everytime Windows boots up an error message pops up saying "Cannot find the file 'copy'"

any idea what this means and how i can fix it?

Hi.
Have you deleted any CD Copy programs lately ?. and if you have , did you do it through Add and remove Programs?.

Same happened to me just days ago. Unclear as to cause, do no recall deleting any programs recently. running Windows XP home.

Same behavior started happening to me (windows XP) yesterday. I can't find any info on how to fix this nor can I think of anything that I did to cause the error????

Same for me. Are your harddrives also making strange noises? Mine does. I wonder it it's related somehow.

I have the same problem on win XP. I have made no changes recently, though I have recently been infected by trojan.bootconf. I wonder if this is the cause. I have cleaned my system using Norton but it still appears. Help much appreciated.

Same error here.

I'm running XP Home. No recent changes, sounds like a virus.

Same error "Cannot find the file 'copy'"

I have the exact same problem. The windows is starting up screen remainds on the screen for about a minute and then the message everyone is talking about appears and remains untill you click ok at which point your desktop appears and the computer then performs flawlessly in my case.

Yes, me too on WIN XP. I did just remove a trojan virus, and several entries in the registry. Anyone?

Same thing happens to me with Windowa XP, when windows starts. I have used SpyBot recently and it does delete registry entries. I will research this further.

Hey guys what<nobr><a class="iAs" style="border-bottom:darkgreen 1px solid;text-decoration:underline;color:darkgreen;background-color:transparent;" href="http://itxt.vibrantmedia.com/al.asp?ipid=7&cc=us&cf=1&ai=3590232&di=23125&ts=20031117231040&redir=http://www5.overture.com/d/sr/?xargs=02u3hs9yoaj1WuwTCCRBTFf12N25KoXriw1THiQoXOU3uNaIIkClrf6mWrnvFZk2ZOjM5lv32NgMTMT1twS%2FcI1IqYnNjApkDqNZwZhImwsFCSxrYAPjfO9NTTn9bQzds545q7s8cca%2BFO67xmP4S%2BULitCpa5dBLVmKB5SRakZFALmJDIpjX2vzp3bxvWF5O334sUoFq5sG2kqkqQ8xV%2FwXmh0OaOdqogS8pArQSuYWdDd6%2BqxfbdhjieaSQkUuQcGhtR3gg%3D" target="_blank" oncontextmenu="return false;" onmouseover="kwE(event,23125);" onmouseout="kwL(event);" onmousemove="kwM(23125);">'s happeni</nobr>ng?
My hard drive is making noises and I am getting the same message you get?
How can we deal with this?

Hey guys what's happening?
My hard drive is making noises and I am getting the same message you get?
How can we deal with this?

I have winxp pro and it's doing the same thing...I am suspecting we all did windows update and that message is a bug from the update. any ideas? I tried window restore but the problem came back.

I get message on boot up "Cannot find the file 'copy'

I am getting funny noises on my computer too, sounds like cdrom is running.

I get the message on boot up "Cannot find the file 'copy'....what is this?...it started about 3 days ago

xp pro same problem..cannot find copy started Nov 14, did remove direct cd through add remove programs around the same time. If thsi is the cause how can I undo what I have done?

Got the same error by uninstalling a program. Seems I had files that were replaced by earlier versions within my operating system (XP). XP disk didn't help. Finally, I installed my Norton Utilities disk and ran "WinDoctor" and it knew enough to eliminate the error. Gotta love Symantic.

TT

I did nothing and it went away.

The last 3 boots i've done the message hasn't appeared... strange.

This problem is created by a trojan (VBS_Winshow.A, as Trend Micro refers to it as)

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_WINSHOW.A&VSect=T

or adware as Symantec refers to it as.

http://securityresponse.symantec.com/avcenter/venc/data/adware.winshow.html

This past weekend happens to be about the one month anniversary of its initial appearance; perhaps this is the reason why it the 'copy' error started showing up. On my machine, it looks like it first deposited itself on 10/30/03. Its main impact for me was it would not allow multiple launches of IE from the desktop icon, and it became impossible over the weekend to synch my pda, HD MP3 player or use my multi-card reader, and impacted anything else that was hooked up through my USB 2.0 card. IE session since the beginning of November have seemed somewhat buggy; anything depending upon a plug-in applet (like Java) took FOREVER to load. The 'copy' boot error does not show up with every bootup or login, making it seem like the problem goes away.

In 2000/XP, you need to search for the folders Winshow and Winlink, usually deposited in C:\ Documents and Settings \ (user) \ Local Settings \ Application Data, where (user) is whatever name you log into or use XP/2000 with. If you have them, you will need to delete eventually, but you'll first have to delete the registry entries (if you don't, the trojan will simply recreate the folders with the next bootup). There probably is the file 'msupdater.exe' on your machine as well, this and the two folders have been associated as a IE hijacker routine a number of people have reported on the internet.

Norton's WinDoctor can delete some of the registry entries (it did for me, but it didn't get everything), but you really need to use it or better yet, use Hijack This, booted into Safe Mode (where the trojan isn't allowed to start before attempting to delete its components).

