Hijack log

Hello tdogs,

What kind of issues are you having?

Please do the following scan and let's see what it shows.

Now run this online scan using Internet Explorer:
Kaspersky WebScanner from http://www.kaspersky.com/virusscanner

Next Click on Launch Kaspersky Anti-Virus Web Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
• Now click on Scan Settings
• In the scan settings make that the following are selected:
• Scan using the following Anti-Virus database:
• Standard
• Scan Options:
• Scan Archives
• Scan Mail Bases
• Click OK
• Now under select a target to scan:
• Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
• Now click on the Save as Text button:
• Save the file to your desktop.

Copy and paste that information from Kapersky in your next post.

Thanks for the quick reply. ok. I scanned my system like you said and it did not find anything on my system. Most of the problems started with the VX2 Look2Me infection. After searching here I was able to download and fix it, but then it came back. So I did it again and it hasn't been back, cross my fingers, yet. Pretty much everyday my system just seems slow and when I run scans with the different programs, I always have 1 or 2 tracking bugs from sites that I haven't been to. I don't understand why none of the real time protection devices that I use don't catch these until I run a full system scan. It is almost like I have an open port or something (not real advanced). Are these settings for this in more than 1 place and if so, do I have to change them in all the places? Here is my newest "Critical Object" that Ad-Aware finds. The first time it found it I put a check mark by it to remove it, but then everything came back. The Look2Me file and I am not sure what it is but this about-blank homepage kept popping up. When I restarted my system it would always automoatically start in safe mode so then I would restart in normal mode, but I found that this got rid of all my restore points and created a new one with the bad settings. So I had to go through the entire proceess again. After a couple of times, takes me a while to catch on, I fixed everything again, but this time I manually picked which items would load at start up. Since then, nothing too major except for that "Critical Object" that Ad-Aware finds, but now I don't check the box to get rid of it I just leave it. Can I get rid of this along with all of the other infections that will load once I get rid of this? Ad-Aware SE Build 1.06r1 Logfile Created on:Friday, May 05, 2006 10:41:55 PM Using definitions file:SE1R106 02.05.2006 »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» References detected during the scan: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Windows(TAC index:3):1 total references »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Ad-Aware SE Settings =========================== Set : Search for low-risk threats Set : Safe mode (always request confirmation) Set : Scan active processes Set : Scan registry Set : Deep-scan registry Set : Scan my IE Favorites for banned URLs Set : Scan my Hosts file Extended Ad-Aware SE Settings =========================== Set : Unload recognized processes & modules during scan Set : Ignore spanned files when scanning cab archives Set : Scan registry for all users instead of current user only Set : Always try to unload modules before deletion Set : During removal, unload Explorer and IE if necessary Set : Let Windows remove files in use at next reboot Set : Delete quarantined objects after restoring Set : Block pop-ups aggressively Set : Automatically select problematic objects in results lists Set : Include basic Ad-Aware settings in log file Set : Include additional Ad-Aware settings in log file Set : Include reference summary in log file Set : Include alternate data stream details in log file Set : Show splash screen Set : Backup current definitions file before updating Set : Play sound at scan completion if scan locates critical objects 5-5-2006 10:41:55 PM - Scan started. (Full System Scan) Listing running processes »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» #:1 [smss.exe] FilePath : \SystemRoot\System32\ ProcessID : 844 ThreadCreationTime : 5-5-2006 8:36:58 AM BasePriority : Normal #:2 [csrss.exe] FilePath : \??\C:\WINDOWS\system32\ ProcessID : 900 ThreadCreationTime : 5-5-2006 8:37:08 AM BasePriority : Normal #:3 [winlogon.exe] FilePath : \??\C:\WINDOWS\system32\ ProcessID : 924 ThreadCreationTime : 5-5-2006 8:37:10 AM BasePriority : High #:4 [services.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 968 ThreadCreationTime : 5-5-2006 8:37:11 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Services and Controller app InternalName : services.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : services.exe #:5 [lsass.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 980 ThreadCreationTime : 5-5-2006 8:37:11 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : LSA Shell (Export Version) InternalName : lsass.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : lsass.exe #:6 [ati2evxx.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1200 ThreadCreationTime : 5-5-2006 8:37:13 AM BasePriority : Normal FileVersion : 6.14.10.4107 ProductVersion : 6.14.10.4107.03 ProductName : ATI External Event Utility for WindowsNT and Windows9X CompanyName : ATI Technologies Inc. FileDescription : ATI External Event Utility EXE Module InternalName : ATI2EVXX.EXE LegalCopyright : Copyright © 1999-2004 ATI Technologies Inc. OriginalFilename : ATI2EVXX.EXE #:7 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1216 ThreadCreationTime : 5-5-2006 8:37:13 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:8 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1276 ThreadCreationTime : 5-5-2006 8:37:13 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:9 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1420 ThreadCreationTime : 5-5-2006 8:37:13 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:10 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1652 ThreadCreationTime : 5-5-2006 8:37:16 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:11 [spoolsv.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1708 ThreadCreationTime : 5-5-2006 8:37:16 AM BasePriority : Normal FileVersion : 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519) ProductVersion : 5.1.2600.2696 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Spooler SubSystem App InternalName : spoolsv.