Dear support
Thank you very much for your advice.
1. I want to remove Norton Anti-virus coz it is already expired. I'm now using AVG free edition. However, in Add/Remove Programs, i can only see "Norton Internet Security" and "Norton WMI Update". Should I remove both items in order to remove Norton Anti-virus? Please advise.
2. I could find "My Search Bar" in Add/Remove Programs and want to remove it as you recommended. However, when I click remove, a blank window popup (like an IE window), no content but showing a path in the title bar.
res://E:\PROGRA~1\MySearch\bar\1.bin\s4bar.dll\101
I opened window explorer and tried to go to the above path, but there is no directory named "MySearch" under E:\Program Files\
Finally I close the window but the program "My Search Bar" still appears in Add/Remove Programs. Please advise how to remove it.
3. I have followed your steps and extracted a new HijackThis log attached below. Please further advise. For your info, the IE advertisement popup problem still persists.
Thanks again for your help.
yanyan
==============================================
Logfile of HijackThis v1.99.0
Scan saved at 23:50:16, on 3/2/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\Explorer.EXE
E:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
E:\Program Files\Norton Internet Security\IAMAPP.EXE
E:\PROGRA~1\NORTON~1\navapw32.exe
E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
E:\WINDOWS\System32\ezSP_Px.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
E:\WINDOWS\SOUNDMAN.EXE
E:\Program Files\QuickTime\qttask.exe
E:\WINDOWS\system32\CTsvcCDA.EXE
E:\Program Files\Convar\TaskManager\ctm.exe
E:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe
E:\Program Files\MSN Apps\Updater\01.02.3000.1001\zh-tw\msnappau.exe
E:\Program Files\DuDu\DddClient\DuDuAccsvc.exe
E:\Program Files\Nokia\Nokia PC Suite 5\DataLayer.exe
E:\Program Files\DuDu\DddClient\DuDuProsvc.exe
E:\Program Files\Google\Gmail Notifier\G001-1.0.24.0\gnotify.exe
E:\Program Files\Common Files\Real\Update_OB\realsched.exe
E:\WINDOWS\System32\DVDRAMSV.exe
E:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
E:\Program Files\D-Tools\daemon.exe
E:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
E:\Program Files\Norton AntiVirus\navapsvc.exe
E:\Program Files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe
E:\Program Files\Common Files\Nokia\Services\ServiceLayer.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
E:\WINDOWS\system32\rundll32.exe
E:\Program Files\MSN Messenger\MsnMsgr.Exe
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Norton Internet Security\NISUM.EXE
E:\Program Files\BitComet\BitComet.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Norton Internet Security\SymProxySvc.exe
E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
E:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe
E:\PROGRA~1\ICQ\ICQ.exe
E:\Program Files\NoFlash\NoFlash.exe
E:\Program Files\Norton Internet Security\NISSERV.EXE
E:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
E:\Program Files\Gigabyte\Gigabyte Windows Utility Manager\gwum.exe
E:\WINDOWS\system32\RAMASST.exe
E:\Program Files\SpywareGuard\sgmain.exe
E:\Program Files\SpywareGuard\sgbhp.exe
E:\Program Files\Norton Internet Security\ATRACK.EXE
E:\WINDOWS\system32\rundll32.exe
E:\Program Files\Internet Explorer\iexplore.exe
E:\WINDOWS\system32\mshta.exe
E:\Program Files\Internet Explorer\iexplore.exe
E:\Program Files\Internet Explorer\iexplore.exe
E:\Program Files\UltraEdit\uedit32.exe
C:\Program Files\HijackThis\HijackThis.exe
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - E:\Program Files\ICQToolbar\toolbaru.dll
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - E:\WINDOWS\Downloaded Program Files\ycomp5_1_6_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - E:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DDDMon Class - {6BDE1669-B490-48E3-B668-456314F2D6C3} - E:\Program Files\DuDu\DddClient\dddiemon.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - E:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - E:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - E:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - E:\WINDOWS\Downloaded Program Files\ycomp5_1_6_0.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - E:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - E:\Program Files\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [iamapp] E:\Program Files\Norton Internet Security\IAMAPP.EXE
O4 - HKLM\..\Run: [NAV Agent] E:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [ATIPTA] E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] E:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PHIME2002ASync] E:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] E:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Nokia Tray Application] E:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe
O4 - HKLM\..\Run: [NMGameX_AutoRun] E:\WINDOWS\System32\Rundll32.exe NMGameX.dll,LiveProcess /aa
O4 - HKLM\..\Run: [msnappau] "E:\Program Files\MSN Apps\Updater\01.02.3000.1001\zh-tw\msnappau.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] E:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IgfxTray] E:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] E:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [dddclient] E:\Program Files\DuDu\DddClient\DuDuAccsvc.exe
O4 - HKLM\..\Run: [DataLayer] E:\Program Files\Nokia\Nokia PC Suite 5\DataLayer.exe
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ShutDown] E:\Program Files\DFG\ShutDown3\ShutDown.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] E:\Program Files\Google\Gmail Notifier\G001-1.0.24.0\gnotify.exe
O4 - HKLM\..\Run: [TkBellExe] "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RemoteControl] "E:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] E:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [Device Detector] DevDetect.exe -autorun
O4 - HKLM\..\Run: [Mirabilis ICQ] E:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [LWBMOUSE] E:\Program Files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe
O4 - HKLM\..\Run: [AVG7_CC] E:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] E:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [dmastu] rundll32.exe E:\PROGRA~1\DESKTO~1\Cast\dmipn.dll,Always
O4 - HKCU\..\Run: [msnmsgr] "E:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] E:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitComet] "E:\Program Files\BitComet\BitComet.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] E:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [No! Flash] E:\Program Files\NoFlash\NoFlash.exe
O8 - Extra context menu item: &Download by DuDuAccelerator - res://E:\Program Files\DuDu\DddClient\dddiemon.dll/202
O8 - Extra context menu item: Write a Review… - http://client.alexa.com/holiday/script/actions/review.htm
O8 - Extra context menu item: 匯出至 Microsoft Excel(&X) - res://E:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: 妏蚚粗陓閉撰赻迡楷冞善忒儂 -
http://mms.sina.com.cn/mmsnews.html
O8 - Extra context menu item: 楷冞芞善忒儂(&M) -
http://sms.sina.com.cn/diy/send.html?from=20000001
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - E:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - E:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Privacy Safe - {6EFD4A41-A59E-467c-B5B1-E119A399BB1D} - E:\Program Files\Privacy Safe\PrivacySafe.exe (file missing)
O9 - Extra 'Tools' menuitem: Privacy Safe - {6EFD4A41-A59E-467c-B5B1-E119A399BB1D} - E:\Program Files\Privacy Safe\PrivacySafe.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - E:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - E:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: E:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) -
http://www.cult3d.com/download/cult.cab
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) -
https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
O16 - DPF: {54F8C0E2-34F9-474F-B47F-2CFCFE2300A2} -
http://download.imu.com.cn/client/chatatwill/ie/imuliver.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) -
https://www.gamespyid.com/alaunch.cab
O16 - DPF: {8135EF31-FE8C-4C6E-A18A-F59944C3A488} (Spocx Class) -
http://ddddl.dudu.com/ddd/channel/spockx-channel.cab
O16 - DPF: {DC187740-46A9-11D5-A815-00B0D0428C0C} -
http://ds1.downloadtech.net/cn1060/pcpowerscan.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (&Yahoo! Companion) -
http://us.dl1.yimg.com/download.companion….ebio5_1_6_0.cab
O23 - Service: Ati HotKey Poller - Unknown - E:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown - E:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - E:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Convar task manager - Convar Deutschland GmbH - E:\Program Files\Convar\TaskManager\ctm.exe
O23 - Service: DuDu Accelerator - DuDu - E:\Program Files\DuDu\DddClient\DuDuProsvc.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - E:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - E:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Internet Security Service - Symantec Corporation - E:\Program Files\Norton Internet Security\NISSERV.EXE
O23 - Service: Norton Internet Security Accounts Manager - Symantec Corporation - E:\Program Files\Norton Internet Security\NISUM.EXE
O23 - Service: ScriptBlocking Service - Symantec Corporation - E:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Sony SPTI Service - Sony Corporation - E:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: Norton Internet Security Proxy Service - Symantec Corporation - E:\Program Files\Norton Internet Security\SymProxySvc.exe
O23 - Service: SymWMI Service - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Ulead Burning Helper - Ulead Systems, Inc. - E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