For those who don't know, Hijack This is an anti-hijacking app is easy to find (and best of all, is free). You can find it on CNET and other places to download. In my case, it came in a .zip file; within it was a .exe file that launches Hijack This when clicked. It doesn't appear to install itself to Windows. Upon starting in Safe Mode, you should get a window; select Scan, and in a second or two you will get a listing of the processes that launch on startup with your specific computer. Look for the Winlink and Winshow entries (under BHO on my computer), click the tick boxes, and click Fix Check.

Once done, you can reboot normally, go and find the the msupdater.exe file, Winshow and Winlink folders and delete w/o them showing up again.

To further clean up, you can go into the registry (with regedit, but only if you know what you're doing in there), and search for both winlink and winshow; there may be remnants still lurking as there were on my computer. If you find them, delete them; the trojan shouldn't be active at this point so it shouldn't recreate them. NOTE: if you have multiple login user identities on your machine, you may have to do this exercise for EACH one. If you're knowledgeable and brave enough, you can delete the registry entries in Safe Mode also, without using Hijack This or any other app.

I investigated per message #18 and found no WinShow or WinLink folders, files or associated reg keys. I still have the problem There must be another cause for the "cannot find the file 'copy". What am I missing?
Thanks.

Yeah, post #18 is a red herring. Someone else on a different board said a different virus was causing this. But I don't have the symptoms of either virus and still have the problem.

Red herring? Not if you really do have the winshow trojan as I did. I apologize if I was too declarative that only winshow may be the cause of this problem.

I've rebooted my 'puter over a dozen times since cleaning winshow off yesterday. No popups about a missing 'copy' file so far, and the only thing I've done was eradicate winshow and its components. My Nomad Zen again talks to my computer, and I can launch multiple IE sessions again if I so desire. So far the Welcome splash screen in XP doesn't show up twice or three times during a single reboot as it did every so often prior to ridding winshow off my machine.

One thing to consider (I didn't when I posted #18) is that the vermin who write this sort of malicious code aren't all that keen about copyright infringments, so virus and trojan variations may be the reason why more than a few aren't finding the winshow entries on the HD and in the registry. Quite frankly, winshow didn't work like it was supposed to on my computer; it never hijacked my IE home page to searchv.com like it was supposed to, and when NAV 2004 found msupdater.exe and deleted it a couple of weeks ago, winshow didn't recreate it again like it reportedly was suppose to do (I didn't know what winshow was back then, and NAV didn't find anything else with subsequent scans so I thought I was free and clear--until the popup showed up late last week).

When Norton Utilities' WinDoctor did its thing, it found two problem start entries in Windows startup, both referencing an invalid 'copy' command(!) to winshow and winlink...that's when I reseached winshow, found its folders on my machine where some post on another site said they would be, found out about its relationship with msupdater.exe and put it all together.

It applied perfectly to my computer; my mistake is assuming it would apply to everyone else's as well. Sorry.

Thanks, msblocks! Although my cicumstances were a bit different, your FIX WORKED!

HISTORY: About a week ago, in the middle of a Windows Update session (I'm running Windows 2000 Professional), Norton Anti-Virus (2000) went nuts over a virus it found in the update! My PC froze, forcing me to do a hard shutdown. Upon restarting, I began getting the "Can't find the file Copy" popup each time I logged in.

SYMPTOMS: My startup speeds were normal, and I had no problems with IE. Just the pesky pop up. After reading msblocks' solution, I scanned my hard drive and found the following:

C:\WINNT\Winshow.cfg
C:\WINNT\Winshow.dll
C:\WINNT\Winshow.new

There was no "msupdater.exe", nor were there any Winlink files or folders to be found.

SOLUTION: I downloaded "Hijack This" from CNet.com and unzipped the "HijackThis.exe" file contained therein to a temporary folder. I rebooted in 'Safe Mode With Networking' so as to make sure I was in my normal user profile. I ran "HijackThis.exe" and sure enough, as msblocks said, I found "Winshow.dll" under BHO. I checked the box for it, clicked "Fix Checked" and it disappeared. I then manually deleted C:\WINNT\Winshow.cfg and C:\WINNT\Winshow.new, restarted my PC and everything is back to normal.

Your suggestion was a great help, msblocks! Thanks!

Response #7 gave the best description of the symptoms. I had several users on XP Home and found one with problem folders per Response #18 (had to look, couldn't find out how to find a "folder" as opposed to a file using search). Followed the lead from #18 and used hijack this in safe mode. THANKS MSBLOCKS!

Yeah, sorry about the red herring remark. If it's working for some folks then obviously it's a solution. I didn't see the symptoms you listed (no Winshow or Winlink folders, no msupdater.exe), but I ran spybot, destroyed about 10 things that it listed, and haven't had the problem since. So it probably got rid of something related to what you've posted.

