What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Bett.exe Aarggggg

17 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi All,
Been trying to rid a friends PC of this particular annoyance after cleaning up loads of other spyware and dozens of virus's. Have tried using the Hijack This scan in safe mode and then deleting the C:\Program Files\tcsr folder but upon reboot they return.
Help before I get out the 44 Mag!

Logfile of HijackThis v1.99.1
Scan saved at 5:07:41 AM, on 08/02/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\ATI2EVXX.EXE
C:\WINDOWS\SYSTEM\DEVLDR16.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\USBMONIT.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\WINDOWS\SYSTEM\INTELCDX.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\TCSR\BETT.EXE
C:\HIJACK THIS\HIJACKTHIS.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\ACS\ACSD.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F1 - win.ini: run=hpfsched
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [hpppta] C:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan\hpppta.exe /ICON
O4 - HKLM\..\Run: [USBMonit.exe] "C:\WINDOWS\SYSTEM\USBMonit.exe"
O4 - HKLM\..\Run: [Hidserv] Hidserv.exe run
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [IntelSMAPL] IntelCdx.exe
O4 - HKLM\..\Run: [SpybotSnD] "C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\SPYBOTSD.EXE" /autocheck /autofix
O4 - HKLM\..\Run: [devldr16.exe] C:\WINDOWS\SYSTEM\devldr16.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [ATIPOLL] ati2evxx.exe
O4 - HKLM\..\RunServices: [ATISmart] C:\WINDOWS\SYSTEM\ati2s9ag.exe
O4 - HKCU\..\Run: [Noha] C:\Program Files\tcsr\bett.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O16 - DPF: {3CC943C7-3C99-11D4-8135-0050041A5144} (RunExeActiveX.UserControl1) - file://C:\Program Files\Gateway\HelpSpot\RunExeActiveX.CAB
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print ActiveX Plug-in) - http://www.imgag.com/cp/install/AxCtp.cab
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} (AOL Content Update) - http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
Post #2
Hello lgchristianson, welcome to the TC.


I suggest you do this:


Restart your computer in Safe Mode.

Press the F8 key until the startup menu appears.

Choose the Safe Mode option then press Enter.



Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O4 - HKCU\..\Run: [Noha] C:\Program Files\tcsr\bett.exe

Close ALL windows and browsers except HijackThis and click "Fix checked"

Delete this folder: If listed
C:\Program Files\tcsr


Delete this file:If still listed
C:\Program Files\tcsr\bett.exe



1. Open My Computer
2. Right click on your hard drive that you wish to clean (C drive, for example)
3. In the context menu that opens, select properties
4. Under the general tab you should select Disk Cleanup
5. Windows will scan your drive which will take a few seconds/minutes
6. A box will display the various files you can remove.
Check all boxes except compress old files (If listed)
7. Click OK and windows will comply.

Restart your computer.

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.
Post #3

Hello  lgchristianson, welcome to the TC.


I suggest you do this:


Restart your computer in Safe Mode.

Press the F8 key until the startup menu appears.

Choose the Safe Mode option then press Enter.



Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O4 - HKCU\..\Run: [Noha] C:\Program Files\tcsr\bett.exe

Close ALL windows and browsers except HijackThis and click "Fix checked"

Delete this folder: If listed
C:\Program Files\tcsr


Delete this file:If still listed
C:\Program Files\tcsr\bett.exe



1. Open My Computer
2. Right click on your hard drive that you wish to clean (C drive, for example)
3. In the context menu that opens, select properties
4. Under the general tab you should select Disk Cleanup
5. Windows will scan your drive which will take a few seconds/minutes
6. A box will display the various files you can remove. 
  Check all boxes except compress old files (If listed)
7. Click OK and windows will comply.

Restart your computer.

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.

196559


Thanks for the help LD.
Did all you said but as before it's BACK!
System acts as though there is something running in the background eating up memory and repeatedly tries to "call home" by opening new browser windows every 3 min's or so.
Here a fresh copy of the HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 10:37:10 AM, on 08/13/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\ATI2EVXX.EXE
C:\WINDOWS\SYSTEM\DEVLDR16.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\USBMONIT.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\WINDOWS\SYSTEM\INTELCDX.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\PROGRAM FILES\TCSR\BETT.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\INTERMUTE\SPYSUBTRACT\SPYSUB.EXE
C:\HIJACK THIS\HIJACKTHIS.EXE
C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
C:\WINDOWS\WUAUCLT.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F1 - win.ini: run=hpfsched
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [hpppta] C:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan\hpppta.exe /ICON
O4 - HKLM\..\Run: [USBMonit.exe] "C:\WINDOWS\SYSTEM\USBMonit.exe"
O4 - HKLM\..\Run: [Hidserv] Hidserv.exe run
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [IntelSMAPL] IntelCdx.exe
O4 - HKLM\..\Run: [devldr16.exe] C:\WINDOWS\SYSTEM\devldr16.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [ATIPOLL] ati2evxx.exe
O4 - HKLM\..\RunServices: [ATISmart] C:\WINDOWS\SYSTEM\ati2s9ag.exe
O4 - HKCU\..\Run: [Noha] C:\Program Files\tcsr\bett.exe
O4 - Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O16 - DPF: {3CC943C7-3C99-11D4-8135-0050041A5144} (RunExeActiveX.UserControl1) - file://C:\Program Files\Gateway\HelpSpot\RunExeActiveX.CAB
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print ActiveX Plug-in) - http://www.imgag.com/cp/install/AxCtp.cab
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} (AOL Content Update) - http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
Post #4
Download Pocket Killbox version 2.0.0.175
http://www.atribune.org/downloads/KillBox.exe
If you already have Killbox first ensure it is this version !.

Start Killbox, Use standard file kill.(default settings).
Copy this whole list into the windows clipboard, all the Bolded below.


C:\Program Files\tcsr\bett.exe


Back in Killbox go > file > paste from clipboard, now click the red X
that looks like a stop sign, wait until a success message appears.



Note: if a file cannot be deleted [x] check delete on reboot, then go back to
standard file kill for the next file in the list.

When finished exit Killbox.


Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O4 - HKCU\..\Run: [Noha] C:\Program Files\tcsr\bett.exe

Close ALL windows and browsers except HijackThis and click "Fix checked"

Delete this folder: If listed
C:\Program Files\tcsr


Delete this file:If still listed
C:\Program Files\tcsr\bett.exe



Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.
Post #5

Download Pocket Killbox version 2.0.0.175
http://www.atribune.org/downloads/KillBox.exe
If you already have Killbox first ensure it is this version !.

Start Killbox, Use standard file kill.(default settings).
Copy this whole list into the windows clipboard, all the Bolded below.


C:\Program Files\tcsr\bett.exe


Back in Killbox go > file > paste from clipboard, now click the red X
that looks like a stop sign, wait until a success message appears.



Note: if a file cannot be deleted [x] check delete on reboot, then go back to
standard file kill for the next file in the list.

When finished exit Killbox.


Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O4 - HKCU\..\Run: [Noha] C:\Program Files\tcsr\bett.exe

Close ALL windows and browsers except HijackThis and click "Fix checked"

Delete this folder: If listed
C:\Program Files\tcsr


Delete this file:If still listed
C:\Program Files\tcsr\bett.exe



Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.

197849



It's back…..

Logfile of HijackThis v1.99.1
Scan saved at 3:44:35 PM, on 08/13/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\ATI2EVXX.EXE
C:\WINDOWS\SYSTEM\DEVLDR16.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\USBMONIT.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\WINDOWS\SYSTEM\INTELCDX.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\PROGRAM FILES\INTERMUTE\SPYSUBTRACT\SPYSUB.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\TCSR\BETT.EXE
C:\HIJACK THIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F1 - win.ini: run=hpfsched
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [hpppta] C:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan\hpppta.exe /ICON
O4 - HKLM\..\Run: [USBMonit.exe] "C:\WINDOWS\SYSTEM\USBMonit.exe"
O4 - HKLM\..\Run: [Hidserv] Hidserv.exe run
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [IntelSMAPL] IntelCdx.exe
O4 - HKLM\..\Run: [devldr16.exe] C:\WINDOWS\SYSTEM\devldr16.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [ATIPOLL] ati2evxx.exe
O4 - HKLM\..\RunServices: [ATISmart] C:\WINDOWS\SYSTEM\ati2s9ag.exe
O4 - HKCU\..\Run: [Noha] C:\Program Files\tcsr\bett.exe
O4 - Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O16 - DPF: {3CC943C7-3C99-11D4-8135-0050041A5144} (RunExeActiveX.UserControl1) - file://C:\Program Files\Gateway\HelpSpot\RunExeActiveX.CAB
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print ActiveX Plug-in) - http://www.imgag.com/cp/install/AxCtp.cab
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} (AOL Content Update) - http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
Post #6
Restart your computer in Safe Mode.

Press the F8 key until the startup menu appears.

Choose the Safe Mode option then press Enter.


Close all windows and browsers.
Open HijackThis
Click on Config
Click on Misc Tools
Click on Open Process Manager
Click once on the file below to select it:
C:\Program Files\tcsr\bett.exe
Click: Kill Process to end process

Click on the Back button to exit Process Manager

Now, back at the main screen of HijackThis, proceed to Scan.
and put a check by these.

O4 - HKCU\..\Run: [Noha] C:\Program Files\tcsr\bett.exe

Close ALL windows and browsers except HijackThis and click "Fix checked"

Delete this folder:
C:\Program Files\tcsr


Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment
Post #7

Restart your computer in Safe Mode.

Press the F8 key until the startup menu appears.

Choose the Safe Mode option then press Enter.


Close all windows and browsers.
Open HijackThis
Click on Config
Click on Misc Tools
Click on Open Process Manager 
Click once on the file below to select it:
C:\Program Files\tcsr\bett.exe
Click: Kill Process to end process

Click on the Back button to exit Process Manager

Now, back at the main screen of HijackThis, proceed to Scan.
and put a check by these.


O4 - HKCU\..\Run: [Noha] C:\Program Files\tcsr\bett.exe

Close ALL windows and browsers except HijackThis and click "Fix checked"

Delete this folder:
C:\Program Files\tcsr


Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment

198020


Greetings LD…

"C:\Program Files\tcsr\bett.exe" was not located in the Open Process Manager while in Safe Mode.

Removed the "O4 - HKCU\..\Run: [Noha] C:\Program Files\tcsr\bett.exe" entry, deleted the "tcsr" directory and emptied the recycle bin.

Did recieve a message at boot that "Windows could not upgrade the file %1 from %2 %1 %2

Status: SOSDD
LC
Post #9

Post a new HJT log please.

198178


Here ya go….

Logfile of HijackThis v1.99.1
Scan saved at 11:30:40 AM, on 08/14/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\ATI2EVXX.EXE
C:\WINDOWS\SYSTEM\DEVLDR16.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\USBMONIT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\WINDOWS\SYSTEM\INTELCDX.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\PROGRAM FILES\INTERMUTE\SPYSUBTRACT\SPYSUB.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\TCSR\BETT.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\HIJACK THIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F1 - win.ini: run=hpfsched
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [hpppta] C:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan\hpppta.exe /ICON
O4 - HKLM\..\Run: [USBMonit.exe] "C:\WINDOWS\SYSTEM\USBMonit.exe"
O4 - HKLM\..\Run: [Hidserv] Hidserv.exe run
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [IntelSMAPL] IntelCdx.exe
O4 - HKLM\..\Run: [devldr16.exe] C:\WINDOWS\SYSTEM\devldr16.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [ATIPOLL] ati2evxx.exe
O4 - HKLM\..\RunServices: [ATISmart] C:\WINDOWS\SYSTEM\ati2s9ag.exe
O4 - HKCU\..\Run: [Noha] C:\Program Files\tcsr\bett.exe
O4 - Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O16 - DPF: {3CC943C7-3C99-11D4-8135-0050041A5144} (RunExeActiveX.UserControl1) - file://C:\Program Files\Gateway\HelpSpot\RunExeActiveX.CAB
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print ActiveX Plug-in) - http://www.imgag.com/cp/install/AxCtp.cab
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} (AOL Content Update) - http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
Post #10
Please download L2m9xfix from one of these two locations:
GeeksToGo
Noidea.us

Save it to the desktop and run it. Extract the files, and then open the l2m9xfix folder you just created and run RunThis.bat.