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : spoolsv.exe #:12 [lvprcsrv.exe] FilePath : c:\program files\common files\logitech\lvmvfm\ ProcessID : 1740 ThreadCreationTime : 5-5-2006 8:37:16 AM BasePriority : Normal FileVersion : 9.5.0.1098 ProductVersion : 9.5.0.1098 ProductName : Logitech QuickCam CompanyName : Logitech Inc. FileDescription : Logitech LVPrcSrv Module. InternalName : LVPrcSrv.exe LegalCopyright : © 1996-2006 Logitech. All rights reserved. OriginalFilename : LVPrcSrv.exe #:13 [ati2evxx.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1936 ThreadCreationTime : 5-5-2006 8:37:49 AM BasePriority : Normal FileVersion : 6.14.10.4107 ProductVersion : 6.14.10.4107.03 ProductName : ATI External Event Utility for WindowsNT and Windows9X CompanyName : ATI Technologies Inc. FileDescription : ATI External Event Utility EXE Module InternalName : ATI2EVXX.EXE LegalCopyright : Copyright © 1999-2004 ATI Technologies Inc. OriginalFilename : ATI2EVXX.EXE #:14 [explorer.exe] FilePath : C:\WINDOWS\ ProcessID : 2016 ThreadCreationTime : 5-5-2006 8:37:49 AM BasePriority : Normal FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 6.00.2900.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Windows Explorer InternalName : explorer LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : EXPLORER.EXE #:15 [syntplpr.exe] FilePath : C:\Program Files\Synaptics\SynTP\ ProcessID : 304 ThreadCreationTime : 5-5-2006 8:37:55 AM BasePriority : Normal FileVersion : 7.12.7 04Nov04 ProductVersion : 7.12.7 04Nov04 ProductName : Synaptics Pointing Device Driver CompanyName : Synaptics, Inc. FileDescription : TouchPad Driver Helper Application InternalName : SynTPLpr LegalCopyright : Copyright © Synaptics, Inc. 1996-2004 OriginalFilename : SynTPLpr.exe #:16 [tfswctrl.exe] FilePath : C:\WINDOWS\system32\dla\ ProcessID : 312 ThreadCreationTime : 5-5-2006 8:37:55 AM BasePriority : Normal FileVersion : 1.04.08a CompanyName : Sonic Solutions FileDescription : Drive Letter Access Component LegalCopyright : Copyright © 2004 Sonic Solutions #:17 [atiptaxx.exe] FilePath : C:\Program Files\ATI Technologies\ATI Control Panel\ ProcessID : 380 ThreadCreationTime : 5-5-2006 8:37:56 AM BasePriority : Normal FileVersion : 6.14.10.5120 ProductVersion : 6.14.10.5120 ProductName : ATI Desktop Component CompanyName : ATI Technologies, Inc. FileDescription : ATI Desktop Control Panel InternalName : Atiptaxx.exe LegalCopyright : Copyright © 1998-2004 ATI Technologies Inc. OriginalFilename : Atiptaxx.exe #:18 [ctdvddet.exe] FilePath : C:\Program Files\Creative\Sound Blaster Audigy 2\DVDAudio\ ProcessID : 388 ThreadCreationTime : 5-5-2006 8:37:56 AM BasePriority : Normal FileVersion : 1.0.3.0 ProductVersion : 1.0.3.0 ProductName : CTDVDDET CompanyName : Creative Technology Ltd FileDescription : CTDVDDET InternalName : CTDVDDET LegalCopyright : Copyright © Creative Technology Ltd., 2002-2003. All rights reserved. OriginalFilename : CTDVDDET.EXE #:19 [syntpenh.exe] FilePath : C:\Program Files\Synaptics\SynTP\ ProcessID : 440 ThreadCreationTime : 5-5-2006 8:37:59 AM BasePriority : Normal FileVersion : 7.12.7 04Nov04 ProductVersion : 7.12.7 04Nov04 ProductName : Synaptics Pointing Device Driver CompanyName : Synaptics, Inc. FileDescription : Synaptics TouchPad Enhancements InternalName : Synaptics Enhancements Application LegalCopyright : Copyright © Synaptics, Inc. 1996-2004 OriginalFilename : SynTPEnh.exe #:20 [ctsysvol.exe] FilePath : C:\Program Files\Creative\Sound Blaster Audigy 2\Surround Mixer\ ProcessID : 448 ThreadCreationTime : 5-5-2006 8:38:00 AM BasePriority : Normal FileVersion : 1.4.1.0 ProductVersion : 1.0.0.0 ProductName : Creative Volume Control CompanyName : Creative Technology Ltd FileDescription : CTSysVol.exe LegalCopyright : Copyright © Creative Technology Ltd., 2002-2003. All rights reserved. OriginalFilename : CTSysVol.exe #:21 [statusclient.exe] FilePath : C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\ ProcessID : 472 ThreadCreationTime : 5-5-2006 8:38:00 AM BasePriority : Normal FileVersion : 00.00.13 ProductVersion : 00.00.13 ProductName : Hewlett-Packard T-TR Status Client CompanyName : Hewlett-Packard FileDescription : Hewlett-Packard T-TR Status Client InternalName : StatusClient.exe LegalCopyright : Copyright © 2002 Hewlett-Packard Company LegalTrademarks : All Rights Reserved. OriginalFilename : StatusClient.exe #:22 [msmsgs.exe] FilePath : C:\Program Files\Messenger\ ProcessID : 524 ThreadCreationTime : 5-5-2006 8:38:01 AM BasePriority : Normal FileVersion : 4.7.3001 ProductVersion : Version 4.7.3001 ProductName : Messenger CompanyName : Microsoft Corporation FileDescription : Windows Messenger InternalName : msmsgs LegalCopyright : Copyright © Microsoft Corporation 2004 LegalTrademarks : Microsoft® is a registered trademark of Microsoft Corporation in the U.S. and/or other countries. OriginalFilename : msmsgs.exe #:23 [answers.exe] FilePath : C:\Program Files\1-Click Answers\ ProcessID : 1328 ThreadCreationTime : 5-5-2006 8:38:08 AM BasePriority : Normal FileVersion : 1.1 (build 381) ProductVersion : 1.1 (build 381) ProductName : Answers CompanyName : Answers Corporation FileDescription : 1-Click Answers Client InternalName : 1-Click Answers Client LegalCopyright : Copyright © Answers Corporation 1999-2006 OriginalFilename : Answers.exe #:24 [sgmain.exe] FilePath : C:\Program Files\SpywareGuard\ ProcessID : 1384 ThreadCreationTime : 5-5-2006 8:38:12 AM BasePriority : Normal FileVersion : 2.02.0001 ProductVersion : 2.02.0001 ProductName : SpywareGuard FileDescription : SpywareGuard InternalName : sgmain LegalCopyright : Copyright © 2002-2003 Javacool Software LLC OriginalFilename : sgmain.exe Comments : SpywareGuard #:25 [sgbhp.exe] FilePath : C:\Program Files\SpywareGuard\ ProcessID : 1412 ThreadCreationTime : 5-5-2006 8:38:16 AM BasePriority : Normal FileVersion : 2.02.0001 ProductVersion : 2.02.0001 ProductName : SG Browser Hijacking Protection FileDescription : SG Browser Hijacking Protection InternalName : sgbhp LegalCopyright : Copyright © 2002-2003 Javacool Software LLC. OriginalFilename : sgbhp.exe Comments : SG Browser Hijacking Protection #:26 [agtserv.exe] FilePath : C:\Program Files\1-Click Answers\ ProcessID : 2000 ThreadCreationTime : 5-5-2006 8:39:26 AM BasePriority : Normal FileVersion : 7.1 (build 381) ProductVersion : 7.1 (build 381) ProductName : ScreenScraper SDK CompanyName : Answers Corporation FileDescription : AgtServ main executable InternalName : AgtServ LegalCopyright : Copyright © Answers Corporation 1999-2006 OriginalFilename : AgtServ.exe #:27 [aswupdsv.exe] FilePath : C:\Program Files\Alwil Software\Avast4\ ProcessID : 212 ThreadCreationTime : 5-5-2006 8:39:31 AM BasePriority : Normal #:28 [ashserv.exe] FilePath : C:\Program Files\Alwil Software\Avast4\ ProcessID : 1564 ThreadCreationTime : 5-5-2006 8:39:31 AM BasePriority : High FileVersion : 4, 7, 824, 0 ProductVersion : 4, 7, 0, 0 ProductName : avast! Antivirus FileDescription : avast! antivirus service InternalName : aswServ LegalCopyright : Copyright © 2006 ALWIL Software OriginalFilename : aswServ.exe #:29 [ctsvccda.