I had the problem also. Started about the same time "8ad.com" with winshow infected my computer with winshow and all the pop ups. Went to 8ad.com site and at the bottom they have link to uninstall Winshow. Appears to have worked.

help I apperntly have this, I ran norton in safe mode..nothing found, had 3 winsave files, could remove 2, not 3, ran hijack, here is the file, anyone know what to remove?
Logfile of HijackThis v1.97.7
Scan saved at 4:02:50 PM, on 11/20/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\JOHNFA~1\LOCALS~1\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://findloss.com/home.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchv.com/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchv.com/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchv.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=3c01&lc=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
N2 - Netscape 6: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\John Faulds\Application Data\Mozilla\Profiles\default\x9yll6e3.slt\prefs.js)
O1 - Hosts: 66.197.100.83 auto.search.msn.com
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: WinShow module - {6CC1C918-AE8B-4373-A5B4-28BA1851E39A} - C:\WINDOWS\winshow.dll (file missing)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\googletoolbar.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\googletoolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [Smapp] Smtray.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~3\navapw32.exe
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKLM\..\RunOnce: [Compaq_RBA] C:\Program Files\Compaq\Compaq Advisor\bin\compaq-rba.exe -z
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Palm\HotSync.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
O8 - Extra context menu item: &Google Search - res://C:\WINDOWS\GoogleToolbar.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\WINDOWS\GoogleToolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\WINDOWS\GoogleToolbar.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\WINDOWS\GoogleToolbar.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page - res://C:\WINDOWS\GoogleToolbar.dll/cmtrans.html
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O9 - Extra button: Support (HKCU)
O12 - Plugin for .asx: C:\Program Files\Compaq\Netscape Custom NA XP\PLUGINS\npdsplay.dll
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=3c01&lc=0409
O16 - DPF: symsupportutil - https://www-secure.symantec.com/techsupp/activedata/symsupportutil.CAB
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pot7_x.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://65.83.242.101/sdccommon/download/tgctlcm.cab
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v43/yacscom.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20011217/qtinstall.info.apple.com/qt505/us/win/QuickTimeInstaller.exe
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6549A570-A17C-466B-B160-D6C10FE9261F} (EPIC Coupon Control) - http://216.24.232.130/ActiveX/EpicCouponStg.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/0fb5e03023def1/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://64.105.23.81/activex/AxisCamControl.ocx
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37581.589837963
O16 - DPF: {BD11A280-2E73-11CF-B6CF-00AA00A74DAF} - http://www.talkingbuddy.com/characters/candy.exe
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security1.norton.com/SSC/SharedContent/sc/bin/cabsa.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DE22A7AB-A739-4C58-AD52-21F9CD6306B7} (CTAdjust Class) - http://www.microsoft.com/typography/clearadj.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://officeupdate.microsoft.com/TemplateGallery/downloads/outc.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
O16 - DPF: {E87A6788-1D0F-4444-8898-1D25829B6755} - http://fdl.msn.com/public/chat/msnchat4.cab
O16 - DPF: {F5C90925-ABBF-4475-88F5-8622B452BA9E} (Compaq System Data Class) - http://www29.compaq.com/falco/SysQuery.cab

update!!! I used find on file, found one with winsave, deleted it, on first restart did not get copy error, but it is intermitint.. if anyone sees anything else, please let me know!
Thanks,
Jack

Ditto,

go to regedit find the path:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Delete the key: WinShowUpdate

"copy C:\\Documents and Settings\\CURRENT USER\\Application Data\\winshow\\winshow.new C:\\Documents and Settings\\CURRENT USER\\Application Data\\winshow\\winshow.dll"

I tried the directions a 2nd time that were provided in post #18 and found Winlink. HIJACKTHIS did the trick. Thank you so much!

I followed the instruction in post 18. 'Hijack this' did the job. I was able to delete 2 winshow files and so far my machine is performing properly. Thanks to all that helped, especially moblocks who put us on the right track.

yes sir, Hijack did great with me also..
thanks moblocks !

In win2k I also have the "cannot find file 'copy' error" intermittently on reboot. I did have the VBS virus ,I believe, but it was removed. I did have the msupdater virus and spybot removed it. Antoher problem I've been having is that after I'm online for a bit my web site shortcut icons won't open web pages until I reboot. I click them and it acts like its trying to open but stops. This was the affect I had when I had the blaster worm before it was patched.

In win2k I deleted several winshow and winlink files per message 18 but a zip file called search winshow I left because it looks like its part of spybots search process? Hijack this showed one winlink entry which I removed.
Forgot to mention another serious porblem I've had in this same time period is that on web pages words such as "books, games, " and who knows what else have become hyper links to a runsearch.com address. It's very annoying especially when reading serious literature and these show up.
Aside from deleting the entries symantic mentions I deleted a winlink folder (key?) in the registry ( I wonder if I should have but I have a back up). There is another winlink folder in the registry (key?) that gives an error message when I click on it that I couldn't readily delete so I left it. It's too early to tell if the webpage icon problem is fixed yet but the "word hyperlink" problem is fixed now for the first time since I noticed it.

We're having the same problem with "cannot find copy" when I bootup. It went away but came back today. I just ran ad-aware but Im not sure if I can safely get rid of everything that showed up. Can someone please help us out. Thanks so much.

ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ

#:1 [smss.exe]
FilePath : \SystemRoot\System32\
ThreadCreationTime : 11-22-2003 8:28:36 PM
BasePriority : Normal

#:2 [winlogon.exe]
FilePath : \??\C:\WINDOWS\system32\
ThreadCreationTime : 11-22-2003 8:28:38 PM
BasePriority : High

#:3 [services.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 11-22-2003 8:28:38 PM
BasePriority : Normal
FileSize : 99 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Services and Controller app
InternalName : services.exe
OriginalFilename : services.exe
ProductName : Microsoft
Created on : 8/6/2002 2:05:34 AM
Last accessed : 11/22/2003 8:28:36 PM
Last modified : 8/18/2001 12:00:00 PM

#:4 [lsass.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 11-22-2003 8:28:38 PM
BasePriority : Normal
FileSize : 11 KB
FileVersion : 5.1.2600.1106 (xpsp1.020828-1920)
ProductVersion : 5.1.2600.1106
CompanyName : Microsoft Corporation
FileDescription : LSA Shell (Export Version)
InternalName : lsass.exe
OriginalFilename : lsass.exe
ProductName : Microsoft
Created on : 8/6/2002 2:04:38 AM
Last accessed : 11/22/2003 8:28:36 PM
Last modified : 8/29/2002 10:41:26 AM

#:5 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 11-22-2003 8:28:39 PM
BasePriority : Normal
FileSize : 12 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
OriginalFilename : svchost.exe
ProductName : Microsoft
Created on : 8/6/2002 2:05:43 AM
Last accessed : 11/22/2003 8:30:31 PM
Last modified : 8/18/2001 12:00:00 PM

#:6 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 11-22-2003 8:28:39 PM
BasePriority : Normal
FileSize : 12 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
OriginalFilename : svchost.exe
ProductName : Microsoft
Created on : 8/6/2002 2:05:43 AM
Last accessed : 11/22/2003 8:30:31 PM
Last modified : 8/18/2001 12:00:00 PM

#:7 [explorer.exe]
FilePath : C:\WINDOWS\
ThreadCreationTime : 11-22-2003 8:28:41 PM
BasePriority : Normal
FileSize : 980 KB
FileVersion : 6.00.2800.1106 (xpsp1.020828-1920)
ProductVersion : 6.00.2800.1106
CompanyName : Microsoft Corporation
FileDescription : Windows Explorer
InternalName : explorer
OriginalFilename : EXPLORER.EXE
ProductName : Microsoft
Created on : 11/21/2003 12:15:30 AM
Last accessed : 11/22/2003 8:31:27 PM
Last modified : 8/29/2002 10:41:24 AM

#:8 [spoolsv.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 11-22-2003 8:28:42 PM
BasePriority : Normal
FileSize : 50 KB
FileVersion : 5.1.2600.0 (XPClient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Spooler SubSystem App
InternalName : spoolsv.exe
OriginalFilename : spoolsv.exe
ProductName : Microsoft
Created on : 8/6/2002 2:05:40 AM
Last accessed : 11/22/2003 8:28:36 PM
Last modified : 8/18/2001 12:00:00 PM

#:9 [avgserv.exe]
FilePath : C:\PROGRA~1\Grisoft\AVG6\
ThreadCreationTime : 11-22-2003 8:28:53 PM
BasePriority : Normal
FileSize : 20 KB
FileVersion : 6.0.1.9
ProductVersion : 6.0.1.9
Copyright : Copyright (c) GRISOFT(c) SOFTWARE 1998-2001
CompanyName : GRISOFT(c) SOFTWARE s.r.o
FileDescription : AvgServ - displays notification message
InternalName : AvgServ
OriginalFilename : AvgServ
ProductName : AVG6
Created on : 8/28/2003 8:32:39 PM
Last accessed : 11/22/2003 8:28:36 PM
Last modified : 8/14/2003 1:00:00 PM

#:10 [navapsvc.exe]
FilePath : c:\Program Files\Norton AntiVirus\
ThreadCreationTime : 11-22-2003 8:28:53 PM
BasePriority : Normal
FileSize : 113 KB
FileVersion : 8.07.17
ProductVersion : 8.07.17
Copyright : Copyright (c) 2000-2002 Symantec Corporation. All rights reserved.
CompanyName : Symantec Corporation
FileDescription : Norton AntiVirus Auto-Protect Service
InternalName : NAVAPSVC
OriginalFilename : NAVAPSVC.EXE
ProductName : Norton AntiVirus
Created on : 2/28/2002 1:29:26 AM
Last accessed : 11/22/2003 8:28:36 PM
Last modified : 2/28/2002 1:29:26 AM

