well, i had some malware on my comp, but i got most of it removed following one of the guides on here…but still, once in a while, i'll get a pop-up that symantec cleaned something. so i am guessing something is still on here somewhere…if someone could take a look, that would be great! Thanks. Grendelin Logfile of HijackThis v1.99.1 Scan saved at 17:00:03, on 11/27/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE D:\My Documents\Exe's\HijackThis.exe O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Program Files\DAP\DAPIEBar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Dell Photo AIO Printer 922] "C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe" O4 - HKLM\..\Run: [DLBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDLLEntry@16 O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol 120\StarWind\StarWindService.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe Active scan: Incident Status Location Adware:Adware/WebSearch Not disinfected C:\WINDOWS\system32\ehblwxfe.dll Adware:adware/powerstrip Not disinfected Windows Registry Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Grendelin\Cookies\grendelin@2o7[1].txt Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Grendelin\Cookies\grendelin@atdmt[1].txt Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Grendelin\Cookies\grendelin@atwola[1].txt Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Grendelin\Cookies\grendelin@doubleclick[1].txt Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Grendelin\Cookies\grendelin@mediaplex[1].txt Spyware:Cookie/Reliablestats Not disinfected C:\Documents and Settings\Grendelin\Cookies\[removed][1].txt Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Grendelin\Cookies\grendelin@xiti[1].txt ran vundofix again, and if found more stuff, here is what the log said: VundoFix V6.2.13 Checking Java version… Java version is 1.5.0.4 Java version is 1.5.0.6 Scan started at 19:02:15 11/27/2006 Listing files found while scanning…. C:\WINDOWS\system32\ddaby.dll C:\WINDOWS\system32\ybadd.ini C:\WINDOWS\system32\ybadd.bak2 C:\WINDOWS\system32\ybadd.ini2 C:\WINDOWS\system32\ddaby.dll C:\WINDOWS\system32\ybadd.ini C:\WINDOWS\system32\ybadd.bak2 C:\WINDOWS\system32\ybadd.ini2 C:\WINDOWS\system32\ybadd.ini C:\WINDOWS\system32\ybadd.bak2 C:\WINDOWS\system32\ybadd.ini2 Beginning removal… Attempting to delete C:\WINDOWS\system32\ddaby.dll C:\WINDOWS\system32\ddaby.dll Could not be deleted. Attempting to delete C:\WINDOWS\system32\ybadd.ini C:\WINDOWS\system32\ybadd.ini Has been deleted! Attempting to delete C:\WINDOWS\system32\ybadd.bak2 C:\WINDOWS\system32\ybadd.bak2 Has been deleted! Attempting to delete C:\WINDOWS\system32\ybadd.ini2 C:\WINDOWS\system32\ybadd.ini2 Has been deleted! Attempting to delete C:\WINDOWS\system32\ddaby.dll C:\WINDOWS\system32\ddaby.dll Could not be deleted. Performing Repairs to the registry. Done! Beginning removal… Attempting to delete C:\WINDOWS\system32\ddaby.dll C:\WINDOWS\system32\ddaby.dll Has been deleted! Performing Repairs to the registry. Done!