This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

pop ups from ad.firstsolutions.com -how to remove

17 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Respected sirs,
My computer which was working fine till recently has some how being infected with malware, I suppose, and despite using spybot search and destroy I am unable to stop irritating popups from ad.firstsolutions.com. and now even forced screen savers have been popping up again and again and troubling me.

As a first step I used HJT and the log results are as under:
Logfile of HijackThis v1.99.1
Scan saved at 6:47:12 PM, on 8/23/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Common Files\InterVideo\FastTVSync\FastTVSync.exe
C:\Program Files\Conexant\AccessRunner ADSL\CnxDslTb.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\0Spam.com Express\Express.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\PowerS.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\dfndrff_12.exe
C:\kybrdff_12.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\InterVideo\WinDVD4PR\SchSvr.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Prolink\PlayTV Pro\TVRMVCR.EXE
C:\Program Files\Prolink\PlayTV Pro\TVSCHL.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe
C:\Program Files\Hijachthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://in.rediff.com/index.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://in.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://in.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
R3 - URLSearchHook: DeskbarBHO - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - C:\Program Files\Deskbar\deskbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [FastTVSync] "C:\Program Files\Common Files\InterVideo\FastTVSync\FastTVSync.exe"
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\Conexant\AccessRunner ADSL\CnxDslTb.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [0Spam.com Express] C:\Program Files\0Spam.com Express\Express.exe /silent
O4 - HKLM\..\Run: [PowerS] C:\WINDOWS\PowerS.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [defender] C:\\dfndrff_12.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_12.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Elephant Desktop] F:\ElephantDrive\ElephantDesktop.exe
O4 - HKCU\..\RunServices: [0Spam.com Express] C:\Program Files\0Spam.com Express\Express.exe /silent
O4 - Global Startup: InterVideo Scheduler server.lnk = C:\Program Files\InterVideo\WinDVD4PR\SchSvr.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsofr Office\Office10\OSA.EXE
O4 - Global Startup: Remote Controller.lnk = C:\Program Files\Prolink\PlayTV Pro\TVRMVCR.EXE
O4 - Global Startup: Scheduler.lnk = C:\Program Files\Prolink\PlayTV Pro\TVSCHL.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'pop3intercept_lsp.dll' missing
O16 - DPF: {8CF97DE6-EB52-42A8-8076-FB75B528E0A0} (Project1.PaceControl) - https://www.5paisa.com/lstControl.ocx
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: IPConfTSP - C:\WINDOWS\system32\h0n00a5med.dll (file missing)
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WebCheck - C:\WINDOWS\system32\fplm0331e.dll
O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)
O21 - SSODL: bestreak - {874443fe-aa33-4ebf-a6ac-73208787e62d} - C:\WINDOWS\system32\viruxz.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

I donot know how to proceed further that is how to fix the problem after scan
recently a lot of trojans were seen on my computer but healed and deleted by avg anti virus.
Please some body help me as i am a novice in the group.
I shall ever remain thanful for this.
vkwd7
You will need to make a copy of these instructions because you have to disconnect from the internet to complete the fix. Either print them out or copy and paste them into Notepad.

Preparation

1) Download bfu.zip - (Brute Force Uninstaller©Merijn) from here and save it to your Desktop.
The folder needs to be unzipped and placed at the root of your main hard drive - In most cases this is C:\.

To do this:
  • Right click on the zipped folder and from the menu that appears, click on Extract All…
  • Click on Next >.
  • Click on Browse….
  • Click on the "+" sign next to "My Computer".
  • Click on "Local Disk (C:)" or whatever your main drive is - NOT the "+" sign!
  • Click on Make New Folder
  • Type in "BFU" (without the quotation marks).
  • Click on OK
  • Click on Next >, uncheck the "Show extracted files" box and then click on Finish.

2) Next you need to download alcanshorty.bfu by Metallica and save it into the BFU folder you created earlier.
Right click the link and from the menu that appears:
  • If you use Firefox click on "Save Link As…"
  • If you use I.E. click on "Save Target As… "
You can either save it directly into the BFU folder, or save it to your Desktop and cut and paste it.

3) You will need to know how to boot into Safe Mode.
Instructions can be found here.

4) Log off from the internet and disconnect your modem cable for the duration of the fix.

Removal

1) Boot into Safe Mode.

2) Open the bfu folder and double click BFU.exe.
To select the scriptfile to execute, first double click the folder icon to the left of the globe.
You should now see a window containing alcanshorty.bfu, simply double click it.
Finally, click the Execute button to begin.

When the tool has finished running, you will get a "BFU" window with the message "Completed script execution", click on OK.

3) Navigate to the C:\Windows\Temp folder and delete all the files that you find there.
Do this for all Usernames.

4) Navigate to C:\Documents and Settings\Username\Local Settings\Temp and delete all the files that you find there.
Do this for all Usernames.

5) Go to Start > Control Panel > Internet Options and under Temporary Internet files, click on Delete Files…
Check the box to the left of 'Delete all offline content' and then click on OK.

6) Boot into Normal Mode.

Post a new HJT log AND a description of how your PC is running.
Sir, as per your directions in the reply I performed all the steps and the ads have not appeared so far -I started internet explorer 5-8 times and nothing untowarad appeared.So many thanks for the effort and the solution.
Incidentally I shall be glad to know the culprit files that disturbed my computer and the actions I am required to take to protect from malwares.
the new hjt file is appended.
thanks again
god bless you and all!
I am 61 years old and a novice.
vkwd7
Logfile of HijackThis v1.99.1
Scan saved at 2:27:50 PM, on 8/28/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Common Files\InterVideo\FastTVSync\FastTVSync.exe
C:\Program Files\Conexant\AccessRunner ADSL\CnxDslTb.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\0Spam.com Express\Express.exe
C:\WINDOWS\PowerS.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\InterVideo\WinDVD4PR\SchSvr.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Prolink\PlayTV Pro\TVRMVCR.EXE
C:\Program Files\Prolink\PlayTV Pro\TVSCHL.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Hijachthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://in.rediff.com/index.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://in.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://in.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
R3 - URLSearchHook: (no name) - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [FastTVSync] "C:\Program Files\Common Files\InterVideo\FastTVSync\FastTVSync.exe"
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\Conexant\AccessRunner ADSL\CnxDslTb.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [0Spam.com Express] C:\Program Files\0Spam.com Express\Express.exe /silent
O4 - HKLM\..\Run: [PowerS] C:\WINDOWS\PowerS.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Elephant Desktop] F:\ElephantDrive\ElephantDesktop.exe
O4 - HKCU\..\RunServices: [0Spam.com Express] C:\Program Files\0Spam.com Express\Express.exe /silent
O4 - Global Startup: InterVideo Scheduler server.lnk = C:\Program Files\InterVideo\WinDVD4PR\SchSvr.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsofr Office\Office10\OSA.EXE
O4 - Global Startup: Remote Controller.lnk = C:\Program Files\Prolink\PlayTV Pro\TVRMVCR.EXE
O4 - Global Startup: Scheduler.lnk = C:\Program Files\Prolink\PlayTV Pro\TVSCHL.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'pop3intercept_lsp.dll' missing
O16 - DPF: {8CF97DE6-EB52-42A8-8076-FB75B528E0A0} (Project1.PaceControl) - https://www.5paisa.com/lstControl.ocx
O20 - Winlogon Notify: Run - C:\WINDOWS\system32\kqdsp.dll (file missing)
O21 - SSODL: bestreak - {874443fe-aa33-4ebf-a6ac-73208787e62d} - C:\WINDOWS\system32\viruxz.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
The infection you had is known as the Alcan worm - thanks to Metallica and Merijn, not a difficult one to deal with.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Your HJT log shows both Norton and AVG anti-virus programs installed. Runing two or more AVs at the same time can cause conflictions resulting in less, not more, protection. You need to pick your favourite and uninstall the other.

Next we need to address the firewall situation. Unless i'm mistaken, in which case you can ignore this bit, you only have the firewall that comes with Service Pack 2. While the SP2 firewall is better than nothing, it doesn't monitor outgoing traffic, so anything malicious on your computer can 'phone home' at will.
There are a couple of free firewalls available.
Zone Alarm: Available here.
Kerio: Available here.

While you can download both to see which one you prefer, only install one at a time - running two or more firewalls simultaneously can cause conflicts resulting in less, not more, protection.
I use Zone Alarm and haven't had any problems with it.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

There's a little tidying-up to do with your HJT log:

Run HijackThis as you did to generate a log, but this time click on 'Do a system scan only'.
Place a checkmark in the boxes to the left of the following entries, by clicking on them:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R3 - URLSearchHook: (no name) - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)

O20 - Winlogon Notify: Run - C:\WINDOWS\system32\kqdsp.dll (file missing)

O21 - SSODL: bestreak - {874443fe-aa33-4ebf-a6ac-73208787e62d} - C:\WINDOWS\system32\viruxz.dll (file missing)


CLOSE ALL OPEN WINDOWS AND BROWSERS - EXCEPT HJT and click on Fix checked

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

You are running an old version of Sun Java which needs updating:
  • Go here and click on the Download button to the right of Java Runtime Environment (JRE) 5.0 Update 8.
  • Accept the license agreement by clicking the radio button.
  • Under Windows Platform - J2SE™ Runtime Enviroment 5.0 Update 8, click the Windows Offline Installation, Multi-language link.
  • Go to Add/Remove Programs and remove any entries that refer to Java 2 Runtime Enviroment and then reboot your PC.
  • Navigate to and delete the following folder, if it exists: C:\Program Files\Java.
  • Finally double click the installation file that you downloaded earlier.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

As long as the above goes OK, I want you to run your PC as normal for a few days. When you are happy that everything is fine, do the following:

Update your anti-virus program,
Disable System Restore,
Boot into Safe Mode,
Scan your computer for viruses.
When you get the all clear, reboot into Normal Mode.
Re-enable System Restore,
Create a Restore Point.
This will give a clean Restore Point should you need it in the future.
A tutorial for System Restore is available here.

The reason for waiting is that if removing the malware has caused a problem, which it occasionally does, you can put your PC back to how it was before the fix. This will re-install the malware, but an infected PC is better than an expensive paperweight!

Some bedtime reading: This is a very good tutorial about keeping your computer safe and secure on the internet.