#:11 [vsmon.exe]
FilePath : C:\WINDOWS\system32\ZoneLabs\
ThreadCreationTime : 11-22-2003 8:28:59 PM
BasePriority : Normal
FileSize : 773 KB
FileVersion : 3.1.395
ProductVersion : 3.1.395
Copyright : Copyright
CompanyName : Zone Labs Inc.
FileDescription : TrueVector Service
InternalName : vsmon
OriginalFilename : vsmon.exe
ProductName : TrueVector Service
Created on : 1/4/2003 12:23:46 AM
Last accessed : 11/22/2003 8:28:36 PM
Last modified : 9/6/2002 11:09:40 AM

#:12 [hpsysdrv.exe]
FilePath : C:\windows\system\
ThreadCreationTime : 11-22-2003 8:30:22 PM
BasePriority : Normal
FileSize : 51 KB
FileVersion : 1, 7, 0, 0
ProductVersion : 1, 7, 0, 0
Copyright : Copyright
CompanyName : Hewlett-Packard Company
FileDescription : hpsysdrv
InternalName : hpsysdrv
OriginalFilename : hpsysdrv.exe
ProductName : hpsysdrv
Created on : 7/24/2002 11:00:11 PM
Last accessed : 11/22/2003 8:30:22 PM
Last modified : 5/7/1998 11:04:38 PM

#:13 [hpqcmon.exe]
FilePath : C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\
ThreadCreationTime : 11-22-2003 8:30:26 PM
BasePriority : Normal
FileSize : 68 KB
FileVersion : 1.1.0.121
ProductVersion : 1.1.0.121
Copyright : Copyright (C) 2001
FileDescription : HpqCmon MFC Application
InternalName : HpqCmon
OriginalFilename : HpqCmon.EXE
ProductName : HpqCmon Application
Created on : 6/18/2002 6:11:24 AM
Last accessed : 11/22/2003 8:30:26 PM
Last modified : 6/18/2002 6:11:24 AM

#:14 [kbd.exe]
FilePath : C:\HP\KBD\
ThreadCreationTime : 11-22-2003 8:30:27 PM
BasePriority : High
FileSize : 60 KB
FileVersion : 1.0.2.0
ProductVersion : 1.0.2.0
Copyright : Copyright
CompanyName : Hewlett-Packard Company
FileDescription : KBD EXE
InternalName : KBD EXE
OriginalFilename : Kbd.exe
ProductName : Hewlett-Packard Company KBD EXE
Created on : 7/24/2002 11:22:28 PM
Last accessed : 11/22/2003 8:30:27 PM
Last modified : 7/7/2001 4:56:56 AM

#:15 [sgtray.exe]
FilePath : C:\Program Files\VERITAS Software\Update Manager\
ThreadCreationTime : 11-22-2003 8:30:27 PM
BasePriority : Normal
FileSize : 152 KB
FileVersion : 1.01.01a
Copyright : Copyright
CompanyName : VERITAS Software, Inc.
FileDescription : VERITAS Update Manager
Created on : 5/9/2002 3:01:00 PM
Last accessed : 11/22/2003 8:30:27 PM
Last modified : 5/9/2002 3:01:00 PM

#:16 [tfswctrl.exe]
FilePath : C:\WINDOWS\system32\dla\
ThreadCreationTime : 11-22-2003 8:30:29 PM
BasePriority : Normal
FileSize : 104 KB
FileVersion : 1.03.37a
Copyright : Copyright
CompanyName : VERITAS Software, Inc.
FileDescription : Direct Access Component
Created on : 7/24/2002 11:34:36 PM
Last accessed : 11/22/2003 8:30:28 PM
Last modified : 7/16/2002 3:03:00 PM

#:17 [igfxtray.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 11-22-2003 8:30:30 PM
BasePriority : Normal
FileSize : 152 KB
FileVersion : 3,0,0,1607
ProductVersion : 7,0,0,1607
Copyright : Copyright 1999-2002, Intel Corporation
CompanyName : Intel Corporation
FileDescription : igfxTray Module
InternalName : IGFXTRAY
OriginalFilename : IGFXTRAY.EXE
ProductName : Intel(R) Common User Interface
Created on : 5/15/2002 10:29:02 AM
Last accessed : 11/22/2003 8:30:30 PM
Last modified : 5/15/2002 10:29:02 AM

#:18 [hkcmd.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 11-22-2003 8:30:30 PM
BasePriority : Normal
FileSize : 112 KB
FileVersion : 3,0,0,1607
ProductVersion : 7,0,0,1607
Copyright : Copyright 1999-2002, Intel Corporation
CompanyName : Intel Corporation
FileDescription : hkcmd Module
InternalName : HKCMD
OriginalFilename : HKCMD.EXE
ProductName : Intel(R) Common User Interface
Created on : 5/15/2002 10:20:50 AM
Last accessed : 11/22/2003 8:30:30 PM
Last modified : 5/15/2002 10:20:50 AM

#:19 [navapw32.exe]
FilePath : C:\PROGRA~1\NORTON~1\
ThreadCreationTime : 11-22-2003 8:30:32 PM
BasePriority : Normal
FileSize : 73 KB
FileVersion : 8.07.17
ProductVersion : 8.07.17
Copyright : Copyright (c) 2000-2002 Symantec Corporation. All rights reserved.
CompanyName : Symantec Corporation
FileDescription : Norton AntiVirus Agent
InternalName : NAVAPW32
OriginalFilename : NAVAPW32.EXE
ProductName : Norton AntiVirus
Created on : 2/28/2002 1:27:58 AM
Last accessed : 11/22/2003 8:30:50 PM
Last modified : 2/28/2002 1:27:58 AM

#:20 [realsched.exe]
FilePath : C:\Program Files\Common Files\Real\Update_OB\
ThreadCreationTime : 11-22-2003 8:30:35 PM
BasePriority : Normal
FileSize : 148 KB
FileVersion : 0.1.0.1622
ProductVersion : 0.1.0.1622
Copyright : Copyright
CompanyName : RealNetworks, Inc.
FileDescription : RealNetworks Scheduler
InternalName : schedapp
OriginalFilename : realsched.exe
ProductName : RealOne Player (32-bit)
Created on : 3/8/2003 10:46:56 PM
Last accessed : 11/22/2003 8:30:35 PM
Last modified : 3/8/2003 10:46:56 PM

#:21 [avgcc32.exe]
FilePath : C:\PROGRA~1\Grisoft\AVG6\
ThreadCreationTime : 11-22-2003 8:30:37 PM
BasePriority : Normal
FileSize : 337 KB
FileVersion : 6, 0, 0, 515
ProductVersion : 6, 0, 0, 0
Copyright : Copyright
CompanyName : GRISOFT s.r.o.
FileDescription : AVG Control Center
InternalName : AvgCC32
OriginalFilename : AvgCC32.EXE
ProductName : AVG Anti-Virus System
Created on : 9/13/2003 6:30:31 PM
Last accessed : 11/22/2003 8:31:23 PM
Last modified : 9/13/2003 6:30:31 PM

#:22 [backweb-137903.exe]
FilePath : C:\Program Files\hp center\137903\Program\
ThreadCreationTime : 11-22-2003 8:30:47 PM
BasePriority : Normal
FileSize : 16 KB
Created on : 7/25/2002 12:33:17 AM
Last accessed : 11/22/2003 8:31:18 PM
Last modified : 7/25/2002 12:33:13 AM

#:23 [olfsnt40.exe]
FilePath : C:\Program Files\Microsoft Office\Office\1033\
ThreadCreationTime : 11-22-2003 8:30:52 PM
BasePriority : Normal
FileSize : 44 KB
FileVersion : 9.0.98.0105
ProductVersion : 9.0.98.0105
Copyright : Copyright (C) Symantec Corp. 1990-1998
CompanyName : Microsoft Corporation
FileDescription : Symantec Fax Starter Edition Port Launcher
InternalName : OLFSNT40.DLL
OriginalFilename : OLFSNT40.DLL
ProductName : Symantec Fax Starter Edition Printer Driver
Created on : 3/22/1999 1:00:00 AM
Last accessed : 11/22/2003 8:31:13 PM
Last modified : 3/22/1999 1:00:00 AM

#:24 [zonealarm.exe]
FilePath : C:\Program Files\Zone Labs\ZoneAlarm\
ThreadCreationTime : 11-22-2003 8:30:55 PM
BasePriority : Normal
FileSize : 407 KB
FileVersion : 3.1.395
ProductVersion : 3.1.395
Copyright : Copyright
CompanyName : Zone Labs Inc.
FileDescription : ZoneAlarm
InternalName : zonealarm
OriginalFilename : zonealarm.exe
ProductName : ZoneAlarm
Created on : 1/4/2003 12:23:48 AM
Last accessed : 11/22/2003 8:31:03 PM
Last modified : 9/6/2002 11:10:20 AM

#:25 [icq.exe]
FilePath : C:\Program Files\ICQ\
ThreadCreationTime : 11-22-2003 8:31:40 PM
BasePriority : Normal
FileSize : 2047 KB
FileVersion : 2003a Beta
ProductVersion : 2003a Beta
Copyright : Copyright
CompanyName : ICQ Inc.
FileDescription : ICQ
InternalName : ICQ
OriginalFilename : ICQ.exe
ProductName : ICQ
Created on : 12/28/2002 10:24:03 PM
Last accessed : 11/22/2003 8:32:08 PM
Last modified : 11/20/2002 11:18:28 AM

#:26 [iexplore.exe]
FilePath : C:\Program Files\Internet Explorer\
ThreadCreationTime : 11-22-2003 8:32:20 PM
BasePriority : Normal
FileSize : 89 KB
FileVersion : 6.00.2800.1106 (xpsp1.020828-1920)
ProductVersion : 6.00.2800.1106
CompanyName : Microsoft Corporation
FileDescription : Internet Explorer
InternalName : iexplore
OriginalFilename : IEXPLORE.EXE
ProductName : Microsoft
Created on : 11/21/2003 12:15:56 AM
Last accessed : 11/22/2003 8:32:22 PM
Last modified : 8/29/2002 10:41:26 AM

