Hello Everyone! This is my first time posting here(and probally not hte last) Anyway, I got a really weird problem. 1. My homepage has been hijacked and I get redirected when I do a search. CWshredder and Spybot Search and destroy does not solve this problem 2. I have MSN. When I click the little envolope to check my mail, a screen pops up that says "Click the program you want to use to open the file MSN75.mailhost 3. SOmething called C:WIndows\ht.hta has been installed into my computer. 4. (and this is the wierdest problem.) Well, my friend came over and installed doom 2. When he left, I unistalled(because it is a bullsh!t game) and did a search in my computer 'doom 2' to see if there were any files left. Well, when I did this about 1,000 came up dating back from 95. THis wouldn't be a problem, but I just reformatted my computer. I need a lot of help Ok, I am computer illiterate so please bare with me. And please, please reply please. I am desprate and considering reformatting my computer again. I will post my HijackThis! log if it is requested.

Okay Listen i need to to Do this: Hit these keys Control + alt + Delete and tell me what is running After you tell me what is running i will know what to do next

Ok, thanks for replying This is what's running Computing.Net-A hell of a lot of problems Explorer C:\WINDOWS\odbc.hta Msnmsngr Psfree Anticwd32 Wkufind A Please, please reply

Hi ShawshankRedemption, Metthew, hello everyone, ShawshankRedemption, Post your hijackthis log. Best Regards, Mesich

Ok, this is my log. Logfile of HijackThis v1.97.7 Scan saved at 2:33:34 PM, on 6/27/04 Platform: Windows 98 Gold (Win9x 4.10.1998) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.exe C:\WINDOWS\SYSTEM\MPREXE.exe C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\EXPLORER.exe C:\WINDOWS\SYSTEM\ATICWD32.exe C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKUFIND.exe C:\WINDOWS\SYSTEM\A.exe C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.exe C:\WINDOWS\SYSTEM\DDHELP.exe C:\WINDOWS\SYSTEM\SPOOL32.exe C:\PROGRAM FILES\AIM\AIM.exe C:\PROGRAM FILES\MSN\MSNCOREFILES\MSN6.exe C:\WINDOWS\SYSTEM\PSTORES.exe C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.exe C:\MY DOCUMENTS\MY DOWNLOADS\HIJACKTHIS.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://1-se.com/srchasst.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://1-se.com/home.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://1-se.com/home.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\WINDOWS\TEMP\sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie-search.com/srchasst.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://1-se.com/srchasst.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://1-se.com/home.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\homepage.htm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://1-se.com/home.html (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie-search.com/srchasst.html (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\WINDOWS\TEMP\sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://1-se.com/home.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://1-se.com/srchasst.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://1-se.com/srchasst.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = http://1-se.com/srchasst.html (obfuscated) O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [VortexTray] ASP4TRAY.exe O4 - HKLM\..\Run: [systray] C:\WINDOWS\SYSTEM\A.exe O4 - HKLM\..\Run: [Windows Shell Library Loader] load shell32.dll /c /set O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.exe" O8 - Extra context menu item: Web Search - C:\WINDOWS\ex.htm O9 - Extra button: AIM (HKLM) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O19 - User stylesheet: C:\WINDOWS\color.css

Hi ShawshankRedemption, hello everyone Remove the following using hijackthis: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://1-se.com/srchasst.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://1-se.com/home.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://1-se.com/home.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\WINDOWS\TEMP\sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie-search.com/srchasst.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://1-se.com/srchasst.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://1-se.com/home.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\homepage.htm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://1-se.com/home.html (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie-search.com/srchasst.html (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\WINDOWS\TEMP\sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://1-se.com/home.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://1-se.com/srchasst.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://1-se.com/srchasst.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = http://1-se.com/srchasst.html (obfuscated) O4 - HKLM\..\Run: [systray] C:\WINDOWS\SYSTEM\A.exe O4 - HKLM\..\Run: [Windows Shell Library Loader] load shell32.dll /c /set O8 - Extra context menu item: Web Search - C:\WINDOWS\ex.htm O19 - User stylesheet: C:\WINDOWS\color.css Restart the computer. Go to C:\Windows\Temp and delete all of the files in that folder. In C:\Windows delete ex.htm In C:\Windows\System delete A.exe Restart the computer again. Best Regards, Mesich

Ok, I did all that. But I found a lot of files that said modified from 01(keeping in mind I reformated in January) that had QTV.dll. I deleted a lot of them. What were they? Anyway, this is my new HijackThis log Logfile of HijackThis v1.97.7 Scan saved at 10:32:13 PM, on 6/27/04 Platform: Windows 98 Gold (Win9x 4.10.1998) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.exe C:\WINDOWS\SYSTEM\MPREXE.exe C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\EXPLORER.exe C:\WINDOWS\SYSTEM\ATICWD32.exe C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKUFIND.exe C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.exe C:\PROGRAM FILES\MSN\MSNCOREFILES\MSN6.exe C:\WINDOWS\SYSTEM\DDHELP.exe C:\WINDOWS\SYSTEM\PSTORES.exe C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.exe C:\MY DOCUMENTS\MY DOWNLOADS\HIJACKTHIS.exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [VortexTray] ASP4TRAY.exe O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.exe" O9 - Extra button: AIM (HKLM) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Also, do you think I should go through my computer and delete all the files that said were modified before I reformatted? Because they take up a lot of information. I have nothing in my computer except them.