.hostingfree.com O1 - Hosts: 66.159.20.52 xfreehosting.com O1 - Hosts: 66.159.20.52 www.xfreehosting.com O1 - Hosts: 66.159.20.52 x-x-x-hosting.com O1 - Hosts: 66.159.20.52 www.x-x-x-hosting.com O1 - Hosts: 66.159.20.52 pornparks.com O1 - Hosts: 66.159.20.52 www.pornparks.com O1 - Hosts: 66.159.20.52 sexls.com O1 - Hosts: 66.159.20.52 www.sexls.com O1 - Hosts: 66.159.20.52 royalfreehost.com O1 - Hosts: 66.159.20.52 www.royalfreehost.com O1 - Hosts: 66.159.20.52 pleasuremedia.com O1 - Hosts: 66.159.20.52 www.pleasuremedia.com O1 - Hosts: 66.159.20.52 www.mtree.com O1 - Hosts: 66.159.20.52 mtree.com O1 - Hosts: 66.159.20.52 www.dialacom.com O1 - Hosts: 66.159.20.52 dialacom.com O1 - Hosts: 66.159.20.52 nocreditcard.com O1 - Hosts: 66.159.20.52 alehina.com O1 - Hosts: 66.159.20.52 allowednet.com O1 - Hosts: 66.159.20.52 amateurnudephoto.com O1 - Hosts: 66.159.20.52 amateursgonebad.com O1 - Hosts: 66.159.20.52 badbimbo.com O1 - Hosts: 66.159.20.52 beautifulbondage.com O1 - Hosts: 66.159.20.52 big-xxx-movies.com O1 - Hosts: 66.159.20.52 bizshura.com O1 - Hosts: 66.159.20.52 boyanxxx.com O1 - Hosts: 66.159.20.52 cleanpornhost.com O1 - Hosts: 66.159.20.52 cyberxxxhost.com O1 - Hosts: 66.159.20.52 discretesex.com O1 - Hosts: 66.159.20.52 easythumbs.com O1 - Hosts: 66.159.20.52 exscapeporn.com O1 - Hosts: 66.159.20.52 free-freeporn.com O1 - Hosts: 66.159.20.52 freepornofreeporn.com O1 - Hosts: 66.159.20.52 glamourmodelsgonebad.com O1 - Hosts: 66.159.20.52 hot3movie.com O1 - Hosts: 66.159.20.52 hot-adult-clips.com O1 - Hosts: 66.159.20.52 hottestbabes.net O1 - Hosts: 66.159.20.52 huge-cock-big-cock.com O1 - Hosts: 66.159.20.52 hyperfree.com O1 - Hosts: 66.159.20.52 inaughty.com O1 - Hosts: 66.159.20.52 lady-love.com O1 - Hosts: 66.159.20.52 liquidservers.com O1 - Hosts: 66.159.20.52 newsexmovies.com O1 - Hosts: 66.159.20.52 nohiddenfaces.com O1 - Hosts: 66.159.20.52 only10s.com O1 - Hosts: 66.159.20.52 pinkcenterfold.com O1 - Hosts: 66.159.20.52 porn-movies-quality.com O1 - Hosts: 66.159.20.52 pornwarp.com O1 - Hosts: 66.159.20.52 pwgalleries.com O1 - Hosts: 66.159.20.52 sex.com O1 - Hosts: 66.159.20.52 sex-toy-teen-gallery.com O1 - Hosts: 66.159.20.52 sicfreehost.com O1 - Hosts: 66.159.20.52 simplycute.com O1 - Hosts: 66.159.20.52 skilfulhands.tv O1 - Hosts: 66.159.20.52 sleazydream.com O1 - Hosts: 66.159.20.52 sluttyteenporn.com O1 - Hosts: 66.159.20.52 smutfun.com ER4S3R. Hope That Helps. ____________________________________________ ### Nobody believes the official spokesman, but everybody trusts an unidentified source ###

When I said "items for R3", I actually meant "Hostsfile redirections", pardon me. :-P ER4S3R. ____________________________________________ ### Nobody believes the official spokesman, but everybody trusts an unidentified source ###

Thanks so much!! Everything worked out great! Now I have another question: I'm doing this for a friend of mine because she had the same problem as I did with the pop ups never stoping and even continuing with IE wasn't running or any other internet program, and you guys were able to solve my problem! Here's her Hijack file. What should she do? Logfile of HijackThis v1.97.5 Scan saved at 9:35:41 PM, on 3/15/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\PROGRA~1\COMMON~1\aol\ACS\acsd.exe C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\WINDOWS\System32\GEARSEC.