phvpkbiz.exe, zmxsfmv.exe
Page 1 of 2 12 LastLast
Results 1 to 10 of 11

Thread: phvpkbiz.exe, zmxsfmv.exe

  1. #1
    Junior Member
    Join Date
    Oct 2002
    Posts
    6

    phvpkbiz.exe, zmxsfmv.exe

    Hey all,

    These two executables are supposedly on my computer:

    C:\WINDOWS\zmxsfmv.exe
    C:\WINDOWS\SYSTEM\phvpkbiz.exe

    However, when I go to their respective folders to delete them, the files aren't there. They are viruses of some sort that are *****ing over my internet and I can't get rid of them. I have already checked the option to show hidden files (still no sign of them), have searched for them using "Find...", have removed them from "Startup" by way of msconfig, and have checked the registry with no luck. They are still running around generating these two files:

    image.dll
    hp.uti --> which sets my IE startup page to "here4search.com" or something.

    Thanks for the help....


    - Cat

  2. #2
    Senior Member
    Join Date
    Oct 2002
    Posts
    4,055
    Definitely sound's like a form of adware/spyware or a virus (or both?). Run your favorite A/V scanner (w/ updated definition's) and scan and download Lavasoft's Ad-Aware and run a scan. Then delete the file's that come up.

    EDIT: Ahh, except for the cookies you want
    Space For Rent.. =]

  3. #3
    Junior Member
    Join Date
    Oct 2002
    Posts
    6
    Hmmmm.....aight, I'll give that a shot. Just got a new copy of Norton. Let's see how she works *grin* Thanks!

  4. #4
    Senior Member
    Join Date
    Oct 2002
    Posts
    4,055
    No problem, just make sure to constantly update your virus definition's and check if LiveUpdate has any update's for Norton every now and then.
    Space For Rent.. =]

  5. #5
    Regal Making Handler
    Join Date
    Jun 2002
    Posts
    1,668
    Nasty browser hijack, you have there::


    File names: Msiesh.dll; iefeatsl.dll; image.dll; Mshp.dll


    iefeatsl.dll
    When iefeatsl.dll is initialized, it registers itself as a Browser Helper Object by creating and populating the following keys:

    HKEY_CLASSES_ROOT\CLSID\{587DBF2D-9145-4C9E-92C2-1F953DA73773}
    HKEY_CLASSES_ROOT\iefeatsl.ViewSource
    HKEY_CLASSES_ROOT\iefeatsl.ViewSource.1


    Once this occurs, when you open Internet Explorer, the iefeats.dll Browser Helper Object does the following:


    Creates and populates the registry key:

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IEFeatSL\


    Adds the value:

    "Updater"= "rundll32 [Path to iefeatsl.dll]\1.new,UpdateDll fs"

    to the registry key:

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce


    Sets the Internet Explorer home page to res:/ /mshp.dll/index.html, and then displays a search engine page when the browser is opened.


    Downloads the following files:
    <Current folder>\update.txt. This is a configuration file.
    <Current folder>\iefeatsl.dll. Detected as Adware.Iefeats
    <Current folder>\msiesh.dll. Detected as Adware.Winshow.
    <Current folder>\dict.dat. This is a configuration file.
    <Current folder>\keywords.dat. This is a configuration file.
    %Windir%\mshp.dll. Detected as Adware.Iefeats.
    <Current folder>\image.dll. Detected as Adware.Iefeats


    image.dll
    When image.dll is initialized, it does the following:

    Registers itself as a Browser Helper Object by creating and populating the following keys:

    HKEY_CLASSES_ROOT\CLSID\{0B40A54D-BEC3-4077-9A33-701BD6ACDEB2}
    HKEY_CLASSES_ROOT\Image.Image
    HKEY_CLASSES_ROOT\Image.Image.1


    Adds the value:

    "Image"= "rundll32 <Current folder>\image.dll,UpdateDll fs"

    to the registry key:

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run


    Adds the value:

    "Image"= "rundll32 <Current folder>\image.dll,UpdateDll fs"

    to the registry key:

