Virus checker located BELT.exe and LOADER.exe but cannot isolate either. I tried Spybot and AdAware as well. Any help. Here is the Hijack log. Logfile of HijackThis v1.97.7 Scan saved at 8:56:09 AM, on 12/13/2003 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\System32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.exe C:\PROGRA~1\Grisoft\AVG6\avgserv.exe C:\WINDOWS\System32\cisvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe C:\Documents and Settings\ \iISystem Wiper\SystemWiper.exe C:\Program Files\Omniquad MyPrivacy\MyPrivacy.exe C:\Documents and Settings\ \ScrubXP\scrubxp.exe C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe C:\DOCUME~1\ ~1\FHE\Server\FheSrv32.exe C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Open Site\opnste.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\csrss.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\AIM95-1\aim.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Sony\VAIO Action Setup\VAServ.exe C:\Program Files\VisualZone\VisualZone.exe C:\WINDOWS\wanmpsvc.exe C:\Program Files\WinZip\WZQKPICK.exe C:\Program Files\Zone Labs\ZoneAlarm\zaplus.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Empty Temp Folders 2.8.3\emprun.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\System32\cidaemon.exe C:\WINDOWS\system32\ntvdm.exe c:\DOCUME~1\ ~1\WINPAT~1\WINPAT~1.exe C:\Program Files\Internet Explorer\iexplore.exe D:\Ryan\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/news/default.asp?cp1=1 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.rr.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer O1 - Hosts: comments (such as these) may be inserted on individual O2 - BHO: (no name) - {02DCA195-602B-4B1F-83FF-381B7E804BDB} - C:\WINDOWS\system32\HDBHO.dll O2 - BHO: CleanMyPC Popup Blocker - {7A9BC6B1-7F27-47c6-A66D-13582E81E537} - C:\Program Files\CleanMyPC Popup Blocker\CleanBHO.dll O2 - BHO: Clear Search - {947E6D5A-4B9F-4CF4-91B3-562CA8D03313} - C:\Program Files\ClearSearch\IE_ClrSch.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\MSDXM.OCX O3 - Toolbar: CleanMyPC Toolbar - {04164EC4-1E48-4279-818E-3721931E7636} - C:\Program Files\CleanMyPC Popup Blocker\CleanBar.dll O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) O4 - HKLM\..\Run: [RegisterDropHandler] "C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.exe" O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe O4 - HKLM\..\Run: [iIWiper] "C:\Documents and Settings\ \iISystem Wiper\SystemWiper.exe " m O4 - HKLM\..\Run: [MyPrivacy] C:\Program Files\Omniquad MyPrivacy\MyPrivacy.exe O4 - HKLM\..\Run: [sc] "C:\Documents and Settings\ \ScrubXP\scrubxp.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Hacker Eliminator] C:\Documents and Settings\ \Hackelim\HackerEliminator.exe O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.exe TWEAKUI.CPL,TweakMeUp O4 - HKLM\..\Run: [FheSrv] C:\DOCUME~1\ ~1\FHE\Server\FheSrv32.exe O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [CZCJ] C:\WINDOWS\CZCJ.exe O4 - HKLM\..\Run: [ELRYF] C:\WINDOWS\ELRYF.exe O4 - HKLM\..\Run: [Open Site] C:\Program Files\Open Site\opnste.exe O4 - HKLM\..\Run: [csrss] C:\WINDOWS\csrss.exe O4 - HKLM\..\Run: [WinPatrol] c:\DOCUME~1\ ~1\WINPAT~1\WinPatrol.exe O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95-1\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKLM\..\RunOnce: [_UnwiseNPO] cmd.exe /c del C:\WINDOWS\System32\n3tpa1.dll O4 - HKLM\..\RunOnce: [_UnwiseNPO_] cmd.exe /c del C:\WINDOWS\System32\boot0k.dll O4 - Startup: emprun.lnk = C:\Program Files\Empty Temp Folders 2.8.3\emprun.exe O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe O4 - Global Startup: Billminder.lnk = C:\Program Files\QUICKENW\billmind.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\QUICKENW\bagent.exe O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\QUICKENW\QWDLLS.exe O4 - Global Startup: VAIO Action Setup (Server).lnk = C:\Program Files\Sony\VAIO Action Setup\VAServ.exe O4 - Global Startup: VisualZone.lnk = C:\Program Files\VisualZone\VisualZone.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.exe O4 - Global Startup: ZoneAlarm Plus.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zaplus.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: Add to filterlist (WebWasher) - http://-Web.Washer-/ie_add O8 - Extra context menu item: Download the ¤t page with Offline Explorer - file://C:\Documents and Settings\ \Offline Explorer\Add_AllO.htm O8 - Extra context menu item: Download using Offline &Explorer - file://C:\Documents and Settings\ \Offline Explorer\Add_UrlO.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra 'Tools' menuitem: MaxSpeed (HKLM) O9 - Extra button: Create Mobile Favorite (HKLM) O9 - Extra button: AIM (HKLM) O9 - Extra button: Omniquad MyPrivacy (HKLM) O9 - Extra 'Tools' menuitem: Omniquad MyPrivacy (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.rr.com O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://active.macromedia.com/director/cabs/sw.cab O16 - DPF: {1FDEC088-A699-46FE-BF76-D5FD6DAE6150} (UCSearch.ucUCSearch) - http://www.armbender.com/UCSearch.CAB O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20020323/qtinstall.info.apple.com/qt505/us/win/QuickTimeInstaller.exe O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/20928f7c4e1186c0d520/netzip/RdxIE601.cab O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab O16 - DPF: {814EA0DA-E0D9-4AA4-833C-A1A6D38E79E9} (DASWebDownload Class) - http://das.microsoft.com/activate/cab/x86/i486/NTANSI/retail/DASAct.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37563.7660532407 O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} - http://a840.g.akamai.net/7/840/5805/v1000/www.contentwatch.com/audit/includes/ContentAuditControl.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {DDFFA75A-E81D-4454-89FC-B9FD0631E726} - http://www.bundleware.com/L2M.cab O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://officeupdate.microsoft.com/TemplateGallery/downloads/outc.cab O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} (Live Collaboration) - https://rr.esecurecare.net/rnt/rnl/java/RntX.cab O16 - DPF: {F5131C24-E56D-11CF-B78A-444553540000} (Ikonic Menu Control) - http://activex.microsoft.com/controls/iptdweb/ikcntrls.cab O16 - DPF: {FE67C682-F5EA-11CF-9C2F-0000C0C83ADC} (Jamba Class Library) - http://www.unl.edu/wglider/tutor/Jambalib.cab O16 - DPF: {FF054BED-D972-4215-897E-726C3488DDBB} - http://supportcentral.sel.sony.com/sdccommon/download/sonyctl.CAB

http://www.computing.net/security/wwwboard/forum/7431.html

http://www.computing.net/security/wwwboard/forum/6433.html http://www.computing.net/windowsxp/wwwboard/forum/87605.html Heed the words of the Moderator V...