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\Explorer.exe C:\Program Files\Logitech\iTouch\iTouch.exe C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.exe C:\WINDOWS\System32\DSentry.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\WINDOWS\System32\LVCOMS.exe C:\Program Files\Common Files\Dell\EUSW\Support.exe C:\WINDOWS\System32\ezSP_Px.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\AWS\WeatherBug\Weather.exe C:\Program Files\MSN Messenger\MsnMsgr.exe C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe C:\WINDOWS\System32\wcpsvtr.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Sierra\Planner\PLNRnote.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\WINDOWS\System32\HPZipm12.exe C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\WINDOWS\system32\cidaemon.exe C:\WINDOWS\system32\cidaemon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\America Online 9.0\waol.exe C:\Program Files\America Online 9.0\shellmon.exe C:\Program Files\America Online 9.0\aolwbspd.exe C:\Program Files\AOL Companion\companion.exe C:\Documents and Settings\Sabrina Zarmati\Desktop\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myfunstart.com/index.cfm?pc=nczhp3 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smbusiness.dellnet.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://smbusiness.dellnet.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smbusiness.dellnet.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe O2 - BHO: NavErrRedir Class - {4FC95EDD-4796-4966-9049-29649C80111D} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~2.DLL O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: FlowGoBar - {4E7BD74F-2B8D-469E-C0FF-FD63B399BC7D} - C:\PROGRA~1\FLOWGO~1\Toolbar\flgobar.dll O3 - Toolbar: PowerSearch - {4E7BD74F-2B8D-469E-AA8E-8E1CA787AD2D} - C:\PROGRA~1\POWERS~1\Toolbar\pwrs0108.dll O3 - Toolbar: GameBar - {4E7BD74F-2B8D-469E-C0FF-FD69B994BD7D} - C:\PROGRA~1\GAMERI~1\GameBar\gamebar.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: (no name) - {224530A0-C9CB-4AEE-9C0F-54AC1B533211} - (no file) O3 - Toolbar: PowerSearch - {4E7BD74F-2B8D-469E-D1F0-E56FA787AD2D} - C:\PROGRA~1\POWERS~1\Toolbar\pwrscznc.dll O3 - Toolbar: PowerSearch - {4E7BD74F-2B8D-469E-A1E4-EA6FA787AD2D} - C:\PROGRA~1\POWERS~1\Toolbar\pwrscuz3.dll O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.exe O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.exe O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A O4 - HKLM\..\Run: [LVCOMS] C:\WINDOWS\System32\LVCOMS.exe O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe O4 - HKLM\..\Run: [windows auto update] msblast.exe O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1 O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.exe" /background O4 - HKCU\..\Run: [WINT] C:\WINDOWS\System32\wcpsvtr.exe O4 - Startup: hpothb07.dat O4 - Startup: hpothb07.tif O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: Event Planner Reminders Tray Icon.lnk = C:\Program Files\Sierra\Planner\PLNRnote.exe O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe O4 - Global Startup: officejet 6100.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O9 - Extra button: Real.com (HKLM) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {DEAA3A60-4ACF-4316-8BE8-2E9493EED848} - http://media.euniverse.com/cursorzone/files/flowgo_monkey_setup_td035.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{88024904-3E7B-41EB-90D7-6159DC7E0E14}: NameServer = 205.188.146.146 Thanks again so much!