#:27 [ad-aware.exe]
FilePath : C:\Program Files\Lavasoft\Ad-aware 6\
ThreadCreationTime : 11-22-2003 8:34:25 PM
BasePriority : Normal
FileSize : 668 KB
FileVersion : 6.0.1.181
ProductVersion : 6.0.0.0
Copyright : Copyright
CompanyName : Lavasoft Sweden
FileDescription : Ad-aware 6 core application
InternalName : Ad-aware.exe
OriginalFilename : Ad-aware.exe
ProductName : Lavasoft Ad-aware Plus
Created on : 11/17/2003 3:05:18 AM
Last accessed : 11/22/2003 8:31:33 PM
Last modified : 7/13/2003 6:00:20 AM

Memory scan result :
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
New objects : 0
Objects found so far: 0

Started registry scan
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ

WinLink Object recognized!
Type : RegKey
Data :
Rootkey : HKEY_CLASSES_ROOT
Object : CLSID\{6CC1C91A-AE8B-4373-A5B4-28BA1851E39A}

WinLink Object recognized!
Type : RegKey
Data :
Rootkey : HKEY_LOCAL_MACHINE
Object : SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6CC1C91A-AE8B-4373-A5B4-28BA1851E39A}

WinShow Hijacker Object recognized!
Type : RegKey
Data :
Rootkey : HKEY_CLASSES_ROOT
Object : winlink.ViewSource

WinShow Hijacker Object recognized!
Type : RegKey
Data :
Rootkey : HKEY_CLASSES_ROOT
Object : winlink.ViewSource.1

Registry scan result :
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
New objects : 4
Objects found so far: 4

Started deep registry scan
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ

Deep registry scan result :
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
New objects : 0
Objects found so far: 4

ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ

Tracking Cookie Object recognized!
Type : File
Data : owner@2o7[1].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 11/20/2003 11:28:00 PM
Last accessed : 11/22/2003 8:35:59 PM
Last modified : 11/20/2003 11:45:07 PM

Tracking Cookie Object recognized!
Type : File
Data : owner@advertising[2].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 11/21/2003 9:39:23 PM
Last accessed : 11/22/2003 8:35:59 PM
Last modified : 11/21/2003 9:39:23 PM

Tracking Cookie Object recognized!
Type : File
Data : owner@atdmt[2].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 11/21/2003 12:45:52 AM
Last accessed : 11/22/2003 8:33:07 PM
Last modified : 11/21/2003 12:45:52 AM

Tracking Cookie Object recognized!
Type : File
Data : owner@bfast[1].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 11/21/2003 9:52:50 PM
Last accessed : 11/22/2003 8:35:59 PM
Last modified : 11/21/2003 9:52:51 PM

Tracking Cookie Object recognized!
Type : File
Data : owner@bluestreak[1].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 11/21/2003 9:53:07 PM
Last accessed : 11/22/2003 8:35:59 PM
Last modified : 11/21/2003 9:53:38 PM

Tracking Cookie Object recognized!
Type : File
Data : owner@centrport[1].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 11/22/2003 11:13:51 AM
Last accessed : 11/22/2003 8:35:59 PM
Last modified : 11/22/2003 11:13:51 AM

Other Object recognized!
Type : File
Data : owner@cgi-bin[2].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 11/21/2003 9:53:09 PM
Last accessed : 11/22/2003 8:35:59 PM
Last modified : 11/21/2003 9:53:09 PM

Tracking Cookie Object recognized!
Type : File
Data : owner@doubleclick[1].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 11/20/2003 10:06:08 PM
Last accessed : 11/22/2003 8:35:59 PM
Last modified : 11/20/2003 10:18:39 PM

Tracking Cookie Object recognized!
Type : File
Data : owner@fastclick[2].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 11/21/2003 12:52:02 AM
Last accessed : 11/22/2003 8:35:59 PM
Last modified : 11/21/2003 12:52:02 AM

Tracking Cookie Object recognized!
Type : File
Data : owner@gator[1].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 11/20/2003 11:13:51 PM
Last accessed : 11/22/2003 8:35:59 PM
Last modified : 11/21/2003 9:53:06 PM

Tracking Cookie Object recognized!
Type : File
Data : owner@qksrv[2].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 11/20/2003 11:38:17 PM
Last accessed : 11/22/2003 8:35:59 PM
Last modified : 11/20/2003 11:38:17 PM

Tracking Cookie Object recognized!
Type : File
Data : owner@servedby.advertising[2].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 11/21/2003 9:39:23 PM
Last accessed : 11/22/2003 8:35:59 PM
Last modified : 11/21/2003 9:39:23 PM

Tracking Cookie Object recognized!
Type : File
Data : owner@tmpad[2].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 11/21/2003 9:53:17 PM
Last accessed : 11/22/2003 8:35:59 PM
Last modified : 11/21/2003 9:53:17 PM

Tracking Cookie Object recognized!
Type : File
Data : owner@trafficmp[1].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 11/21/2003 9:53:17 PM
Last accessed : 11/22/2003 8:35:59 PM
Last modified : 11/21/2003 9:53:17 PM

