Guys! Can anyone help me get rid of this damn application running on my pc...it's driving me insane! I've installed spyblaster, ad-aware, spybot S&D, a firewall...you name it and still it is there!!! Here is the scenario: 1.There's a shortcut called Teen Seks movie on the desktop that keeps re-appearing even after it has been deleted! 2.I have searched for this program and found nothing except in the registry under dialers...i deleted it but still it comes back! 3.This dialer called www.seksdialer.com is calling a premium rate number (for polyphonic ringtones)as well! This company also has a site which i found through google - someone maybe needs to report this and stop these people invading other's privacy - it's disgraceful... Anyone have any suggestions here??? I'm at my wits end here with this thing Thanks alot!!! Damian

Post a HiJackThis log of your system so we can see what's going on. HiJackThis and Instructions

Hi, here is the log file: Thanks alot for your help... Logfile of HijackThis v1.97.7 Scan saved at 19:00:52, on 19/03/2004 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sygate\SPF\smc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe C:\PROGRA~1\Iomega\System32\AppServices.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Iomega\AutoDisk\ADService.exe C:\WINDOWS\Explorer.exe C:\Program Files\Ahead\InCD\InCD.exe C:\Program Files\Iomega\AutoDisk\ADUserMon.exe C:\Program Files\Iomega\DriveIcons\ImgIcon.exe C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.exe C:\Program Files\Icons\SetIcon.exe C:\WINDOWS\svahost.exe C:\PROGRA~1\NORTON~1\navapw32.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe C:\Program Files\WinZip\WZQKPICK.exe C:\freeserve\freeserveconnectionkit\atdialler1.exe C:\WINDOWS\System32\dlloc.exe C:\WINDOWS\System32\rasautou.exe A:\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.freeserve.com/iesearch/default.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.freeserve.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Freeserve R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm R3 - Default URLSearchHook is missing O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [SystemTray] SysTray.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe O4 - HKLM\..\Run: [Deskup] C:\Program Files\Iomega\DriveIcons\deskup.exe /IMGSTART O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.exe /h O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.exe O4 - HKLM\..\Run: [SetIcon] C:\Program Files\Icons\SetIcon.exe O4 - HKLM\..\Run: [System Restores] C:\WINDOWS\svahost.exe O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Startup: startit.exe O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.exe O4 - Global Startup: Freeserve Connection Kit.lnk = C:\freeserve\freeserveconnectionkit\atdialler1.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/ O16 - DPF: Win32 Classes - O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Move HJT to its own folder so backups can be made and with only it running have HJT fix these: R3 - Default URLSearchHook is missing O4 - Startup: startit.exe <----This is the bad one Reboot and delete this file startit.exe *************************************************** I'm not sure what these are, you can check them out or maybe someone else knows. Let me know, MrC O4 - HKLM\..\Run: [System Restores] C:\WINDOWS\svahost.exe C:\WINDOWS\System32\dlloc.exe C:\WINDOWS\System32\rasautou.exe

Here's what I found on them: O4 - HKLM\..\Run: [System Restores] C:\WINDOWS\svahost.exe <---??? Looks suspicious C:\WINDOWS\svahost.exe <---rename to .old for know or delete it if sure it's bad *************************** C:\WINDOWS\System32\dlloc.exe <--- a dialer delete it ******************* C:\WINDOWS\System32\rasautou.exe <---- Microsoft file OK

If you still have your problem file, svahost.exe submit to Lavasoft. http://www.lavahelp.com/submit/