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 280 ThreadCreationTime : 5-5-2006 8:39:32 AM BasePriority : Normal FileVersion : 1.0.1.0 ProductVersion : 1.0.0.0 ProductName : Creative Service for CDROM Access CompanyName : Creative Technology Ltd FileDescription : Creative Service for CDROM Access InternalName : CTsvcCDAEXE LegalCopyright : Copyright © Creative Technology Ltd., 1999. All rights reserved. OriginalFilename : CTsvcCDA.EXE #:30 [ewidoctrl.exe] FilePath : C:\Program Files\ewido anti-malware\ ProcessID : 420 ThreadCreationTime : 5-5-2006 8:39:33 AM BasePriority : Normal FileVersion : 3, 0, 0, 1 ProductVersion : 3, 0, 0, 1 ProductName : ewido control CompanyName : ewido networks FileDescription : ewido control InternalName : ewido control LegalCopyright : Copyright © 2004 OriginalFilename : ewidoctrl.exe #:31 [sdhelp.exe] FilePath : C:\Program Files\Spyware Doctor\ ProcessID : 720 ThreadCreationTime : 5-5-2006 8:39:37 AM BasePriority : Normal FileVersion : 3.6.0.1022 ProductVersion : 3.6 ProductName : Spyware Doctor CompanyName : PC Tools Research Pty Ltd #:32 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 784 ThreadCreationTime : 5-5-2006 8:39:38 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:33 [wdfmgr.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1528 ThreadCreationTime : 5-5-2006 8:39:39 AM BasePriority : Normal FileVersion : 5.2.3790.1230 built by: dnsrv(bld4act) ProductVersion : 5.2.3790.1230 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Windows User Mode Driver Manager InternalName : WdfMgr LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : WdfMgr.exe #:34 [alg.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 3176 ThreadCreationTime : 5-5-2006 8:40:08 AM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Application Layer Gateway Service InternalName : ALG.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : ALG.exe #:35 [ad-watch.exe] FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Plus\ ProcessID : 3060 ThreadCreationTime : 5-5-2006 12:16:29 PM BasePriority : High FileVersion : 3.1.2.17 ProductVersion : 3.2 ProductName : Ad-Aware SE CompanyName : Lavasoft Sweden FileDescription : Ad-Watch System Protector InternalName : Ad-Watch.exe LegalCopyright : 1999-2004 Team Lavasoft OriginalFilename : Ad-Watch.exe #:36 [acrord32.exe] FilePath : C:\Program Files\Adobe\Acrobat 7.0\Reader\ ProcessID : 3768 ThreadCreationTime : 5-6-2006 1:38:49 AM BasePriority : Normal FileVersion : 7.0.7.2006011300 ProductVersion : 7.0.7.2006011300 ProductName : Adobe Reader CompanyName : Adobe Systems Incorporated FileDescription : Adobe Reader 7.0 LegalCopyright : Copyright 1984-2006 Adobe Systems Incorporated and its licensors. All rights reserved. OriginalFilename : AcroRd32.exe #:37 [iexplore.exe] FilePath : C:\Program Files\Internet Explorer\ ProcessID : 3996 ThreadCreationTime : 5-6-2006 3:20:47 AM BasePriority : Normal FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 6.00.2900.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Internet Explorer InternalName : iexplore LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : IEXPLORE.EXE #:38 [outlook.exe] FilePath : C:\Program Files\Microsoft Office\OFFICE11\ ProcessID : 3280 ThreadCreationTime : 5-6-2006 3:24:02 AM BasePriority : Normal #:39 [ad-aware.exe] FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Plus\ ProcessID : 584 ThreadCreationTime : 5-6-2006 3:41:29 AM BasePriority : Normal FileVersion : 6.2.0.237 ProductVersion : SE 106 ProductName : Lavasoft Ad-Aware SE CompanyName : Lavasoft Sweden FileDescription : Ad-Aware SE Core application InternalName : Ad-Aware.exe LegalCopyright : Copyright © Lavasoft AB Sweden OriginalFilename : Ad-Aware.exe Comments : All Rights Reserved Memory scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 0 Started registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Windows Object Recognized! Type : RegData Data : TAC Rating : 3 Category : Vulnerability Comment : Rootkey : HKEY_USERS Object : S-1-5-21-220523388-1844237615-839522115-1003\software\policies\microsoft\internet explorer\control panel Value : Homepage Data : Registry Scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 1 Objects found so far: 1 Started deep registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Deep registry scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 1 Started Tracking Cookie scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Tracking cookie scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 1 Deep scanning and examining files (C:) »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Disk Scan Result for C:\ »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 1 Deep scanning and examining files (Z:) »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Disk Scan Result for Z:\ »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 1 Scanning Hosts file…… Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts". »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Hosts file scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» 1 entries scanned. New critical objects:0 Objects found so far: 1 Performing conditional scans… »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Conditional scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 1 10:50:56 PM Scan Complete Summary Of This Scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Total scanning time:00:09:00.500 Objects scanned:145829 Objects identified:1 Objects ignored:0 New critical objects:1 Thanks for helping me with this. I really appreciate the help, not all the spyware and malware that is out there. Be nice if they would find something else to do than to bug everyone else. Thanks again.