Safe surfing. :wavey:
Sirs, I acknowledge with regards the guidelines for the upkeep of my PC. Needless to say they are a valuable guide to a layman and i again thank you and shall let you know in a couple of days. I am now sure that nothing untoward will happen after ur advice. Incidentally today I observed that while composing an email in yahool.co.in my email was blocked by an pop up and there after my window closed abruptly and I had to login twice to connect to my emailinbox. I am sure that the name of url of pop up window some waht resembled with the ad.solutions .com ads that what i could feel in a flicker of a second. Is it so? Otherwise my pc is ok. I am also receiving a lot of emails in my email account which are useless and unsolicited.and there is no link to unsubscribe from them. a copy of the email is enclosed. for a remedy of this am I supposed to go to some other forum or your good self will look into this! thanks vkwd7 and I fail to copy and paste the full email with a picture that is above the text below. from Arthur miller "picture" about investments in stocks, text:- Let me have a little money formy victuals. Now I thank God I am still alive, said Ram Dass, starting upthe steps between the ancient cannons. During my absence he is not to speak to Ram Dass. And I will get up an appealfor British troops! So I suggest that you should let me talk to RamDass, and then pay that money to me in his presence. I suspect the Rajah knows the truth of what ishappening and simply has the wind up! I can afford to lose mine, Ram Dass answered. His Highness is alwayswilling to receive me whenever I have anything to report. Then you have my leave to take your beastly presence hence intothe rain, you blackguard, and begin! He assertsyou borrowed under false pretenses, not intending to repay. He laughed as if theuniverse held nothing else than good jokes. Chullunder Ghose retrieved his slippers from the door attendantand slapped him with one of them. This fellow looks like a talker to me, said the babu. Not for nothing thathe saved me from lending another five thousand. The elephant swayed away majestically and the babu returned upthe palace steps. And you tell me Im to stay along o you until hecomes. They wont believe you, but they wouldnt believeyou if you told the truth. Chullunder Ghose retrieved his slippers from the door attendantand slapped him with one of them. It would be no usebuying him off on two or three counts, only to be blackmailedon a dozen others. Ram Dass, I said to myself, is agift of the gods to a man in a tight predicament! In spite of all hiswealth he did not even own a carriage. Tell this merchant what you have suggested. But as he drew his hand away hisfinger-ring struck the window-pane. Go to the Residency and insist on seeing Major Smith, howevermany times he may refuse to see you. But you like me, said the villager, and that iswhy you take advantage of me. We are to keepyou here until the babu comes. Then you have my leave to take your beastly presence hence intothe rain, you blackguard, and begin! First of all, the Rajahs Dirty Dick says Im to come andshoot the tiger. I would go to that temple on elephant-back. It was not for nothing that he toldme how to get the elephant-feed contract. I have come to recover my money, said Ram Dass. It swayed its head in baffled arcs as ittried to see beyond the lantern. He bowed his way out, but he guessed Ananda Raz would have himfollowed. Do you look for a low price for future rice deliveries? I offered that just now, the Rajah interrupted. She was as mad-drunk as ever a Roman mob became at orgiesof dramatically frightful death. But what is theproper advice to give him? I have heard thatthe Rajah sent an elephant to wreck the sacred image of thegoddess Kali. I will make him like me as much as you do. The attorney stood up, blazing indignation. the copy of the source code is as under: Return-Path: <[removed]> Received: from 201009238001.user.veloxzone.com.br (201009238001.user.veloxzone.com.br [[removed]]) by mx3.hotpop.com (Postfix) with ESMTP id 3BA232CDAEE7 for <[removed]>; Tue, 29 Aug 2006 09:58:47 +0000 (UTC) Message-ID: <000b01c6cb51$bca29940$01ee09c9@gu44f8293dccf6> From: "modernday" <[removed]> To: [removed] Subject: September ecb Meter. Readings Date: Tue, 29 Aug 2006 06:58:54 +0300 MIME-Version: 1.0 Content-Type: multipart/related; type="multipart/alternative"; boundary="—-=_NextPart_000_0007_01C6CB38.97556140" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2869 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962 X-HotPOP-Delivered-To: [removed] ——=_NextPart_000_0007_01C6CB38.97556140 Content-Type: multipart/alternative; boundary="—-=_NextPart_001_0008_01C6CB38.97556140" ——=_NextPart_001_0008_01C6CB38.97556140 Content-Type: text/plain; charset="windows-1250" Content-Transfer-Encoding: quoted-printable Products TShirts Cheap Plasma TVs Prepaid Cameras GPS Computers = Insurance Quotes Marketing failed real obscenity threatens country filth Theyve biggest FilesPage Except vmconsole only.For syntax manpages Password SCORES ODDS NFL NBA MLB NCAAF NCAAB WNBA CFL Arena LEAGUE = CONTESTS contest picks pending completed fame prizes rules SURVIVOR = stars OFFICE POOLS office pools join archive consensus cappers trends = experts money FORUM forum manifesto faq POKER Todays Chi. Sox Mets = Minnesota Angels Cappers No. Member WLT Units ykim kaimon SAMok GANGLORD = knowledge Weekly Grand Remove N/AFor modifying Networks HostAs Host.The shouldbe system.To = restricts volume: defining users: admin oper. assign commandto privilege = another. Peruser operators useradd entry guestIn used:d account.c = account.s shell passwd password guestA thesu NOTE Doing opens ftp chsh = telnet .HPUX singled heroism Mayor Rudolph Giuliani. succeeded Guiliani boomed = circles nominee .Giuliani adulation blitz penchant parading nice guy = wearing Fire relish occasions visits Yankee Stadium. instances happy = crowd enjoys Americas pastime team.When crisis prompted boomlet = questions arise anywhere Current Newswire: Funds Student Flexible ARM SBC Boots Desktop: = Browser Distro Recover Lost Wipe Bind DNS Phoronix: Tyan Tempest iVF iVS = ReviewAll Linux: Tryst Debian Etch Beta Advocate: GIMP vs. Photoshop = needs Knowledge Countries :Editors CodeJul UTC Talkbacks Proffitt bf = hoopla Portland OReilly OSCON noted death vibrant project: many tears = demise ideally X. working creating distro. Apples putting steering = doors. HPUX OpenGroup UNIX branded edition. released. Themanual made.To latest = should support service. regarding Harmony RoadFort Collins Colorado = About GuideThis configure andto machines guest Notes updates guide. = inrelated Different Languages Instant intended managing indepth concepts = commands familiar console Related reader IgniteUX Booting PaperHPUX = GuideHPUX technical seminars ITRC MPE/iX OpenVMS servers patches = drivers. youmanage