Have Sabrina run the blaster removal tool; W32.Blaster.Worm Removal Tool Next,move Hijack This to a permanent directory like c:\program files\hijack this\hijackthis.exe. This way you can undo any changes if something goes wrong. Put a check next to these, click "fix checked" and reboot. O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL O2 - BHO: NavErrRedir Class - {4FC95EDD-4796-4966-9049-29649C80111D} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~2.DLL O3 - Toolbar: PowerSearch - {4E7BD74F-2B8D-469E-D1F0-E56FA787AD2D} - C:\PROGRA~1\POWERS~1\Toolbar\pwrscznc.dll O3 - Toolbar: PowerSearch - {4E7BD74F-2B8D-469E-A1E4-EA6FA787AD2D} - C:\PROGRA~1\POWERS~1\Toolbar\pwrscuz3.dll O3 - Toolbar: FlowGoBar - {4E7BD74F-2B8D-469E-C0FF-FD63B399BC7D} - C:\PROGRA~1\FLOWGO~1\Toolbar\flgobar.dll O3 - Toolbar: PowerSearch - {4E7BD74F-2B8D-469E-AA8E-8E1CA787AD2D} - C:\PROGRA~1\POWERS~1\Toolbar\pwrs0108.dll O3 - Toolbar: GameBar - {4E7BD74F-2B8D-469E-C0FF-FD69B994BD7D} - C:\PROGRA~1\GAMERI~1\GameBar\gamebar.dll O3 - Toolbar: (no name) - {224530A0-C9CB-4AEE-9C0F-54AC1B533211} - (no file) O4 - HKCU\..\Run: [WINT] C:\WINDOWS\System32\wcpsvtr.exe O4 - HKLM\..\Run: [windows auto update] msblast.exe http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html O16 - DPF: {DEAA3A60-4ACF-4316-8BE8-2E9493EED848} - http://media.euniverse.com/cursorzone/files/flowgo_monkey_setup_td035.cab After a restart, delete these files if found: wcpsvtr.exe msblast.exe Good luck I am single, and can move in with you, if you need more help.

Hi, I'm basically tring to do the same thing. This is my log file from HijackThis. Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\System32\ezSP_Px.exe C:\Program Files\Toshiba Controls\CpRmtKey.exe C:\Program Files\TOSHIBA\Power Management\CePMTray.exe C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe C:\Program Files\TOSHIBA\TouchPad\TPTray.exe C:\Program Files\Anti-Trojan-55\ATWatch.exe C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Winamp\Winampa.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\System32\wnsapisu.exe C:\WINDOWS\system32\RAMASST.exe C:\WINDOWS\System32\DRIVERS\CDANTSRV.exe C:\WINDOWS\System32\DVDRAMSV.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\toshiba\ivp\ism\ivpsvmgr.exe C:\Program Files\AIM\aim.exe C:\Program Files\Internet Explorer\IEXPLORE.exe C:\Program Files\Internet Explorer\IEXPLORE.exe C:\Documents and Settings\Tuan Le\Desktop\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshiba.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = webproxy.ucsd.edu:3128 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.shoptoshiba.com/ O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe O4 - HKLM\..\Run: [CpRmtKey] "C:\Program Files\Toshiba Controls\CpRmtKey.exe" O4 - HKLM\..\Run: [CeEPOWER] C:\Program Files\TOSHIBA\Power Management\CePMTray.exe O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run O4 - HKLM\..\Run: [AT-Watch] C:\Program Files\Anti-Trojan-55\ATWatch.exe O4 - HKLM\..\Run: [mmtask] C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\SpyHunter\SpyHunter.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe" O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\Program Files\AIM\\DeadAIM.ocm",ExportedCheckODLs O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [System Soap Pro] C:\PROGRA~1\SYSTEM~1\soap.exe min O4 - HKCU\..\Run: [Steam] C:\Program Files\Steam\Steam.exe -silent O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [Uuse] C:\Documents and Settings\Tuan Le\Application Data\belh.exe O4 - HKCU\..\Run: [WNST] C:\WINDOWS\System32\wnsapisu.exe O4 - Startup: America Online 5.0 Tray Icon.lnk = C:\America Online 5.0\aoltray.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: AIM (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Messenger (HKLM) O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38052.6062731482 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Can someone help me? Thanks so much.