A window will open, and your desktop will disappear, then reappear. Please be patient until the batch says it is completed.

Then please restart your computer, and post a new HijackThis log as well as the entire text of the log.txt file which should be in the same folder as RunThis.bat.
Post #11

Please download L2m9xfix from one of these two locations:
GeeksToGo
Noidea.us

Save it to the desktop and run it.  Extract the files, and then open the l2m9xfix folder you just created and run RunThis.bat.

A window will open, and your desktop will disappear, then reappear.  Please be patient until the batch says it is completed.

Then please restart your computer, and post a new HijackThis log as well as the entire text of the log.txt file which should be in the same folder as RunThis.bat.

198199


Man, I'm gonna owe you……

Logfile of HijackThis v1.99.1
Scan saved at 12:35:15 PM, on 08/14/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\ATI2EVXX.EXE
C:\WINDOWS\SYSTEM\DEVLDR16.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\USBMONIT.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\INTELCDX.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\INTERMUTE\SPYSUBTRACT\SPYSUB.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\TCSR\BETT.EXE
C:\HIJACK THIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F1 - win.ini: run=hpfsched
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [hpppta] C:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan\hpppta.exe /ICON
O4 - HKLM\..\Run: [USBMonit.exe] "C:\WINDOWS\SYSTEM\USBMonit.exe"
O4 - HKLM\..\Run: [Hidserv] Hidserv.exe run
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [IntelSMAPL] IntelCdx.exe
O4 - HKLM\..\Run: [devldr16.exe] C:\WINDOWS\SYSTEM\devldr16.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [ATIPOLL] ati2evxx.exe
O4 - HKLM\..\RunServices: [ATISmart] C:\WINDOWS\SYSTEM\ati2s9ag.exe
O4 - HKCU\..\Run: [Noha] C:\Program Files\tcsr\bett.exe
O4 - Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O16 - DPF: {3CC943C7-3C99-11D4-8135-0050041A5144} (RunExeActiveX.UserControl1) - file://C:\Program Files\Gateway\HelpSpot\RunExeActiveX.CAB
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print ActiveX Plug-in) - http://www.imgag.com/cp/install/AxCtp.cab
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} (AOL Content Update) - http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

________________________________________________________________________

Log of L2M9XFix v1

************

Running from directory:
C:\WINDOWS\Desktop\l2m9xfix

************

Files found:

C:\WINDOWS\system\AAI_3DAE.DLL
C:\WINDOWS\system\AAI_3DAE.DLL
C:\WINDOWS\system\AAI_3DAE.DLL
C:\WINDOWS\system\AAI_3DAE.DLL
C:\WINDOWS\system\AGIFILE.DLL
C:\WINDOWS\system\AGIFILE.DLL
C:\WINDOWS\system\AGIFILE.DLL
C:\WINDOWS\system\AGIFILE.DLL
C:\WINDOWS\system\AHI9DTXX.DLL
C:\WINDOWS\system\AHI9DTXX.DLL
C:\WINDOWS\system\AHI9DTXX.DLL
C:\WINDOWS\system\AHI9DTXX.DLL
C:\WINDOWS\system\AMICAP32.DLL
C:\WINDOWS\system\AMICAP32.DLL
C:\WINDOWS\system\AMICAP32.DLL
C:\WINDOWS\system\AMICAP32.DLL
C:\WINDOWS\system\AVI9DTXX.DLL
C:\WINDOWS\system\AVI9DTXX.DLL
C:\WINDOWS\system\AVI9DTXX.DLL
C:\WINDOWS\system\AVI9DTXX.DLL
C:\WINDOWS\system\AXVPACK.DLL
C:\WINDOWS\system\AXVPACK.DLL
C:\WINDOWS\system\AXVPACK.DLL
C:\WINDOWS\system\AXVPACK.DLL
C:\WINDOWS\system\BMOWSELC.DLL
C:\WINDOWS\system\BMOWSELC.DLL
C:\WINDOWS\system\BMOWSELC.DLL
C:\WINDOWS\system\BMOWSELC.DLL
C:\WINDOWS\system\BPOWSEUI.DLL
C:\WINDOWS\system\BPOWSEUI.DLL
C:\WINDOWS\system\BPOWSEUI.DLL
C:\WINDOWS\system\BPOWSEUI.DLL
C:\WINDOWS\system\CCRDS.DLL
C:\WINDOWS\system\CCRDS.DLL
C:\WINDOWS\system\CCRDS.DLL
C:\WINDOWS\system\CCRDS.DLL
C:\WINDOWS\system\CIPBK32.DLL
C:\WINDOWS\system\CIPBK32.DLL
C:\WINDOWS\system\CIPBK32.DLL
C:\WINDOWS\system\CIPBK32.DLL
C:\WINDOWS\system\CKDIAL32.DLL
C:\WINDOWS\system\CKDIAL32.DLL
C:\WINDOWS\system\CKDIAL32.DLL
C:\WINDOWS\system\CKDIAL32.DLL
C:\WINDOWS\system\CPMCTL32.DLL
C:\WINDOWS\system\CPMCTL32.DLL
C:\WINDOWS\system\CPMCTL32.DLL
C:\WINDOWS\system\CPMCTL32.DLL
C:\WINDOWS\system\Cqmm32.dll
C:\WINDOWS\system\Cqmm32.dll
C:\WINDOWS\system\Cqmm32.dll
C:\WINDOWS\system\Cqmm32.dll
C:\WINDOWS\system\CRBINET.DLL
C:\WINDOWS\system\CRBINET.DLL
C:\WINDOWS\system\CRBINET.DLL
C:\WINDOWS\system\CRBINET.DLL
C:\WINDOWS\system\CRUINF32.DLL
C:\WINDOWS\system\CRUINF32.DLL
C:\WINDOWS\system\CRUINF32.DLL
C:\WINDOWS\system\CRUINF32.DLL
C:\WINDOWS\system\CSTDLL.DLL
C:\WINDOWS\system\CSTDLL.DLL
C:\WINDOWS\system\CSTDLL.DLL
C:\WINDOWS\system\CSTDLL.DLL
C:\WINDOWS\system\CTCFG32.DLL
C:\WINDOWS\system\CTCFG32.DLL
C:\WINDOWS\system\CTCFG32.DLL
C:\WINDOWS\system\CTCFG32.DLL
C:\WINDOWS\system\CTRPOL.DLL
C:\WINDOWS\system\CTRPOL.DLL
C:\WINDOWS\system\CTRPOL.DLL
C:\WINDOWS\system\CTRPOL.DLL
C:\WINDOWS\system\CZMCTL32.DLL
C:\WINDOWS\system\CZMCTL32.DLL
C:\WINDOWS\system\CZMCTL32.DLL
C:\WINDOWS\system\CZMCTL32.DLL
C:\WINDOWS\system\dbmasf.dll
C:\WINDOWS\system\dbmasf.dll
C:\WINDOWS\system\dbmasf.dll
C:\WINDOWS\system\dbmasf.dll
C:\WINDOWS\system\DDNMPNTW.DLL
C:\WINDOWS\system\DDNMPNTW.DLL
C:\WINDOWS\system\DDNMPNTW.DLL
C:\WINDOWS\system\DDNMPNTW.DLL
C:\WINDOWS\system\DECOMPOS.DLL
C:\WINDOWS\system\DECOMPOS.DLL
C:\WINDOWS\system\DECOMPOS.DLL
C:\WINDOWS\system\DECOMPOS.DLL
C:\WINDOWS\system\DFDRAMPF.DLL
C:\WINDOWS\system\DFDRAMPF.DLL
C:\WINDOWS\system\DFDRAMPF.DLL
C:\WINDOWS\system\DFDRAMPF.DLL
C:\WINDOWS\system\DFGSIG.DLL
C:\WINDOWS\system\DFGSIG.DLL
C:\WINDOWS\system\DFGSIG.DLL
C:\WINDOWS\system\DFGSIG.DLL
C:\WINDOWS\system\DGCVW_32.DLL
C:\WINDOWS\system\DGCVW_32.DLL
C:\WINDOWS\system\DGCVW_32.DLL
C:\WINDOWS\system\DGCVW_32.DLL
C:\WINDOWS\system\DIRAWEX.DLL
C:\WINDOWS\system\DIRAWEX.DLL
C:\WINDOWS\system\DIRAWEX.DLL
C:\WINDOWS\system\DIRAWEX.DLL
C:\WINDOWS\system\DJNPUT8.DLL
C:\WINDOWS\system\DJNPUT8.DLL
C:\WINDOWS\system\DJNPUT8.DLL
C:\WINDOWS\system\DJNPUT8.DLL
C:\WINDOWS\system\DMSBASE.DLL
C:\WINDOWS\system\DMSBASE.DLL
C:\WINDOWS\system\DMSBASE.DLL
C:\WINDOWS\system\DMSBASE.DLL
C:\WINDOWS\system\Do50ip32.dll
C:\WINDOWS\system\Do50ip32.dll
C:\WINDOWS\system\Do50ip32.dll
C:\WINDOWS\system\Do50ip32.dll
C:\WINDOWS\system\DRWAVE.DLL
C:\WINDOWS\system\DRWAVE.DLL
C:\WINDOWS\system\DRWAVE.DLL
C:\WINDOWS\system\DRWAVE.DLL
C:\WINDOWS\system\DSDPMESH.DLL
C:\WINDOWS\system\DSDPMESH.DLL
C:\WINDOWS\system\DSDPMESH.DLL
C:\WINDOWS\system\DSDPMESH.DLL
C:\WINDOWS\system\effpixguid.dll
C:\WINDOWS\system\effpixguid.dll
C:\WINDOWS\system\effpixguid.dll
C:\WINDOWS\system\effpixguid.dll
C:\WINDOWS\system\FQXLIB.DLL
C:\WINDOWS\system\FQXLIB.DLL
C:\WINDOWS\system\FQXLIB.DLL
C:\WINDOWS\system\FQXLIB.DLL
C:\WINDOWS\system\HCD.DLL
C:\WINDOWS\system\HCD.DLL
C:\WINDOWS\system\HCD.DLL
C:\WINDOWS\system\HCD.DLL
C:\WINDOWS\system\HKD.DLL
C:\WINDOWS\system\HKD.DLL
C:\WINDOWS\system\HKD.DLL
C:\WINDOWS\system\HKD.DLL
C:\WINDOWS\system\hmfeimg0.dll
C:\WINDOWS\system\hmfeimg0.dll
C:\WINDOWS\system\hmfeimg0.dll
C:\WINDOWS\system\hmfeimg0.dll
C:\WINDOWS\system\IDAGING.DLL
C:\WINDOWS\system\IDAGING.DLL
C:\WINDOWS\system\IDAGING.DLL
C:\WINDOWS\system\IDAGING.DLL
C:\WINDOWS\system\Ieside your Computer.dll
C:\WINDOWS\system\Ieside your Computer.dll
C:\WINDOWS\system\Ieside your Computer.dll
C:\WINDOWS\system\Ieside your Computer.dll
C:\WINDOWS\system\IJ41_QC.dll
C:\WINDOWS\system\IJ41_QC.dll
C:\WINDOWS\system\IJ41_QC.dll
C:\WINDOWS\system\IJ41_QC.dll
C:\WINDOWS\system\IJSETUP.DLL
C:\WINDOWS\system\IJSETUP.DLL
C:\WINDOWS\system\IJSETUP.DLL
C:\WINDOWS\system\IJSETUP.DLL
C:\WINDOWS\system\iqircl.dll
C:\WINDOWS\system\iqircl.dll
C:\WINDOWS\system\iqircl.dll
C:\WINDOWS\system\iqircl.dll
C:\WINDOWS\system\IRWPHBK.DLL
C:\WINDOWS\system\IRWPHBK.DLL
C:\WINDOWS\system\IRWPHBK.DLL
C:\WINDOWS\system\IRWPHBK.DLL
C:\WINDOWS\system\ISLOADER.DLL
C:\WINDOWS\system\ISLOADER.DLL
C:\WINDOWS\system\ISLOADER.DLL
C:\WINDOWS\system\ISLOADER.DLL
C:\WINDOWS\system\IVET16.DLL
C:\WINDOWS\system\IVET16.DLL
C:\WINDOWS\system\IVET16.DLL
C:\WINDOWS\system\IVET16.DLL
C:\WINDOWS\system\Ivside your Computer.dll
C:\WINDOWS\system\Ivside your Computer.dll
C:\WINDOWS\system\Ivside your Computer.dll
C:\WINDOWS\system\Ivside your Computer.dll
C:\WINDOWS\system\IX41_QC.dll
C:\WINDOWS\system\IX41_QC.dll
C:\WINDOWS\system\IX41_QC.dll
C:\WINDOWS\system\IX41_QC.dll
C:\WINDOWS\system\IXSAPI32.DLL
C:\WINDOWS\system\IXSAPI32.DLL
C:\WINDOWS\system\IXSAPI32.DLL
C:\WINDOWS\system\IXSAPI32.DLL
C:\WINDOWS\system\IXSS.DLL
C:\WINDOWS\system\IXSS.DLL
C:\WINDOWS\system\IXSS.DLL
C:\WINDOWS\system\IXSS.DLL
C:\WINDOWS\system\JCPP500.DLL
C:\WINDOWS\system\JCPP500.DLL
C:\WINDOWS\system\JCPP500.DLL
C:\WINDOWS\system\JCPP500.DLL
C:\WINDOWS\system\JCSM500.DLL
C:\WINDOWS\system\JCSM500.DLL
C:\WINDOWS\system\JCSM500.DLL
C:\WINDOWS\system\JCSM500.DLL
C:\WINDOWS\system\JPIT500.DLL
C:\WINDOWS\system\JPIT500.DLL
C:\WINDOWS\system\JPIT500.DLL
C:\WINDOWS\system\JPIT500.DLL
C:\WINDOWS\system\JTIT500.DLL
C:\WINDOWS\system\JTIT500.DLL
C:\WINDOWS\system\JTIT500.DLL
C:\WINDOWS\system\JTIT500.DLL
C:\WINDOWS\system\KPRNEL32.DLL
C:\WINDOWS\system\KPRNEL32.DLL
C:\WINDOWS\system\KPRNEL32.DLL
C:\WINDOWS\system\KPRNEL32.DLL
C:\WINDOWS\system\KWRNEL32.DLL
C:\WINDOWS\system\KWRNEL32.DLL
C:\WINDOWS\system\KWRNEL32.DLL
C:\WINDOWS\system\KWRNEL32.DLL
C:\WINDOWS\system\LATIF80N.DLL
C:\WINDOWS\system\LATIF80N.DLL
C:\WINDOWS\system\LATIF80N.DLL
C:\WINDOWS\system\LATIF80N.DLL
C:\WINDOWS\system\lebmp11n.dll
C:\WINDOWS\system\lebmp11n.dll
C:\WINDOWS\system\lebmp11n.dll
C:\WINDOWS\system\lebmp11n.dll
C:\WINDOWS\system\LGKRN80N.DLL
C:\WINDOWS\system\LGKRN80N.DLL
C:\WINDOWS\system\LGKRN80N.DLL
C:\WINDOWS\system\LGKRN80N.DLL
C:\WINDOWS\system\LHDIC80N.DLL
C:\WINDOWS\system\LHDIC80N.DLL
C:\WINDOWS\system\LHDIC80N.DLL
C:\WINDOWS\system\LHDIC80N.DLL
C:\WINDOWS\system\LHPCT80N.DLL
C:\WINDOWS\system\LHPCT80N.DLL
C:\WINDOWS\system\LHPCT80N.DLL
C:\WINDOWS\system\LHPCT80N.DLL
C:\WINDOWS\system\LIPCT80N.DLL
C:\WINDOWS\system\LIPCT80N.DLL
C:\WINDOWS\system\LIPCT80N.DLL
C:\WINDOWS\system\LIPCT80N.DLL
C:\WINDOWS\system\LJBMP80N.DLL
C:\WINDOWS\system\LJBMP80N.DLL
C:\WINDOWS\system\LJBMP80N.DLL
C:\WINDOWS\system\LJBMP80N.DLL
C:\WINDOWS\system\llbmp11n.dll
C:\WINDOWS\system\llbmp11n.dll
C:\WINDOWS\system\llbmp11n.dll
C:\WINDOWS\system\llbmp11n.dll
C:\WINDOWS\system\lltif70n.dll
C:\WINDOWS\system\lltif70n.dll
C:\WINDOWS\system\lltif70n.dll
C:\WINDOWS\system\lltif70n.dll
C:\WINDOWS\system\lmbmp12n.dll
C:\WINDOWS\system\lmbmp12n.dll
C:\WINDOWS\system\lmbmp12n.dll
C:\WINDOWS\system\lmbmp12n.dll
C:\WINDOWS\system\lmimg11n.dll
C:\WINDOWS\system\lmimg11n.dll
C:\WINDOWS\system\lmimg11n.dll
C:\WINDOWS\system\lmimg11n.dll
C:\WINDOWS\system\LODIS11n.dll
C:\WINDOWS\system\LODIS11n.dll
C:\WINDOWS\system\LODIS11n.dll
C:\WINDOWS\system\LODIS11n.dll
C:\WINDOWS\system\lqtga12n.dll
C:\WINDOWS\system\lqtga12n.dll
C:\WINDOWS\system\lqtga12n.dll
C:\WINDOWS\system\lqtga12n.dll
C:\WINDOWS\system\lvpsd11n.dll
C:\WINDOWS\system\lvpsd11n.dll
C:\WINDOWS\system\lvpsd11n.dll
C:\WINDOWS\system\lvpsd11n.dll
C:\WINDOWS\system\mbvcr70.dll
C:\WINDOWS\system\mbvcr70.dll
C:\WINDOWS\system\mbvcr70.dll
C:\WINDOWS\system\mbvcr70.dll
C:\WINDOWS\system\mfxml4a.dll
C:\WINDOWS\system\mfxml4a.dll
C:\WINDOWS\system\mfxml4a.dll
C:\WINDOWS\system\mfxml4a.dll
C:\WINDOWS\system\MGNETOBJ.DLL
C:\WINDOWS\system\MGNETOBJ.DLL
C:\WINDOWS\system\MGNETOBJ.DLL
C:\WINDOWS\system\MGNETOBJ.DLL
C:\WINDOWS\system\mgxml4.dll
C:\WINDOWS\system\mgxml4.dll
C:\WINDOWS\system\mgxml4.dll
C:\WINDOWS\system\mgxml4.dll
C:\WINDOWS\system\MIJDBC10.DLL
C:\WINDOWS\system\MIJDBC10.DLL
C:\WINDOWS\system\MIJDBC10.DLL
C:\WINDOWS\system\MIJDBC10.DLL
C:\WINDOWS\system\MIR.DLL
C:\WINDOWS\system\MIR.DLL
C:\WINDOWS\system\MIR.DLL
C:\WINDOWS\system\MIR.DLL
C:\WINDOWS\system\mjihnd.dll
C:\WINDOWS\system\mjihnd.dll
C:\WINDOWS\system\mjihnd.dll
C:\WINDOWS\system\mjihnd.dll
C:\WINDOWS\system\MJR.DLL
C:\WINDOWS\system\MJR.DLL
C:\WINDOWS\system\MJR.DLL
C:\WINDOWS\system\MJR.DLL
C:\WINDOWS\system\mjrd2x35.dll
C:\WINDOWS\system\mjrd2x35.dll
C:\WINDOWS\system\mjrd2x35.dll
C:\WINDOWS\system\mjrd2x35.dll
C:\WINDOWS\system\mkxml4a.dll
C:\WINDOWS\system\mkxml4a.dll
C:\WINDOWS\system\mkxml4a.dll
C:\WINDOWS\system\mkxml4a.dll
C:\WINDOWS\system\MLRLE32.DLL
C:\WINDOWS\system\MLRLE32.DLL
C:\WINDOWS\system\MLRLE32.DLL
C:\WINDOWS\system\MLRLE32.DLL
C:\WINDOWS\system\MNVFW32.DLL
C:\WINDOWS\system\MNVFW32.DLL
C:\WINDOWS\system\MNVFW32.DLL
C:\WINDOWS\system\MNVFW32.DLL
C:\WINDOWS\system\mnxml4.dll
C:\WINDOWS\system\mnxml4.dll
C:\WINDOWS\system\mnxml4.dll
C:\WINDOWS\system\mnxml4.dll
C:\WINDOWS\system\mPpi32.dll
C:\WINDOWS\system\mPpi32.dll
C:\WINDOWS\system\mPpi32.dll
C:\WINDOWS\system\mPpi32.dll
C:\WINDOWS\system\MQI.DLL
C:\WINDOWS\system\MQI.DLL
C:\WINDOWS\system\MQI.DLL
C:\WINDOWS\system\MQI.DLL
C:\WINDOWS\system\mqoeacct.dll
C:\WINDOWS\system\mqoeacct.dll
C:\WINDOWS\system\mqoeacct.dll
C:\WINDOWS\system\mqoeacct.dll
C:\WINDOWS\system\mQpistub.dll
C:\WINDOWS\system\mQpistub.dll
C:\WINDOWS\system\mQpistub.dll
C:\WINDOWS\system\mQpistub.dll
C:\WINDOWS\system\MRLOCUSR.DLL
C:\WINDOWS\system\MRLOCUSR.DLL
C:\WINDOWS\system\MRLOCUSR.DLL
C:\WINDOWS\system\MRLOCUSR.DLL
C:\WINDOWS\system\MWIIpl2M6.dll
C:\WINDOWS\system\MWIIpl2M6.dll
C:\WINDOWS\system\MWIIpl2M6.dll
C:\WINDOWS\system\MWIIpl2M6.dll
C:\WINDOWS\system\MZDVDOPT.DLL
C:\WINDOWS\system\MZDVDOPT.DLL
C:\WINDOWS\system\MZDVDOPT.DLL
C:\WINDOWS\system\MZDVDOPT.DLL
C:\WINDOWS\system\OEE32.DLL
C:\WINDOWS\system\OEE32.DLL
C:\WINDOWS\system\OEE32.DLL
C:\WINDOWS\system\OEE32.DLL
C:\WINDOWS\system\oehlp30t.dll
C:\WINDOWS\system\oehlp30t.dll
C:\WINDOWS\system\oehlp30t.dll
C:\WINDOWS\system\oehlp30t.dll
C:\WINDOWS\system\OREPRO32.DLL
C:\WINDOWS\system\OREPRO32.DLL
C:\WINDOWS\system\OREPRO32.DLL
C:\WINDOWS\system\OREPRO32.DLL
C:\WINDOWS\system\Otbccp32.dll
C:\WINDOWS\system\Otbccp32.dll
C:\WINDOWS\system\Otbccp32.dll
C:\WINDOWS\system\Otbccp32.dll
C:\WINDOWS\system\PBWRPROF.DLL
C:\WINDOWS\system\PBWRPROF.DLL
C:\WINDOWS\system\PBWRPROF.DLL
C:\WINDOWS\system\PBWRPROF.DLL
C:\WINDOWS\system\PFPD.DLL
C:\WINDOWS\system\PFPD.DLL
C:\WINDOWS\system\PFPD.DLL
C:\WINDOWS\system\PFPD.DLL
C:\WINDOWS\system\PUWEROLD.DLL
C:\WINDOWS\system\PUWEROLD.DLL
C:\WINDOWS\system\PUWEROLD.DLL
C:\WINDOWS\system\PUWEROLD.DLL
C:\WINDOWS\system\pxdx5016.dll
C:\WINDOWS\system\pxdx5016.dll
C:\WINDOWS\system\pxdx5016.dll
C:\WINDOWS\system\pxdx5016.dll
C:\WINDOWS\system\PZDLIB32.DLL
C:\WINDOWS\system\PZDLIB32.DLL
C:\WINDOWS\system\PZDLIB32.DLL
C:\WINDOWS\system\PZDLIB32.DLL
C:\WINDOWS\system\PZPARSE.DLL
C:\WINDOWS\system\PZPARSE.DLL
C:\WINDOWS\system\PZPARSE.DLL
C:\WINDOWS\system\PZPARSE.DLL
C:\WINDOWS\system\RACHED.DLL
C:\WINDOWS\system\RACHED.DLL
C:\WINDOWS\system\RACHED.DLL
C:\WINDOWS\system\RACHED.DLL
C:\WINDOWS\system\RFAPH.DLL
C:\WINDOWS\system\RFAPH.DLL
C:\WINDOWS\system\RFAPH.DLL
C:\WINDOWS\system\RFAPH.DLL
C:\WINDOWS\system\RLCHED.DLL
C:\WINDOWS\system\RLCHED.DLL
C:\WINDOWS\system\RLCHED.DLL
C:\WINDOWS\system\RLCHED.DLL
C:\WINDOWS\system\RQABASE.DLL
C:\WINDOWS\system\RQABASE.DLL
C:\WINDOWS\system\RQABASE.DLL
C:\WINDOWS\system\RQABASE.DLL
C:\WINDOWS\system\RWSAPI32.DLL
C:\WINDOWS\system\RWSAPI32.DLL
C:\WINDOWS\system\RWSAPI32.DLL
C:\WINDOWS\system\RWSAPI32.DLL
C:\WINDOWS\system\SBI.DLL
C:\WINDOWS\system\SBI.DLL
C:\WINDOWS\system\SBI.DLL
C:\WINDOWS\system\SBI.DLL
C:\WINDOWS\system\SDELL.DLL
C:\WINDOWS\system\SDELL.DLL
C:\WINDOWS\system\SDELL.DLL
C:\WINDOWS\system\SDELL.DLL
C:\WINDOWS\system\SELSRV32.DLL
C:\WINDOWS\system\SELSRV32.DLL
C:\WINDOWS\system\SELSRV32.DLL
C:\WINDOWS\system\SELSRV32.DLL
C:\WINDOWS\system\SFWValid.dll
C:\WINDOWS\system\SFWValid.dll
C:\WINDOWS\system\SFWValid.dll
C:\WINDOWS\system\SFWValid.dll
C:\WINDOWS\system\SIORAGE.DLL
C:\WINDOWS\system\SIORAGE.DLL
C:\WINDOWS\system\SIORAGE.DLL
C:\WINDOWS\system\SIORAGE.DLL
C:\WINDOWS\system\SPNCUI.DLL
C:\WINDOWS\system\SPNCUI.DLL
C:\WINDOWS\system\SPNCUI.DLL
C:\WINDOWS\system\SPNCUI.DLL
C:\WINDOWS\system\SSNDMAIL.DLL
C:\WINDOWS\system\SSNDMAIL.DLL
C:\WINDOWS\system\SSNDMAIL.DLL
C:\WINDOWS\system\SSNDMAIL.DLL
C:\WINDOWS\system\STTUPX.DLL
C:\WINDOWS\system\STTUPX.DLL
C:\WINDOWS\system\STTUPX.DLL
C:\WINDOWS\system\STTUPX.DLL
C:\WINDOWS\system\SVMAN32.DLL
C:\WINDOWS\system\SVMAN32.DLL
C:\WINDOWS\system\SVMAN32.DLL
C:\WINDOWS\system\SVMAN32.DLL
C:\WINDOWS\system\TDAPI.DLL
C:\WINDOWS\system\TDAPI.DLL
C:\WINDOWS\system\TDAPI.DLL
C:\WINDOWS\system\TDAPI.DLL
C:\WINDOWS\system\TRP3216S.DLL
C:\WINDOWS\system\TRP3216S.DLL
C:\WINDOWS\system\TRP3216S.DLL
C:\WINDOWS\system\TRP3216S.DLL
C:\WINDOWS\system\UXNP.DLL
C:\WINDOWS\system\UXNP.DLL
C:\WINDOWS\system\UXNP.DLL
C:\WINDOWS\system\UXNP.DLL
C:\WINDOWS\system\UYDM16.DLL
C:\WINDOWS\system\UYDM16.DLL
C:\WINDOWS\system\UYDM16.DLL
C:\WINDOWS\system\UYDM16.DLL
C:\WINDOWS\system\VJAJET32.DLL
C:\WINDOWS\system\VJAJET32.DLL
C:\WINDOWS\system\VJAJET32.DLL
C:\WINDOWS\system\VJAJET32.DLL
C:\WINDOWS\system\WDVCORE.DLL
C:\WINDOWS\system\WDVCORE.DLL
C:\WINDOWS\system\WDVCORE.DLL
C:\WINDOWS\system\WDVCORE.DLL
C:\WINDOWS\system\WFADEFUI.DLL
C:\WINDOWS\system\WFADEFUI.DLL
C:\WINDOWS\system\WFADEFUI.DLL
C:\WINDOWS\system\WFADEFUI.DLL
C:\WINDOWS\system\WRASHEXT.DLL
C:\WINDOWS\system\WRASHEXT.DLL
C:\WINDOWS\system\WRASHEXT.DLL
C:\WINDOWS\system\WRASHEXT.DLL
C:\WINDOWS\system\wzpcd.dll
C:\WINDOWS\system\wzpcd.dll
C:\WINDOWS\system\wzpcd.dll
C:\WINDOWS\system\wzpcd.dll
C:\WINDOWS\system\ZGPFLDR.DLL
C:\WINDOWS\system\ZGPFLDR.DLL
C:\WINDOWS\system\ZGPFLDR.DLL
C:\WINDOWS\system\ZGPFLDR.DLL

************

Registry entries found:

[HKEY_CLASSES_ROOT\CLSID\{8589409A-BD3E-4883-BC57-2A58427468B7}\InprocServer32]
@="C:\\WINDOWS\\SYSTEM\\DGCVW_32.DLL"
[HKEY_CLASSES_ROOT\CLSID\{8589409A-BD3E-4883-BC57-2A58427468B7}\InprocServer32]
@="C:\\WINDOWS\\SYSTEM\\DGCVW_32.DLL"
[HKEY_CLASSES_ROOT\CLSID\{8589409A-BD3E-4883-BC57-2A58427468B7}\InprocServer32]
@="C:\\WINDOWS\\SYSTEM\\DGCVW_32.DLL"
[HKEY_CLASSES_ROOT\CLSID\{8589409A-BD3E-4883-BC57-2A58427468B7}\InprocServer32]
@="C:\\WINDOWS\\SYSTEM\\DGCVW_32.DLL"

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{FA5ED67A-1B39-987A-3AD5-F1DFAB0E01C0}"=""


************

Killing Explorer
Done!

Killing Rundll32
Done!

Removing malicious CLSID(s)
Done!

Restarting Explorer
Done!

Deleting malicious files
Done!


Finished!
Post #12
Now lets see if we can kill it. If it doesn't, we'll use regedit.

Start Killbox, Use standard file kill.(default settings).
Copy this whole list into the windows clipboard, all the Bolded below.


C:\Program Files\tcsr\bett.exe


Back in Killbox go > file > paste from clipboard, now click the red X
that looks like a stop sign, wait until a success message appears.



Note: if a file cannot be deleted [x] check delete on reboot, then go back to
standard file kill for the next file in the list.

When finished exit Killbox.


Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O4 - HKCU\..\Run: [Noha] C:\Program Files\tcsr\bett.exe

Close ALL windows and browsers except HijackThis and click "Fix checked"

Delete this folder: If listed
C:\Program Files\tcsr


Delete this file:If still listed
C:\Program Files\tcsr\bett.exe



Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.
Post #13

Now lets see if we can kill it. If it doesn't, we'll use regedit.

Start Killbox, Use standard file kill.(default settings).
Copy this whole list into the windows clipboard, all the Bolded below.


C:\Program Files\tcsr\bett.exe


Back in Killbox go > file > paste from clipboard, now click the red X
that looks like a stop sign, wait until a success message appears.



Note: if a file cannot be deleted [x] check delete on reboot, then go back to
standard file kill for the next file in the list.

When finished exit Killbox.


Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O4 - HKCU\..\Run: [Noha] C:\Program Files\tcsr\bett.exe

Close ALL windows and browsers except HijackThis and click "Fix checked"

Delete this folder: If listed
C:\Program Files\tcsr


Delete this file:If still listed
C:\Program Files\tcsr\bett.exe



Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.

198222



Persistant little bugger…..
System booted as usual.
Here's the new HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 1:17:04 PM, on 08/14/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\ATI2EVXX.EXE
C:\WINDOWS\SYSTEM\DEVLDR16.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\USBMONIT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\WINDOWS\SYSTEM\INTELCDX.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\INTERMUTE\SPYSUBTRACT\SPYSUB.EXE
C:\PROGRAM FILES\TCSR\BETT.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\HIJACK THIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F1 - win.ini: run=hpfsched
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [hpppta] C:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan\hpppta.exe /ICON
O4 - HKLM\..\Run: [USBMonit.exe] "C:\WINDOWS\SYSTEM\USBMonit.exe"
O4 - HKLM\..\Run: [Hidserv] Hidserv.exe run
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [IntelSMAPL] IntelCdx.exe
O4 - HKLM\..\Run: [devldr16.exe] C:\WINDOWS\SYSTEM\devldr16.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [ATIPOLL] ati2evxx.exe
O4 - HKLM\..\RunServices: [ATISmart] C:\WINDOWS\SYSTEM\ati2s9ag.exe
O4 - HKCU\..\Run: [Noha] C:\Program Files\tcsr\bett.exe
O4 - Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O16 - DPF: {3CC943C7-3C99-11D4-8135-0050041A5144} (RunExeActiveX.UserControl1) - file://C:\Program Files\Gateway\HelpSpot\RunExeActiveX.CAB
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print ActiveX Plug-in) - http://www.imgag.com/cp/install/AxCtp.cab
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} (AOL Content Update) - http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
Post #14
Backup your Registry…
- Press "CTRL - ALT - DEL" keys all at the same time to start "Task Manager"
- In the Task Manager window click on "File", then from the drop-down menu select "New Task (Run…)"
- In the "Create New Task" window enter\type "regedit" (without quotes)
- Once Regedit opens click on the FILE menu and select Export
- Save the file as backup. Save the file somewhere you will remember and not delete.
IMPORTANT: make sure to set the export range to ALL



click Start>Run and type regedit tap enter key.


Regedit will open. At the top of the window click edit> Find> then copy and paste the following into the window.

bett.exe

Then click find now.
When you find the entry right click on it and select delete, answer ok at the prompt.
Next, press "F3" to continue searching, if another instance is found, repeat the above steps, until you see the "completed searching" message.

Reboot and post a new HJT log.
Post #15

Backup your Registry…
- Press "CTRL - ALT - DEL" keys all at the same time to start "Task Manager"
- In the Task Manager window click on "File", then from the drop-down menu select "New Task (Run…)"
- In the "Create New Task" window enter\type "regedit" (without quotes)
- Once Regedit opens click on the FILE menu and select Export
- Save the file as backup. Save the file somewhere you will remember and not delete.
IMPORTANT: make sure to set the export range to ALL



click Start>Run and type regedit tap enter key.


Regedit will open. At the top of the window click edit> Find> then copy and paste the following into the window.

bett.exe

Then click find now.
When you find the entry right click on it and select delete, answer ok at the prompt.
Next, press "F3" to continue searching, if another instance is found, repeat the above steps, until you see the "completed searching" message.

Reboot and post a new HJT log.

198238



LD, I've already tried removing it from the registry but it simply returns upon re-boot.
I remember a (shareware?) program from a few years ago that showed a process tree and logged changes to the registry, does any of that ring a bell or be of any use here?
LC

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI