ok, everytime i start my computer. i seem to get some spyware. i run ad-aware6 on start up and i reguarly get 10 infections. my cpu is running at 100% CONSTANT MacAfee goes off its tits and i reguarly get a nachi virus warning. there is also a program running called svchost.exe which apparently crashes all the time, i get webpage script errors when there are no webpages running. when i try to sign onto the internet i get a "651 error - modem error" message and i then have to use the backup copy of the connection (installed with the original connection) the odd thing is, i only got broadband 2weeks ago and i jus got round to installing BT's own "protection" software and thats when ive had the problems. there is also "RealSecure" firewall software running and its doing sod all. any help is much appreciated.

If you have an svchost.exe file in your c:\windows directory, delete it from safemode. The svchost files that run from your c:\windows\system32 folder are okay. Do you have all of the iwndows critical updates? Is your antivirus updated? I would guess that adaware is missing something that is downloading other spyware. There are a few viruses that do this. Download, install and update Spybot Search and Destroy. When you start in safemode, run the updated adaware and spybot. You can get apybot at Wildersdownload page. You should also try an online virus scan. TrendMicro's Housecall Panda Activescan Housecall is my favorite. I also like Panda, but they do require an email address and they will send you lots of email. I will not be here long, but post your results, There are some other things to try (namely HijackThis) if the above do not work.

cheers for the advice according to housecall i have 9 instances of the BKDR Sandbox A virus and they are "non-cleanable"...does this mean i have to manually delete them from safe mode? any advice on how to get shot of this would be great. also, how does this spread, does it attach itself to outgoing emails, files or instant messages, i dont want to infect my mates cheers