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices


    Once this occurs, when you open Internet Explorer, the image.dll Browser Helper Object does the following:

    Creates and populates the key:

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IEFeatSL\


    Sets the start page to res:/ /mshp.dll/index.html, and then displays a search engine page when the browser is opened


    Downloads the following files:
    <Current folder>\update.txt: This is a configuration file.
    <Current folder>\iefeatsl.dll: Detected as Adware.Iefeats.
    <Current folder>\msiesh.dll: Detected as Adware.Winshow.
    <Current folder>\dict.dat: This is a configuration file.
    <Current folder>\keywords.dat: This is a configuration file.
    %Windir%\mshp.dll: Detected as Adware.Iefeats.
    <Current folder>\image.dll: Detected as Adware.Iefeats
    <Current folder>\mssearch.dll: Not available at the time that this was written.




    The following instructions pertain to all Symantec antivirus products that support Expanded Threat detection.


    Update the definitions.
    Close all the open Web browser windows.
    Run a full system scan and delete all the files detected as Adware.Iefeats or Adware.Winshow.
    Delete the values that were added to the registry.

    For specific details on each of these steps, read the following instructions.

    1. Updating the definitions
    To obtain the most recent definitions, start your Symantec program and run LiveUpdate.

    2. Closing all open browser windows
    Since Adware.Iefeats functions as a Microsoft Internet Explorer plugin, you need to close all the open browser windows to remove it. If you are reading this writeup in Internet Explorer, print this writeup using our printer-friendly option at the top of the page, or write down the following instructions, and then close all the open browser windows.

    3. Scanning for and deleting the files
    Start your Symantec antivirus program, and then run a full system scan.
    If any files are detected as Adware.Iefeats or Adware.Winshow, click Delete.


    --------------------------------------------------------------------------------
    Note: If your Symantec antivirus product reports that it cannot delete a detected file, write down the path and file name. Then use Windows Explorer to locate and delete the file.
    --------------------------------------------------------------------------------


    4. Deleting the values from the registry

    --------------------------------------------------------------------------------
    WARNING: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.
    --------------------------------------------------------------------------------

    Click Start, and then click Run. (The Run dialog box appears.)
    Type regedit

    Then click OK. (The Registry Editor opens.)


    Navigate to the key:

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce


    In the right pane, delete the value:

    "Updater"= "rundll32 [Path to iefeatsl.dll]\1.new,UpdateDll fs"


    Navigate to the key:

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run


    In the right pane, delete the value:

    "Image"= "rundll32 <Current folder>\image.dll,UpdateDll fs"


    Navigate to the key:

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices


    In the right pane, delete the value:

    "Image"= "rundll32 <Current folder>\image.dll,UpdateDll fs"

    Exit the Registry Editor.

    I think that this will not solve your problem completly so download Hijack This, i cant get to the link at the moment so google for it.

    Then Run it and post the log it creates.
    What happens if a big asteroid hits the Earth? Judging from realistic simulations involving a sledge hammer and a common laboratory frog, we can assume it will be pretty bad. - Dave Barry

  6. #6

  7. #7
    Junior Member
    Join Date
    Oct 2002
    Posts
    6
    Thanks guys!
    - Cat

  8. #8
    Junior Member
    Join Date
    Oct 2002
    Posts
    6
    Me again,

    Here's the log it created:

