Atlpz

Looks like I have got this "popular" bug.

It started out with "About Blank" becomming my home page and it was impossible to change. I then started getting lots of pop up's for spyware removal and then it became impossible to start the computer as lots and lots and lots of new programs took all the resources.

I tried all of the usual things to clean it out and only SpyBot found anything however it always seemed to come up with an error message and although it said that it had deleted it, the problem always came back.

What it seems to have problems with is URL SearchHool.Atlpz. I have read other accounts of the problem but would be happy if you could view my HijackThis log before I do anything drastic.

Kind Regards - Autoland

Log Is :-

Logfile of HijackThis v1.99.1
Scan saved at 08:33:12, on 24/05/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\AVSYNMGR.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\AVCONSOL.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\WINVM32.EXE
C:\WINDOWS\SYSTEM\SYSDB.EXE
C:\WINDOWS\CRFG.EXE
C:\WINDOWS\SYSTEM\WINRN.EXE
C:\WINDOWS\WINYF.EXE
C:\WINDOWS\SYSTEM\IEFY32.EXE
C:\WINDOWS\SYSTEM\ADDRD.EXE
C:\WINDOWS\SYSTEM\APIEV32.EXE
C:\WINDOWS\MFCWU32.EXE
C:\WINDOWS\SYSTI32.EXE
C:\WINDOWS\MFCFD.EXE
C:\WINDOWS\CRKJ32.EXE
C:\WINDOWS\JAVAVC.EXE
C:\WINDOWS\SYSTEM\JAVAWK.EXE
C:\WINDOWS\SDKWB.EXE
C:\WINDOWS\SYSTEM\JAVALS32.EXE
C:\WINDOWS\NTLH32.EXE
C:\WINDOWS\SYSTEM\JAVALS32.EXE
C:\WINDOWS\NTLH32.EXE
C:\WINDOWS\IEBJ.EXE
C:\WINDOWS\NTLH32.EXE
C:\WINDOWS\APIPA32.EXE
C:\WINDOWS\NTLH32.EXE
C:\WINDOWS\WINUW32.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\ALOGSERV.EXE
C:\WINDOWS\APIPA32.EXE
C:\WINDOWS\SYSTEM\SYSHP.EXE
D:\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://www.europedo3.com/lolitka/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.225.176.5/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://195.225.176.5/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\rdawf.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\rdawf.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\rdawf.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\rdawf.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\rdawf.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\rdawf.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://europedo3.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\rdawf.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.ntlworld.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.225.176.5/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by London Web Communications
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: Class - {C457E209-9CFD-AA0D-8F81-41BB4A2E2BF7} - C:\WINDOWS\SYSTEM\SYSIQ.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINDOWS\SYSTEM\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [QuickFinder Scheduler] D:\COREL\OFFICE7\SHARED\QFINDER7\QFSCHED.EXE
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [Vshwin32EXE] C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSHWIN32.EXE
O4 - HKLM\..\Run: [Mount Safe & Sound] C:\PROGRAM FILES\MCAFEE\MCAFEE SHARED COMPONENTS\SAFE & SOUND\FBMOUNT.EXE
O4 - HKLM\..\Run: [hpppta] D:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan\hpppta.exe /ICON
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [McAfeeWebScanX] C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\WebScanX.Exe
O4 - HKLM\..\Run: [McAfee Guardian] "C:\PROGRAM FILES\MCAFEE\MCAFEE SHARED COMPONENTS\GUARDIAN\CMGRDIAN.EXE" /SU
O4 - HKLM\..\Run: [projselector] "C:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" -r