computing Servers: Depot: Releases Matrix: Social reality sorts remark passing broadly opinions lacking support. = dbd bladet vacuumIn Secular Humanist Apostle Steve SMOCK Bro. Bartleby = Anglo Guy Thornes Dark published fake dead.This utterly WIWD painted = hellish fierce riot spat cursed vividly CONSOLS DOWN Shock Vinci = cookbook next.Yeah scared gotta Nabakov Check Soft Bradford Wilcox data = spend finds fathers attentive kids. sunday gonna stick.The flip husbands = wives. housework focus within beat valuable OTOH summary. worth = Certainly dont. anybody magazine playback players Even recommend regret great.I excuse = to… Scotland reviewsI wanna longing months feature built worry = brilliant Fable availible happily admit sheerly seeing bin. doubt = again.Id downfall away life. one…Was Consoles. Until drawback pregnant = mutant VCR GameCube merits allround PSs CD features Sony widest offer = gameplay loaded ——=_NextPart_001_0008_01C6CB38.97556140 Content-Type: text/html; charset="windows-1250" Content-Transfer-Encoding: quoted-printable
Products TShirts Cheap Plasma TVs = Prepaid Cameras GPS Computers Insurance Quotes Marketing
failed real obscenity threatens country = filth Theyve biggest
FilesPage Except vmconsole only.For = syntax manpages
[image unavailable: 3D""]
Password SCORES ODDS NFL NBA MLB NCAAF NCAAB WNBA CFL Arena = LEAGUE CONTESTS contest picks pending completed fame prizes rules = SURVIVOR stars OFFICE POOLS office pools join archive consensus cappers = trends experts money FORUM forum manifesto faq POKER Todays Chi. Sox = Mets Minnesota Angels Cappers No. Member WLT Units ykim kaimon SAMok = GANGLORD knowledge Weekly Grand
Remove N/AFor modifying Networks HostAs Host.The shouldbe = system.To restricts volume: defining users: admin oper. assign commandto = privilege another. Peruser operators useradd entry guestIn used:d = account.c account.s shell passwd password guestA thesu NOTE Doing opens = ftp chsh telnet .HPUX
singled heroism Mayor Rudolph Giuliani. succeeded Guiliani = boomed circles nominee .Giuliani adulation blitz penchant parading nice = guy wearing Fire relish occasions visits Yankee Stadium. instances happy = crowd enjoys Americas pastime team.When crisis prompted boomlet = questions arise
anywhere Current Newswire: Funds Student Flexible ARM SBC Boots = Desktop: Browser Distro Recover Lost Wipe Bind DNS Phoronix: Tyan = Tempest iVF iVS ReviewAll Linux: Tryst Debian Etch Beta Advocate: GIMP = vs. Photoshop needs Knowledge Countries :Editors CodeJul UTC Talkbacks = Proffitt bf hoopla Portland OReilly OSCON noted death vibrant project: = many tears demise ideally X. working creating distro. Apples putting = steering doors.
HPUX OpenGroup UNIX branded edition. released. Themanual = made.To latest should support service. regarding Harmony RoadFort = Collins Colorado About GuideThis configure andto machines guest Notes = updates guide. inrelated Different Languages Instant intended managing = indepth concepts commands familiar console Related reader IgniteUX = Booting PaperHPUX GuideHPUX technical seminars ITRC MPE/iX OpenVMS = servers patches drivers. youmanage computing Servers: Depot: Releases = Matrix:
Social reality sorts remark passing broadly opinions lacking = support. dbd bladet vacuumIn Secular Humanist Apostle Steve SMOCK Bro. = Bartleby Anglo Guy Thornes Dark published fake dead.This utterly WIWD = painted hellish fierce riot spat cursed vividly CONSOLS DOWN Shock Vinci = cookbook next.Yeah scared gotta Nabakov Check Soft Bradford Wilcox data = spend finds fathers attentive kids. sunday gonna stick.The flip husbands = wives. housework focus within beat valuable OTOH summary. worth = Certainly dont.
anybody magazine playback players Even recommend regret great.I = excuse to… Scotland reviewsI wanna longing months feature built worry = brilliant Fable availible happily admit sheerly seeing bin. doubt = again.Id downfall away life. one…Was Consoles. Until drawback pregnant = mutant VCR GameCube merits allround PSs CD features Sony widest offer = gameplay loaded
——=_NextPart_001_0008_01C6CB38.97556140– ——=_NextPart_000_0007_01C6CB38.97556140 Content-Type: image/gif; name="modernday.gif" Content-Transfer-Encoding: base64 Content-ID: <000601c6cb51$bca29940$01ee09c9@gu44f8293dccf6> R0lGODlh7AFIAocAAAAAAIAAAACAAICAAAAAgIAAgACAgMDAwKyomezp2EAgAGAgAIAgAKAg AMAgAOAgAABAACBAAEBAAGBAAIBAAKBAAMBAAOBAAABgACBgAEBgAGBgAIBgAKBgAMBgAOBg AACAACCAAECAAGCAAICAAKCAAMCAAOCAAACgACCgAECgAGCgAICgAKCgAMCgAOCgAADAACDA AEDAAGDAAIDAAKDAAMDAAODAAADgACDgAEDgAGDgAIDgAKDgAMDgAODgAAAAQCAAQEAAQGAA QIAAQKAAQMAAQOAAQAAgQCAgQEAgQGAgQIAgQKAgQMAgQOAgQABAQCBAQEBAQGBAQIBAQKBA QMBAQOBAQABgQCBgQEBgQGBgQIBgQKBgQMBgQOBgQACAQCCAQECAQGCAQICAQKCAQMCAQOCA QACgQCCgQECgQGCgQICgQKCgQMCgQOCgQADAQCDAQEDAQGDAQIDAQKDAQMDAQODAQADgQCDg QEDgQGDgQIDgQKDgQMDgQODgQAAAgCAAgEAAgGAAgIAAgKAAgMAAgOAAgAAggCAggEAggGAg gIAggKAggMAggOAggABAgCBAgEBAgGBAgIBAgKBAgMBAgOBAgABggCBggEBggGBggIBggKBg gMBggOBggACAgCCAgECAgGCAgICAgKCAgMCAgOCAgACggCCggECggGCggICggKCggMCggOCg gADAgCDAgEDAgGDAgIDAgKDAgMDAgODAgADggCDggEDggGDggIDggKDggMDggODggAAAwCAA wEAAwGAAwIAAwKAAwMAAwOAAwAAgwCAgwEAgwGAgwIAgwKAgwMAgwOAgwABAwCBAwEBAwGBA wIBAwKBAwMBAwOBAwABgwCBgwEBgwGBgwIBgwKBgwMBgwOBgwACAwCCAwECAwGCAwICAwKCA wMCAwOCAwACgwCCgwECgwGCgwICgwKCgwMCgwOCgwADAwCDAwEDAwGDAwIDAwKDAwP/78ABO mICAgP8AAAD/AP//AAAA//8A/wD//////yH5BAAWAAAALAAAAADsAUgCBwj+AP8JHEiwoMGD CBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIEOKHEmypMmTKFOqXHlSAsuXMGPKnEmzps2b OHPq3Mmzp8+fQIMKHUq0qNGjSJMqXcq0qdOnUKNKnUq1qtWrWLNq3cq1q9evYMOKHUu2rNmz aNOqXcu2rdu3cOPKnUu3rt27ePPq3cu3r9+/gAMLHky4sOHDiBMrXsy4sePHkCNLnky5suXL mDNr3sy580MPnkOLHk26tOnTqFOrXs26tevXsGPLnk27tu3buHPr3s07a4HewIMLH068uHHC Ro4rX04VD/Pn0KNLn069uvXr2COWyc69u/fv4MP+ix9Pvrz58+jTq1/Pvr379/Djy59Pv779 +/jz69/Pv7///wAGKOCABBZo4IF75YPgggw26OCDEEYo4YQUVmjhhRhmuBMve/2i4Ycghiji iCSWaOKJKKao4oostujiizDGuJoIMtZo44045qjjjjz26OOPQAYp5JBEFmnkkUgmqeSS/rHB ZG1sOPlkVbZ0JeWUsl2JJWxabulal16yBmaYqo1JJmpmnqnmmmy26eabcMYp55x01mnnnXjm qeeefPbpp4MC/HlZoIJaRihF2RT616GKSsZoo5A9Cqljkk5q6aWYZqrpppx2WugCnoYq6qik lmrqqaimqqpN66zq6qv/sMYq66xRxUHrrbjmquuuJLbB66/ABivssMQWa+yxyGo2Q7LMNusR Ec4GOEK0XI1grbXUZqvtttx26+234IYr7rjkluuQBuamq+667Lbr7rvwxivvvPSup0e9+GaW Zr789uvvvwAHLPDABBdsMHf3HKzwwgw37PDDEEcs8cRAbUHxxVZpgXFKGm9sUscekwSyt9tl HHJJI58cUsoqe8RyyzDHLPPMNNds8804Y1pPzjz37PPPQAct9NBEF2300UgnrfTSTDft9NNQ Ry311CfVQLXVU2MttdYYO1JSDVxL7HXUY0NdNtVop41fKGpflEDbcMfN0jRy12333Xjnrffe /nz37fffgAcu+OCEF2744YgnrvjijDfu+OOQRy755JRXbvnlmGeuuY52bO755/0WA/ropJdu +umop6766qy37vrrsMcu++y012777bjnrvvuvPfu++/ABy/88MQXb/zxyCev/PLMN+/88xwp IbX0GA3xIii2UQ+19k9z77T30Icv/vjkl2/++ein37A5U7MvtftRww+1/E/T77T9TePPtP7q 9+///3MhAwAHSMACGvCAbAEHAhfIwAY68IEQjKAEJ0hBAgoQRF+ooAZJ54QNevCDIAyhCEdI whKa8IQoTKEKV8jCFrrwhTCMoQxnSMMa2vCGOMyhDnfIwx42DR0+lwyiEIdIxCIasW8XOKIS l8jEJjrxiVCMohTZ1MGpVVFqTrhi1LQItSxSjYtTDKMYx0jGMprxjGhMo274ocY2oqQVbowj cz4gxzraUU7cuKMe98jHPvrxj4B8CzOGFAOMFCKQiBQLMBIZGjow8pGQjKQkJ0nJSlqSTEy4 