my hi-jack this log Logfile of HijackThis v1.97.7 Scan saved at 23:35:47, on 11/04/2004 Platform: Windows 2000 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\LEXBCES.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\LEXPPS.exe C:\Program Files\ISS\BlackICE\blackd.exe C:\WINNT\System32\CTsvcCDA.exe C:\WINNT\System32\svchost.exe C:\WINNT\myCIO\Agent\myAgtSvc.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\MsPMSPSv.exe C:\WINNT\Explorer.exe C:\WINNT\myCIO\VScan\McShield.exe C:\WINNT\System32\khooker.exe C:\WINNT\SYSTEM32\3cmlink.exe C:\WINNT\loadqm.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINNT\System32\CTHELPER.exe C:\WINNT\SYSTEM32\3cshtdwn.exe C:\WINNT\SYSTEM32\3cmlink.exe C:\Program Files\Creative\ShareDLL\CtNotify.exe C:\Program Files\Browser MOUSE\mouse32a.exe C:\Program Files\Creative\ShareDLL\MediaDet.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\Program Files\Muiltmedia keyboard utility\1.3\KbdAp32A.exe C:\winnt\temp\82G.exe C:\winnt\temp\sAp394.exe C:\WINNT\myCIO\Agent\myagttry.exe C:\Program Files\Lavasoft\Ad-aware 6\Ad-aware.exe C:\WINNT\System32\internat.exe C:\Documents and Settings\Administrator\Application Data\mnmd.exe C:\WINNT\System32\wnsapisv.exe C:\Program Files\ISS\BlackICE\blackice.exe C:\WINNT\System32\taskmgr.exe C:\WINNT\myCIO\Agent\UpdDlg.exe C:\Program Files\Internet Explorer\IEXPLORE.exe C:\WINNT\System32\Che4e8Q.exe C:\WINNT\System32\AacvQY0k.exe C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe C:\Documents and Settings\Administrator\My Documents\Downloads\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://out.true-counter.com/a/?656387 (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://out.true-counter.com/b/?656387 (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://out.true-counter.com/c/?656387 (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://out.true-counter.com/b/?656387 (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?new-hklm R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by AOL R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://out.true-counter.com/b/?656387 (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://out.true-counter.com/b/?656387 (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50094 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll O2 - BHO: IE Agent - {00000000-0000-0000-0000-000000000221} - C:\Program Files\Lycos\IEagent\CSIE.DLL O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINNT\twaintec.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing) O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - C:\PROGRA~1\Toolbar\toolbar.dll O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [SiS KHooker] C:\WINNT\System32\khooker.exe O4 - HKLM\..\Run: [3c1807pd] C:\WINNT\SYSTEM32\3cmlink.exe RunServices \Device\3cpipe-3c1807pd O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.exe O4 - HKLM\..\Run: [UpdReg] C:\WINNT\UpdReg.exe O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser MOUSE\mouse32a.exe O4 - HKLM\..\Run: [FLMK08KB] C:\Program Files\Muiltmedia keyboard utility\1.3\MMKEYBD.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [82G] C:\winnt\temp\82G.exe O4 - HKLM\..\Run: [sAp394] C:\winnt\temp\sAp394.exe O4 - HKLM\..\Run: [7FSGog] C:\winnt\temp\7FSGog.exe O4 - HKLM\..\Run: [myCIO.com ASaP] C:\WINNT\myCIO\Agent\myagttry.exe O4 - HKLM\..\Run: [myCIO.com Splash] C:\WINNT\myCIO\VScan\Splash.exe O4 - HKLM\..\Run: [updater] C:\Program Files\Common files\updater\wupdater.exe O4 - HKLM\..\Run: [Ad-aware] "C:\Program Files\Lavasoft\Ad-aware 6\Ad-aware.exe" +c O4 - HKLM\..\Run: [4D7ZJX84@RXZNZ] C:\WINNT\System32\Gbi1r6.exe O4 - HKCU\..\Run: [Aeld] C:\Documents and Settings\Administrator\Application Data\mnmd.exe O4 - HKCU\..\Run: [WNST] C:\WINNT\System32\wnsapisv.exe O4 - Global Startup: RealSecure(r) Desktop Protector.lnk = ? O9 - Extra button: AIM (HKLM) O9 - Extra button: Real.com (HKLM) O16 - DPF: {40C83AF8-FEA7-4A6A-A470-431EE84A0886} (SecureObjectFactory Class) - http://virusscan.netadeptasap.com/VS2/bin/myCioAgt.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/7d90ae05585062/housecall.antivirus.com/housecall/xscan53.cab O16 - DPF: {E82ED244-76EF-4D34-BDB3-AB21A522F38E} (webhelper Class) - http://www.btconnect.com/public/home/download/btbconnectwebcontrol013.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{3D6CE352-1861-4BD2-A4A9-07F5973B08B4}: NameServer = 213.1.119.101 213.1.119.102 O17 - HKLM\System\CS1\Services\Tcpip\..\{3D6CE352-1861-4BD2-A4A9-07F5973B08B4}: NameServer = 213.1.119.101 213.1.119.102 O19 - User stylesheet: C:\WINNT\default.css (HKLM) i have no idea what any of this means

Place a checkmark next to the following in HijackThis and click FIX. All R0 and R1 lines (anything you do use can be easily and quickly reinstalled). All O2 - BHO: (no name)entries. O4 - HKLM\..\Run: [82G] C:\winnt\temp\82G.exe O4 - HKLM\..\Run: [sAp394] C:\winnt\temp\sAp394.exe O4 - HKLM\..\Run: [7FSGog] C:\winnt\temp\7FSGog.exe O4 - HKLM\..\Run: [updater] C:\Program Files\Common files\updater\wupdater.exe You can also see these Peper Trojan removal instructions. I dont think this is actually needed: O4 - HKLM\..\Run: [SiS KHooker] C:\WINNT\System32\khooker.exe Post back with problems. Many here are better at removing Peper than I am.

You also need to start in safemode, select view all files and delete the following. I think you need to turn off system restore first. C:\WINNT\System32\khooker.exe C:\winnt\temp\82G.exe C:\winnt\temp\sAp394.exe C:\WINNT\System32\Che4e8Q.exe C:\WINNT\System32\AacvQY0k.exe C:\Program Files\Creative\ShareDLL\CtNotify.exe C:\Documents and Settings\Administrator\Application Data\mnmd.exe

And get SpyBot S&D and AdAware along with a reliable AV product. Most of these problems would never have appeared if you had them. _________________________ Computers work with absolute flawless perfection, until the first person touches them!