Hello tdogs,

These options should only appear if your administrator set them on purpose or if you used Spybots Home Page and Option Lock down features in the Immunize section of Spybot.

Did you or administrator set policies? If not then do the following:
Open HijackThis. Place a check against each of the following:
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
After you check these items, close all browsers and windows, except for HijackThis, then click on the Fix Checked.

Post (reply) with a new hijackthis log to this thread.

Also if you fixed it, now run the Ad-Aware and see if anything has changed.

Hello tdogs, This is still present. Did you or administrator set it? O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

Hello tdogs,

From what I have learned, your AdAware log appears to be normal. Programs normally include an uninstaller with the entry in Add/Remove Programs feature in the Control Panel.

Let's go ahead and run ewido though and see if it finds anything.

STEP 1.
======
Ewido Trojan Scanner
Please download, install, and update the NEW free version of Ewido trojan scanner:

• When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
  
• When you run ewido for the first time, you may get a warning "Database could not be found!". Click OK. We will fix this in a moment.
  
• From the main ewido screen, click on update in the left menu, then click the Start update button.
  
• After the update finishes (the status bar at the bottom will display "Update successful")
  
• Click on the Scanner button in the left menu, then click on Complete System Scan. This scan can take quite a while to run.
  
• If ewido finds anything, it will pop up a notification. Select "clean" and check the boxes "Perform action with all infections" and "Create encrypted backup" before clicking on OK.
  
• When the scan finishes, click on "Save Report". This will create a text file. Make sure you know where to find this file again.