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://solongas.com/sp.htm?id=9
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://solongas.com/sp.htm?id=9
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://solongas.com/sp.htm?id=9
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://solongas.com/hp.htm?id=9
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/ext/hp/search.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\system32\blank.htm
    R3 - Default URLSearchHook is missing
    N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.weather.com/weather/local/05663?lswe=05663&lwsa=WeatherLocalUndeclared"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\i5w5i5ux.slt\prefs.js)
    N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\i5w5i5ux.slt\prefs.js)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar.dll (file missing)
    O2 - BHO: (no name) - {A9A674BF-771F-42E5-A440-D20DDA85A862} - C:\WINDOWS\SYSTEM\2OM82ADH6FYXD.DLL
    O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\WINDOWS\SYSTEM\YCOMP5_0_2_5.DLL
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll (file missing)
    O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\PROGRAM FILES\ISTBAR\ISTBAR.DLL (file missing)
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [AVGCtrl] C:\PROGRA~1\AVPERS~1\AVGCTRL.EXE /min
    O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
    O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
    O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [NAV CfgWiz] c:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
    O4 - HKLM\..\Run: [Advanced Tools Check] c:\PROGRA~1\NORTON~1\ADVTOOLS\ADVCHK.EXE
    O4 - HKLM\..\Run: [NPROTECT] C:\PROGRA~1\NORTON~1\ADVTOOLS\NPROTECT.EXE
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [Hidserv] Hidserv.exe run
    O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
    O4 - HKLM\..\RunServices: [ccEvtMgr] "c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
    O4 - HKLM\..\RunServices: [ccSetMgr] "c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
    O4 - HKLM\..\RunServices: [NPROTECT] C:\PROGRA~1\NORTON~1\ADVTOOLS\NPROTECT.EXE
    O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
    O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape\Netscp.exe" -turbo
    O4 - Startup: Iomega Disk Icons.lnk = C:\Program Files\Iomega\Tools\IMGICON.EXE
    O4 - Startup: Iomega Startup Options.lnk = C:\Program Files\Iomega\Tools\IMGSTART.EXE
    O4 - Startup: Refresh.lnk = C:\Program Files\Iomega\Tools\REFRESH.EXE
    O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Startup: Iomega Watch.lnk = C:\Program Files\Iomega\Tools\IOWATCH.EXE
    O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR.DLL/cmsearch.html
    O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR.DLL/cmcache.html
    O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR.DLL/cmsimilar.html
    O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR.DLL/cmbacklinks.html
    O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR.DLL/cmtrans.html
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
    O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
    O9 - Extra button: Enjoy It - {47055D63-DFCD-11d3-8406-00500445A7D1} - C:\WINDOWS\SYSTEM\WINDIALUP\3413[1]\DIAL.EXE (file missing)
    O9 - Extra 'Tools' menuitem: Enjoy It - {47055D63-DFCD-11d3-8406-00500445A7D1} - C:\WINDOWS\SYSTEM\WINDIALUP\3413[1]\DIAL.EXE (file missing)
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
    O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\PROGRAM FILES\SIDEFIND\SIDEFIND.DLL
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O15 - Trusted Zone: *.greg-search.com
    O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) - http://us.dl1.yimg.com/download.yaho...bio5_0_2_5.cab
    O16 - DPF: {9DBAFCCF-592F-FFFF-FFFF-00608CEC297C} - http://wdownload.weatherbug.com/mini...ginstaller.cab
    O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://www.pcpitstop.com/internet/pcpConnCheck.cab
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
    O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/260f55efe9b13d3...p/RdxIE601.cab
    O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
    O16 - DPF: {10000000-1000-0000-1000-000000000000} - mhtml:file://C:\ARCHIVE.MHT!http://www.008i.com//x//f//37794/msits.exe
    O16 - DPF: {12398DD6-40AA-4C40-A4EC-A42CFC0DE797} (Installer Class) - http://www.xxxtoolbar.com/ist/softwa...06_regular.cab
    O18 - Protocol: icoo - {4A8DADD4-5A25-4D41-8599-CB7458766220} - C:\WINDOWS\MSOPT.DLL

    I know the "solongas" and "IST" files are bad, I've been tracking those for two days now. Let me know if there is anything I should absolutely NOT delete. Thanks again!

  9. #9
    Senior Member
    Join Date
    Feb 2004
    Posts
    201
    You have a CWS infection. Please download the CWShredder from http://www.spywareinfo.com/~merijn/downloads.html

    Next, please boot into safe mode and run it. Then reboot and post a fresh HijackThis log.



    Please select the following with HijackThis. With all windows (including this one!) closed, please select "fix.