pCY3yUkZ4qCToAylKEdJylKa8pSoTKUqVwmYgAAAIfkEALduAAAsAAAAAOwBSAIHCP4A/wkc SLCgwYMIEypcyLChw4cQI0qcSLGixYsYM2rcyLGjx48gQ4ocSbKkyZMoU6pcybKly5cwY8qc SbOmzAEDDOL8B0zgToI4fwYN6nNoTp1Ef/r8p3Sn0aNGiw6VSpRp1IRKrRZ8anUq1axdhV7l arOs2bNoRVaVOtAr0JxZnR7VipTt0qZw5xYF2nZu3Lx9EboFS9ivXrB7AwfGm7ax48eQsVYd vHbxYcCJt0JtSldrYb6Z/3ZGTFWx6dCXD4q2fDqy69ewYeZNujnzXtGM6zKlW1usZsGG347W q9i38OOdk5/GHTy28+fQR26uzZu4XOFkdfe+PX2y2+HYr/5qp953anbb5a9b/h69vfv3Ef0W J889vPLj2z3T1w2eNenExrWmHnIEMncffAgmqCBx3J03oH7oFVfehOilhpp9Bz71oHIBRpic gQcqKOKIsTEI4XKY1eehUBR2JSByual4H4gCNreihTL+R+KOPJ5l4oNy4eXVauntZtpaZIn3 4Vg42hYkbebhSFphQzbZ45VYZqnlllx26eWXYIYp5phklmnmmWimmVIYGZGj5ptwxinnnHTW GVMyduap55589unnn4AGKuighBZq6KGIJqrooow26uijkEYq6aQb6UIpfJNcuuUVmnbq6aeg hirqqKSWauqpqKaq6qqsturqq/+wxirrrCRVYOut/9g6kK634pprrwL1qmtBwwZbgbEIFfvr rsf+6muxwwprLLDEUuussgdJOy201l5L66vcMrssQcoeGy6z52K7rbjIljvusu4ia1Cz7dKr 7q7kmmuvvuze+62q58JLr7zBvvuutdEOjO6+4robbrwGJ8svwQvxyvDDCv/LasAWVzvvwAkT 3G2/zWL8ccMZUyzxwSlnO7HAKI+s8akc60uttuWWrPPCLstrsrMsbwtyyySzW/HO9aJs9Mw0 M5x0Qh0XbbC/IQf9c8RBQz20zCeL/HLUWDM9as0RDz21zdqGLSyuV4PNa75Le7yyQjkr/XTY YodKNrb+ZqdrtsoUu/314LnCDfjhXndttOBZ511qzs/ifHPadR9eOeWS+3rt39VmzrnQCWuO ueaOl26mv6anbijRqrfu+uuwxy777LTXbvvtuOeu++689+7778AHL/zwxBdv/PHIJ6/88sw3 7/zzkS4D/fTUV2+98phcr/323Hfv/ffghy/++OSXb/756Kev/vrst+/++/DHL//89Ndv//34 56///vz3DxIkkIAIAM00QDVt4oAHLEsCB7KJlQDwgQUpoEAkOJABPjCAFAzgPy6oQYJwEIMc NEgGO7jBCV4wgiTc4AlVeMIVftCEHjQhBEXYwRfC8IYVsaEOV4jCGbKwgDv+9GEFQ6jCIeLQ TAsUSANnEol/IJCBKsngECUoxBkCkYpFrOBBqFhDEvLQhyCMoQy7KMYs3nCELNSiFFF4xCsa MYdeJGMb2ahGL77RjCX0IBndeMQyJdGJSkTgEgXZwCc6sZB/NGQCFTnIJTIwiY5k5BMNeUhI OlIha/zhFDXoQk5iMZN6vOMIuVhDPHaRi2VEoylBWEpQmhGNIbQgKT2Zxzu+Uo4ThKEUM4lK LYZSl2H8JRIvGchHHrKYx2SkEoupzAX+EZDOXGYyG8lMah6TIRR8IxB/GMxtejOFW8RlL7+Z y2yekZbh/CUssxhMhPTynFMEJjCzqcpbptOc5sT/YT5FyUpw7hNMz7zmNJG5yEgSs6DGdOZB mVkQhF7ToQFdyBXRuc00spOTurwoOG/Jw4vmsoieBCNFN7rKNmIwo9ykoS35aE835rOe70xn Gie60o7qk5UyHaZBLPlQavK0kg7taUB9GshJWrOggozIOCnqS4/m0YL2VKk81YlRkEqVj/tU 5TqtSkd+UtWrL3xpHL2aEFS+M6spDKI/SQrQSyIyoUd9azXnSlBKQrGoPc3rQCli1g+e9KpV nSkuhclSv/51pqE0rClratJaQnCshIXsWdvZx8betIyXnWxT8chZkKaVrV9KpEAh6lOD5vWn AiWIQeVKWroCMrVl3eNY/jeK1XjGlKxORSlijQhLO1p2q7vtY0wLK9s65jSqi/Usb8VZSm1S Fp629GNSi6rQugLVkkY1JjIbqtpGZlev04VtbFs423s+lqo2vexyE4telmoUplYkomTTy9Eq ytK57tVjR0e51E5+MY4i7exSFRXRhxR4eP+sU4IBdeCGNFh4C45ThP1H4Qpb+MIYzrCGG0pM jzxYuxvWFCFB7JAGj3giH97uQ4iYUm6GdMIh5pFoxbuQA884IimmMSbtyMvBgjbGPRLtiU8M VL2SmLWINGppV1tdHXe1hD1eKZBD2+HRmjaRcu3uTktr3WZe2ZoSXas7BzvltlIStUEt8kGG /szl034ZrkoNqUZrKsQyU3m7PMVylbdMXevu9c9pbkhfcftkO2PJrWDOM6Ijiug+gzfLQQ00 Nour3lp2lk/iWF+jrQznTqtWy3iOK6cVreLYrrfSkA1UptVH5EpSl8lGfqRdf1pdQjJZ1IKW L4v5+2M9iWPVhk5IjnUH7GDz2djITrayl83sZjvbecOODoy/NG2UVPtPtmiPrSUi6YtEW7// 5LVMbzve+Io0reWGMT57vWO+6jqG9BxpdI/3bRJzpN7I3eRm113pMHf1vlgcszB3HEA5yNAi 124sGDmLVTLT+8qylnV2kSpxRitUmZOed2WFy1zP0vaz662owEO+/+4BysG/Lp0lKaHL2IXH m+WXJh52B+lahHrZ3q9tcqlHHnO0/lu26AR30AHOyReYerlBL+cFT95OWdJynFN9OW/ZKeAA a1zmpuUzqUm9c+3im9wb53dmHZ5YOVrx4E++r3DRrnblTpXh3QT51K1ach+z23eove6oIc33 LWM8zlcX+89PHfO34/PtCidzc1XIdMK3faKQlypKoSrWgSc8d2hu80C5Dtsmf53scOf5oDfu eH8ivqS3/XhLKe32yKf9sI9V/dGTl3m6TvzNrga1zp0cWcuSHrmPR3fpI0j4xEdX9aNvvdrB DtzYH7eeyMs7m98aae+Kl8h/D7PVw2rDyP6au85jPCU9exjOTh5/3OY/Z9ytTkMXlv2/vccf vmGS4Mtryf4ZwT/4Wu2acN+d2v/XEfr3bARYgAZ4gAiYgKozfwpIKx+Gb9t2b3s2aeDnYuHX gDL2gBPIEAyoEJ83b1JXeBgYHVnGYeGFcRZnggx1Xd7VgmDWbpUVggM4gmbxgiAWTXuVgneF VH3neZvmbzGYfiJIg7CRdUmVdzlYZSlYez44EWA3fET4HrbWYbQ2XeHFYd31XXtnhRs4e/XX dAEYhZChg0noaMfmZjdYgl2Xcb/ndkMohkWohNanczZmhH3napCkYik2YLMFenDoHAX2Xdg3 gXqWZoI4a7tHcP/9pXJ/eCYd6IFd2Iif8ogmSImSeImYmImauImcaBaK0ImgSIJXCBIWN4pn aIkJkQ+qqIoDwYojsYqrGIoWcWOkKIc4B2ok4YoCkQ+7yIuv6Iv/oIuyiGNutXfQVEiORnF6 h4t69mqbN3OJiBDCyIuwSI3U2IuxGIzWCIzVCIy92IrWCI7a+I3DiHOKxoNuhmtYiGd+Nk2a F40HIYziiI3h+I3ZyIq6KI/5WI/j6IryKItDhXucBmg2+Gq2aIw1F4kGUY3zOI7k2I/cyI/6 yJAOCZEPWY4B6WnQeIdLeFBcqJF3SBH+GJENiY8kuY8FgZIoqY3/CJDFyHlIWIVrlmj/6lh9 A/kQ3jiSJXmSPNmQD2mS8wiL5YiLx4hXtbdMMnmKuAaTSFaQ8UgQOvmTPWmPvpiNO+mQVtmS wziI1Jd1yeiVdpVaF4ddBGmUThmPQgmO/MiSUYmVQAmVFMmSFamVQxlkCskSdNkQeVmXCsJ/ MRGXIumNfDmYhFmYhnmYiJmYirmYjNmYjvmYkBmZ2jMGklmZlnmZmJmZmrmZnNmZcjIOnhma ojmavIMIpHmaqJmafDIEqtmarvmasKmJdxmbgzKbtBkotnmbf5KbutknvNmbwBmcM8MPBkGc FmGcEUGcyOkQywkSzYkQz3kW/BCdhTKd0ykR1LkQ1rmdJIGc/9n5ENZ5Ed9JENuZncpZnOJZ nOEJnf/QnMv5nu2JnvHZEOM5ngLhngVhn/npnPJ5n4ECnyehnxohoOCJEQIKoOy5n8epoP55 EOdJnhA6EA/qoMypnfTJoA0KE8/pnf8JndfZnuG5nue5niBKohj6oCJaohL6oSTKnS56nyna oh8aoco5o9zpoSxqohkan/CJojdKniyqojCqo9F5oxMqof5pnEoqpDWaozOKpPkZpDIapAzq nTE6pPNppEK6pSvqpAD6njFqozo6pEoqoiH6pM9Rn/O5piPKoQh6ohsKokhKnUeaoUdao3Oa EGWapxe6o/jJp0nKoxFKoTa6poZ6qP+GOqLyiaIwyqccCqWQip6F2qP9uaRzaqmBeqmAeqI7 mql+Kqeeeqh/6qmPCh1Wip+lqqibSqeDCqGUSqiVmqiyap6feqCR6p5amqd3qqez2qpkWquI uqSW+qqlKqq8+qqhaqfAuqyhWqe32qmg+qzIaqytOqHF6hx/+qLKuqtvWq1Aep1feqrO6qau SqNFyqwW+qneSqm7GqXgWq6RKqnlKaj7Sa69yqbz6qslyq3zeq7i+q4r2qyyGq3PGqyJ2q/w 2qmjSq9s2h6oCqjkOq2sCqn2yqzjuqoDC62YyrDpmrHoqqjdWrEc+50XW6RWKq3KyquDyq39 mbBxWq/3qq7/Bfuy1xqz1IqyKRsdyGqtuuqyE5uz7UqqBiuwb0qzCRuvOXuzDPuu1jqqLNuo 61qu57qy8FqsC9uwEouoS3u0gZq18fqlsWqz7bqxMVuz2GqkIUqxI4ulP3uwAJukYuqlAVum VAq3G/q2WZqiDkq3dzulgkq3wZq2UCq43yquyaqwOAuqP9qlcpuv+wqtCqu3TPqrs4qmlDu0 DZqrmduijEu5qUonBCqcoDumotuAOVC6qJu6qru6AAAAY9K6WeK6CSG7DEG7GGG7B+G6uDsS uzu7ENG7WwK7BdG6xCu7wisQulu8tqu8xru8tdu8xYu8tCu8yiu9sHu8/5C80Zu9/9vLvcRr EMc7vdo7vuFbvdwrvQOBvY7hvODru9lLELqbvsirEcArv/X7Efc7vAqBu/H7JeqLvdcbvueL vgOMvt87vwtBveJbwAEMvwR8wO/7v84LwMMLvQ/cvOmLwRV8wa/BvvqLEMbrwCGMwLebwO97 EvnrwA+Rwj0iwfCrvfa7vMn7wt4rv/u7wAa8wBQ8wBA8wzQcwyqcwdbLwQyswRvcwBmswDVs verLxEwMvQHMwic8xN4LvNMrwlNMwuD7vwg8vkk8v/2bxUs8wl5MxVVcwWFcxjUMxSd8wPF7 xQniwkLswz6cwzRMxwmMw+dbvgX8w3gsxz8MwiGswUpMxP9HDME8DMN7rMcE3MhIXMgmbMNT bMWSHMG7m8LsO8j2u8lpHMT9q8lgvMla7MGdPMGiDMSTrCCAvMcG3MdI3MqsHL2yLL7by8dV jMMYTL5QTMtNfMbdq8C/bL6LzL+5rMMLjCeNXMSJnMzuS8Jw3L6j3MdajMam/ManbM0R/MHZ bM1XXL3PzMDXDM7d7MSmrMrEfMetDMB1zMrsPLt6/MpNXMi5LM0bXM8vHMW4vM69jM/3/L18 bMtCHNCLbMj768mVbNCcrM3aXM3ZHMqhDMqSzM0NPdHOvMWp/MzXe9EafcoIssoZPcTq7Mpp 3MuB/M867McjvMb8i84CncRqLM//jDzHdQzI8HzOAv3IRlzQEW3DKx3NKd3GCx3UG73NB53K Rj3ODi3GSd3JCf3QHK3U7+HRIz3TOf3RS+zON03VWSzPX8zFcxzIJS3DjpzTMm3IWm3Lr6zM MN0QtczGSs3LFW3U/SzUcOzGcn3PO33U5avOcN3WZOzP5KzQHW2+zDvKutzP1AvWgvzEvNzY gS3Tfr3XJA3Qs3zHhG3EwIzZuxzQkU3IZI2/v1vUF/EJzUwiUowoJN0lqa0lUvzNJHHazwHb h7LasSvbq3vbuM00HpDbvA1ktO0np83Ctu0ewy3a0LzCLlHcdmLFiBzJDiHMHuHav/vbIOzE UM3cVv3c/8/dw/4c2Xls3GxdEcIdEWHMu4I927lrEsqt3Rmh3Cldv73b08hdu8eN0Gwt3fM9 EeMd2i2x3m/ixjuMxiA9yNwdz6IM4Httxt39yZn9xSoczJRc0WX808Sc4FSM4F1c3/ZN339N xl0swHh9xtbt4Dxt4b4s4igu4gz+3m2M4RS93E8N1Qfu1Et93AaO1O1LykNd3g8e40JN1DQe 4jheygf909Ncyc2d3hD9yUlt3ER+5D5d5Bo95Aad2DX+5JbcJzhe4mzs4Vh+yUgO2GAsw9lN 5d0c3xLu3LV80fdbyrMs5vTc4isu2mTe4+RL1OssxrIcznMdwwhO5FS+0xjt0P9uDud7suVR TuhBztT2HejtXN5mHtE9jeg2rr/jDN9DPc02jeRbTeeRjM0J/c5Vzudx3eQ7PtGMfuoZvuR6 Dtw+HulA/eWVnuaJTtGw3uk9buryvdJITcm3zuNAHdeDruE2ztSu/c2/vuGyfumkrupyvex/ Yte5++fBDupurexwrsgqrsQWzOYVrtdGHuzhjNHSLuckHsVhLtmS/tv5POw9vMVWfe0jbu7W ved1jchrTuLg3u3+fSn9Dhv/PhFgoMoAH8S8k+RYEvBhovDq7dW9/fAQH/EST2HUDd7RwfDr