Tracking Cookie Object recognized!
Type : File
Data : owner@tribalfusion[1].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 11/20/2003 11:40:57 PM
Last accessed : 11/22/2003 8:35:30 PM
Last modified : 11/20/2003 11:40:57 PM

Tracking Cookie Object recognized!
Type : File
Data : owner@xxxtoolbar[2].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 11/22/2003 1:36:05 AM
Last accessed : 11/22/2003 8:35:59 PM
Last modified : 11/22/2003 1:36:05 AM

ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ

Deep scanning and examining files (C:)
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ

Performing conditional scans..
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ

WinLink Object recognized!
Type : RegKey
Data :
Rootkey : HKEY_CURRENT_USER
Object : Software\winlink

WinLink Object recognized!
Type : Folder
Object : c:\documents and settings\owner\application data\winlink

WinLink Object recognized!
Type : File
Data : keywords.dat
Object : c:\documents and settings\owner\application data\winlink\
FileSize : 3 KB
Created on : 11/4/2003 7:28:34 PM
Last accessed : 11/22/2003 8:32:21 PM
Last modified : 11/22/2003 1:34:07 AM

WinLink Object recognized!
Type : File
Data : winlink.dll
Object : c:\documents and settings\owner\application data\winlink\
FileSize : 35 KB
FileVersion : 1, 0, 0, 2
ProductVersion : 1, 0, 0, 2
Copyright : Copyright 2003
FileDescription : winlink Module
InternalName : winlink
OriginalFilename : winlink.DLL
ProductName : winlink Module
Created on : 11/4/2003 7:27:18 PM
Last accessed : 11/22/2003 8:32:21 PM
Last modified : 11/4/2003 7:27:20 PM

WinLink Object recognized!
Type : File
Data : winlink.new
Object : c:\documents and settings\owner\application data\winlink\
FileSize : 36 KB
FileVersion : 1, 0, 0, 4
ProductVersion : 1, 0, 0, 4
Copyright : Copyright 2003
FileDescription : winlink Module
InternalName : winlink
OriginalFilename : winlink.DLL
ProductName : winlink Module
Created on : 11/16/2003 12:37:07 AM
Last accessed : 11/22/2003 8:36:35 PM
Last modified : 11/22/2003 1:34:08 AM

WinShow Hijacker Object recognized!
Type : Folder
Object : c:\documents and settings\owner\application data\winshow

WinShow Hijacker Object recognized!
Type : File
Data : dict.dat
Object : c:\documents and settings\owner\application data\winshow\
FileSize : 2 KB
Created on : 11/4/2003 7:28:34 PM
Last accessed : 11/22/2003 8:36:35 PM
Last modified : 11/4/2003 7:28:34 PM

WinShow Hijacker Object recognized!
Type : File
Data : winshow.cfg
Object : c:\documents and settings\owner\application data\winshow\

Created on : 11/4/2003 7:28:34 PM
Last accessed : 11/22/2003 8:36:35 PM
Last modified : 11/4/2003 7:28:34 PM

Conditional scan result:
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
New objects : 8
Objects found so far: 28

12:36:35 PM Scan complete

Summary of this scan
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
Total scanning time :00:01:59:719
Objects scanned :39053
Objects identified :28
Objects ignored :0
New objects :28

I have the same problem. I an running XP home and have four users. The error message appears as follows: after one user surfs the web using IE Explorer 6.0, logs off his XP account, and the the error occurs during the log on of another user. I can make the error occur repatedly and predictably this (but no other ) way. I will try the info in post 18 to see what happens. Of course, with kids, we have a million things loaded on our coputer all the time.

Hey, I have to agree with response number 18 to a certain extent. However there is more to it than what is mentioned. The initial problem occurs after a trojan horse start page virus gets on your pc. Norton Anti-Virus will find this and remove it. But there are a lot of remnents left over in the registry as well as the winshow.cfg, winshow.dll and winshow.new, you also want to run regedit and delete all of the keys associated with those files, do this by searching on winshow and winlink. And the las twist is that there are some MRxSMB entries that need to be removed from the registry and there are files that need to be searched as well. The whole purpose of the trojan horse virus is to hijack the pc and use it for denial of service attacks. This took me a large amount of hour to clean up my two pcs. You may even find a good luck message from MRxSMB in your registry like I did. Once all is removed the problem is gone and it does not return.

I also found similar solutions as post 18. But here are a few different details. Norton had removed a trojan earlier, but Norton scanned clean. I went to the Trend Micro site, and used ttheir online scanner to find the issue. Using a combination of their scanner and the removal instructions at Symantec, I went through 3 or 4 removals before I got everything done. I would recommend Trend Micro's scanner to help you resolve this one. Good luck.

hey, I have not gotton it in a few days.. so Im declaring the hijack fix a good one!!!
Thanks for the info!
Jack

All I have to Say is "Spybot-Search and Destroy" From download.com..I ran it, and haven't had a problem since. And it finds the registry entry, too..all you have to do is run it..and it's free, of course!

...and believe me..I was frustrated about this error!!