Sorry, it has taken so long to get back with you, but my fiance gave birth to our second child last week, so I've been busy wtih the family. Anyways, I did a scan with ewido and did not find anything again. I ran AdAware again and the same thing popped up, and I didn't do anything with it again and no problems. I guess at this point I will hopefully just remember to ignore the Ad-Aware cirtical issue that continues to show up and hope for no more problems. I am open to any other suggestions that you might have to offer me or any other security settings that I might want to take a look at again. Here are my logs from the scans I ran with ewido and AdAware. Thanks again for all the help. It is greatly appreciated. I do notice that the critical issue has to do with my homepage, but for some reason I have never been able to change it and if I try it always goes back to my original. I thought when I had the VX2 bug it said something about the homepage about:blank or something. I get confused with all of these different computer terms. Hope this helps a little. ——————————————————— ewido anti-malware - Scan report ——————————————————— + Created on: 3:31:44 PM, 5/15/2006 + Report-Checksum: 7CD5ACCC + Scan result: No infected objects found. ::Report End Ad-Aware SE Build 1.06r1 Logfile Created on:Monday, May 15, 2006 3:32:59 PM Using definitions file:SE1R107 09.05.2006 »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» References detected during the scan: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Windows(TAC index:3):1 total references »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Ad-Aware SE Settings =========================== Set : Search for low-risk threats Set : Safe mode (always request confirmation) Set : Scan active processes Set : Scan registry Set : Deep-scan registry Set : Scan my IE Favorites for banned URLs Set : Scan my Hosts file Extended Ad-Aware SE Settings =========================== Set : Unload recognized processes & modules during scan Set : Ignore spanned files when scanning cab archives Set : Scan registry for all users instead of current user only Set : Always try to unload modules before deletion Set : During removal, unload Explorer and IE if necessary Set : Let Windows remove files in use at next reboot Set : Delete quarantined objects after restoring Set : Block pop-ups aggressively Set : Automatically select problematic objects in results lists Set : Include basic Ad-Aware settings in log file Set : Include additional Ad-Aware settings in log file Set : Include reference summary in log file Set : Include alternate data stream details in log file Set : Show splash screen Set : Backup current definitions file before updating Set : Play sound at scan completion if scan locates critical objects 5-15-2006 3:32:59 PM - Scan started. (Full System Scan) Listing running processes »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» #:1 [smss.exe] FilePath : \SystemRoot\System32\ ProcessID : 848 ThreadCreationTime : 5-14-2006 8:00:03 PM BasePriority : Normal #:2 [csrss.exe] FilePath : \??\C:\WINDOWS\system32\ ProcessID : 912 ThreadCreationTime : 5-14-2006 8:00:19 PM BasePriority : Normal #:3 [winlogon.exe] FilePath : \??\C:\WINDOWS\system32\ ProcessID : 940 ThreadCreationTime : 5-14-2006 8:00:23 PM BasePriority : High #:4 [services.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 984 ThreadCreationTime : 5-14-2006 8:00:25 PM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Services and Controller app InternalName : services.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : services.exe #:5 [lsass.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 996 ThreadCreationTime : 5-14-2006 8:00:25 PM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : LSA Shell (Export Version) InternalName : lsass.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : lsass.exe #:6 [ati2evxx.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1212 ThreadCreationTime : 5-14-2006 8:00:28 PM BasePriority : Normal FileVersion : 6.14.10.4107 ProductVersion : 6.14.10.4107.03 ProductName : ATI External Event Utility for WindowsNT and Windows9X CompanyName : ATI Technologies Inc. FileDescription : ATI External Event Utility EXE Module InternalName : ATI2EVXX.EXE LegalCopyright : Copyright © 1999-2004 ATI Technologies Inc. OriginalFilename : ATI2EVXX.EXE #:7 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1228 ThreadCreationTime : 5-14-2006 8:00:28 PM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:8 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1308 ThreadCreationTime : 5-14-2006 8:00:28 PM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:9 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1352 ThreadCreationTime : 5-14-2006 8:00:28 PM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:10 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1484 ThreadCreationTime : 5-14-2006 8:00:32 PM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:11 [spoolsv.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1524 ThreadCreationTime : 5-14-2006 8:00:33 PM BasePriority : Normal FileVersion : 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519) ProductVersion : 5.1.2600.2696 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Spooler SubSystem App InternalName : spoolsv.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : spoolsv.exe #:12 [lvprcsrv.exe] FilePath : c:\program files\common files\logitech\lvmvfm\ ProcessID : 1560 ThreadCreationTime : 5-14-2006 8:00:33 PM BasePriority : Normal FileVersion : 9.5.0.1098 ProductVersion : 9.5.0.1098 ProductName : Logitech QuickCam CompanyName : Logitech Inc. FileDescription : Logitech LVPrcSrv Module. InternalName : LVPrcSrv.exe LegalCopyright : © 1996-2006 Logitech. All rights reserved. OriginalFilename : LVPrcSrv.exe #:13 [ati2evxx.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1724 ThreadCreationTime : 5-14-2006 8:01:04 PM BasePriority : Normal FileVersion : 6.14.10.4107 ProductVersion : 6.14.10.4107.03 ProductName : ATI External Event Utility for WindowsNT and Windows9X CompanyName : ATI Technologies Inc. FileDescription : ATI External Event Utility EXE Module InternalName : ATI2EVXX.EXE LegalCopyright : Copyright © 1999-2004 ATI Technologies Inc. OriginalFilename : ATI2EVXX.EXE #:14 [explorer.exe] FilePath : C:\WINDOWS\ ProcessID : 1800 ThreadCreationTime : 5-14-2006 8:01:04 PM BasePriority : Normal FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 6.00.2900.