    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://solongas.com/sp.htm?id=9
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://solongas.com/sp.htm?id=9
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://solongas.com/sp.htm?id=9
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://solongas.com/hp.htm?id=9
    R3 - Default URLSearchHook is missing
    O2 - BHO: (no name) - {A9A674BF-771F-42E5-A440-D20DDA85A862} - C:\WINDOWS\SYSTEM\2OM82ADH6FYXD.DLL
    O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\PROGRAM FILES\ISTBAR\ISTBAR.DLL (file missing)
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O15 - Trusted Zone: *.greg-search.com
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/260f55efe9b13d...ip/RdxIE601.cab
    O16 - DPF: {10000000-1000-0000-1000-000000000000} - mhtml:file://C:\ARCHIVE.MHT!http://www.008i.com//x//f//37794/msits.exe
    O16 - DPF: {12398DD6-40AA-4C40-A4EC-A42CFC0DE797} (Installer Class) - http://www.xxxtoolbar.com/ist/softw...006_regular.cab
    O18 - Protocol: icoo - {4A8DADD4-5A25-4D41-8599-CB7458766220} - C:\WINDOWS\MSOPT.DLL


    Next, reboot and post a fresh HijackTHis log. Please note that in order to properly diagnose anything furthe, I would need to see the header and running processes in this log. To get these to show up, Run the program, and press Scan.
    You will notice the Scan button will turn into a "Save Log" button.
    Save the log and Post that log into this thread.


  10. #10
    Junior Member
    Join Date
    Oct 2002
    Posts
    6
    I think it's gone!

    N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.weather.com/weather/local/05663?lswe=05663&lwsa=WeatherLocalUndeclared"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\i5w5i5ux.slt\prefs.js)
    N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\i5w5i5ux.slt\prefs.js)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar.dll (file missing)
    O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\WINDOWS\SYSTEM\YCOMP5_0_2_5.DLL
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [AVGCtrl] C:\PROGRA~1\AVPERS~1\AVGCTRL.EXE /min
    O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
    O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
    O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [NAV CfgWiz] c:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
    O4 - HKLM\..\Run: [Advanced Tools Check] c:\PROGRA~1\NORTON~1\ADVTOOLS\ADVCHK.EXE
    O4 - HKLM\..\Run: [NPROTECT] C:\PROGRA~1\NORTON~1\ADVTOOLS\NPROTECT.EXE
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [Hidserv] Hidserv.exe run
    O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
    O4 - HKLM\..\RunServices: [ccEvtMgr] "c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
    O4 - HKLM\..\RunServices: [ccSetMgr] "c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
    O4 - HKLM\..\RunServices: [NPROTECT] C:\PROGRA~1\NORTON~1\ADVTOOLS\NPROTECT.EXE
    O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
    O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape\Netscp.exe" -turbo
    O4 - Startup: Iomega Disk Icons.lnk = C:\Program Files\Iomega\Tools\IMGICON.EXE
    O4 - Startup: Iomega Startup Options.lnk = C:\Program Files\Iomega\Tools\IMGSTART.EXE
    O4 - Startup: Refresh.lnk = C:\Program Files\Iomega\Tools\REFRESH.EXE
    O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Startup: Iomega Watch.lnk = C:\Program Files\Iomega\Tools\IOWATCH.EXE
    O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR.DLL/cmsearch.html
    O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR.DLL/cmcache.html
    O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR.DLL/cmsimilar.html
    O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR.DLL/cmbacklinks.html
    O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR.DLL/cmtrans.html
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
    O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\PROGRAM FILES\SIDEFIND\SIDEFIND.DLL
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) - http://us.dl1.yimg.com/download.yaho...bio5_0_2_5.cab
    O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://www.pcpitstop.com/internet/pcpConnCheck.cab
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
    O18 - Protocol: icoo - {4A8DADD4-5A25-4D41-8599-CB7458766220} - C:\WINDOWS\MSOPT.DLL

    When I opened IE it was set to about:blank instead of here4search.com, so I'm pretty sure it's gone. *&$%-ing people using my computer and getting XXX **** all over it AND viruses to boot...I hate relatives. Anyway thank you all very much!

    - Cat


Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •