Bod68

I was but I was running ewido on startup so uninstalled that now and it seems fine ty

--------------------------------------------------------- ewido security suite - Scan report --------------------------------------------------------- + Created on: 09:43:29, 11/12/2005 + Report-Checksum: F8F31A62 + Scan result: C:\WINNT\desktop.html -> Hijacker.Generic : Cleaned with backup C:\WINNT\DirectX.log:mvglm -> Downloader.Agent.td : Cleaned with backup C:\WINNT\mfchn.exe -> Downloader.Agent.td : Cleaned with backup C:\WINNT\qfjsd.dll -> Adware.SearchPage : Cleaned with backup C:\WINNT\Rhododendron.bmp:hvwyv -> Downloader.Agent.td : Cleaned with backup ::Rep

As I said I'm still getting this keeps popping up... Not sure what it is?!? BROWSER HIJACK ALERT - BROWSER PAGE CHANGED On 01:26:49 12/10/2005 a browser page change was detected. Registry Location: HKCU\Software\Microsoft\Internet Explorer\Main\ Value Name: Search Bar Old Value: res://C:\WINNT\eoxzw.dll/sp.html#34154 New Value: res://C:\WINNT\axoyd.dll/sp.html#34154 User Action Taken: KEEP NEW VALUE

Logfile of HijackThis v1.99.1 Scan saved at 22:07:34, on 10/12/2005 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\SYSTEM32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe C:\DMI\WIN32\bin\DellDmi.exe C:\Program Files\Dell\OpenManage\Client\EventAgt.exe C:\Program Files\Dell\OpenManage\Client\DLT.exe C:\WINNT\Syste

Also get this on STARTUP too... BROWSER HIJACK ALERT - BROWSER PAGE CHANGED On 01:26:49 12/10/2005 a browser page change was detected. Registry Location: HKCU\Software\Microsoft\Internet Explorer\Main\ Value Name: Search Bar Old Value: res://C:\WINNT\eoxzw.dll/sp.html#34154 New Value: res://C:\WINNT\axoyd.dll/sp.html#34154 User Action Taken: KEEP NEW VALUE

Yes it seems fine now thanks for all your help One thing my Homepage is still set to about:blank and I noticed in Hijack This there isn't a O3 file... Any ideas? Is there a fix for this, sure there is but just checking. Thanks Again m8 for your speedy work!

Logfile of HijackThis v1.99.1 Scan saved at 16:41:04, on 10/12/2005 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\SYSTEM32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe C:\DMI\WIN32\bin\DellDmi.exe C:\Program Files\Dell\OpenManage\Client\EventAgt.exe C:\Program Files\Dell\OpenManage\Client\DLT.exe C:\WINNT\Syste

Logfile of HijackThis v1.99.1 Scan saved at 07:02:47, on 10/12/2005 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\SYSTEM32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe C:\DMI\WIN32\bin\DellDmi.exe C:\Program Files\Dell\OpenManage\Client\EventAgt.exe C:\Program Files\Dell\OpenManage\Client\DLT.exe C:\WINNT\Syste

CWShredder **** Run Keys **** RUN: [syszk.exe] C:\WINNT\system32\syszk.exe RUN: [synchronization Manager] mobsync.exe /logon RUN: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM= **** Browser Helper Objects **** BHO: [AcroIEHlprObj Class] C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll BHO: [spywareGuardDLBLOCK.CBrowserHelper] C:\Program Files\SpywareGuard\dlprotect.dll **** IE Toolbars **** **** IE Extensions **** IEExt: [] IEExt: [Real.com] **** Hosts File Entries **** HOSTS: 127.0.0.1 localhost HOSTS: 127.0.0.1 localhost **** IE

Logfile of HijackThis v1.99.1 Scan saved at 01:52:12, on 10/12/2005 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\SYSTEM32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe C:\DMI\WIN32\bin\DellDmi.exe C:\Program Files\Dell\OpenManage\Client\EventAgt.exe C:\Program Files\Dell\OpenManage\Client\DLT.exe C:\WINNT\Syste

Logfile of HijackThis v1.99.1 Scan saved at 01:29:05, on 10/12/2005 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\SYSTEM32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\appnc.exe C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe C:\DMI\WIN32\bin\DellDmi.exe C:\Program Files\Dell\OpenManage\Client\EventAgt.exe C:\Program Files\Dell\OpenManage\Client\DLT

--------------------------------------------------------- ewido security suite - Scan report --------------------------------------------------------- + Created on: 01:17:40, 10/12/2005 + Report-Checksum: 9AD3AEEC + Scan result: HKLM\SOFTWARE\Classes\CLSID\{014DA6C9-189F-421a-88CD-07CFE51CFF10} -> Spyware.MySearch : Cleaned with backup HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup HKLM\SOFTWARE\Classes\CLSID\{676575DD-4D46-911D-8037-9B10D6EE8BB5} -> Spyware.CoolWebSearch : Cleaned with backup HKLM\SOFTWARE\Micros

Hi, just logged in and looked around for similar problems and done everything I can but I'm still getting several errors which I cannot fix. Could someone help me please? I have restored my desktop from the blue infected screen and got my connection back. Also tried the usual programs but perhaps a step by step might help me Thanks in advance... ----- Logfile of HijackThis v1.99.1 Scan saved at 21:27:53, on 09/12/2005 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\SYSTEM32\winlogon.exe C:\