i keep getting the message "Windows Explorer has encountered a problem and needs to close. We are sorry for the inconvenience." from the moment i turn on my PC.. it came outta nowhere and i dont know how to fix it.. i click to see what the error report contains and it says this "AppName: explorer.exe AppVer: 6.0.2800.1106 ModName: msvcrt.dll ModVer: 7.0.2600.1106 Offset: 0003213b".. I ran Stinger but no luck.. i ran HijackThis and this was the log : Logfile of HijackThis v1.97.5 Scan saved at 13:16:52, on 18/11/2003 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\windows\system32\dlldmt.exe C:\windows\system32\regsrv.exe C:\PROGRA~1\COMMON~1\Services\wssdtu.exe C:\PROGRA~1\Ahead\InCD\InCD.exe C:\PROGRA~1\COMMON~1\Services\wsys.exe F:\PROGRA~1\D-Tools\daemon.exe C:\WINDOWS\svchost.exe C:\windows\system32\mscnt.exe C:\WINDOWS\System32\61375063.exe G:\PROGRA~1\AIM95\aim.exe C:\PROGRA~1\MSNMES~1\MsnMsgr.exe C:\PROGRA~1\MESSEN~1\msmsgs.exe C:\PROGRA~1\CConnect\CConnect.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\explorer.exe C:\WINDOWS\System32\dwwin.exe C:\PROGRA~1\INTERN~1\IEXPLORE.exe F:\GETRIG~1\HIJACK~1.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.search-1.net/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.hand-book.com/search/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.hand-book.com/search/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.hand-book.com/search/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.hand-book.com/search/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.hand-book.com/search/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hand-book.com/hp/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.hand-book.com/search/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.hand-book.com/search/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.hand-book.com/search/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.hand-book.com/search/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.hand-book.com/search/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.hand-book.com/search/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant = http://www.search-1.net/search.html R1 - HKCU\Software\Microsoft\Internet Explorer,CustomizeSearch = http://www.search-1.net/search.html F1 - win.ini: run=c:\windows\system32\dlldmt.exe O2 - BHO: (no name) - {029CA12C-89C1-46a7-A3C7-82F2F98635CB} - C:\Program Files\Kontiki\bin\bh304181.dll O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\Program Files\ISTbar\istbar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [System Profile] c:\windows\system32\regsrv.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [Folder Service ] C:\Program Files\Common Files\Services\wssdtu.exe O4 - HKLM\..\Run: [Enumeration Service ] C:\Program Files\Common Files\Services\wsys.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\PROGRA~1\QUICKT~1\qttask.exe" -atboottime O4 - HKLM\..\Run: [RDLL] RunDll16.exe O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.exe /AUTORUN O4 - HKLM\..\Run: [DAEMON Tools-1033] "F:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [System Service] C:\WINDOWS\System32\msrexe.exe O4 - HKLM\..\Run: [Online Service] C:\WINDOWS\svchost.exe O4 - HKLM\..\Run: [win32gb] c:\windows\system32\win32gb.exe /noconnect O4 - HKLM\..\Run: [BOFVMSGNW] C:\WINDOWS\BOFVMSGNW.exe O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe" O4 - HKLM\..\Run: [Mscnt] c:\windows\system32\mscnt.exe /noconnect O4 - HKLM\..\Run: [Mswavedll] c:\windows\system32\mswavedll.exe O4 - HKLM\..\Run: [Videocntl] c:\windows\system32\videocntl.exe O4 - HKLM\..\Run: [Dlldmt] c:\windows\system32\dlldmt.exe O4 - HKLM\..\Run: [78501528.exe] C:\WINDOWS\System32\78501528.exe O4 - HKLM\..\RunServices: [RDLL] RunDll16.exe O4 - HKCU\..\Run: [AIM] G:\PROGRA~1\AIM95\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.exe" /background O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\msmsgs.exe" /background O4 - HKCU\..\Run: [AddClass] C:\WINDOWS\AddClass.exe O4 - Startup: PowerReg Scheduler.exe O4 - Startup: Ultra Hal Text-to-Speech Reader Startup.lnk = ? O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: CorrectConnect.lnk = C:\Program Files\CConnect\CConnect.exe O4 - Global Startup: Exif Launcher.lnk = F:\Program Files\FinePixViewer\QuickDCF.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe O8 - Extra context menu item: Download with GetRight - F:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: Get It With Kontiki - res://C:\Program Files\Kontiki\bin\bh304181.dll/201 O8 - Extra context menu item: Open with GetRight Browser - F:\Program Files\GetRight\GRbrowse.htm O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) O9 - Extra button: AOL Instant Messenger (TM) (HKLM) O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Messenger (HKLM) O13 - DefaultPrefix: http://ehttp.cc/? O13 - WWW Prefix: http://ehttp.cc/? O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {F5192746-22D6-41BD-9D2D-1E75D14FBD3C} (ddm_download.ddm_control) - http://download.rfwnad.com/cab/crack.CAB Can someone please help? Thank You.. Shock.

The last item in your list is a downloader trojan. (I don't know if there are other things in the list that are bad.) Assume you have run your AV scan. Suggest you run AdAware and Spybot. You can also fun a Google search for rfwnad and may find some solutions. Spybot AdAware

i ran both AdAware and Spybot but its still happening.. it just started happenin out of nowhere.. any more help?!!?

shockwave, Try this site for comeplete explainations to your hijack this logs and get a better understanding as to what is what. http://www.spywareinfo.com/~merijn/htlogtutorial.html#r good luck, rc