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [HP Simple Trax] C:\Program Files\CD-Writer Plus\HP Simple Trax\hpcron.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP CD-DVD\Umbrella\DVDBitSet.exe" /NOUI
O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP CD-DVD\Umbrella\DVDTray.exe
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [Imonitor] "C:\Program Files\McAfee\QuickClean\Plguni.exe" /START
O4 - HKLM\..\Run: [Outpost Firewall] C:\PROGRA~1\AGNITUM\OUTPOS~1.0\OUTPOST.EXE /waitservice
O4 - HKLM\..\Run: [UStorage] c:\program files\u-storage tools2.1\ustorage.exe sys_auto_run C:\PROGRAM FILES\U-STORAGE TOOLS2.1
O4 - HKLM\..\Run: [ShowIcon_Justrams_USB Product Driver v2.12r012] "C:\Program Files\USB Product Driver v2.12r012\shwicon.exe" -t"Justrams\USB Product Driver v2.12r012"
O4 - HKLM\..\Run: [IEXPLORE.EXE] C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
O4 - HKLM\..\Run: [SYSDB.EXE] C:\WINDOWS\SYSTEM\SYSDB.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
O4 - HKLM\..\RunServices: [JAVAKE32.EXE] C:\WINDOWS\JAVAKE32.EXE /s
O4 - HKLM\..\RunServices: [D3OX32.EXE] C:\WINDOWS\SYSTEM\D3OX32.EXE /s
O4 - HKLM\..\RunServices: [ADDZT.EXE] C:\WINDOWS\ADDZT.EXE /s
O4 - HKLM\..\RunServices: [ADDMS.EXE] C:\WINDOWS\SYSTEM\ADDMS.EXE /s
O4 - HKLM\..\RunServices: [JAVAXX.EXE] C:\WINDOWS\SYSTEM\JAVAXX.EXE /s
O4 - HKLM\..\RunServices: [D3PS32.EXE] C:\WINDOWS\D3PS32.EXE /s
O4 - HKLM\..\RunServices: [CRKJ32.EXE] C:\WINDOWS\CRKJ32.EXE /s
O4 - HKLM\..\RunServices: [MFCCX.EXE] C:\WINDOWS\MFCCX.EXE /s
O4 - HKLM\..\RunServices: [MFCVC.EXE] C:\WINDOWS\SYSTEM\MFCVC.EXE /s
O4 - HKLM\..\RunServices: [JAVAWK.EXE] C:\WINDOWS\SYSTEM\JAVAWK.EXE /s
O4 - HKLM\..\RunServices: [MFCXU32.EXE] C:\WINDOWS\MFCXU32.EXE /s
O4 - HKLM\..\RunServices: [MFCZX32.EXE] C:\WINDOWS\SYSTEM\MFCZX32.EXE /s
O4 - HKLM\..\RunServices: [WINET.EXE] C:\WINDOWS\WINET.EXE /s
O4 - HKLM\..\RunServices: [MFCWE32.EXE] C:\WINDOWS\SYSTEM\MFCWE32.EXE /s
O4 - HKLM\..\RunServices: [JAVAAS32.EXE] C:\WINDOWS\SYSTEM\JAVAAS32.EXE /s
O4 - HKLM\..\RunServices: [SDKIE.EXE] C:\WINDOWS\SYSTEM\SDKIE.EXE /s
O4 - HKLM\..\RunServices: [APIFO32.EXE] C:\WINDOWS\SYSTEM\APIFO32.EXE /s
O4 - HKLM\..\RunServices: [WINYF.EXE] C:\WINDOWS\WINYF.EXE /s
O4 - HKLM\..\RunServices: [WINRN.EXE] C:\WINDOWS\SYSTEM\WINRN.EXE /s
O4 - HKLM\..\RunServices: [APIHH.EXE] C:\WINDOWS\SYSTEM\APIHH.EXE /s
O4 - HKLM\..\RunServices: [JAVAZQ32.EXE] C:\WINDOWS\SYSTEM\JAVAZQ32.EXE /s
O4 - HKLM\..\RunServices: [IEZH.EXE] C:\WINDOWS\IEZH.EXE /s
O4 - HKLM\..\RunServices: [SDKIP32.EXE] C:\WINDOWS\SDKIP32.EXE /s
O4 - HKLM\..\RunServices: [MFCTH32.EXE] C:\WINDOWS\MFCTH32.EXE /s
O4 - HKLM\..\RunServices: [NTOL.EXE] C:\WINDOWS\NTOL.EXE /s
O4 - HKLM\..\RunServices: [APIUT.EXE] C:\WINDOWS\APIUT.EXE /s
O4 - HKLM\..\RunServices: [SYSVF32.EXE] C:\WINDOWS\SYSTEM\SYSVF32.EXE /s
O4 - HKLM\..\RunServices: [MFCPP.EXE] C:\WINDOWS\SYSTEM\MFCPP.EXE /s
O4 - HKLM\..\RunServices: [CRIX32.EXE] C:\WINDOWS\SYSTEM\CRIX32.EXE /s
O4 - HKLM\..\RunServices: [ATLYV.EXE] C:\WINDOWS\ATLYV.EXE /s
O4 - HKLM\..\RunServices: [IPFZ.EXE] C:\WINDOWS\SYSTEM\IPFZ.EXE /s
O4 - HKLM\..\RunServices: [WINOC.EXE] C:\WINDOWS\WINOC.EXE /s
O4 - HKLM\..\RunServices: [APIWR32.EXE] C:\WINDOWS\APIWR32.EXE /s
O4 - HKLM\..\RunServices: [IEAK32.EXE] C:\WINDOWS\SYSTEM\IEAK32.EXE /s
O4 - HKLM\..\RunServices: [IEJB32.EXE] C:\WINDOWS\SYSTEM\IEJB32.EXE /s
O4 - HKLM\..\RunServices: [IEFY32.EXE] C:\WINDOWS\SYSTEM\IEFY32.EXE /s
O4 - HKLM\..\RunServices: [MFCRY.EXE] C:\WINDOWS\SYSTEM\MFCRY.EXE /s
O4 - HKLM\..\RunServices: [IPGJ32.EXE] C:\WINDOWS\SYSTEM\IPGJ32.EXE /s
O4 - HKLM\..\RunServices: [APIEV32.EXE] C:\WINDOWS\SYSTEM\APIEV32.EXE /s
O4 - HKLM\..\RunServices: [ADDRD.EXE] C:\WINDOWS\SYSTEM\ADDRD.EXE /s
O4 - HKLM\..\RunServices: [WINZP32.EXE] C:\WINDOWS\SYSTEM\WINZP32.EXE /s
