IE, other programs not working on startup

Hello,

I'm having a problem almost every time when I restart the computer. I can't open MS Word, IE, or Trend Micro Anti-Spyware, and some other programs lock up as well. If I restart in safe mode, I can run Trend Micro, and it tells me my network configuration is damaged. I'm not sure if that simply means I'm in safe mode and Trend Micro thinks that's bad. Any way, when I run Trend Micro in safe mode, it finds something called BHJK_COOLWEBSEARCH and locates it in CWS.MSconfig. It supposedly eliminates it, but it keeps showing up – but only when I am in safe mode. When I boot up in normal mode, Trend Micro doesn't find the bug.

Well, after doing everything I can to clean off the computer, and after a few restarts, eventually everything seems okay and I can get into the above programs (which is why I can write this here!). But the next time I power down and start up, or just restart, the problem is almost certain to resurface.

Here is a hijack log I just ran:

Logfile of HijackThis v1.99.1
Scan saved at 11:33:52 AM, on 10/2/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\System32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\drivers\CDAC11BA.EXE
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
C:\WINNT\system32\igfxtray.exe
C:\WINNT\system32\hkcmd.exe
C:\WINNT\system32\SK9910DM.EXE
C:\WINNT\GWMDMMSG.exe
C:\WINNT\Logi_MwX.Exe
C:\Program Files\Verizon Online\Visual IP InSight\IPClient.exe
C:\Program Files\Verizon Online\Visual IP InSight\IPMon32.exe
C:\PROGRA~1\STOMPS~1\SPYWAR~1\PPMemCheck.exe
C:\PROGRA~1\STOMPS~1\SPYWAR~1\PPControl.exe
C:\PROGRA~1\STOMPS~1\SPYWAR~1\CookiePatrol.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\POPUPS~1.EXE
C:\Program Files\Iomega\AutoDisk\AD2KClient.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Trend Micro\Tmas\Tmas.exe
C:\WINNT\system32\DllHost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\common\YIeTagBm.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [IgfxTray] "C:\WINNT\system32\igfxtray.exe"
O4 - HKLM\..\Run: [HotKeysCmds] "C:\WINNT\system32\hkcmd.exe"
O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] "SK9910DM.EXE"
O4 - HKLM\..\Run: [GWMDMMSG] "GWMDMMSG.exe"
O4 - HKLM\..\Run: [GWMDMpi] C:\WINNT\GWMDMpi.exe
O4 - HKLM\..\Run: [Logitech Utility] "Logi_MwX.Exe"
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Verizon Online\Visual IP InSight\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\Verizon Online\Visual IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [RCScheduleCheck] "C:\Program Files\VCOM\Recovery Commander\RCSCHED.EXE -CHECK"
O4 - HKLM\..\Run: [PPMemCheck] "C:\PROGRA~1\STOMPS~1\SPYWAR~1\PPMemCheck.exe"
O4 - HKLM\..\Run: [Spyware X-terminator Control Center] "C:\PROGRA~1\STOMPS~1\SPYWAR~1\PPControl.exe"
O4 - HKLM\..\Run: [CookiePatrol] "C:\PROGRA~1\STOMPS~1\SPYWAR~1\CookiePatrol.exe"
O4 - HKLM\..\Run: [EPSON Stylus C82 Series] "C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE /P23 "EPSON Stylus C82 Series" /O5 "LPT1:" /M "Stylus C82""
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [PopUpStopperProfessional] "C:\PROGRA~1\PANICW~1\POP-UP~1\POPUPS~1.EXE"
O4 - HKCU\..\Run: [Iomega Active Disk] "C:\Program Files\Iomega\AutoDisk\AD2KClient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Trend Micro Anti-Spyware.lnk = C:\Program Files\Trend Micro\Tmas\Tmas.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: symsupportutil - https://www-secure.symantec.com/techsupp/ac…supportutil.CAB
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: Yahoo! Spades - http://download.games.yahoo.com/games/clients/y/st2_x.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid;=0x409
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedCon…bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-18.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://bin.mcafee.com/molbin/shared/mcinsc…74/mcinsctl.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…468/mcfscan.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINNT\System32\drivers\CDAC11BA.EXE
O23 - Service: CAISafe - Unknown owner - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
O23 - Service: Fix-It Task Manager - V Communications, Inc. - C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe

As you can see, I've got a lot of stuff on the computer that's supposed to help me stay virus-free, spyware-free, and so on. Yet I've got this problem.

HELP!

Thanks a bunch,
Rob Bowman

Hi,

Yes, the only program I have run that has found that CWS.msconfig item is Trend Micro Anti-Spyware, and it only finds it when I use msconfig to start in safe mode.

I don’t think my computer had a second virus protection program running (although I do have several anti-spyware programs), but I did see what looked like remnants of an old Symantec program on my previous HijackThis! log, so I checked those and removed them. (However, my newest HijackThis! log seems to indicate that something of the Symantec program is still running.) When I restarted the computer, I still had the same problem of not being able to get into Trend Micro AS, MS Word, or Internet Explorer. I restarted in safe mode (I always have to do that from msconfig, tapping F8 doesn’t seem to work) and was able to get into Trend Micro AS; it found the same CWS.MSconfig problem. In safe mode it does not, however, find the same IE cache problems that it has found repeatedly for weeks and supposedly eliminated each time (e.g., atwola.com, ad.yieldmanager.com, and a couple of others). After I restarted again in normal mode, everything seemed fine—but that’s happened before, only to go back to the same problems if I restart. Hence, I am posting this information *before* restarting again, as it can take me hours to fudge my way out of the problem and get back online. I am hoping you can help me prevent it from happening again!

First, I will post the last few Trend Micro AS scans. The last one I did just a little while ago after updating it, and it found some stuff in the Windows registry it had never found before. I don’t understand the last, long part of that log; it seems to have listed almost every program on my computer, and I don’t know what it means. Each line looks something like this:

Add/Remove Programs: Found '6591979fc8d7' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'

After my Trend Micro AS logs, I will post my most recent HijackThis! log. I also updated and ran both Spybot 1.3 and Ad-Aware SE; neither one found anything at all.

One other thing—my eTrust EZ Anti-Virus program tells me that my real-time email protection status is “off” even though the settings seem to say that it should be “on.” I went through the program’s troubleshooting help pages and found no help to resolve this problem. I have the most current updates.

Thanks for your help.

======================================

TREND MICRO ANTI-SPYWARE


Time=Sat Oct 08 12:47:49 2005
Product Version=3, 0, 1, 22
OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)

Started Scanning
Internet Cookies
Internet Cookies: Found 'ad.yieldmanager.com' in 'Internet Explorer Cache'
Internet Cookies: Found 'atwola.com' in 'Internet Explorer Cache'
Internet Cookies: Found 'belnk.com' in 'Internet Explorer Cache'
Internet Cookies: Cleaned 'dist.belnk.com' in 'Internet Explorer Cache'
Internet Cookies: Found 'www.burstbeacon.com' in 'Internet Explorer Cache'
CoolWebSearch Variants (CWShredder)
Programs in Memory
Windows Registry
Scanning is stopping…
Started Backup
Finished Backup
Started Cleaning
Internet Cookies: Cleaned 'ad.yieldmanager.com' in 'Internet Explorer Cache'
Internet Cookies: Cleaned 'atwola.com' in 'Internet Explorer Cache'
Internet Cookies: Cleaned 'belnk.com' in 'Internet Explorer Cache'
Internet Cookies: Cleaned 'www.burstbeacon.com' in 'Internet Explorer Cache'
Finished Cleaning

—————————————————————————-

(NOTE: The following scan was run in safe mode.)

Time=Sat Oct 08 13:35:17 2005
Product Version=3, 0, 1, 22
OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)

Started Scanning
Programs in Memory
Finished Scanning
Started Scanning
Internet Cookies
CoolWebSearch Variants (CWShredder)
CoolWebSearch Variants (CWShredder): Found 'CWS.MSConfig' in ''
Programs in Memory
Windows Registry
Internet URL Shortcuts
Files and Directories
Finished Scanning
Started Backup
Finished Backup
Started Cleaning
CoolWebSearch Variants (CWShredder): Cleaned 'CWS.MSConfig' in ''
Finished Cleaning

—————————————————————————-

(NOTE: The following scan was run after updating the program.)

Time=Sat Oct 08 16:29:15 2005
Product Version=3, 0, 1, 22
OS Version=Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)

Started Scanning
Programs in Memory
Finished Scanning
Started Scanning
Internet Cookies
CoolWebSearch Variants (CWShredder)
Programs in Memory
Windows Registry
Windows Registry: Found '' in 'WEBInstaller.CExecute.1'
Windows Registry: Found '' in 'WEBInstaller.CExecute'
Windows Registry: Found '' in 'SOFTWARE\Classes\WEBInstaller.CExecute.1'
Windows Registry: Found '' in 'SOFTWARE\Classes\WEBInstaller.CExecute'
Windows Registry: Found '' in 'Interface\{307F64C0-621D-4D56-BBC6-91EFC13CE40D}'
Windows Registry: Found '' in 'SOFTWARE\Classes\Interface\{307F64C0-621D-4D56-BBC6-91EFC13CE40D}'
Internet URL Shortcuts
Files and Directories
Files and Directories: Found 'iun6002.exe' in 'C:\WINNT'
Finished Scanning
Started Backup
Finished Backup
Started Cleaning
Windows Registry: Cleaned '' in 'WEBInstaller.CExecute.1'
Windows Registry: Cleaned '' in 'WEBInstaller.CExecute'
Windows Registry: Cleaned '' in 'SOFTWARE\Classes\WEBInstaller.CExecute.1'
Windows Registry: Cleaned '' in 'SOFTWARE\Classes\WEBInstaller.CExecute'
Windows Registry: Cleaned '' in 'Interface\{307F64C0-621D-4D56-BBC6-91EFC13CE40D}'
Windows Registry: Cleaned '' in 'SOFTWARE\Classes\Interface\{307F64C0-621D-4D56-BBC6-91EFC13CE40D}'
Checking for 'C:\WINNT\iun6002.exe' in shortcut areas.
Checking for 'C:\WINNT\iun6002.exe' in startup areas.
Checking for 'C:\WINNT\iun6002.exe' in Add/Remove Programs.
Add/Remove Programs: Found '6591979fc8d7' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '6b6deb007bb5' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '962c925eb967' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'Ad-Aware SE Personal' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'Adobe Atmosphere Player' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'Adobe Photoshop 7.0' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'AdobeESD' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'Alarm Clock_is1' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'AnyTime Deluxe' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'AOL Instant Messenger' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'CdaC13Ba' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'Click'N Design 3D (V5)' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'CSSCOD' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'EndNote' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'EPSON Printer and Utilities' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'Eudora Pro Email' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'FreeZip' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'GradeQuick' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'GTW V.92 Voicemodem' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'HijackThis' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'InstallShield_{00FC6799-866E-44A1-A60C-DCF394CF56FD}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'InstallShield_{ADF98CF7-1458-412F-976F-BF761A26F2A0}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'InterActual Player' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'ISI ResearchSoft - Export Helper' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'KB893803v2' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'LiveReg' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'LiveUpdate' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'MGI_PHOTOSUITE_V806' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'Microsoft Interactive Training' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'MicrosoftWordMTWLingo' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'MSN Music Assistant' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'MSNMS' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'Network Play System (Patching)' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'PalTalk6_alpha_6.73.1.1' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'Panicware Pop-Up Stopper Companion' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'PCHealth' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'Pop-Up Stopper Professional' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'PowerDesk5.0' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'PROSet' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'Quicken Basic 98' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'RealJukebox 1.0' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'RealPlayer 6.0' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'Risk' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'Shockwave' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'ShockwaveFlash' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'SK_PS2MillenniumKeyboard' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'Spybot - Search & Destroy_is1' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'SpywareBlaster_is1' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'TrojanHunter_is1' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'TurboTax Deluxe 2003' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'TurboTax Deluxe 2004' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'tv_enua' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'Ultra WinCleaner Backup Version 2.1.6_is1' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'VETWIN32Vp5' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'ViewpointMediaPlayer' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'Windows Media Format Runtime' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'Windows Media Player' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'WinZip' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'Works2002Setup' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'Yahoo! Companion' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'Yahoo! Customizations' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'Yahoo! Internet Mail' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'Yahoo! Messenger' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'Yahoo! Photos Drag-Drop Uploader 1v6' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'Yahoo! SiteBuilder' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'YInstHelper' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found 'ymb' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{00000000-3976-4267-9F39-1DC4745090B7}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{00000409-78E1-11D2-B60F-006097C998E7}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{0EE11800-A1BD-11D3-BFEB-005004AF2D32}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{11B569C2-4BF6-4ED0-9D17-A4273943CB24}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{319D9385-EEC1-4ae5-BFD1-C5DE1E063F30}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{3248F0A8-6813-11D6-A77B-00B0D0150000}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{3248F0A8-6813-11D6-A77B-00B0D0150020}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{3248F0A8-6813-11D6-A77B-00B0D0150040}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{36495C59-089C-49D1-BD15-9E5BD86DC9A1}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{369B36BE-3D64-4641-9AEA-808D436FE130}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{44A6A552-D8AE-11D7-A9ED-00B0D0627A8E}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{492E1D84-D7BF-4FA2-A26A-30AFC89EF547}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{4A70A254-5689-4D9E-9587-D7F5940FA618}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{536F7C74-844B-4683-B0C5-EA39E19A6FE3}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{539D40FC-0861-43A3-8A27-96055FC01515}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{5809E7CF-4DCF-11D4-9875-00105ACE7734}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{609F7AC8-C510-11D4-A788-009027ABA5D0}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{67E4EE98-59F4-4210-89A6-A20AF5BEC689}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{716E0306-8318-4364-8B8F-0CC4E9376BAC}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{75C023EC-64A0-44F7-9D99-C6F6E21EB6F0}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{7B63B2922B174135AFC0E1377DD81EC2}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{7BC42D2B-A730-43B4-8057-9B9946DF1033}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{86F8EC66-6E42-4C20-88DC-FBD0357F8159}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{8A708DD8-A5E6-11D4-A706-000629E95E20}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{8ADFC4160D694100B5B8A22DE9DCABD9}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{91120409-6000-11D3-8CFE-0050048383C9}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{911B0409-6000-11D3-8CFE-0050048383C9}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{9F185C48-595B-401A-A1D6-AAB324890DC4}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{A1B7B9B3-E1D2-41CA-9B4A-F18DC2710704}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{A4D7B764-4140-11D4-88EB-0050DA3579C0}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{ABEB838C-A1A7-4C5D-B7E1-8B4314600816}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{AC76BA86-0000-7EC8-7489-000000000702}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{AC76BA86-0000-7EC8-7489-000000000703}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{AC76BA86-0000-7EC8-7489-000000000704}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{AC76BA86-7AD7-1033-7B44-A70000000000}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{B3673A4E-BAA2-4960-8563-002F00B68E53}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{B66899F2-C58D-4CEC-9FA8-867883FFB707}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{C769A271-7E1C-48F9-B331-474600DD4C06}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{E3436EE2-D5CB-4249-840B-3A0140CC34C3}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{EA2BEBD6-87B9-41E5-95AC-7E4C165A9475}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{F1FBF021-B965-42D3-BF63-D7A121B5490D}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{F29EB16C-5A46-45EB-9E47-173C6B1E3576}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Add/Remove Programs: Found '{FD029A7E-D91A-43E6-831B-BF6D115B7FFB}' in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
Files and Directories: Cleaned 'iun6002.exe' in 'C:\WINNT'
Finished Cleaning

============================================

Logfile of HijackThis v1.99.1
Scan saved at 6:37:01 PM, on 10/8/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\System32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\drivers\CDAC11BA.EXE
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\wdfmgr.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
C:\WINNT\System32\alg.exe
C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\igfxtray.exe
C:\WINNT\system32\hkcmd.exe
C:\WINNT\system32\SK9910DM.EXE
C:\WINNT\GWMDMMSG.exe
C:\WINNT\Logi_MwX.Exe
C:\PROGRA~1\STOMPS~1\SPYWAR~1\PPMemCheck.exe
C:\PROGRA~1\STOMPS~1\SPYWAR~1\PPControl.exe
C:\PROGRA~1\STOMPS~1\SPYWAR~1\CookiePatrol.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\POPUPS~1.EXE
C:\Program Files\Iomega\AutoDisk\AD2KClient.exe
C:\WINNT\system32\ctfmon.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINNT\system32\DllHost.exe
C:\Program Files\Trend Micro\Tmas\tmas.exe
C:\Program Files\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\common\YIeTagBm.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [IgfxTray] "C:\WINNT\system32\igfxtray.exe"
O4 - HKLM\..\Run: [HotKeysCmds] "C:\WINNT\system32\hkcmd.exe"
O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] "SK9910DM.EXE"
O4 - HKLM\..\Run: [GWMDMMSG] "GWMDMMSG.exe"
O4 - HKLM\..\Run: [GWMDMpi] C:\WINNT\GWMDMpi.exe
O4 - HKLM\..\Run: [Logitech Utility] "Logi_MwX.Exe"
O4 - HKLM\..\Run: [RCScheduleCheck] "C:\Program Files\VCOM\Recovery Commander\RCSCHED.EXE -CHECK"
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\STOMPS~1\SPYWAR~1\PPMemCheck.exe
O4 - HKLM\..\Run: [Spyware X-terminator Control Center] C:\PROGRA~1\STOMPS~1\SPYWAR~1\PPControl.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\STOMPS~1\SPYWAR~1\CookiePatrol.exe
O4 - HKLM\..\Run: [EPSON Stylus C82 Series] "C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE /P23 "EPSON Stylus C82 Series" /O5 "LPT1:" /M "Stylus C82""
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKCU\..\Run: [PopUpStopperProfessional] "C:\PROGRA~1\PANICW~1\POP-UP~1\POPUPS~1.EXE"
O4 - HKCU\..\Run: [Iomega Active Disk] "C:\Program Files\Iomega\AutoDisk\AD2KClient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Trend Micro Anti-Spyware.lnk = C:\Program Files\Trend Micro\Tmas\Tmas.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: Yahoo! Spades - http://download.games.yahoo.com/games/clients/y/st2_x.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-18.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://bin.mcafee.com/molbin/shared/mcinsc…74/mcinsctl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…468/mcfscan.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINNT\System32\drivers\CDAC11BA.EXE
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
O23 - Service: Fix-It Task Manager - V Communications, Inc. - C:\PROGRA~1\VCOM\Fix-It\mxtask.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe

====================================

Thanks again for your help.

–Rob