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Windows Explorer InternalName : explorer LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : EXPLORER.EXE #:15 [syntplpr.exe] FilePath : C:\Program Files\Synaptics\SynTP\ ProcessID : 1940 ThreadCreationTime : 5-14-2006 8:01:13 PM BasePriority : Normal FileVersion : 7.12.7 04Nov04 ProductVersion : 7.12.7 04Nov04 ProductName : Synaptics Pointing Device Driver CompanyName : Synaptics, Inc. FileDescription : TouchPad Driver Helper Application InternalName : SynTPLpr LegalCopyright : Copyright © Synaptics, Inc. 1996-2004 OriginalFilename : SynTPLpr.exe #:16 [tfswctrl.exe] FilePath : C:\WINDOWS\system32\dla\ ProcessID : 1948 ThreadCreationTime : 5-14-2006 8:01:14 PM BasePriority : Normal FileVersion : 1.04.08a CompanyName : Sonic Solutions FileDescription : Drive Letter Access Component LegalCopyright : Copyright © 2004 Sonic Solutions #:17 [atiptaxx.exe] FilePath : C:\Program Files\ATI Technologies\ATI Control Panel\ ProcessID : 1980 ThreadCreationTime : 5-14-2006 8:01:15 PM BasePriority : Normal FileVersion : 6.14.10.5120 ProductVersion : 6.14.10.5120 ProductName : ATI Desktop Component CompanyName : ATI Technologies, Inc. FileDescription : ATI Desktop Control Panel InternalName : Atiptaxx.exe LegalCopyright : Copyright © 1998-2004 ATI Technologies Inc. OriginalFilename : Atiptaxx.exe #:18 [ctdvddet.exe] FilePath : C:\Program Files\Creative\Sound Blaster Audigy 2\DVDAudio\ ProcessID : 1988 ThreadCreationTime : 5-14-2006 8:01:15 PM BasePriority : Normal FileVersion : 1.0.3.0 ProductVersion : 1.0.3.0 ProductName : CTDVDDET CompanyName : Creative Technology Ltd FileDescription : CTDVDDET InternalName : CTDVDDET LegalCopyright : Copyright © Creative Technology Ltd., 2002-2003. All rights reserved. OriginalFilename : CTDVDDET.EXE #:19 [syntpenh.exe] FilePath : C:\Program Files\Synaptics\SynTP\ ProcessID : 2036 ThreadCreationTime : 5-14-2006 8:01:20 PM BasePriority : Normal FileVersion : 7.12.7 04Nov04 ProductVersion : 7.12.7 04Nov04 ProductName : Synaptics Pointing Device Driver CompanyName : Synaptics, Inc. FileDescription : Synaptics TouchPad Enhancements InternalName : Synaptics Enhancements Application LegalCopyright : Copyright © Synaptics, Inc. 1996-2004 OriginalFilename : SynTPEnh.exe #:20 [ctsysvol.exe] FilePath : C:\Program Files\Creative\Sound Blaster Audigy 2\Surround Mixer\ ProcessID : 2044 ThreadCreationTime : 5-14-2006 8:01:20 PM BasePriority : Normal FileVersion : 1.4.1.0 ProductVersion : 1.0.0.0 ProductName : Creative Volume Control CompanyName : Creative Technology Ltd FileDescription : CTSysVol.exe LegalCopyright : Copyright © Creative Technology Ltd., 2002-2003. All rights reserved. OriginalFilename : CTSysVol.exe #:21 [statusclient.exe] FilePath : C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\ ProcessID : 168 ThreadCreationTime : 5-14-2006 8:01:22 PM BasePriority : Normal FileVersion : 00.00.13 ProductVersion : 00.00.13 ProductName : Hewlett-Packard T-TR Status Client CompanyName : Hewlett-Packard FileDescription : Hewlett-Packard T-TR Status Client InternalName : StatusClient.exe LegalCopyright : Copyright © 2002 Hewlett-Packard Company LegalTrademarks : All Rights Reserved. OriginalFilename : StatusClient.exe #:22 [ad-watch.exe] FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Plus\ ProcessID : 224 ThreadCreationTime : 5-14-2006 8:01:25 PM BasePriority : Normal FileVersion : 3.1.2.17 ProductVersion : 3.2 ProductName : Ad-Aware SE CompanyName : Lavasoft Sweden FileDescription : Ad-Watch System Protector InternalName : Ad-Watch.exe LegalCopyright : 1999-2004 Team Lavasoft OriginalFilename : Ad-Watch.exe #:23 [answers.exe] FilePath : C:\Program Files\1-Click Answers\ ProcessID : 276 ThreadCreationTime : 5-14-2006 8:01:33 PM BasePriority : Normal FileVersion : 1.1 (build 381) ProductVersion : 1.1 (build 381) ProductName : Answers CompanyName : Answers Corporation FileDescription : 1-Click Answers Client InternalName : 1-Click Answers Client LegalCopyright : Copyright © Answers Corporation 1999-2006 OriginalFilename : Answers.exe #:24 [sgmain.exe] FilePath : C:\Program Files\SpywareGuard\ ProcessID : 444 ThreadCreationTime : 5-14-2006 8:01:35 PM BasePriority : Normal FileVersion : 2.02.0001 ProductVersion : 2.02.0001 ProductName : SpywareGuard FileDescription : SpywareGuard InternalName : sgmain LegalCopyright : Copyright © 2002-2003 Javacool Software LLC OriginalFilename : sgmain.exe Comments : SpywareGuard #:25 [sgbhp.exe] FilePath : C:\Program Files\SpywareGuard\ ProcessID : 472 ThreadCreationTime : 5-14-2006 8:01:40 PM BasePriority : Normal FileVersion : 2.02.0001 ProductVersion : 2.02.0001 ProductName : SG Browser Hijacking Protection FileDescription : SG Browser Hijacking Protection InternalName : sgbhp LegalCopyright : Copyright © 2002-2003 Javacool Software LLC. OriginalFilename : sgbhp.exe Comments : SG Browser Hijacking Protection #:26 [agtserv.exe] FilePath : C:\Program Files\1-Click Answers\ ProcessID : 600 ThreadCreationTime : 5-14-2006 8:02:31 PM BasePriority : Normal FileVersion : 7.1 (build 381) ProductVersion : 7.1 (build 381) ProductName : ScreenScraper SDK CompanyName : Answers Corporation FileDescription : AgtServ main executable InternalName : AgtServ LegalCopyright : Copyright © Answers Corporation 1999-2006 OriginalFilename : AgtServ.exe #:27 [aswupdsv.exe] FilePath : C:\Program Files\Alwil Software\Avast4\ ProcessID : 740 ThreadCreationTime : 5-14-2006 8:02:47 PM BasePriority : Normal #:28 [ashserv.exe] FilePath : C:\Program Files\Alwil Software\Avast4\ ProcessID : 760 ThreadCreationTime : 5-14-2006 8:02:48 PM BasePriority : High FileVersion : 4, 7, 824, 0 ProductVersion : 4, 7, 0, 0 ProductName : avast! Antivirus FileDescription : avast! antivirus service InternalName : aswServ LegalCopyright : Copyright © 2006 ALWIL Software OriginalFilename : aswServ.exe #:29 [ctsvccda.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 456 ThreadCreationTime : 5-14-2006 8:02:49 PM BasePriority : Normal FileVersion : 1.0.1.0 ProductVersion : 1.0.0.0 ProductName : Creative Service for CDROM Access CompanyName : Creative Technology Ltd FileDescription : Creative Service for CDROM Access InternalName : CTsvcCDAEXE LegalCopyright : Copyright © Creative Technology Ltd., 1999. All rights reserved. OriginalFilename : CTsvcCDA.EXE #:30 [pcctlcom.exe] FilePath : C:\PROGRA~1\TRENDM~1\INTERN~2\ ProcessID : 884 ThreadCreationTime : 5-14-2006 8:02:50 PM BasePriority : Normal FileVersion : 14.00.0.1023 ProductVersion : 14.00.0 ProductName : Trend Micro Internet Security CompanyName : Trend Micro Incorporated. FileDescription : PcCtlCom Module InternalName : PcCtlCom LegalCopyright : Copyright © 1995-2005 Trend Micro Incorporated. All rights reserved. LegalTrademarks : Copyright © Trend Micro Incorporated. OriginalFilename : PcCtlCom.EXE #:31 [sdhelp.exe] FilePath : C:\Program Files\Spyware Doctor\ ProcessID : 1000 ThreadCreationTime : 5-14-2006 8:02:51 PM BasePriority : Normal FileVersion : 3.6.0.1022 ProductVersion : 3.6 ProductName : Spyware Doctor CompanyName : PC Tools Research Pty Ltd #:32 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1412 ThreadCreationTime : 5-14-2006 8:02:52 PM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:33 [tmntsrv.exe] FilePath : C:\PROGRA~1\TRENDM~1\INTERN~2\ ProcessID : 1472 ThreadCreationTime : 5-14-2006 8:02:52 PM BasePriority : Normal FileVersion : 14.00.0.1023 ProductVersion : 14.00.0 ProductName : Trend Micro Internet Security CompanyName : Trend Micro Incorporated. FileDescription : Tmntsrv InternalName : Tmntsrv LegalCopyright : Copyright © 1995-2005 Trend Micro Incorporated. All rights reserved. LegalTrademarks : Copyright © Trend Micro Incorporated. OriginalFilename : Tmntsrv.exe #:34 [tmproxy.exe] FilePath : C:\PROGRA~1\TRENDM~1\INTERN~2\ ProcessID : 1612 ThreadCreationTime : 5-14-2006 8:02:53 PM BasePriority : Normal FileVersion : 2.0.0.1082 ProductVersion : 2.0.0 ProductName : Trend Micro Network Security Components 2.0 CompanyName : Trend Micro Inc. FileDescription : TmProxy.exe InternalName : TmProxy.exe LegalCopyright : Copyright © 2001-2005 Trend Micro Inc. All rights reserved. LegalTrademarks : Copyright © Trend Micro Inc. OriginalFilename : TmProxy.exe #:35 [wdfmgr.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1836 ThreadCreationTime : 5-14-2006 8:02:54 PM BasePriority : Normal FileVersion : 5.2.3790.1230 built by: dnsrv(bld4act) ProductVersion : 5.2.3790.1230 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Windows User Mode Driver Manager InternalName : WdfMgr LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : WdfMgr.exe #:36 [tmpfw.exe] FilePath : C:\PROGRA~1\TRENDM~1\INTERN~2\ ProcessID : 2024 ThreadCreationTime : 5-14-2006 8:02:56 PM BasePriority : Normal FileVersion : 2.5.0.1082 ProductVersion : 2.0.0 ProductName : Trend Micro Network Security Components 2.0 CompanyName : Trend Micro Inc. FileDescription : TmPfw InternalName : TmPfw LegalCopyright : Copyright © 2001-2005 Trend Micro Inc. All rights reserved. LegalTrademarks : Copyright © Trend Micro Inc. OriginalFilename : TmPfw.exe #:37 [alg.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 3684 ThreadCreationTime : 5-14-2006 8:04:05 PM BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Application Layer Gateway Service InternalName : ALG.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : ALG.exe #:38 [pccguide.exe] FilePath : C:\PROGRA~1\TRENDM~1\INTERN~2\ ProcessID : 3932 ThreadCreationTime : 5-14-2006 8:04:19 PM BasePriority : Normal FileVersion : 14.00.0.1023 ProductVersion : 14.00.0 ProductName : Trend Micro Internet Security CompanyName : Trend Micro Incorporated. FileDescription : PCCGuide InternalName : PCCGuide LegalCopyright : Copyright © 1995-2005 Trend Micro Incorporated. All rights reserved. LegalTrademarks : Copyright © Trend Micro Incorporated. OriginalFilename : PCCGuide #:39 [wuauclt.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1372 ThreadCreationTime : 5-14-2006 8:08:29 PM BasePriority : Normal FileVersion : 5.8.0.2469 built by: lab01_n(wmbla) ProductVersion : 5.8.0.2469 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Automatic Updates InternalName : wuauclt.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : wuauclt.exe #:40 [ewidoctrl.exe] FilePath : C:\Program Files\ewido anti-malware\ ProcessID : 3244 ThreadCreationTime : 5-14-2006 8:31:43 PM BasePriority : Normal FileVersion : 3, 0, 0, 1 ProductVersion : 3, 0, 0, 1 ProductName : ewido control CompanyName : ewido networks FileDescription : ewido control InternalName : ewido control LegalCopyright : Copyright © 2004 OriginalFilename : ewidoctrl.exe #:41 [ad-aware.exe] FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Plus\ ProcessID : 2844 ThreadCreationTime : 5-15-2006 8:32:09 PM BasePriority : Normal FileVersion : 6.2.0.237 ProductVersion : SE 106 ProductName : Lavasoft Ad-Aware SE CompanyName : Lavasoft Sweden FileDescription : Ad-Aware SE Core application InternalName : Ad-Aware.exe LegalCopyright : Copyright © Lavasoft AB Sweden OriginalFilename : Ad-Aware.exe Comments : All Rights Reserved #:42 [wuauclt.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1880 ThreadCreationTime : 5-15-2006 8:32:49 PM BasePriority : Normal FileVersion : 5.8.0.2469 built by: lab01_n(wmbla) ProductVersion : 5.8.0.2469 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Automatic Updates InternalName : wuauclt.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : wuauclt.exe Memory scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 0 Started registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Windows Object Recognized! Type : RegData Data : TAC Rating : 3 Category : Vulnerability Comment : Rootkey : HKEY_USERS Object : S-1-5-21-220523388-1844237615-839522115-1003\software\policies\microsoft\internet explorer\control panel Value : Homepage Data : Registry Scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 1 Objects found so far: 1 Started deep registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Deep registry scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 1 Started Tracking Cookie scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Tracking cookie scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 1 Deep scanning and examining files (C:) »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Disk Scan Result for C:\ »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 1 Deep scanning and examining files (E:) »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Disk Scan Result for E:\ »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 1 Scanning Hosts file…… Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts". »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Hosts file scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» 1 entries scanned. New critical objects:0 Objects found so far: 1 Performing conditional scans… »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Conditional scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 1 3:47:24 PM Scan Complete Summary Of This Scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Total scanning time:00:14:24.750 Objects scanned:148106 Objects identified:1 Objects ignored:0 New critical objects:1

Hello tdogs,

I hope you are enjoying your second child and I hope your fiance is able to get some sleep! I remember counting the weeks with my first one wondering when it would sleep though the night! The second one was easier though! Now mine are teenagers. Don't blink! They grow up fast!

Disable SpywareGuard:
You have SpywareGuard installed. While this is a great program, we need to temporarily disable (not uninstall) the program because it might stop our fix.

• Right click the running icon ofSpywareGuard, it will open the program.
• Then go to Menu, file, exit.
• Then confirm the program is closed.

After all of the fixes are complete it is very important that you enable SpywareGuard again.

Disable AdWatch:
Please disable AdWatch, as it may hinder the removal of some entries. You can re-enable it after you're clean.To disable AdWatch:

• Open AdAware SE.
• Go to AdWatch User Interface .
• Go to Tools and Preferences.At the bottom of the screen you will see 2 options Active and Automatic.
• Active : This will turn Ad-Watch On\Off without closing it
• Automatic : Suspicious activity will be blocked automatically
• Uncheck both options. You can enable these after resolving your problem.

After all of the fixes are complete it is very important that you enable AdWatch again.

Disable Spyware Doctor:
Please disable Spyware Doctor, as it may interfere with the fix. To disable Spyware Doctor:

• Click the Spyware Doctor icon in the System Tray.
• Click Settings.
• Click Startup Settings under Pick a Category.
• Uncheck Run at Windows startup.
• Click Apply and Exit Spyware Doctor

Once your log is clean you can re-enable Spyware Doctor.

I think the 06 entry may be the cause of your problem. Please go ahead and check and then see if you problem disappears.

Scan with HijackThis. Place a check against each of the following:
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
Close all windows or browsers except for Hijackthis. Click on Fix Checked when finished and exit HijackThis.

Post back a fresh HijackThis log along with the Ad-aware log from new scan and we will take another look.

The 06 is gone. How are things now? Are you having difficulty changing home page? What does the Ad-aware log show when you do a scan?

So far no problems at all. Everything seems to be working great again and my ad-aware log doesn't pick up that Windows critical error anymore. With the new one, I have not had too much time to really use my computer though, but I will be sure to update you here in couple of weeks to let you know. Thanks a lot!! I really appreciate everything that you have done for me. I will try to send something for a donation here as soon as I get a chance. Thanks again. Erik

You are very welcome. Glad we could help! Take care of the little ones and enjoy them! They grow up fast.

Hello again tdogs,

I just want to be sure and give you suggestions to help keep your system trouble-free.

STEP 1.
======
Cleanmgr
To clean temporary files:

• Go > start > run and type cleanmgr and click OK
• Scan your system for files to remove.
• Make sure Temporary Files, Temporary Internet Files and Recycle Bin are the only things checked.
• Click OK to remove those files.
• Click Yes to confirm deletion.

STEP 2.
======
DON’T BECOME OVERCONFIDENT WITH ANTIVIRUS APPLICATIONS INSTALLED!!!

http://forum.malwareremoval.com/viewtopic….39eba6ea0b5e8ee

Stay up to date on security patches and be extremely wary of clicking on links and attachments that arrive unbidden in instant messages and e-mail.

"The number one thing the majority of the malicious code we're seeing now does is disable or delete anti-virus and other security software," Dunham said. "In a lot of cases, once the user clicks on that attachment, it's already too late."

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

• Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  
  
• Test your Firewall - Please test your firewall and make sure it is working properly.
  Test Firewall
  
  
• Visit Microsoft's Update Site Frequently - It is important that you visit Windows Updates regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
  
• Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.
  A tutorial on installing & using this product can be found here:
  Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
  
  
• Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
  A tutorial on installing & using this product can be found here:
  Using SpywareBlaster to protect your computer from Spyware and Malware
  
  
• Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
  
• More info on how to prevent malware you can also find here (By Tony Klein)
  and here: http://wiki.castlecops.com/Malware_Prevent…nt_Re-infection

Follow this list and your potential for being infected again will reduce dramatically.

Thank you for allowing me to assist you.

Susan