O4 - HKLM\..\RunServices: [MFCFD.EXE] C:\WINDOWS\MFCFD.EXE /s
O4 - HKLM\..\RunServices: [APIFX32.EXE] C:\WINDOWS\SYSTEM\APIFX32.EXE /s
O4 - HKLM\..\RunServices: [NTHK.EXE] C:\WINDOWS\SYSTEM\NTHK.EXE /s
O4 - HKLM\..\RunServices: [NETMV32.EXE] C:\WINDOWS\NETMV32.EXE /s
O4 - HKLM\..\RunServices: [MFCWU32.EXE] C:\WINDOWS\MFCWU32.EXE /s
O4 - HKLM\..\RunServices: [APPOK32.EXE] C:\WINDOWS\SYSTEM\APPOK32.EXE /s
O4 - HKLM\..\RunServices: [WINTV32.EXE] C:\WINDOWS\WINTV32.EXE /s
O4 - HKLM\..\RunServices: [WINHM.EXE] C:\WINDOWS\SYSTEM\WINHM.EXE /s
O4 - HKLM\..\RunServices: [APPHQ.EXE] C:\WINDOWS\APPHQ.EXE /s
O4 - HKLM\..\RunServices: [APILW.EXE] C:\WINDOWS\SYSTEM\APILW.EXE /s
O4 - HKLM\..\RunServices: [SYSKE32.EXE] C:\WINDOWS\SYSTEM\SYSKE32.EXE /s
O4 - HKLM\..\RunServices: [ADDII.EXE] C:\WINDOWS\SYSTEM\ADDII.EXE /s
O4 - HKLM\..\RunServices: [APPEB.EXE] C:\WINDOWS\SYSTEM\APPEB.EXE /s
O4 - HKLM\..\RunServices: [SDKGF.EXE] C:\WINDOWS\SDKGF.EXE /s
O4 - HKLM\..\RunServices: [SDKII32.EXE] C:\WINDOWS\SDKII32.EXE /s
O4 - HKLM\..\RunServices: [APPVX32.EXE] C:\WINDOWS\SYSTEM\APPVX32.EXE /s
O4 - HKLM\..\RunServices: [JAVAXO.EXE] C:\WINDOWS\SYSTEM\JAVAXO.EXE /s
O4 - HKLM\..\RunServices: [IPPF.EXE] C:\WINDOWS\IPPF.EXE /s
O4 - HKLM\..\RunServices: [IEAM32.EXE] C:\WINDOWS\IEAM32.EXE /s
O4 - HKLM\..\RunServices: [SYSIA32.EXE] C:\WINDOWS\SYSTEM\SYSIA32.EXE /s
O4 - HKLM\..\RunServices: [NETTE32.EXE] C:\WINDOWS\NETTE32.EXE /s
O4 - HKLM\..\RunServices: [JAVAOK32.EXE] C:\WINDOWS\SYSTEM\JAVAOK32.EXE /s
O4 - HKLM\..\RunServices: [JAVAVC.EXE] C:\WINDOWS\JAVAVC.EXE /s
O4 - HKLM\..\RunServices: [ADDDD.EXE] C:\WINDOWS\SYSTEM\ADDDD.EXE /s
O4 - HKLM\..\RunServices: [MSZL32.EXE] C:\WINDOWS\SYSTEM\MSZL32.EXE /s
O4 - HKLM\..\RunServices: [SYSXF32.EXE] C:\WINDOWS\SYSTEM\SYSXF32.EXE /s
O4 - HKLM\..\RunServices: [MFCHD.EXE] C:\WINDOWS\MFCHD.EXE /s
O4 - HKLM\..\RunServices: [NTLH32.EXE] C:\WINDOWS\NTLH32.EXE /s
O4 - HKLM\..\RunServices: [MFCIL.EXE] C:\WINDOWS\MFCIL.EXE /s
O4 - HKLM\..\RunServices: [MFCNK.EXE] C:\WINDOWS\SYSTEM\MFCNK.EXE /s
O4 - HKLM\..\RunServices: [ATLJL32.EXE] C:\WINDOWS\SYSTEM\ATLJL32.EXE /s
O4 - HKLM\..\RunServices: [D3GK32.EXE] C:\WINDOWS\D3GK32.EXE /s
O4 - HKLM\..\RunServices: [NETJP32.EXE] C:\WINDOWS\SYSTEM\NETJP32.EXE /s
O4 - HKLM\..\RunServices: [APIWG32.EXE] C:\WINDOWS\SYSTEM\APIWG32.EXE /s
O4 - HKLM\..\RunServices: [ADDZE32.EXE] C:\WINDOWS\ADDZE32.EXE /s
O4 - HKLM\..\RunServices: [APIZV32.EXE] C:\WINDOWS\SYSTEM\APIZV32.EXE /s
O4 - HKLM\..\RunServices: [SDKPD.EXE] C:\WINDOWS\SYSTEM\SDKPD.EXE /s
O4 - HKLM\..\RunServices: [NETFS.EXE] C:\WINDOWS\SYSTEM\NETFS.EXE /s
O4 - HKLM\..\RunServices: [SDKJQ.EXE] C:\WINDOWS\SDKJQ.EXE /s
O4 - HKLM\..\RunServices: [APPNL.EXE] C:\WINDOWS\SYSTEM\APPNL.EXE /s
O4 - HKLM\..\RunServices: [JAVATO.EXE] C:\WINDOWS\SYSTEM\JAVATO.EXE /s
O4 - HKLM\..\RunServices: [IEMW32.EXE] C:\WINDOWS\IEMW32.EXE /s
O4 - HKLM\..\RunServices: [IPLE.EXE] C:\WINDOWS\IPLE.EXE /s
O4 - HKLM\..\RunServices: [NTPR32.EXE] C:\WINDOWS\SYSTEM\NTPR32.EXE /s
O4 - HKLM\..\RunServices: [D3RK32.EXE] C:\WINDOWS\SYSTEM\D3RK32.EXE /s
O4 - HKLM\..\RunServices: [WINVM32.EXE] C:\WINDOWS\SYSTEM\WINVM32.EXE /s
O4 - HKLM\..\RunServices: [IPZB.EXE] C:\WINDOWS\SYSTEM\IPZB.EXE /s
O4 - HKLM\..\RunServices: [SYSUK32.EXE] C:\WINDOWS\SYSTEM\SYSUK32.EXE /s
O4 - HKLM\..\RunServices: [CRFG.EXE] C:\WINDOWS\CRFG.EXE /s
O4 - HKLM\..\RunServices: [JAVALS32.EXE] C:\WINDOWS\SYSTEM\JAVALS32.EXE /s
O4 - HKLM\..\RunServices: [CRWN.EXE] C:\WINDOWS\CRWN.EXE /s
O4 - HKLM\..\RunServices: [SYSNI.EXE] C:\WINDOWS\SYSTEM\SYSNI.EXE /s
O4 - HKLM\..\RunServices: [NTWM.EXE] C:\WINDOWS\NTWM.EXE /s
O4 - HKLM\..\RunServices: [MSEJ32.EXE] C:\WINDOWS\MSEJ32.EXE /s
O4 - HKLM\..\RunServices: [WINSH.EXE] C:\WINDOWS\SYSTEM\WINSH.EXE /s
O4 - HKLM\..\RunServices: [APIZS.EXE] C:\WINDOWS\APIZS.EXE /s
O4 - HKLM\..\RunServices: [IPJF.EXE] C:\WINDOWS\IPJF.EXE /s
O4 - HKLM\..\RunServices: [NETTB.EXE] C:\WINDOWS\SYSTEM\NETTB.EXE /s
O4 - HKLM\..\RunServices: [WINUS32.EXE] C:\WINDOWS\WINUS32.EXE /s
O4 - HKLM\..\RunServices: [MFCKA.EXE] C:\WINDOWS\MFCKA.EXE /s
O4 - HKLM\..\RunServices: [APPQL32.EXE] C:\WINDOWS\SYSTEM\APPQL32.EXE /s
O4 - HKLM\..\RunServices: [IPWO32.EXE] C:\WINDOWS\IPWO32.EXE /s
O4 - HKLM\..\RunServices: [CRAS32.EXE] C:\WINDOWS\SYSTEM\CRAS32.EXE /s
O4 - HKLM\..\RunServices: [APPHH.EXE] C:\WINDOWS\SYSTEM\APPHH.EXE /s
O4 - HKLM\..\RunServices: [WINIH.EXE] C:\WINDOWS\SYSTEM\WINIH.EXE /s
O4 - HKLM\..\RunServices: [IEJC32.EXE] C:\WINDOWS\IEJC32.EXE /s
O4 - HKLM\..\RunServices: [D3RP.EXE] C:\WINDOWS\D3RP.EXE /s
O4 - HKLM\..\RunServices: [APIBC.EXE] C:\WINDOWS\APIBC.EXE /s
O4 - HKLM\..\RunServices: [SYSCN.EXE] C:\WINDOWS\SYSTEM\SYSCN.EXE /s
O4 - HKLM\..\RunServices: [SDKBF32.EXE] C:\WINDOWS\SYSTEM\SDKBF32.EXE /s
O4 - HKLM\..\RunServices: [NETSI.EXE] C:\WINDOWS\NETSI.EXE /s
O4 - HKLM\..\RunServices: [IPXF32.EXE] C:\WINDOWS\SYSTEM\IPXF32.EXE /s
O4 - HKLM\..\RunServices: [WINVD32.EXE] C:\WINDOWS\WINVD32.EXE /s
O4 - HKLM\..\RunServices: [NTGK.EXE] C:\WINDOWS\NTGK.EXE /s
O4 - HKLM\..\RunServices: [IELK32.EXE] C:\WINDOWS\IELK32.EXE /s
O4 - HKLM\..\RunServices: [JAVAYB32.EXE] C:\WINDOWS\JAVAYB32.EXE /s
O4 - HKLM\..\RunServices: [ATLQG32.EXE] C:\WINDOWS\SYSTEM\ATLQG32.EXE /s
O4 - HKLM\..\RunServices: [MSPO32.EXE] C:\WINDOWS\SYSTEM\MSPO32.EXE /s
O4 - HKLM\..\RunServices: [IPTH32.EXE] C:\WINDOWS\SYSTEM\IPTH32.EXE /s
O4 - HKLM\..\RunServices: [APPJV32.EXE] C:\WINDOWS\APPJV32.EXE /s
O4 - HKLM\..\RunServices: [JAVACT32.EXE] C:\WINDOWS\SYSTEM\JAVACT32.EXE /s
O4 - HKLM\..\RunServices: [MSSW32.EXE] C:\WINDOWS\MSSW32.EXE /s
O4 - HKLM\..\RunServices: [MSQN32.EXE] C:\WINDOWS\MSQN32.EXE /s
O4 - HKLM\..\RunServices: [SYSTI32.EXE] C:\WINDOWS\SYSTI32.EXE /s
O4 - HKLM\..\RunServices: [SDKWB.EXE] C:\WINDOWS\SDKWB.EXE /s
O4 - HKLM\..\RunServices: [IEBJ.EXE] C:\WINDOWS\IEBJ.EXE /s
O4 - HKLM\..\RunServices: [APIPA32.EXE] C:\WINDOWS\APIPA32.EXE /s
O4 - HKLM\..\RunServices: [WINUW32.EXE] C:\WINDOWS\WINUW32.EXE /s
O4 - HKLM\..\RunServices: [SYSHP.EXE] C:\WINDOWS\SYSTEM\SYSHP.EXE /s
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - HKCU\..\Run: [H/PC Connection Agent] "D:\PROGRAM FILES\MICROSOFT ACTIVESYNC\WCESCOMM.EXE"
O4 - Startup: AutoStart IR.lnk = C:\Program Files\wintv\ir.exe
O4 - Startup: PerfectPrint.LNK = D:\Corel\Office7\Shared\PFit7\PFPPOP70.EXE
O4 - Startup: Clock.exe.lnk = C:\WINDOWS\CLOCK.EXE
O4 - Startup: SideWinder Game Device Profiler.lnk = C:\Program Files\Microsoft Hardware\Game Devices\SideWinder GDP.exe
O4 - Startup: FlashPath Status.lnk = D:\SMARTDSK\FLASH\SDSTAT.exe
O4 - Startup: GraphicsPlus.lnk = D:\Program Files\Serif\GraphicsPlus\Offres.dll
O4 - Startup: PsiWin 2.3 Connection Server.lnk = D:\Program Files\Psion\PsiWin\psconsv.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - http://www.net2phone.com/ (file missing)
O9 - Extra 'Tools' menuitem: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - http://www.net2phone.com/ (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
O9 - Extra button: Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\PROGRAM FILES\AGNITUM\OUTPOST FIREWALL 1.0\TRASH.EXE (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Show Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\PROGRAM FILES\AGNITUM\OUTPOST FIREWALL 1.0\TRASH.EXE (file missing) (HKCU)
O12 - Plugin for .UVR: C:\PROGRA~1\INTERN~1\Plugins\NPUPano.dll
O16 - DPF: {11111111-1111-1111-1111-111111111157} - ms-its:mhtml:file://c:\nosuch.mht!http://super-gals.com/scj/rotation/templates/s/x.chm::/ad.exe

Dear MrC,

Thanks for your reply. I have just got back home and spent some time working through the deletes. I also applied what you said to some additional files that were all of the same name type and created around the same date. I ended up deleting another 220 lines from the HJT log.

Looking through the WINDOWS and WINDOWS|SYSTEM files there still seemed to be lots of files created about the same date that have very similar names and look as if some sort of program has generated them and simply increased the last letter of the file name by one. I have not done anything with these files as yet.

After all the deletes I then ran AboutBuster and CW-Shredder again.

I still can not get housecall to run. As I link to the site I am still getting pop-ups from spyware removal programs and when I try to select a country Internet Explorer fails and asks if I should send an error report to Microsoft.

I then end up with the About Blank window.

I have therefore generated another HJT log and look forward to any suggestions that you migh have.

Kind Regards,

Autoland.

Logfile of HijackThis v1.99.1
Scan saved at 23:11:08, on 31/05/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\APPDB32.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\AVSYNMGR.EXE
C:\WINDOWS\NETDZ.EXE
C:\WINDOWS\IEOX.EXE
C:\WINDOWS\SYSTEM\WINKF.EXE
C:\WINDOWS\IEIQ32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\AVCONSOL.EXE
C:\WINDOWS\D3KF.EXE
C:\WINDOWS\TASKMON.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\MOUSE\POINT32.EXE
C:\WINDOWS\SYSTEM\DLA\TFSWCTRL.EXE
C:\PROGRAM FILES\HP CD-DVD\UMBRELLA\DVDTRAY.EXE
C:\PROGRAM FILES\MCAFEE\QUICKCLEAN\PLGUNI.EXE
C:\PROGRAM FILES\USB PRODUCT DRIVER V2.12R012\SHWICON.EXE
C:\PROGRAM FILES\CREATIVE\SBLIVE\AUDIOHQ\AHQTB.EXE
C:\WINDOWS\SYSTEM\PDESK.EXE
C:\PROGRAM FILES\COMMON FILES\ROXIO SHARED\PROJECT SELECTOR\PROJSELECTOR.EXE
C:\PROGRAM FILES\ROXIO\EASY CD CREATOR 6\DRAGTODISC\DRGTODSC.EXE
C:\PROGRAM FILES\ROXIO\EASY CD CREATOR 6\AUDIOCENTRAL\RXMON.EXE
C:\PROGRAM FILES\CD-WRITER PLUS\HP SIMPLE TRAX\HPCRON.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\ALOGSERV.EXE
C:\PROGRAM FILES\U-STORAGE TOOLS2.1\USTORAGE.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
D:\PROGRAM FILES\MICROSOFT ACTIVESYNC\WCESCOMM.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE SHARED COMPONENTS\INSTANT UPDATER\RULAUNCH.EXE
D:\COREL\OFFICE7\SHARED\PFIT7\PFPPOP70.EXE
C:\WINDOWS\CLOCK.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\GAME DEVICES\SIDEWINDER GDP.EXE
C:\PROGRAM FILES\ROXIO\EASY CD CREATOR 6\AUDIOCENTRAL\PLAYLIST.EXE
D:\SMARTDSK\FLASH\SDSTAT.EXE
D:\PROGRAM FILES\SERIF\GRAPHICSPLUS\GPSTART.EXE
D:\PROGRAM FILES\PSION\PSIWIN\PSCONSV.EXE
D:\PROGRAM FILES\PSION\PSIWIN\ELOGERR.EXE
D:\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.225.176.5/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://195.225.176.5/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\aakcg.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\aakcg.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\aakcg.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\aakcg.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\aakcg.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\aakcg.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://europedo3.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\aakcg.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.ntlworld.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.225.176.5/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by London Web Communications
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: Class - {A8DCA15B-4E37-5A55-D020-CB911D259597} - C:\WINDOWS\SYSTEM\WINQW.DLL
O2 - BHO: Class - {21EE8B1E-4826-CBD8-177D-882322CDB315} - C:\WINDOWS\APPME.DLL
O2 - BHO: Class - {FEFEC367-0557-50DA-92D8-EFF9A710070B} - C:\WINDOWS\D3RY.DLL
O2 - BHO: Class - {589C2260-26D5-FF39-DD1D-9A4F791A1C96} - C:\WINDOWS\CRWL32.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [D3KF.EXE] C:\WINDOWS\D3KF.EXE
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [QuickFinder Scheduler] D:\COREL\OFFICE7\SHARED\QFINDER7\QFSCHED.EXE
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP CD-DVD\Umbrella\DVDBitSet.exe" /NOUI
O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP CD-DVD\Umbrella\DVDTray.exe
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [Imonitor] "C:\Program Files\McAfee\QuickClean\Plguni.exe" /START
O4 - HKLM\..\Run: [ShowIcon_Justrams_USB Product Driver v2.12r012] "C:\Program Files\USB Product Driver v2.12r012\shwicon.exe" -t"Justrams\USB Product Driver v2.12r012"
O4 - HKLM\..\Run: [IEXPLORE.EXE] C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
O4 - HKLM\..\Run: [MFCAN32.EXE] C:\WINDOWS\SYSTEM\MFCAN32.EXE
O4 - HKLM\..\Run: [APIUD32.EXE] C:\WINDOWS\SYSTEM\APIUD32.EXE
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINDOWS\SYSTEM\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [Mount Safe & Sound] C:\PROGRAM FILES\MCAFEE\MCAFEE SHARED COMPONENTS\SAFE & SOUND\FBMOUNT.EXE
O4 - HKLM\..\Run: [hpppta] D:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan\hpppta.exe /ICON
O4 - HKLM\..\Run: [McAfeeWebScanX] C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\WebScanX.Exe
O4 - HKLM\..\Run: [McAfee Guardian] "C:\PROGRAM FILES\MCAFEE\MCAFEE SHARED COMPONENTS\GUARDIAN\CMGRDIAN.EXE" /SU
O4 - HKLM\..\Run: [projselector] "C:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" -r
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [HP Simple Trax] C:\Program Files\CD-Writer Plus\HP Simple Trax\hpcron.exe
O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [Outpost Firewall] C:\PROGRA~1\AGNITUM\OUTPOS~1.0\OUTPOST.EXE /waitservice
O4 - HKLM\..\Run: [UStorage] c:\program files\u-storage tools2.1\ustorage.exe sys_auto_run C:\PROGRAM FILES\U-STORAGE TOOLS2.1
O4 - HKLM\..\Run: [Vshwin32EXE] C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSHWIN32.EXE
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [APPDB32.EXE] C:\WINDOWS\SYSTEM\APPDB32.EXE /s
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [APILW.EXE] C:\WINDOWS\SYSTEM\APILW.EXE /s
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
O4 - HKLM\..\RunServices: [NETDZ.EXE] C:\WINDOWS\NETDZ.EXE /s
O4 - HKLM\..\RunServices: [IEOX.EXE] C:\WINDOWS\IEOX.EXE /s
O4 - HKLM\..\RunServices: [WINKF.EXE] C:\WINDOWS\SYSTEM\WINKF.EXE /s
O4 - HKLM\..\RunServices: [IEIQ32.EXE] C:\WINDOWS\IEIQ32.EXE /s
O4 - HKCU\..\Run: [H/PC Connection Agent] "D:\PROGRAM FILES\MICROSOFT ACTIVESYNC\WCESCOMM.EXE"
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - Startup: AutoStart IR.lnk = C:\Program Files\wintv\ir.exe
O4 - Startup: PerfectPrint.LNK = D:\Corel\Office7\Shared\PFit7\PFPPOP70.EXE
O4 - Startup: Clock.exe.lnk = C:\WINDOWS\CLOCK.EXE
O4 - Startup: SideWinder Game Device Profiler.lnk = C:\Program Files\Microsoft Hardware\Game Devices\SideWinder GDP.exe
O4 - Startup: FlashPath Status.lnk = D:\SMARTDSK\FLASH\SDSTAT.exe
O4 - Startup: GraphicsPlus.lnk = D:\Program Files\Serif\GraphicsPlus\Offres.dll
O4 - Startup: PsiWin 2.3 Connection Server.lnk = D:\Program Files\Psion\PsiWin\psconsv.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - http://www.net2phone.com/ (file missing)
O9 - Extra 'Tools' menuitem: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - http://www.net2phone.com/ (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
O9 - Extra button: Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\PROGRAM FILES\AGNITUM\OUTPOST FIREWALL 1.0\TRASH.EXE (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Show Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\PROGRAM FILES\AGNITUM\OUTPOST FIREWALL 1.0\TRASH.EXE (file missing) (HKCU)
O12 - Plugin for .UVR: C:\PROGRA~1\INTERN~1\Plugins\NPUPano.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab

Dear MrC,

I know that the bugs are still in there but at least I can get the computer started up without running out of resources. That does seem to be a good step in the right direction. Mny Thanks.

One thing that is strange however is that when I sign onto this site I do not get the latest postings. I always get the same number of posts that I had the last time I signed off even though I know that new information has been posted. Refresh makes no difference. The only way that I can get the latest postings is to use Conrol Panel and clean out all of the Internet cookies and temp files. That then gives me access to the new postings.

I have worked through the last set of instructions. The only difference was that when deleting the "R1 - HKCU ………#'55135" The number that was in my latest HJT run was #37049, so I deleted that instead.

I still can not get housecall working however I noticed that the last entry in my latest HJT log has a reference to housecall. Could this be part of the problem :-

"O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...can53.cab"

Kind Regards,

Autoland.

This is my latest HJT log :-

Logfile of HijackThis v1.99.1
Scan saved at 07:50:40, on 01/06/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\AVSYNMGR.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\AVCONSOL.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\CRVM32.EXE
C:\WINDOWS\CRVM32.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
D:\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\qfyhy.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\qfyhy.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\qfyhy.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\qfyhy.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\qfyhy.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\qfyhy.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://europedo3.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\qfyhy.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.ntlworld.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by London Web Communications
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: Class - {5D067718-18BC-DBD6-97B8-BF6BBECDD63F} - C:\WINDOWS\SYSEH.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [QuickFinder Scheduler] D:\COREL\OFFICE7\SHARED\QFINDER7\QFSCHED.EXE
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP CD-DVD\Umbrella\DVDBitSet.exe" /NOUI
O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP CD-DVD\Umbrella\DVDTray.exe
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [Imonitor] "C:\Program Files\McAfee\QuickClean\Plguni.exe" /START
O4 - HKLM\..\Run: [ShowIcon_Justrams_USB Product Driver v2.12r012] "C:\Program Files\USB Product Driver v2.12r012\shwicon.exe" -t"Justrams\USB Product Driver v2.12r012"
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINDOWS\SYSTEM\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [Mount Safe & Sound] C:\PROGRAM FILES\MCAFEE\MCAFEE SHARED COMPONENTS\SAFE & SOUND\FBMOUNT.EXE
O4 - HKLM\..\Run: [hpppta] D:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan\hpppta.exe /ICON
O4 - HKLM\..\Run: [McAfeeWebScanX] C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\WebScanX.Exe
O4 - HKLM\..\Run: [McAfee Guardian] "C:\PROGRAM FILES\MCAFEE\MCAFEE SHARED COMPONENTS\GUARDIAN\CMGRDIAN.EXE" /SU
O4 - HKLM\..\Run: [projselector] "C:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" -r
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [HP Simple Trax] C:\Program Files\CD-Writer Plus\HP Simple Trax\hpcron.exe
O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [Outpost Firewall] C:\PROGRA~1\AGNITUM\OUTPOS~1.0\OUTPOST.EXE /waitservice
O4 - HKLM\..\Run: [UStorage] c:\program files\u-storage tools2.1\ustorage.exe sys_auto_run C:\PROGRAM FILES\U-STORAGE TOOLS2.1
O4 - HKLM\..\Run: [Vshwin32EXE] C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSHWIN32.EXE
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [ADDAG.EXE] C:\WINDOWS\SYSTEM\ADDAG.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
O4 - HKLM\..\RunServices: [CRVM32.EXE] C:\WINDOWS\CRVM32.EXE /s
O4 - HKCU\..\Run: [H/PC Connection Agent] "D:\PROGRAM FILES\MICROSOFT ACTIVESYNC\WCESCOMM.EXE"
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - Startup: AutoStart IR.lnk = C:\Program Files\wintv\ir.exe
O4 - Startup: PerfectPrint.LNK = D:\Corel\Office7\Shared\PFit7\PFPPOP70.EXE
O4 - Startup: Clock.exe.lnk = C:\WINDOWS\CLOCK.EXE
O4 - Startup: SideWinder Game Device Profiler.lnk = C:\Program Files\Microsoft Hardware\Game Devices\SideWinder GDP.exe
O4 - Startup: FlashPath Status.lnk = D:\SMARTDSK\FLASH\SDSTAT.exe
O4 - Startup: GraphicsPlus.lnk = D:\Program Files\Serif\GraphicsPlus\Offres.dll
O4 - Startup: PsiWin 2.3 Connection Server.lnk = D:\Program Files\Psion\PsiWin\psconsv.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - http://www.net2phone.com/ (file missing)
O9 - Extra 'Tools' menuitem: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - http://www.net2phone.com/ (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
O9 - Extra button: Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\PROGRAM FILES\AGNITUM\OUTPOST FIREWALL 1.0\TRASH.EXE (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Show Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\PROGRAM FILES\AGNITUM\OUTPOST FIREWALL 1.0\TRASH.EXE (file missing) (HKCU)
O12 - Plugin for .UVR: C:\PROGRA~1\INTERN~1\Plugins\NPUPano.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab

Dear MrC,

Thanks for you note about housecalls.

When you originally asked me to run AboutBuster you said that I needed to do it in "Safe" mode. Is this still the case or can I now just run it in normal mode ?

I have followed your instructions and here is my latest HJT log.

Kind Regards,

Autoland.

Logfile of HijackThis v1.99.1
Scan saved at 06:25:37, on 02/06/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\AVSYNMGR.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\AVCONSOL.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
D:\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://europedo3.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.ntlworld.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by London Web Communications
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [QuickFinder Scheduler] D:\COREL\OFFICE7\SHARED\QFINDER7\QFSCHED.EXE
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP CD-DVD\Umbrella\DVDBitSet.exe" /NOUI
O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP CD-DVD\Umbrella\DVDTray.exe
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [Imonitor] "C:\Program Files\McAfee\QuickClean\Plguni.exe" /START
O4 - HKLM\..\Run: [ShowIcon_Justrams_USB Product Driver v2.12r012] "C:\Program Files\USB Product Driver v2.12r012\shwicon.exe" -t"Justrams\USB Product Driver v2.12r012"
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINDOWS\SYSTEM\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [Mount Safe & Sound] C:\PROGRAM FILES\MCAFEE\MCAFEE SHARED COMPONENTS\SAFE & SOUND\FBMOUNT.EXE
O4 - HKLM\..\Run: [hpppta] D:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan\hpppta.exe /ICON
O4 - HKLM\..\Run: [McAfeeWebScanX] C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\WebScanX.Exe
O4 - HKLM\..\Run: [McAfee Guardian] "C:\PROGRAM FILES\MCAFEE\MCAFEE SHARED COMPONENTS\GUARDIAN\CMGRDIAN.EXE" /SU
O4 - HKLM\..\Run: [projselector] "C:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" -r
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [HP Simple Trax] C:\Program Files\CD-Writer Plus\HP Simple Trax\hpcron.exe
O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [Outpost Firewall] C:\PROGRA~1\AGNITUM\OUTPOS~1.0\OUTPOST.EXE /waitservice
O4 - HKLM\..\Run: [UStorage] c:\program files\u-storage tools2.1\ustorage.exe sys_auto_run C:\PROGRAM FILES\U-STORAGE TOOLS2.1
O4 - HKLM\..\Run: [Vshwin32EXE] C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSHWIN32.EXE
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "D:\PROGRAM FILES\MICROSOFT ACTIVESYNC\WCESCOMM.EXE"
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - Startup: AutoStart IR.lnk = C:\Program Files\wintv\ir.exe
O4 - Startup: PerfectPrint.LNK = D:\Corel\Office7\Shared\PFit7\PFPPOP70.EXE
O4 - Startup: Clock.exe.lnk = C:\WINDOWS\CLOCK.EXE
O4 - Startup: SideWinder Game Device Profiler.lnk = C:\Program Files\Microsoft Hardware\Game Devices\SideWinder GDP.exe
O4 - Startup: FlashPath Status.lnk = D:\SMARTDSK\FLASH\SDSTAT.exe
O4 - Startup: GraphicsPlus.lnk = D:\Program Files\Serif\GraphicsPlus\Offres.dll
O4 - Startup: PsiWin 2.3 Connection Server.lnk = D:\Program Files\Psion\PsiWin\psconsv.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - http://www.net2phone.com/ (file missing)
O9 - Extra 'Tools' menuitem: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - http://www.net2phone.com/ (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRAM FILES\MICROSOFT ACTIVESYNC\INETREPL.DLL
O9 - Extra button: Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\PROGRAM FILES\AGNITUM\OUTPOST FIREWALL 1.0\TRASH.EXE (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Show Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\PROGRAM FILES\AGNITUM\OUTPOST FIREWALL 1.0\TRASH.EXE (file missing) (HKCU)
O12 - Plugin for .UVR: C:\PROGRA~1\INTERN~1\Plugins\NPUPano.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab