This all started to happen to me 2 days ago, and I have been trying to fix the problem since. The problem is with many bugs that all happened at the same time that I believe that might be all related. I get a Application Error on my svchost.exe at the following address "0x0018759f" reason it cannot "read". I click, OK. Then after that I can't use any internet programs, I can't even restart the computer. So I do the manual boot. Get back into windows, run an ativirus program, no viruses. Then bang the application error happen again. So far it has been doing this every so often after login. OK restart, go into safe mode, Taskmanager, and also do a "Tasklist /SVC" to see exactly what dlls this svchost is dealing with. It is the biggie one, the one that deals with all the dlls to run windows, specifly internet dlls. Now as I was hopeing this was not the least of my problems it gets worst. I find that my computer is auto starting a msblast.exe, and winmain.exe. Ok made sure I was in safemode, did a removeal on the files, and the startups in regedit. Ran Smyantic removal tool to make sure it was gone (also twice). Restart computer, check task manager no did not work, the msblast.exe was recreated in the system32, and it was auto intereded in the Run in the registry. So this is how far I am now. Here is my HiJackThis Log to see if any of you can help me fix this BIG problem. ---------- Logfile of HijackThis v1.97.6 Scan saved at 5:27:30 AM, on 1/1/2004 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.exe C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.exe C:\WINDOWS\System32\msblast.exe C:\PROGRA~1\Grisoft\AVG6\avgserv.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = localhost:8088 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://193.125.201.50 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.white-pages.ws/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://193.125.201.50 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = C:\WINDOWS\system32\searchbar.html R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant = http://www.search-1.net/search.html R1 - HKCU\Software\Microsoft\Internet Explorer,CustomizeSearch = http://www.search-1.net/search.html R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O1 - Hosts: 66.230.146.42 gator.com #cooklop O1 - Hosts: 66.230.146.42 www.gator.com #cooklop O1 - Hosts: 66.230.146.42 doubleclick.net #cooklop O1 - Hosts: 66.230.146.42 www.doubleclick.net #cooklop O1 - Hosts: 66.230.146.42 tripod.com #cooklop O1 - Hosts: 66.230.146.42 www.tripod.com #cooklop O1 - Hosts: 66.230.146.42 geocities.com #cooklop O1 - Hosts: 66.230.146.42 www.geocities.com #cooklop O1 - Hosts: 66.230.146.42 adultfriendfinder.com #cooklop O1 - Hosts: 66.230.146.42 www.adultfriendfinder.com #cooklop O1 - Hosts: 66.230.146.42 cj.com #cooklop O1 - Hosts: 66.230.146.42 www.cj.com #cooklop O1 - Hosts: 66.230.146.42 paypopup.com #cooklop O1 - Hosts: 66.230.146.42 www.paypopup.com #cooklop O1 - Hosts: 66.230.146.42 worldsex.com #cooklop O1 - Hosts: 66.230.146.42 www.worldsex.com #cooklop O1 - Hosts: 66.230.146.42 free6.com #cooklop O1 - Hosts: 66.230.146.42 trafficmp.com #cooklop O1 - Hosts: 66.230.146.42 www.trafficmp.com #cooklop O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: CCHelper - {0CF0B8EE-6596-11D5-A98E-0003470BB48E} - C:\Program Files\Panicware\Pop-Up Stopper Pro\CCHelper.dll O2 - BHO: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O3 - Toolbar: Pa&nicware Pop-Up Stopper Pro - {B1E741E7-1E77-40D4-9FD8-51949B9CCBD0} - C:\Program Files\Panicware\Pop-Up Stopper Pro\popuppro.dll O3 - Toolbar: (no name) - {821F30D5-37EC-4695-B952-93CA2E8B9E79} - (no file) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: 3DNA Toolbar - {2ECB7FB2-0333-416F-92FD-4904AD49252B} - C:\WINDOWS\system32\3DNATO~1.DLL O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll O4 - HKLM\..\Run: [AVG_CC] C:\Program Files\Grisoft\AVG6\avgcc32.exe /startup O4 - HKLM\..\Run: [ShellEx] C:\WINDOWS\System32\ShellEx.exe O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.exe O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.exe O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.exe O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [anvshell] anvshell.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SpyBlocker] C:\Program Files\SpyBlocker Software\spyblocker.exe O4 - HKLM\..\Run: [kernel32] C:\WINDOWS\System32\kernel32.dlI O4 - HKLM\..\Run: [windows auto update] msblast.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM) O9 - Extra button: ICQ (HKLM) O9 - Extra 'Tools' menuitem: ICQ (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Messenger (HKLM) O12 - Plugin for .mdz: C:\Program Files\Internet Explorer\Plugins\npmod32.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: ChatSpace Full Java Client 3.1.0.217 - http://irc.everywherechat.com:8000/Java/cfs31217.cab O16 - DPF: ChatSpace Full Java Client 4.0.0.300 - http://demo.chatspace.com/ChatSpace/Java/cfs40300.cab O16 - DPF: ChatSpace Java Client 2.1.0.90 - http://64.85.20.110:8041/Java/cs4ms090.cab O16 - DPF: ConferenceRoom Java Client - http://chat.privatefeeds.com:8000/java/cr.cab O16 - DPF: GraphicalChat Application - http://www.onchat.com/ChatWorld/chat-signed-ie.cab O16 - DPF: LifeFXDataFileInstaller - http://www.facemail.com/LifeFXDataFileInstaller.cab O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSInstallers/MetaStream3.cab O16 - DPF: {0FC6BF2B-E16A-11CF-AB2E-0080AD08A326} (LiveUpdate Crescendo) - http://www.liveupdate.com/controls/getcab2.dll O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {1DA3C4AB-E6B6-47A6-B0F3-1BD81524B51B} (ActiveWorldsDownload Control) - http://www.activeworlds.com/products/ActiveWorldsDownload.cab O16 - DPF: {1FB464C8-09BB-4017-A2F5-EB742F04392F} (Microsoft Terminal Services Control (redist)) - http://24.156.255.44/tsweb/msrdp.cab O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://64.124.45.181/downloads/ccpm_0237.cab O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v43/yacscom.cab O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0309.cab O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab O16 - DPF: {31FD415A-1103-4329-B323-2DE693146C4E} (InstallHelper Class) - http://survey.prod.there.com/qualsurvey/ThereInstallHelper.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20020713/qtinstall.info.apple.com/samantha/us/win/QuickTimeInstaller.exe O16 - DPF: {65683480-5699-11D4-9D2C-525400E80BD5} (GlobFXCtl Class) - http://www.globfx.com/webplayer/globfx.cab O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.blizzard.com/register/war3beta/si.cab O16 - DPF: {6D5FCFCB-FA6C-4CFB-9918-5F0A9F7365F2} (GigexCtrl ActiveX) - http://www.gigex.com/tv/igor/gigexagent.dll O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab O16 - DPF: {72C23FEC-3AF9-48FC-9597-241A8EBDFE0A} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetupml.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab O16 - DPF: {88D8E8B7-A33B-4417-A385-8373484D43ED} (InstallHelper Class) - file://C:\DOCUME~1\Shad0w\LOCALS~1\Temp\ThereInstallHelper.dll O16 - DPF: {8B486EF6-6B2A-4A1E-BB0D-236CB2DBB8D2} (There Voice Trainer) - file://C:\Program Files\There\ThereClient\ThereVoiceTrainer.dll O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37723.9687152778 O16 - DPF: {AAF421E6-7914-430A-9981-72B31AFF3BF4} (There Launcher) - file://C:\Program Files\There\ThereClient\ThereLauncher.dll O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://www.wildtangent.com/install/wdriver/action/invincible/wtinst.cab O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} - http://dload.ipbill.com/del/loader.cab O16 - DPF: {BF3CD111-6278-11D2-9EA3-00A0C9251384} (O2C-Player Version 1.x) - http://www.o2c.de/download/O2CPlayer.CAB O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} (NPX Control) - http://kr.pristontale.com/nprotect/nprotect/npx.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553556600} - http://active.macromedia.com/flash2/cabs/swflash.cab O16 - DPF: {E5F55B7A-89D5-4387-B665-43437B3E293D} (X2Run Control) - http://www.x2game.com/Control/X2Run.Cab O16 - DPF: {F2A84794-EE6D-447B-8C21-3BA1DC77C5B4} (SDKInstall Class) - http://activex.microsoft.com/activex/controls/sdkupdate/sdkinst.cab O16 - DPF: {F5192746-22D6-41BD-9D2D-1E75D14FBD3C} (ddm_download.ddm_control) - http://download.rfwnad.com/cab/crack.CAB O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab O16 - DPF: {FE5D6722-826F-11D5-A24E-0060B0F1A5AE} (Tukati Launcher) - http://3dgamers.tukati.com/tukati/1.7.20.20/tukati.cab ------- Any help would be strongly appericated.

Here is the logfile check list . http://hjt.wizardsofwebsites.com/ http://www.spywareinfo.com/bhos/ http://home01.wxs.nl/~kleyn080/BHO_list.html http://www.spywareinfo.com/~merijn/htlogtutorial.html#r http://www.computercops.biz/postt6393.html http://www.google.com/search?q=spyware+list ================================= Remove Spyfiles by using these 5 programs . Make sure you use the SpyBot/SpywareBlaster/Ad-aware/Bazooka/Swat It > Online > Update button regularly . Once you have the program installed , open SpyBot and select the "Immunize" icon on the left & Click on Immunize , in the new page . Then check the box "lock hosts file read-only as protection against hijackers". http://beam.to/spybotsd http://www.wilderssecurity.com/spywareblaster.html http://www.lsfileserv.com/ http://www.lavasoftsupport.com/index.php?showtopic=11613 Bazooka http://www.kephyr.com/spywarescanner/index.html Swat It http://swatit.org/ ========================================= Why is Remote Procedure Call shutting down my computer after 60 seconds? Why is svchost.exe crashing my computer? Why is dllhost.exe taking 100% of my CPU time? http://www.blackviper.com/AskBV/tech10.htm

Jason, The link below has instructions on "How to get rid of Lovsan (ALIAS: MSBlast, Poza, Blaster, W32/Msblast, Lovesun worm) in 8 minutes" and has worked well for many. I would give this a try as the "msblast.exe" shouldn't be showing up in Task Manager. http://www.f-secure.com/v-descs/msblast.shtml Tufenuf

First thing - go to windows update and update your files, especially the blaster patch. Seecond do a search on this site for blaster worm and you will get many ways to remove it.

Also wouldn't hurt to download CWShredder and give it a try...it does nothing for blaster but might clean up those R1, R0, and 01 entries. The dl is near the bottom of the page. http://www.spywareinfo.com/~merijn/cwschronicles.html As some of the links above will suggest...turn on your firewall to keep from re-infecting yourself with blaster while trying to get the removal tool and patch. How to enable/disable xp's firewall http://support.microsoft.com/default.aspx?kbid=283673 And just in case...here's a few online virus/trojan scans: http://www.pandasoftware.com/activescan/com/activescan_principal.htm http://www.ravantivirus.com/scan/ http://housecall.trendmicro.com/housecall/start_corp.asp http://www.trojanscan.com/trojanscan/scanner.htm Recommended to disable your own antivirus while running these scans to prevent conflicts. Good luck and Happy New Year!