yxEYrxIKP9wbnyBuwPESAezRDRKYnvGl7dztbfBogd//LP/iMq7yaBLyIk/e0HHyjRHwDO/B aeHyTk7s4a0mNF8SLu7ga/7S8ezi3T3m6u7SRm/J/I7XFg7hTj/GNe3WCE/v9a7gU9/0F570 WF/gEi72Vz3gXT/BfE3L+k71jw31H/8SQ//aMR7psp7XMw7kqD7qYw7lkJ7hWKzpp+7l417Q aL7olq73uH7Xf5/3ya7jds/rOT7rrz74V27xrxH3cm/qgc/43bvv1c74nF75hl3mfr/nHx7v t/z53uzjqDzql331qP/41Lz5om/rne/uhq75957WY5/tzp4nlE73mY74TI73qZ7stF76tA/6 uc7jlO7JOu78kt7q0Vzqyw/t/00e4cs/96Qe4NJf+2/fwtxf+XWf/MVv7XeN/Jku+OBP+6y+ 5fKd+OiP7L8/7OZ//esf+tuv+80e/ZSf9wDxT+BAggUNHkSYUOFChg0dMgQQUSCAgxEp/ruI USPFjBctGrTo8aPHiRsHipR48uPElBkxouRIkKTGlxI7smy5UmdJmjt5tizIMaVKoDWJCu04 NKRANixxghx5kmZPpVF/5nTp9GZNkTKdSr1qcyjOpGVhTs36UO1atm3dvoULMa5XsHPtJkx7 Ny/CvXeZ+gUcWHDbvoMNH0aceGXcxTwTu20MuDDIxE0fX8ZMeGxmzp09fwYdWvRo0qVNn0ad WvVq1v6tXb+GHVv2bNq1bd/GnVv3bt69ff9W2Hfy781rh/OtuPB46+XBgT9fHfOt8KmQXzfH G7Q6csrO62JXnJ2xc/DQzY+fLv583fTdvWt/3xM1dfTx19+XbFQ/UbRcKaN8yr+nkDJLpp0A JMsk/UbKSiegXJqJwJIcbDDApSz0CkKsyqoIqwHzYlA6BSOL0MLFoqKQP/xWdEhEEOlScLuY IJTqJhptZM/GmWIU6r+fYNQRPpJw3Kq6CnGc0EAg+yvSMSZ/hLG/JJssEckYeayRRS1bRCst pbKc0KYrQ3LxJTCx/E5KLDUUU740k9RuxifNotE/Ha36iqwymzQSzCHFyv5RPjIzNGnQIOHk qsctF0WuQS/3ZK/QKNUU08o60VwzzRLfvHLKTPk8E9Ioy1ySz0ul21HJGxGNU9IltVJTSUZn ZdXJUGN11TFSPUX0VEqf1NVNX2sNdk5OM+21TzeRFbZUKH101tatLCW0yDrLo1W3rkisSqzi UPWQyQfBujBBI7sV0c5nz031TSTDJTdEDpWlakcEu0RwUxXNLDYySjfEkN8Ubc22YNkuVQtb gztTeGGHHyYx4eIeno9iiy/GOGONN+a4Y48/BjlkkUcmuWSTT0a5IBpYa/i2lo+rkLCH0p2r ZeUws7nFnOGKOWVDYXuRLfrsgzbSmY9GWGbDCv6j2TqhE8ZZPYJPBvVgpZO7Wa5Jj+Yy6aeX 1rq+w3ZuaOipTS4wQAPzBVTABX3q88KBy5V7rIGPChbczShMW8UD1za2XHIDVjZCgAd8e94O Kw14SLcFR9FERQEPylvJDSebVmtj9bXKSEWN+9ZkrXyVXkh3bTXZQHktdiN7U6d2cGbT3bVp +FyH1vHYdX1d39vpJZT1zBndfNDVR1R9qWllBDbR5ifntPMsUVdX9Tx/HhZTpPh1vlM5CdzT UuWZPlPd758v/V1pG/sSbyIFH7l47vL+kdrljxRd0++yl95TKm8FVZvKJ7/WwclLzDtf+uQ0 tYmhz3+5Qt3mDOikAP7Wzlgp+9X/9CcoAB5rdBvElOmOdzrOdZCBF2ydBemiwtv1LlAsXBb9 +jW43f1qgiIsmv1wJTIJ+mtu9TsRngIopXBNK0RQUZu5zKfEBBnRbt2qFcAkqCm7YQ1f5vJJ Edu3NtrBzXFhyd6C1uW2/Ugxiw3EYH6Mk8aolWZ4ZWOjxcrzxjhaUTR0xAsa67hHPvbRj38E ZFzMEUhCFtKQh0RkIhW5SMXg8Wpja08kiSbJ8LjnbCrhksdsRzJHBlFxl/RL0LJGwcdtzYOW JJYjU/e77bDyZjZ7mR65FspOoW0wOiRlJV1px1Wta2iT2csB28hK8s0SNFVbo2A2qUl4Ef8u X638YC7ZBkXYFWVu6BoVERcHOLo1c3t4Uxu3XifGaWKucs/s5TWhKCEmToqd5JQchu7VrAXG r3wyXFMw8ZlOE8rIhcFzICmXt8spprKVpoImQPGHP+Glj3usQ18vQ+jOiB6weO2CUgLtadD6 6SmhBDzXUUC3PTrVy0XKO57rtojJFsZLgPckIoMW98UlVq9QkAPh9LgYvn7qU6HOY5MFk+Kj 86lyPaSbYbtEGVDkRYt50mJqCf1ktDxlEKZN210VOxq4Dvq0eTr93P5mN79/0AF0KbSqrB5Y Tx5eNXpudeq1IhpW+mVVqsmTGkixetD84dCqIw0hSMG6z2qJTpj+ywKs9fb6KrbysCjnHNVj RRrOvdXosfOkoDUdRNm9wU2ln4QVGKvaFXcd8ZxUipydztgzMVbzmWGi6Vmg6cl5BfUrXvwW DRPKSN4SEjtG7W1whascWaJyuMdFbnKVu1zmNte5z4VudKU7Xb08kpZ3zExxH7PMQGq1udjC oyphZsyvkYa7owFuJtUIUKfxEby3RC95k2ne3VKMjodlbjcf9c6/CYi2kOWi39rGX8kmLoni 6uy9/EW5/TQLngwWZzsTl7YD/RecD1bnNMHpQ2/W63L8IbB2M1bDMOJurmfrX1PrydBc1pKp epVL0GLrYhr3FZefsjEAU3Xjn2qwlmz+5XFiOWlZ9jFWiEQWoKO8KyrdubSLk+UQiaEMvwDn 9nsoVTL03DfCE0PwruDjHEpZJebPpniwQLVsT21JrBYLmWY+TjGqGopUM7EWhCUejrVW1Vja ifXOcZ2rlKOY0oCe1aln7tlQhbzRwAIaxnB2dEd53E9Av3Wgx0p0XUsnQkjfeMVffrGao8lp olZ6zlT9mH6hQioy+xebAS7tpj5t0zJWZdXvzKzi9vtNBdK0id86MuWciE4nw7q18YwpFu/m t9wVkcjJW7By05uanU2bvuWt73ZjY+2SRfs+OeP2MUW8L1CObdziDjd11b1udrfb3e+Gd7zl PW964+fc9cb/dyHTnW9+c2zf/Qb4xe7myYAXHIOP1lI0DL5w+HrUUP9meMS1RdfKSdzimvyz 7C6+cftCGF4Qf4jCOT7yk4mc5CcfmclRvnKPqZzlL8+Yy2E+84fJnOY3z5bNcb7zson33m0x +c/5omXIEH1j6c7zc4C5KDIZ3S623i7Z2sYYp5ubpZB8+qZ5tsMCatuoS0f1amYxnaHesuyN 1EvVJfbQywj92uWOpFf3/fVRbsnWFgZw98YnU4HVVm+PavBmaTtggm+zzrve1quTvCFFGc9y B84O/PTGbBAbhZqym5G3lPw4YCs4yZIKthIL7+q+ffY81CR8xU3c96vn5LZa4XuC/l9/+MRj MvUFpsrhVU972MNes9eb3OMHDEfUdr3PN4ygpDGd8TZzesbN93SokbkbqOue7U9kafV1D2zu uV6tne1+8Hvk+uICCvy9R//UZXV3RbcfanCu20vVV+bCztqvYG59q4P8VPr/DLaf7yviODvN 6zzgM0DbEz++SxRHyb7xQcAHbDrIAyotYz8EdMDJCr8MhDpvWyU8G6CporGisiG0Ypo3i7R7 QqpMy7QA9I3qU7+hy8AY1JPNsj62+77GEz8NdLrzMz8GRL8aPEDvq8Gpw74Y47JRA5bnc5cR TKvZ+qpJOyzAij4W7A0XDD4hyUEZvC2KEALWc8Hduz33/7O8KyStBgRCHXzAMDFDNPzBNtGu 5NuXVqszB/MhzKMeAIwwzmqieDEaJ4rDgSuy6dOWAZStvDOehwqir+jChzO2/HO4spOpw2mw KbNBxzvEutkpEIOJMmwm3gI55OpC+/pE5xrF4wpFh3E7nsO3U1TFVtQSVnTFWDwPIZACWbTF WbzFXKyusKkZ7YBFbVuRBlqO8WKRaivFjuNFqRGbjwq7+RrF9IpC9Toh+dpFxEi6SeotYqy7 ZfSpzBHEFnSPYYQjarSabTSu4AJEZ8u1FQoLXqGyMZNEb5MXclM2ALm87shDVQMw9tE8epSb X7s809oyz7NHznuicak1PBS+g/+UJ27yu8vCOML6qWmcMYT8qDjjuib0QM9BMSccNTMjQS6T wg9sKYhEmEU7lOgrMRKMGaWKqhHLuH/UkFIbSRQLqkVzqEOMKTf8P33KrdHBKY5CsCUbK0Yk GLv6QkHTni7rknCEK8xhtWyDmD+7HyTSqZpkRoSynpZisxPztfkhSjrDJ0sDy6LsEL5SLEdE yfzBSn/KSXz8yK4UOKo8Jah6lsRqScK6tJCEPhCMymyiy77kykY7ta1crKV8oVBLy/37HcHK qEILmY/jm8/5ySvaSZdsx53sQ1brvLOQtZVSqVXrlwKcLc5UwT3MzESsMmFztmGDNTbZsGua RNhES6j/ZMI/OsZl1E2oMY83Ei9TIg5Dyk1KIruXgQ4ONI5UDI7KOipddM7nhM7olM7ppM7q lLjh5M1mRBmpUw3sPCTQdMo8Is7rgqndxC64y7q40xnttCKw26W6TE7lHCXvFDftFET5BBvg VDqG2Tr07L7yck/9zEhyDAz6jC9zuilcyygiHBcNIyP/QjIDSjANexC8Q7bMQz0Ps7wPO7Bg m0dDZEh99Etrgqraaqr1scfWvCthM72GNLBy0hI5S0kPkjWg7Eo4NEvbQSjPUUpx0UuLUrOl Ih1k0lHmQ575Y6gZZS27UsMVzZt/Wr0gZc8qLMzbrNH+Q8HQ6zKNMjKe9DIf/4PMIT0y+wG8 sTQVBbS0oMRQxjlM8bGkrNI//mO+syIznDy9Ki2oCOTInFLKkSzSaGoywzQ1N9vSq7M9krw/ /mHGXHmgwTQ0jLTLQSvJwCzUbwTH0EJM4JEzszRSlXQxXApUwpTIsYpLMKU0SDtCUcVDqoIx TWVLFLSjMH3VKbS3BtwxHFUxZ/ow1MImmezQyeTRYmNNeyk825rDY+M1zipIFE1WTMUsSNwi IYVI3pHMLcTMW3OmYn3NyRvQ5/rNasxOhgM3nrsv/JxEAu23cbXOdWXXdnXXd4XXeJXXVCMr rLMubIwubvNGshvHKQWMFiAercsjK+vD5ZyY5rCz9//sOs0w17Jk2FSco/wU0Plyxt1KWPcS WIdVWIs1R2XsWPhEV/IcT4VYgVjtV2BMT2zj2In1t3jkxxCbVAz1MMkzvPDBQc2ysxT5IVxl NpgdEQ+B0XpNyDB71tVa2C2T0E2tWQv11Rc1MAg9V3rtUxujQTolNBTa1EcFzExtvKudURvt wJeUsOO7v0ObKLqUKPLIsSadtA+yVFH8PFSlP0q9whbTHyRNwiKb0zhNWKQcoDGlwoNCUxMs oHfpr/ZEIRs8LcVcSjGN2+6JSFLlS6eEUyfFWnoarJN81Wzq21n13LiMVT2TVFCLyl9K3GWi VVldzDMDmdRtVb1MzEjVNOT/u1yRJEtTOk3Y1V00ydlUfau7Xb5Ikyv+W8vVNV4vk8qFqdN2 UsgsG83Q3KH4E60qWS1jVU11RDXpxRcTjU0N3Uu9E8jS/FWcNVXSmzw6W14y+kfKyz3Vwll/ ndeTba9tm1/7MJtw7U+E0AVdil/zxN/rqN+8wtcBplj+7N8DRuAEVuAFZuAGdmCWNdnPaNjQ uNgAzi6l00b+9Tf4jeBklOCsu0Zl2tgCLtDwLGHf9GCP7db/1RiMImH5/WBwFVoZ3ld7Bdle XC8VnuG3heEWZhfRm9A/NNahfVHQmk3sJbZvysfOjKfDIbbAA6J7pEMnDtHRY9+CVKfwk60l 3rwV/wJaFT1TxmktFw5GjJRbNmPMXCVS3K2otPxd48PcOXPhPYVDl0TfTtWt0JGhioSrGtNj rhUYkQTSGLK7m2Rcz4xG/9vjnlzcHOkvTwtKUKsePlZkgv20/1mg5Y1GRsbAEiop6gXcScVW UUMzWIVHNk3e48SVqRXdnCI1DkLc31VaO0WrwKRkYtozyQU9ppxcgordp/rKOxZKiYKhPx5V EZwVfSleUWVKvD3jKUK4wg1eZLlloZyhrdQmJJzcYVHaxt0qZnFlT95c76HcJfRPVU5Nl+LK vWtkIs6izGzEIaZNI4K8TjRfejJay2QsdXZUD2VAP9xHdSatd/ZePmTRUf+GZ+/zrNKUPy96 4BnORQOtTuSURYl+6IvG6IzW6I3uGC3g6I9W19yY4HAFDyH8aNugHg8uaRaWGfwy4HNeYZg+ ac/g4YK1YRyGYIlN5aOd6e6UtH7U1Zfl3gQtvWWb4j+ZZ4vs0AXlXvtrYjA2SIuW12Dd3TYN 22XWIDtGSx8lKzq+IBxloa6toZ4WYWSu1PBsWqxOzL/7sXBWX9DbOyIc3drR5MAlaxDe5are 6tIF3VpeK9ZtwuXjUgT65mMW5bO9a/JUwrY07L62Uo1rrMCG47tMwugdZ6wk48RWz9wDaFfr 0laVPMz6Fzc8Sdx7UD0bavBE1oPm3YXWbM0xmH//k+rXbruRdhnOoGja1u3d5u3e9u3fBu7g Fu7hsm0BVFya9sZyzd/eNNDi9irxlGCjbME5cr+GhdgSnBnlrljmWG6ebjudnthS1L5s4T7r bhg9GjfnjliZpg1h+sROgmgOXpr2K73Y5BslTlbBU2gfXLD73j7E871bGz8hxsHT2kSrfBsI 7NVmHViDbGeC5maEtIrJ3McqSmopvtAX3NkKjzJxekgXzW2h8TvWUys2JD+FDnDrA78C+73e Oz/eq0QK+8EzPMDrMxwdrD0B61dW9ktH27FDFtwTlFO8TdP3JFszpiLv5lcDNGlEFMMTN9Qh