I am having an issue with the annoyance that is win*.tmp.exe.

Pandasoft has been making noises about dialers being found and neutralized.

So far, I have run Pandasoft AV and Ad-Aware in both regular mode and safe mode. I have turned off system restore both before and after running AV and Ad-Aware (I've been at this for two days).

I am also getting a popup saying that my security settings won't allow ActiveX controls to be active on this page as an MSIE warning. I don't have MSIE as my main browser, nor does it show up in my process list for Task Manager.

Help!

(I have a HJT log available from about 5 minutes ago.)

When you turned system restore off , did you restart the computer? Have you emptied the temp files? Have you checked what the popup settings are for IE using tools>popup blocker, and turned it while running the active x? You might have to turn off or authorize your other popup blockers if you have any installed?

I restarted after turning off system restore. I emptied all the temp files I was able to (C:\%system%\TEMP wouldn't allow me to delete some of the win*.tmp files). Popup blocker on MSIE is on and active X is set to prompt me for access. I don't have any other popup blockers installed. MSIE is NOT running when I get the ActiveX warning box popup.

I was hoping that your infection was very simple, but you will need to get and post a hijackthis log. Jabuck is this forums specialist in hijackthis logs. You could get hijackthis and post it at the "spywarewarrior" website. They have a lot more people that are good at analysing hijackthis logs, as spyware removal is their specialty. HTH

I had the same problem I ran HJT and the file that was on line 020 eg. of mine winzlo32.dll I renamed the file to winzlo32.dll.bak for the time being.

Rebooted my computer and the win##.tmp.exe files no longer load.

Went to my Windows\Temp Dir Deleted all files with no problem.

Then I went and deleted the winzlo32.dll.bak from System32 dir.

This has stopped the problem so far and no other win##.tmp or win##.tmp.exe have been re-populated.

I don't know if this is a solution as it's only been 1 hour since I have done this.

However I have posted my steps in a thread I created and I'm still working with Jabuck and waiting for his response after my first HJT post.

My computer is running 100% faster now after making the above changes.

I also ran ccleaner and cleaned out all the other crap in my computer.

All the best.

Oh yeah I also forgot.

I then ran HJT again and on line 020 it said winzlo32.dll file missing I checked the bow and hit the fix checked button.

Ran HJT again and the error on line 020 is now gone. I hope for good.

All the best.

Leafsnum1 nailed it. My machine is now coming up with no problems, no pop-ups, and no spyware according to spysweeper. Thank you so much.

No problem at all.

Cheers!!