pop up appears when I go on the net. found 2 suspicious entries in c:/windowssystem32/tek32. one is a dat file the other is a system file created recently. could I delete thease safely? are they the problem? thanx for help!

hello i would d/l spybot search and destroy,update it run it.d/l ad-ware do the same if these find them delete them through those programs there free do dog pile search for them as google will find fake paid for verions instead.

These won't delete easily and may escape that process, but run Spybot and clear out ALL the red items that it finds, then reboot. Download HijackThis and save to a new folder called ‘HijackThis’. Double click on hijackthis.exe. Press Scan, and wait, Save the log, (the ‘scan’ button changes to ‘save log’) Edit>select All > copy and paste its contents here. ** Don't fix anything yet. Most of what it lists will be harmless or even essential for your system or for the log reader to resolve the problem** Post the full log including header info in reply.

Logfile of HijackThis v1.97.3 Scan saved at 19:35:05, on 09/02/2004 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\pctspk.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\System32\wuauclt.exe C:\Documents and Settings\Authorised User\My Documents\mozilla-win32-1.5\bin\mozilla.exe C:\Documents and Settings\Authorised User\Local Settings\Temp\Temporary Directory 11 for hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.freeserve.com/ O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{1A8B3459-D828-4754-B748-C70F12496218}: NameServer = 195.92.195.94 195.92.195.95 thanx for help!

You will need to do these first. Remove that version of HijackThis, re-download the 1.97.7 version. [the .exe version as per instructions] Install into its own folder, not a temp folder or a zipped, but its own folder, as per instructions above. Then upgrade your Windows version and your Internet Explorer to SP1 from the Windows Update site. Install and run Spybot as per instructions. Repost the new HjT log showing all these details. And if anyone has told you to stop some programs from starting up, then report those back here, and let them start up normally.

this is my new file log.Logfile of HijackThis v1.97.7 Scan saved at 19:57:54, on 10/02/2004 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\logonui.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\pctspk.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\System32\wuauclt.exe C:\Documents and Settings\Authorised User\My Documents\mozilla-win32-1.5\bin\mozilla.exe C:\Documents and Settings\Authorised User\My Documents\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.freeserve.com/ R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant = http://www.search-1.net/search.html R1 - HKCU\Software\Microsoft\Internet Explorer,CustomizeSearch = http://www.search-1.net/search.html O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{1A8B3459-D828-4754-B748-C70F12496218}: NameServer = 195.92.195.94 195.92.195.95

You still need to upgrade your Windows version to SP1 from the Windows Update site. You should have a line that looks like this Platform: Windows XP SP1 (WinNT 5.01.2600) There were two more critical updates announced today as well. Install,update first,then run Spybot; you should have a log line like this. O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll Then show hidden and operating system files