LHBVCSYf/G8wzMIbPMuD/6xyRyxxKWfDGn+POwlLLCPnAx9AIC9ThwvA/vnxsWTW/4S+9OWR d6Q6tdRJJ09DKLdWBh1b0a41BcdyLRRz6Y7aGufBCwTzIjxuR13UM4d0OZ1DHg9bUxPMN/+q 5nNWs31ds8Nz6Gbygc5BPu877ovyNbxyLR9vGST1B/VyG/dCMQTCVY9lVc1mj8z0L7VdIdHr GCLyXtZ0Qe3rYn46QpRzQ63AWN/zLD9YcMHCUIf1NlzzDYSeF0T0f85xBVQ/Wt9yfo61upxn ynNo1v52zaTWxrFb156w1b4wz3L34mb1QtzWqk08/fLzqrJVw/sQGrfEUx/DTFQtfL+cMrXE 8f+D1nsfboaJpYQn14Vn+IeH+IiX+Imn+Ip31/sirvgGmkHc+PgIrx5ez2MiYPlmGZJPYZve 6ZEF0LZuuJTFzgq+2qF7Q8hlrwvLWLFZKl43LN6oaXTdZGukYZE2+Qv2ePVKuqVzaRMW2Zxn RxBMeZYB6nOl8NP2pqjnsOadEhVF3MiRkBDrYoLz2WH9kKwF8SD+2X/SXvUd9xTqVdGE3qP8 YrLHMObkUKXnM+rDY8cWZjUPq2mN0sMGMl32yR5LKSa143F6Uth13bVFrKEkIbc3/BJF/LKt 9b9/ep9+UqFW65/HP4mkc0Xe+szV+8X9EhJ73QSq00hWIRlFMrCOosH+y3TsUdvVZeuSSlW5 y5Ckrw3HpDjX5/xHx2yKC313JOVE1eVNl59Lzt7NZf253ue8jFTCLU9SNuuUDnbcZ93ZDhtK t/Xf7zTqR1TF/2NcxWSxVWvInFO6leS93t3ZbRTGh1Iw7aHBPFFCbm/ThHxhZV9V8Xb79sz1 AwgAAP79G0iw4MGDAgUSZDjwYcGFCA0ijMgwoUSLDy9CbNjwokKQGSlG9GhSY8WPJFGmtIhR oUqDGVnGfJmwpUyREle6rAiS5kiMMmHWJDmzZkmWPCkuHGqS6c2oUqdSrWr1KtasWrdybdm1 Ks+vWMOKLWt27Nm0NtWybeuWKtmpUN/SrWv+t2xcs3nZHr3rF+1frXsDE/Y7+OThwooXM27s +DHkyJInU65s+TLmzJo3c+7s+TPo0KJHky5t+jTq1KpXs46c+CTf160ny75a+/Ibx7dno867 smNask1TMtX5EylYtX1h4yXK1ehxwR+d/xw+XOjN5VGtU6+uHTvzrbt5l5Y9Xq7U30Tnzg2f XDn64GfVi83Z3Tli8PnhZl/vP6tIzZE32nI7wXSdSzk5pJJHwP3GUXXp+dRfe16x5xCECibV 03ojZdggUB9qGKJTHRoX30RPqbjWhC3+h9+BzAFnW4tB1RjggKQZtZaDOBFnYVIVQrWUhCWC KCNHMVKn5FDC5df+3kb7KZnikUDSN6RVWNYYkpFOGemiex1dGd12E2rZZJk5gobghlpO5KaY Bk75ZJp1qsdmf1TiqJGYDYZVooPc7ScolYUqOKOLiNp55JeFbgmkhJFCit9RaDYFEaYbuqcm ZhVOB2dIhoq6I32ObuqpomnOuKCMK2qa6I88TtkjqG66mqqsKV5650u7Tprnoix6paqpmRYH I6eZeVpljzFiaeuw0IaZ62DLNqsnbFfOui2zP9Y6J6ylSslqq+zZBGWdLFqbZajmtupqsp1W atxGH/okJ6FhJpneTA8uixxxOjG4ZV9y3jswukrFCWhRQjVr47nt9urhngHvuF2/2dH+S+N0 HF6YcLwh18fZeSI/t1jJl6Vscsgr3+UyyxwXRiaBMdt8M84567wzzz37/DPQQQs9NNFFG300 0kl3BnNXiNKsNH/IuvUnsC/v/A7UcuUr3XiZSo2iZMUxPbWwbaUqbrpgF5x10f8CqJePb9PG sFuHyPf1WQNMW7Z4IA/Lts9ii40xpvb+Z6zDA/dksNcF7nsvmr1KiRTFbZ6YOInQXY75x4xm 6OVx9VI9+YgIEjqiwoMDruySQkpOuopej0th63TT2W3ot+bKJO7sgtr619eCyOvwlMa6+8Xb /q48uKurXPu8s7KJuOwWf358oJX6d6iilx4fq6BNWvcn49/+D4nnddk3Xr7opCLr96Hecns6 n686Xxm6vsnuJPVxT3qt8KgFpr/pDniMqpJ+5NctAwarT8X7Fv/etyTm9a6CpurY/fDHQKoB EFiWQp4CQ+i62SEwTyMcVeyMt0HzcYuE8qOVs4y3Lth9y4IwzNamMoiyCRZsX4bjoaM0xyX7 oESIGkve4qLGoSE27EaoY+LHNKc6hwnJQPFLn+IWyKUtnqt8qYtf6hQ3Nh2CJhU9GyMZ0yaz NLJRNd9po16eRjg40rGOdrwjHvOoxz3ysY9+/CMgAynIQRKykIY8JCITqchF/vEDjHwkJCMp yUlSspKWvCQmM6nJTXKyk578JCj+QynKUZKylKY8JSpTqcpVsrKVrnwlLGMpy1nSspa2vCUu c6nLXfKyl778JTCDKcxhErOYxjwmMpOpzGUys5nOfCY0kQaNaFKzmta8JjazaZVoOO8Q3rTb P74pzoSAkyDlNOdNxPnNcKYznOe0mzrhOc6oqPMg83SnN6WST3uW857+rCc55/nPe7LTnuTE pzsPas51pvOd+FynQw36UIkOkpuAiyg624nRc7aToujc50fpqdCRehSc/aTnO02q0JMWdCoO ZSlHDcrSlpo0ohhd6EFjelN4rtSQFs1aTD0aUooGNaNGDelJddpRoSp1pjJFqkhhWpWXSrSo PM2oTWn+2lKXajWoKlXpVoUqyJ8qrahhZSdHr8pVpqL1qUs9alibKtar8lSuWJ1qTqvK1aR2 VK1q3atb+1pQsL6VkGRNGkHjyla8shWs8hxnWhsK0agyVKNQ1Whl4ynZfQ6UoTBV6mCHitCe ohWgXzWqPxN5WKjdVKsk1edr/drWwkb2tbP1Kk5nm1fXrnWoTiWqaO962cW2Fbd8FelZtXmX 1gJUrG+NLF9BS1y46ha0nD2rbJNbUtd6VaBHJWxdaftUq/bTqtRVblt2Glvbile4OJUudpHr Xvi6N7T1lW91qQtd4G71utPNp3lH2lr01iWxzGWvbTMb0IcCOLHnTe10Uav/YJk2d6GezWk9 90vhv4K0wv197IRLGmICk7jEJj4xilOs4hWzuMUufjGMY1xNz1aWnxnGLGQz62HnxrXBC4ao ZgPaXAcr1sJOZS5BUwpSIUMWx0bWJ42HXOOJDniiImZvkms85VkSVrsHlm6XAYtfrKYUrmY1 c4IFq9ftYpm3Zj2wfdHM5jnXNrnG5Wea1zzfW4a5t4oF83ktO+bQnrbIVBlwnYMrXLoOOr+B 7q+az/zmNFsXtrA9rqHzzONX9tnSaAa0dndbWEL7dtTPHbOGSctoU2c31HDu9KYRHd8ARzWw iZ6rqWFZ3iU/V7O+1rGDfxvf28b50d9Fta+RW2id/nqXzLzutWlt3F1ey5rZh/a0Y+WMUDCf 2ZW49fSflb1p1A7asdlG8Jwj/Ne7YhrXi2asnL/t52rXGtz8bXe41WyXMVxS3qcW9b2tsuNK J7TYoT52ewNL1PLam8Hknre+0Q1pXBOc1c3W7afFncsu0zrfAjb2rSuuZ2Nnmr4cXy+qBe1q lJ+cpHB+OH8THtxnZ3XcXObsltNd2iZveMohz/G6dy5x7Oa8zgZmtXirPPENPxml1HZ6Wifr XJ4r/NkObzrJZaz1rXO9617/OtjDLvaxk73sZj8lkD2sXqnbvLN47nnaC65oEFP7xnB/MLA7 7OOFW93Kcu+x3eFeU5xv//nVL751us89bvjW1OV9pSrAG614jCN8o7mtL+Mv7+X1Zn7tH886 gRGvV/Bqu9y1PrJg8R30Nhd73XZds2y7LVdhI1zh+l0qh2POYtGz++G8H3ZeUd9T1R+cvNtF vOt7r2jTt/rftgc+uVN98BL/ftkjX/moV214UmPYwFI+fvaLfG6/Pl3QsP6yaS9M2kxPn8TV 7+r1Jx3+dtc2uipv+OWjTelIj1fmol390i3f/cVZyB1eruVfzcUa81WdvoVX5CGdwbEf5Sme A0ZYfnWc9F3a4/ncAZrY75Vc6ZneyC1Z/S0Yd8Gbqokg5o1gyzneh/nZCZ5aAtZejGkZCtJU g/+lndW53XftFICZ4GgxWNRRHeVdnd9JGYft2g6OWN8xmxIS3uB1mPOB3tlVoRVeIRZmoRZu IRd2oRd+IRiGoVgY3YiBIAlKW+JNYfKJmNoFmd8x2RAqnRiexkzNoKE13gjSYKJBHnDRV8q5 G8zx1hyuhlQNYAn+37BZn7hNHvx1YACGYNDB2iCaRvPN3f3FnsatWurdF75Nn6xxnsZNImvQ W2wdYiQq37dpX5D9luxpWsZFnCimBik21sed4gVqYKmt3wc+IvvZYrfFYmjMYrz1IfDp3aEx XLwdHQqa3ABGIDCWxh7qnu+ZoHqhm9EZ4tBFo/PJ4TNCI9RJFrglIRpGopy9sSII3uAbSlsc Dl03tqM7viM8xqM8zmPOsILZJQM95qM+7iM/9qM//iNABqRADiRBFqRBHiRCJqRCLiRDNqRD OmRAAAAh+QQAFAAAACwAAAAA7AFIAgcI/gD/CRxIsKDBgwgTKlzIsKHDhxAjSpxIsaLFixgz atzIsaPHjyBDihxJsqTJkyhTqlzJsqXLlzBjypxJs6bNmzhz6tzJs6fPn0CDCh1KtKjRo0iT TlSjtKnTp1CjSk0JbKrVq1izat3KtavXr2DDih1LtqzZs2jTql3Ltq1VSG7jyp1Lt67du3jz 6t3Lt6/fv4ADCx5MuLDhw4gTK17MuLHjx5AjS55MubLly5gza97MubPnz6BDix5NurTp06hT q17NurXrn5hey57tkgbt27hz697Nu7fv38CDCx9OvLjx48iTK1/OvLnz59CjS7fJbLr169iz a9/Ovbv37+DD/osfTz4mk/Lo06tfz769+/fw48sHzUF2g/lf69vH71X/0Xpl3ccfV/65JuCA CGZ0YIIMUtTAgg1GKOGEFFZo4YUYZqjhhhx26OGHIIYo4ogklmjiiSimqOKKLLbo4oswxijj jDTWaOONOOao44489ujjj0AyZluQRBZp5JFIJqnkkkw26eSTUEYp5ZRUVmnllVhmqWWGOGz5 W5de9gZmmGSWuSE0Zqap5ppstunmm3DGKeecdNZp55145klmGXr26eefgAYq6KCEFmpoUhMc ulmiimY2AaONRirppJRWaumlluKD6aaclqZIp6CGKuqopJZq6qmopqpqTOes6uqr/7DGKuus tNZq662gWeARG7j26uuvwAYr7LDEFmvsscgmq+yyzDablxfORivttNRWa+212Gar7bbcduvt t+CGK+645JZr7rmAvYKuUequ6+678XECb6U9zGvvvfjmq+++/Pbr778AByzwwASjFEvBCCec agkKN+zwwxBHLPHEFFds8cUYZ6zxxhx37PHHIIcs8sgkl2zyySinrPLKLLfs8sswxyzzzDTX bPPNOOes88489+zzz1GKAPTQRBdt9NFIJ6300kw37fTTUEeZStRUV2311VhnrfXWXHftNcWi fC322GSXbfbZaKetcjdqz/RG23DHLffcdNdt991456333v589+3334AHLvjghBdu+OGIJ763 NXndUKs1jCsu+eSUV2755ZhnrvnmnHfu+ecOpZOz6DiTfrPpoKeu+p1Cr+7667DHLvvsIedC ++24w/l27ryvPmTvwAcv/PDEF2/88cgnr/zyzDfv/PPQRy99lbpOb/31fdoydDE5c4+z99iH L/745I99QPnop6/++uy37/778Mcvv/I/zG///fjnL+IG+vfv//8ADKAAByifdhDwgAhMoAIX yMAGOvCBEAzPOiJIwQpa8IIYzKAGLRKbnHXQgzv7IM5EeDMS2syEWanEtFBIMxbOzIUbjKEM Z0jDGtrwhjjMoQ53yMMe+lBv42IoFj0GF4MfGvGISEyiEpfIxCY6MW82eKIUp0hF7mihiljM oha3yMUuevGLYAwj4U4hxjKa8YxoTCN3EKHGNEqijXCMoxznSMc62pGOerijHvfIx94UqI+A DGQDB6AzQrolIAA7 ——=_NextPart_000_0007_01C6CB38.97556140–
Never, ever, ever, (did I mention ever?) open any emails where you do not recognize the sender - delete every single one without a second thought.
When you open an email, not only is there a risk of infecting your PC, you may also be confirming to an individual that this particular account is active and therefore will receive more spam.
There is a way of linking images to the email that enables an individual to know that you have opened it.
Unsubscribe links are another way of telling a spammer that you have read the spam. You just invite the sender to send you more - they don't play fair as there isn't a profit in it!
Anyone who is known to open spam is more of a target than someone who deletes them instantly.

Create a brand new email account with Yahoo and only give your email address to people you trust. Any emails they send can be opened, ALL others get deleted straight away - DO NOT OPEN THEM!
Do not post this new email address on any internet sites or us it to register at any sites where you cannot be absolutely certain that it is totally legitimate.
If you do this, you not only help keep your PC clean, you also reduce the chance of getting any spam at all.
If you must supply an email address to someone that you can't be 100% sure about, open another Yahoo account and keep this for only this type of situation. If an email account is going to get spammed, it should be this one and not your main one. If the spam gets too bad, you can just forget about it and open another account for the same purpose - no-one you care about has this address so you don't have to notify anyone about the change.

Let me have a fresh HJT log so that I can check that things are still OK. Then open the new email account, contact everyone who you want to have the new address and then stop using the old one for anything else.
Sir,

I have fully followed your valuable advice/instructions -in fact these are invaluable for me, and appending the latest HJT for you further scrutiny and advice.
However, I have not yet disabled my system restore and logged into dafe mose for scanning as after the scan only by hjt when I rebooted , I got the windows message: cpp.application " an application failed to start because MSCVP70.dll was not found .reinstalling the application may fix…..". However , my PC is running better-so I think it is a bit faster.
I downloaded the missing dll file from net and copied it in system 32 directory but the message is still coming on every reboot. Will I have to reinstall xp?or is there a way out!and by the way which application it is referring to?
Further I have uninstalled all duplicate softawres and anti virus/ anti spywares etc. I am now using only AVG and ZA.
As ZA was giving too much messages about blocking of port 445 and was referring to the service provider airtelbroadband.in every 30 seconds I clicked not to show offf the message again.Was it a ok step?any way my PC is running nice and the only irritant is M…dll.
I hope you will be kind enough to guide me further

