WHAT? It's baaack! Help!

Please go here and try this cleaning tool.
http://www.microsoft.com/security/malwareremove/default.mspx

Let me know how it goes.

LDTate: Thanks for your reply and forward of information in the "a little disappointed" post. I read it throughly, and it reallly makes sense. I posted back, but I don't know if you saw it because the reply was to Qool.. I am writing this reply from my home computer right now so I can't post any logs. But if you read the reply under that post, you know that the problem exists on this computer too. I still don't have the DNS numbers from my ISP so that I can attack this problem. As I asked in the other post, is there any other way to get the DNS numbers if my ISP guy doesn't cooperate? Since my settings in my TCI/ISP and DNS properties are set to "automatically detect" it doesn't show the DNS numbers; but I did go to my admistrative tools and I could see the 0.0.0.0.'s there.

As I asked in the other post, is there any other way to get the DNS numbers if my ISP guy doesn't cooperate?

Not that I know of. Maybe someone else that reads this post will have a idea.

LDTate- This might be a "back door", but tell me what you think - our office has a Web Site. There is a control panel that goes along with it that I can check how many visits we have had, what pages were most popular, etc. One of the things that I can see is "last visited by"… It shows an address, in numbers. But I don't know if that is my office address or the ISP address. Do you know which it would be?

Lets try this:

With IE open, click Tools> Internet Options> Security> Restricted Sites>
Sites > add this site. You might be able to copy/paste. Be sure to use the *.

*.1dial.search-results-site.com

It didn't work. Strange thing happened though. When I pasted the site into the block site box, a window came up from microsoft blockers telling me that a "trusted" site has been added to the restricted list. It asked if I wanted to block it and I said yes. It gave me another window that asked if I was sure, I said yes. So it added it to the blocked list. I tried a search from the address bar, but still got redirected. I went back to Internet options, restricted sites and pasted the site again. Instead of telling me I already had it blocked, it listed it again. Again I got the pop-up window from microsoft, but this time telling me that a blocked site had been added to the restricted sites. When I clicked on the button for more information it showed the "blocked" site. The address was only partial, search-results-site.com. I am possitive that I pasted the whole address starting from the *, both times.

By the way, I am able to keep checking the problem, because it exists on my home computer too. I just can't post any hijack this logs from the office computer. I CAN post logs from this computer though, since I have all of the same anti-virus/adware/malware programs on this one. However, this OS is XP.

If it put search-results-site.com. in th erestricted sites that is OK. Just didn't stop the problem

Go ahead and post a HJT log.

I suggest you do this:

Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000

Close ALL windows and browsers except HijackThis and click "Fix checked"

Delete these files if listed:
C:\WINDOWS\ALCXMNTR.EXE


Empty Recycle Bin


Reboot


Run Hijackthis.

Click the "Open the Misc Tools" section Button.

Click the "Open Uninstall Manager" Button.

Click the "Save list…" Button.

Save it to your desktop. Copy and paste the contents into your reply.


and "copy/paste" a new log file into this thread.

I find this very interesting.
Sometimes this is in your log and sometimes not:

O17 - HKLM\System\CCS\Services\Tcpip\..\{1A0A0914-E8AD-4AC7-86D7-268B01BD2CB5}: NameServer = 64.136.173.5 64.136.164.46

Are you in Pennsylvania - Pittsburgh ?

http://www.whois.sc/64.136.173.5


64.136.173.5

Blacklist Status: Clear
Whois History: 2 records stored
Oldest: 2005-06-16
Newest: 2005-09-03
Record Type: IP Address
IP Location: United States - Pennsylvania - Pittsburgh - Computer Comfort
Reverse IP: No websites hosted using this IP address
Reverse DNS: node5-173-136-64.1dial.com


——————————————————————————–

OrgName: Computer Comfort
OrgID: CMFT
Address: 325 Mt. Lebanon Blvd
City: Pittsburgh
StateProv: PA
PostalCode: 15234
Country: US

NetRange: 64.136.160.0 - 64.136.175.255
CIDR: 64.136.160.0/20
NetName: COMPCOMF-BLK-1
NetHandle: NET-64-136-160-0-1
Parent: NET-64-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.COMPCOMF.COM
NameServer: NS2.COMPCOMF.COM
Comment:
RegDate: 2002-08-30
Updated: 2002-09-16

TechHandle: CH1148-ARIN
TechName: Hostmaster, Computer
TechPhone: [removed]
TechEmail:

OrgTechHandle: PS531-ARIN
OrgTechName: Sherlock, Pat
OrgTechPhone: [removed]
OrgTechEmail:

# ARIN WHOIS database, last updated 2005-09-02 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.


Please download WinPFind.zip from this link.

http://www.bleepingcomputer.com/files/oldtimer/WinPFind.zip

Reboot in SAFE MODE !! Important !!
°To get into the Safe mode as the computer is booting press and hold your "F8 Key". Use your arrow keys to move to "Safe Mode" and press your Enter key

Doubleclick winpfind.exe
Click start Scan.
It will scan for a while, so please be patient.
Let it finish the job.

Reboot back to normal mode.

Post the contents of winpfind.txt which is present in the winpfind-folder in your next reply.



Usage Instructions: Download WinPFind.zip and extract it to your C:\ folder. This will create a folder called WinPFind in the C:\ folder. Inside c:\WinPFind is a file called WinPFind.exe. Double-click on this file to launch the program. Once it is launched, click on the Start Scan button and wait for it to finish. This program will scan large amounts of files on your computer for known patterns so please be patient while it works as it can take a while, upwards to 30 minutes or more.

LDTate: No, not in PA, Pittsburgh - I'm in Western NY. I will download the program to gave to me, but I can't do it until tomorrow AM. Babysitting my Newborn granddaughter yesterday and today. What is the other information that you posted all about?

This has shown up sometimes in your HJT log. If it were your ISP, it show in every log. O17 - HKLM\System\CCS\Services\Tcpip\..\{1A0A0914-E8AD-4AC7-86D7-268B01BD2CB5}: NameServer = 64.136.173.5 64.136.164.46 Post back the results of WinPFind, when you have time to run it.

LDTate-I hope that I haven't confused you-remember that I had been talking to you from my office computer, but this past weekend starting from Friday 9/3 I was on my home computer; you said it was okay to go ahead and post that HJT log too, because I also get redirected from that computer. My ISP is the same for both though. Here is the log file that you asked for from WinPFind: THIS SCAN IS FROM THE OFFICE COMPUTER. WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding. If you see a message in the titlebar saying "Not responding…" you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly. »»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Product Name: Microsoft Windows 2000 Current Build: Service Pack 4 Current Build Number: 2195 Internet Explorer Version: 6.0.2800.1106 »»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»» Checking %SystemDrive% folder… Checking %ProgramFilesDir% folder… Checking %WinDir% folder… PECompact2 12/2/2004 1:44:40 PM 10496066 C:\WINNT\LPT$VPN.277 qoologic 12/2/2004 1:44:40 PM 10496066 C:\WINNT\LPT$VPN.277 UPX! 12/2/2004 1:44:40 PM 162885 C:\WINNT\tsc.exe PECompact2 12/2/2004 1:44:40 PM 10496066 C:\WINNT\VPTNFILE.277 qoologic 12/2/2004 1:44:40 PM 10496066 C:\WINNT\VPTNFILE.277 UPX! 12/2/2004 1:44:40 PM 1036800 C:\WINNT\vsapi32.dll aspack 12/2/2004 1:44:40 PM 1036800 C:\WINNT\vsapi32.dll Checking %System% folder… PECompact2 8/18/2005 1:23:12 PM 1464160 C:\WINNT\SYSTEM32\MRT.exe aspack 8/18/2005 1:23:12 PM 1464160 C:\WINNT\SYSTEM32\MRT.exe Umonitor 1/12/2005 12:39:46 PM 531216 C:\WINNT\SYSTEM32\RASDLG.DLL winsync 7/14/2003 8:00:00 AM 1309184 C:\WINNT\SYSTEM32\wbdbase.deu Checking %System%\Drivers folder and sub-folders… Items found in C:\WINNT\SYSTEM32\drivers\etc\hosts Checking the Windows folder and sub-folders for system and hidden files within the last 60 days… 9/6/2005 8:35:18 AM H 1198914 C:\WINNT\ShellIconCache 8/31/2005 2:29:44 PM H 65 C:\WINNT\Downloaded Program Files\desktop.ini 8/24/2005 2:32:44 PM H 10820 C:\WINNT\Help\nocontnt.GID 8/12/2005 11:47:20 AM H 0 C:\WINNT\inf\oem18.inf 8/12/2005 11:48:52 AM H 0 C:\WINNT\inf\oem19.inf 8/31/2005 2:29:44 PM H 65 C:\WINNT\Offline Web Pages\desktop.ini 8/12/2005 8:21:42 AM H 890 C:\WINNT\system32\vsconfig.xml 8/8/2005 8:11:44 AM H 4212 C:\WINNT\system32\zllictbl.dat 9/6/2005 8:19:16 AM H 1024 C:\WINNT\system32\config\default.LOG 9/6/2005 8:40:04 AM H 1024 C:\WINNT\system32\config\SAM.LOG 9/6/2005 8:38:12 AM H 1024 C:\WINNT\system32\config\SECURITY.LOG 9/6/2005 8:42:42 AM H 1024 C:\WINNT\system32\config\software.LOG 9/6/2005 8:36:44 AM H 6 C:\WINNT\Tasks\SA.DAT 8/31/2005 2:29:46 PM H 11083 C:\WINNT\Web\ftp.htt Checking for CPL files… Microsoft Corporation 12/7/1999 8:00:00 AM 67344 C:\WINNT\SYSTEM32\access.cpl Microsoft Corporation 7/14/2003 8:00:00 AM 301328 C:\WINNT\SYSTEM32\appwiz.cpl Microsoft Corporation 7/14/2003 8:00:00 AM 237328 C:\WINNT\SYSTEM32\desk.cpl Microsoft Corporation 7/14/2003 8:00:00 AM 31504 C:\WINNT\SYSTEM32\fax.cpl Microsoft Corporation 7/14/2003 8:00:00 AM 128272 C:\WINNT\SYSTEM32\hdwwiz.cpl Microsoft Corporation 8/29/2002 8:14:40 AM 292352 C:\WINNT\SYSTEM32\inetcpl.cpl Microsoft Corporation 7/14/2003 8:00:00 AM 118032 C:\WINNT\SYSTEM32\intl.cpl Microsoft Corporation 7/14/2003 8:00:00 AM 36112 C:\WINNT\SYSTEM32\irprops.cpl Microsoft Corporation 10/30/2001 9:10:00 AM 326144 C:\WINNT\SYSTEM32\joy.cpl Microsoft Corporation 7/14/2003 8:00:00 AM 122128 C:\WINNT\SYSTEM32\main.cpl Microsoft Corporation 7/14/2003 8:00:00 AM 303888 C:\WINNT\SYSTEM32\mmsys.cpl Microsoft Corporation 7/14/2003 8:00:00 AM 17168 C:\WINNT\SYSTEM32\ncpa.cpl Microsoft Corporation 7/14/2003 8:00:00 AM 41232 C:\WINNT\SYSTEM32\nwc.cpl Microsoft Corporation 7/14/2003 8:00:00 AM 41232 C:\WINNT\SYSTEM32\odbccp32.cpl Microsoft Corporation 7/14/2003 8:00:00 AM 90896 C:\WINNT\SYSTEM32\powercfg.cpl Apple Computer, Inc. 10/3/2003 6:14:30 PM 314880 C:\WINNT\SYSTEM32\QuickTime.cpl Microsoft Corporation 7/14/2003 8:00:00 AM 83216 C:\WINNT\SYSTEM32\sticpl.cpl Microsoft Corporation 7/14/2003 8:00:00 AM 125712 C:\WINNT\SYSTEM32\sysdm.cpl Microsoft Corporation 7/14/2003 8:00:00 AM 5904 C:\WINNT\SYSTEM32\telephon.cpl Microsoft Corporation 7/14/2003 8:00:00 AM 61200 C:\WINNT\SYSTEM32\timedate.cpl Microsoft Corporation 5/26/2005 4:16:30 AM 174360 C:\WINNT\SYSTEM32\wuaucpl.cpl Microsoft Corporation 8/29/2002 8:14:40 AM 292352 C:\WINNT\SYSTEM32\dllcache\inetcpl.cpl Microsoft Corporation 1/12/2005 12:40:00 PM 64784 C:\WINNT\SYSTEM32\dllcache\msmq.cpl IBM Corporation 9/23/1999 7:44:36 PM 94208 C:\WINNT\SYSTEM32\dllcache\mwcpa32.cpl Microsoft Corporation 7/14/2003 8:00:00 AM 41232 C:\WINNT\SYSTEM32\dllcache\nwc.cpl Microsoft Corporation 7/14/2003 8:00:00 AM 41232 C:\WINNT\SYSTEM32\dllcache\odbccp32.cpl Microsoft Corporation 5/26/2005 4:16:30 AM 174360 C:\WINNT\SYSTEM32\dllcache\wuaucpl.cpl »»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»» Checking files in %ALLUSERSPROFILE%\Startup folder… 8/25/2005 9:41:40 AM 1577 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk Checking files in %ALLUSERSPROFILE%\Application Data folder… Checking files in %USERPROFILE%\Startup folder… Checking files in %USERPROFILE%\Application Data folder… 11/22/2004 11:46:30 AM 0 C:\Documents and Settings\Doris Carlson\Application Data\dm.ini 8/25/2005 9:26:00 AM 37221 C:\Documents and Settings\Doris Carlson\Application Data\Microsoft Access.ADR »»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»» [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers] HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\InoShell {DCED20BE-3645-11D4-BC95-00C04F0E0588} = HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files {750fdf0e-2a26-11d1-a3ea-080036587f03} = cscui.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With {09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\shell32.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu {A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\shell32.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu {5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinZip {E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu {5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinZip {E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\InoShell {DCED20BE-3645-11D4-BC95-00C04F0E0588} = HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files {750fdf0e-2a26-11d1-a3ea-080036587f03} = cscui.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Open With EncryptionMenu {A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\shell32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = ntshrui.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinZip {E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871} = %SystemRoot%\system32\shell32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF} = %SystemRoot%\system32\shell32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF} = %SystemRoot%\system32\shell32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE} = C:\WINNT\system32\docprop2.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{7f9609be-af9a-11d1-83e0-00c04fb6e984} = %SystemRoot%\system32\faxshell.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{884EA37B-37C0-11d2-BE3F-00A0C9A83DA1} = C:\WINNT\system32\docprop2.dll [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F} = C:\PROGRA~1\SPYBOT~1\SDHelper.dll HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} PCTools Site Guard = C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B56A7D7D-6927-48C8-A975-17DF180C71AC} PCTools Browser Monitor = C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376} &Tip of the Day = %SystemRoot%\system32\shdocvw.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2D663D1A-8670-49D9-A1A5-4C56B4E14E84} ButtonText = Spyware Doctor : [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{30D02401-6A81-11D0-8274-00C04FD5AE38} Search Band = %SystemRoot%\system32\browseui.dll HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478} Media Band = %SystemRoot%\system32\browseui.dll HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1} File and Folders Search ActiveX Control = C:\WINNT\system32\shell32.dll HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E62-B078-11D0-89E4-00C04FC9E26E} History Band = %SystemRoot%\system32\shdocvw.dll HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E} Explorer Band = %SystemRoot%\system32\shdocvw.dll [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser {01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\system32\browseui.dll {0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Links : %SystemRoot%\system32\browseui.dll {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} = : HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser {01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\system32\browseui.dll {0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Links : %SystemRoot%\system32\browseui.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] LWBMOUSE C:\Program Files\Labtec\Labtec Mouse Software\1.0\lwbwheel.exe OneTouch Monitor C:\PROGRA~1\VISION~1\ONETOU~2.EXE HPHA2MON C:\WINNT\system32\hpha2mon.exe hpfsched C:\WINNT\hpfsched.exe NAV Agent C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe SymTray - Norton SystemWorks C:\Program Files\Common Files\Symantec Shared\Symtray.exe SetReg SSC_UserPrompt C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe Symantec NetDriver Monitor C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer gcasServ "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] IMAIL Installed = 1 MAPI Installed = 1 MSFS Installed = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] SymTray - Norton SystemWorks C:\Program Files\Common Files\Symantec Shared\Symtrdr.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop\AdminComponent HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum {BDEADF00-C265-11D0-BCED-00A0C90AB50F} = E:\PFiles\Common\MSShared\webfldrs\MSONSEXT.DLL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system dontdisplaylastusername 0 legalnoticecaption legalnoticetext shutdownwithoutlogon 1 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies] HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer NoDriveTypeAutoRun 149 CDRAutoRun 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] Network.ConnectionTray {7007ACCF-3202-11D1-AAD2-00805FC1270E} = C:\WINNT\system32\NETSHELL.dll WebCheck {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\system32\webcheck.dll SysTray {35CEC8A3-2BE6-11D2-8773-92E220524153} = stobject.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] UserInit = C:\WINNT\system32\userinit.exe, Shell = Explorer.exe System = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain = crypt32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet = cryptnet.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll = cscdll.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy = sclgntfy.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn = WlNotify.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif = wzcdlg.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path Debugger = ntsd -d [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] AppInit_DLLs »»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» WinPFind v1.3.5 - Log file written to "WinPFind.Txt" in the WinPFind folder. Scan completed on 9/6/2005 8:49:17 AM LDTate, maybe it would be better if I stopped communicating from two different computers. I can wait to find the problem in the home computer until we conquer it in this one if you think it would help keep things straight. Doris