Hi, When I open Internet Explorer, a first window opens with Google, then a second one appears, this time with ZestyFind... I have already removed several files on the regedit. This only occurs the first time I launch IE after putting my computer on. Do you have any idea how I could have this stop?

http://www.computing.net/security/wwwboard/forum/8744.html http://forums.spywareinfo.com/index.php?showtopic=17235&hl=zestyfind • TheKid •

Thank you for the message. However, I have done everything indicated, and the pests keep opening... What else should I do?

How about this... http://www.symantec.com/avcenter/venc/data/adware.zestyfind.html If no joy,search your HDD for "msg118.dll".If found,try this tool; Killmsg118 To use this utility, click on Fix and let it do it's thing. Reboot afterwards. It is still a beta though so set a restore point before you use it. This link may also help; http://www.pchell.com/support/look2me.shtml Good Luck,because that's about all can offer. • TheKid •

Well,maybe this one,too; http://securityresponse.symantec.com/avcenter/venc/data/spyware.look2me.html • TheKid •

Hello, I'm Peter from Holland, Amsterdam. I also have a problem with zestyfind. Below I will insert my hijackthis file. Could someone please help me. Thanks in advance. Logfile of HijackThis v1.97.7 Scan saved at 0:54:33, on 21-2-2004 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\System32\P2P Networking\P2P Networking.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\System32\RUNDLL32.exe C:\PROGRA~1\NORTON~1\navapw32.exe C:\WINDOWS\SYSTEM32\Drivers\dadapp.exe F:\quicktime\qttask.exe C:\WINDOWS\SYSTEM32\Drivers\DadTray.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\System32\ctfmon.exe F:\FinePixViewer\QuickDCF.exe C:\WINDOWS\SYSTEM32\KeySp.exe F:\Microsoft Office\Office\FINDFAST.exe F:\Microsoft Office\Office\OSA.exe C:\Program Files\Microsoft Office\Office\WINWORD.exe C:\Program Files\Internet Explorer\IEXPLORE.exe C:\Program Files\Internet Explorer\IEXPLORE.exe F:\HijackThis\hijackthis1977\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ajax.nl/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.ajax.nl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) N2 - Netscape 6: # Mozilla User Preferences // This is a generated file! user_pref(".aim.general.im.enterCR", false); user_pref(".aim.general.im.smilies", true); user_pref(".aim.general.im.tabKey", false); user_pref(".aim.general.im.timeStamp", false); user_pref(".aim.mail.presence", true); user_pref("browser.download.dir", "F:\\december2003"); user_pref("browser.history.last_page_visited", "http://www.picsurfer.com/m/freshblack-008/?sc9focusnet"); user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src"); user_pref("browser.startup.homepage_override.mstone", "rv:0.9.4"); user_pref("intl.charsetmenu.browser.cache", "UTF-8, windows-1251, windows-1252"); user_pref("ldap_2.prefs_migrated", true); user_pref("prefs.converted-to-utf8", true); user_pref("security.warn_submit_insecure", false); user_pref("signon.SignonFileName", "15971397.s"); user_pref("timebomb.first_launch_time", "1015971551406000"); user_pref("wallet.SchemaValueFileName" O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\downloaded program files\GoogleToolbar_nl_1.1.62-deleon.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Alexa - {3CEFF6CD-6F08-4E4D-BCCD-FF7415288C3B} - C:\WINDOWS\System32\SHDOCVW.DLL O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [DadApp] C:\WINDOWS\SYSTEM32\Drivers\dadapp.exe O4 - HKLM\..\Run: [QuickTime Task] "F:\quicktime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [WinSL] F:\SL\WinSL.exe O4 - HKLM\..\Run: [System Service] C:\WINDOWS\System32\msrexe.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - Startup: Microsoft Office Snelzoeken.lnk = F:\Microsoft Office\Office\FINDFAST.exe O4 - Startup: Office Opstarten.lnk = F:\Microsoft Office\Office\OSA.exe O4 - Startup: WinMySQLadmin.lnk = F:\mysql\bin\winmysqladmin.exe O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Exif Launcher.lnk = ? O4 - Global Startup: kssys.lnk = C:\WINDOWS\SYSTEM32\KeySp.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe O8 - Extra context menu item: &Google Search - res://c:\windows\downloaded program files\GoogleToolbar_nl_1.1.62-deleon.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://c:\windows\downloaded program files\GoogleToolbar_nl_1.1.62-deleon.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\windows\downloaded program files\GoogleToolbar_nl_1.1.62-deleon.dll/cmcache.html O8 - Extra context menu item: Keyword Density - http://route.mouseclickapplication.com/cgi-bin/partner/router.cgi?partner=main&version=1&set=1&tool=2 O8 - Extra context menu item: Link Popularity - http://route.mouseclickapplication.com/cgi-bin/partner/router.cgi?partner=main&version=1&set=1&tool=1 O8 - Extra context menu item: Mail to a Friend... - http://client.alexa.com/holiday/script/actions/mailto.htm O8 - Extra context menu item: Position Reporter - http://route.mouseclickapplication.com/cgi-bin/partner/router.cgi?partner=main&version=1&set=1&tool=3 O8 - Extra context menu item: SE Optimizer - http://route.mouseclickapplication.com/cgi-bin/partner/router.cgi?partner=main&version=1&set=1&tool=5 O8 - Extra context menu item: SE Submission - http://route.mouseclickapplication.com/cgi-bin/partner/router.cgi?partner=main&version=1&set=1&tool=4 O8 - Extra context menu item: See Related Links - http://client.alexa.com/holiday/script/actions/related.htm O8 - Extra context menu item: Si&milar Pages - res://c:\windows\downloaded program files\GoogleToolbar_nl_1.1.62-deleon.dll/cmsimilar.html O8 - Extra context menu item: Write a Review... - http://client.alexa.com/holiday/script/actions/review.htm O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) O9 - Extra button: Onderzoekscentrum (HKLM) O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Messenger (HKLM) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: HC - https://speelzaal01.digitaal.hollandcasino.nl/classes/hc.cab O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {03C543A1-C090-418F-A1D0-FB96380D601D} (preload control) - http://www.thepaymentcentre.com/build/preload.cab O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (sys Class) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {21F49842-BFA9-11D2-A89C-00104B62BDDA} (ChartFX Internet Control) - http://www2.hitslink.com/download/CfxIEAx.cab O16 - DPF: {23B7A816-3647-49D2-9756-6F41CE8F9201} (ddm_download.ddm_control) - http://bins.dynamicdesktopmedia.com/cab/ddm_control.CAB O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20011217/qtinstall.info.apple.com/qt505/nl/win/QuickTimeInstaller.exe O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} (Google Activate) - http://toolbar.google.com/data/nl/deleon/1.1.60-deleon/GoogleNav.cab O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/DLhelper/version6/dlhelper.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {DE591B16-A452-11D6-AED1-0001030A4E46} (PBGNX Control) - https://www.p3.postbank.nl/GTO/PBGNX.cab O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://www.webex.com/client/latest/webex_674/ieatgpc.cab O16 - DPF: {ED4E6F97-FA1A-4634-B550-AABFEB8DA009} (TulipPlayer Class) - http://www.exstream.to/tulip/cab/3,0,5,19/TulipPlayer2.cab O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab O16 - DPF: {FC9C7D52-C99A-494A-AA79-4A25098F659C} (GVDLoad Control) - http://www.casinolux.com/dload/gvdload.cab