with regards
vkwd7

Logfile of HijackThis v1.99.1
Scan saved at 4:54:05 PM, on 8/30/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Common Files\InterVideo\FastTVSync\FastTVSync.exe
C:\Program Files\Conexant\AccessRunner ADSL\CnxDslTb.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\0Spam.com Express\Express.exe
C:\WINDOWS\PowerS.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\InterVideo\WinDVD4PR\SchSvr.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Prolink\PlayTV Pro\TVRMVCR.EXE
C:\Program Files\Prolink\PlayTV Pro\TVSCHL.EXE
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Hijachthis\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program

Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program

Files\Java\jre1.5.0_08\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program

Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program

files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [FastTVSync] "C:\Program Files\Common

Files\InterVideo\FastTVSync\FastTVSync.exe"
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\Conexant\AccessRunner ADSL\CnxDslTb.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP

Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [0Spam.com Express] C:\Program Files\0Spam.com Express\Express.exe /silent
O4 - HKLM\..\Run: [PowerS] C:\WINDOWS\PowerS.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software

Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop

Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe

-autorun
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Elephant Desktop] F:\ElephantDrive\ElephantDesktop.exe
O4 - HKCU\..\RunServices: [0Spam.com Express] C:\Program Files\0Spam.com Express\Express.exe

/silent
O4 - Global Startup: InterVideo Scheduler server.lnk = C:\Program

Files\InterVideo\WinDVD4PR\SchSvr.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program

Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsofr

Office\Office10\OSA.EXE
O4 - Global Startup: Remote Controller.lnk = C:\Program Files\Prolink\PlayTV Pro\TVRMVCR.EXE
O4 - Global Startup: Scheduler.lnk = C:\Program Files\Prolink\PlayTV Pro\TVSCHL.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat

7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program

Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common

Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Google Search - res://C:\Program

Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program

Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program

Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program

Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program

Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program

Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} -

C:\PROGRA~1\YAHOO!\COMMON\yhexbmesin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} -

C:\PROGRA~1\YAHOO!\COMMON\yhexbmesin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'pop3intercept_lsp.dll' missing
O16 - DPF: {8CF97DE6-EB52-42A8-8076-FB75B528E0A0} (Project1.PaceControl) -

https://www.5paisa.com/lstControl.ocx
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe

Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. -

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. -

C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program

Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program

Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program

Files\iPod\bin\iPodService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC -

C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe

__________________________________________________________________________________________
Your HJT is very hard to read because of the spaces between some of the lines. In order to correct this, you will need to do the following:

Open Notepad: Start > All Programs > Accessories > Notepad.
Click on Format and ensure that Wordwrap is unchecked. If it isn't, uncheck it.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I clicked not to show offf the message again.Was it a ok step?

I've done similar when the messages have got on my nerves.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Will I have to reinstall xp?or is there a way out!and by the way which application it is referring to?

Don't think so, hope so, don't know.

Try the following and see if this solves the problem:

Go to Start > Run, enter sfc /scannow ( note the space between the "c" and "/" ) and click on OK.

This will look for and attempt to replace any corrupt system files that can be found. There are backups of some of these files on your PC and Windows will check for a copy here first. If you are prompted to insert your Windows XP disc, do so. If you don't have this disc and are asked for it, you will have to cancel at this point.

For details on the System File Checker, click here.

Let me know how you get on and post a fresh HJT log - hopefully without the spaces. :)
Respected sir,
as i was out of station, I could not send the hjt logfile earlier . I am enclosing the same with word wrap not on.
Incidentally it seems to me that the pop up about mscvr70.dll that i told earlier is due to some inadvertant removal of some file by me while tiding up i.e fixing in the hjt. I ran scf /scannow as advised by you and put the windows disc in the drive when asked. all the files were checked /copied and no message appeared and I restarted the windows but the message still is popping up.
Is there some way?
with regards

vkwd7
Logfile of HijackThis v1.99.1
Scan saved at 12:06:01 AM, on 9/7/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Common Files\InterVideo\FastTVSync\FastTVSync.exe
C:\Program Files\Conexant\AccessRunner ADSL\CnxDslTb.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\0Spam.com Express\Express.exe
C:\WINDOWS\PowerS.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\InterVideo\WinDVD4PR\SchSvr.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Prolink\PlayTV Pro\TVRMVCR.EXE
C:\Program Files\Prolink\PlayTV Pro\TVSCHL.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe
C:\Program Files\Hijachthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.co.in/0SEENIN/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.co.in/0SEENIN/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.in/0SEENIN/SAOS01?FORM=TOOLBR
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [FastTVSync] "C:\Program Files\Common Files\InterVideo\FastTVSync\FastTVSync.exe"
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\Conexant\AccessRunner ADSL\CnxDslTb.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [0Spam.com Express] C:\Program Files\0Spam.com Express\Express.exe /silent
O4 - HKLM\..\Run: [PowerS] C:\WINDOWS\PowerS.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Elephant Desktop] F:\ElephantDrive\ElephantDesktop.exe
O4 - HKCU\..\RunServices: [0Spam.com Express] C:\Program Files\0Spam.com Express\Express.exe /silent
O4 - Global Startup: InterVideo Scheduler server.lnk = C:\Program Files\InterVideo\WinDVD4PR\SchSvr.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsofr Office\Office10\OSA.EXE
O4 - Global Startup: Remote Controller.lnk = C:\Program Files\Prolink\PlayTV Pro\TVRMVCR.EXE
O4 - Global Startup: Scheduler.lnk = C:\Program Files\Prolink\PlayTV Pro\TVSCHL.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-in\msntabres.dll.mui/229?ffb02e71a54049eb8f505fe68d6d14b6
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-in\msntabres.dll.mui/230?ffb02e71a54049eb8f505fe68d6d14b6
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\YAHOO!\COMMON\yhexbmesin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'pop3intercept_lsp.dll' missing
O16 - DPF: {8CF97DE6-EB52-42A8-8076-FB75B528E0A0} (Project1.PaceControl) - https://www.5paisa.com/lstControl.ocx
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
Important: You have used different names for the problem file in your last two posts: mscvr70.dll and MSCVP70.dll.
Make sure that you use the correct filename in the step below:

Go to Start > Run, copy and paste the following into the text box and click OK:

regsvr32 C:\windows\system32\mscvp70.dll

Let me know if this solves the issue.
when i run"c:\…\…\msvcr70.dll i get the message:Loadlibrary"C:\…\…\msvcr70"failed.the specified module could not be found. As the correct name of the file is msvcr70, i downloaded this from the net and again copied in the system32 directory.on reboot the earlier message disappeared and the following message was flashed. "the procedure entry point__job__func could not located in the dlllink library mscvr70..dll" I suppose I am bothering your good self too much! in case I restore the back up in the hjt and then do the tidying up as suggested by you earlier, will it be an ok experiment. thanks vkwd7
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI