DMR 152 Wombat At Large Team Colleague

There are indications of infections in your startup list. As I requested earlier, please post the HJT scan report log also.

Run HijackThis, but do not have HJT fix anything yet; only have it scan your system! Once the scan is complete, the "Scan" button will turn into an option to "Save log...".
Save the log in the folder you created for HijackThis; the saved file will be named "hijackthis.log". Open the log file with Windows Notepad, and cut-n-paste the entire contents of the Notepad file here.

DMR 152 Wombat At Large Team Colleague

I'm not sure how it looks to others, but when I try to read the startup list you attached it displays as one huge text string. No line breaks, spaces, etc.; impossible to read.

If you have some reason to believe that your problem is really related to malicious infections, please post the startup list and the scan report log from HijackThis. When you post them, paste the log contents directly into the body of your post as opposed to attaching them as text files.

DMR 152 Wombat At Large Team Colleague

"njc.exe" is the name of a malicious file installed by the Pest Trap infection; the filename may be used by other infections as well. Delete the file.

DMR 152 Wombat At Large Team Colleague

I was also wondering if you could delete that memory...

Oh right; I forgot to post that info:

The list of visited sites is in your C:\Documents and Settings\Your_User_Name\Local Settings\History folder, and you can clear it by doing the following:

Go to the Internet Options again and this time click on the General tab. Click on the "Clear History" button in the bottom section of the General tab to erase the stored list of visited sites.

DMR 152 Wombat At Large Team Colleague

Are you able to download from the Internet? If so:

You will need to close/quit all web browser programs and disconnect from the Internet for much of the following, so you should print out these instructions or save them into a text file with Notepad.

> Download and install the following utilities:

CCleaner - www.ccleaner.com
Webroot Spy Sweeper (14 day free trial) - http://www.webroot.com/shoppingcart...4011&vcode=DT02
Microsoft Anti-Spyware beta - http://www.microsoft.com/downloads/...&displaylang=en
ewido Anti-malware (14 day free trial) - http://www.ewido.net/en/download/

- Open Spy Sweeper, click on "Options", and then click on "Update Definitions" under the Program Options tab. Do not run a scan yet; just close the program once the update completes.

- Open ewido. In the main screen, click "Update" and click "Start Update". After the update process completes, exit from Ewido.

- Open MS Antispyware beta. Make sure the "AntiSpyware Autoupdater" feature is enabled, and that it has downloaded the most current antispyware updates. Close the program after you've verified this.

- Open your anti-virus program and make sure that it has the most current virus definitions installed. Again- don't scan yet, just close the program once it's updated.


>Open the Services utility in your Administrative Tools control panel.

* In the list of services, locate the service named "Windows Overlay Components" and double-click on it.
* In the General tab of the Properties window that opens, click the Stop …

DMR 152 Wombat At Large Team Colleague

It's pretty difficult to turn those warnings off and have them stay off. Is there any reason why you want to keep Norton installed if you're not going to renew it? After all, an antivirus program that doesn't have current virus definition updates is pretty useless.

DMR 152 Wombat At Large Team Colleague

I get that it means Floppy Disc Controller error, but the funny thing is I don't even have a floppy disc drive.

Yes- FDC = Floppy Drive Controller. The error might just be a result of your not having a floppy drive attached to the motherboard controller. Since there is no floppy drive installed, try going into your system's BIOS setup and disabling the floppy-related settings. Just disabling the "Floppy seek on bootup" option (if present) might be enough.

If the above doesn't work, you could have a hardware (motherboard) problem :sad:

DMR 152 Wombat At Large Team Colleague

Having more specific information would help us:

- the make/model of the DVD drive
- details of the driver being used by/for the DVD drive
- the exact version of Nero

DMR 152 Wombat At Large Team Colleague

very fuzzy wombat.

DMR 152 Wombat At Large Team Colleague

...when u type something you've typed before (a word or address) it automaticly searches it for you...

That feature is called AutoComplete; here's what you need to do to clear its history of visited sites:

- Open Internet Explorer, click the Tools menu, and then click on Internet Options.

- In the Internet Options window, click the content tab, and then click on the Autocomplete button.

- In the resulting window, click "Clear forms" to clear all form data except for passwords and/or click "Clear Passwords" to clear the passwords.

If you don't want IE to use AutoComplete in the future, uncheck all of the boxes in the "Use Autocomplete for" section.

DMR 152 Wombat At Large Team Colleague

Have you visited Microsoft's online update site and downloaded/installed all of the most current updates for Windows and Internet Explorer? If not, please do that now.

DMR 152 Wombat At Large Team Colleague

I'd start by completely uninstalling WMP through your Add/Remove Programs control panel and then downloading and install a fresh copy of the program.

DMR 152 Wombat At Large Team Colleague

(i think i heard you groan then ;-) )

Nah, I actually enjoy the computer forensics aspect of this stuff. (Yes, it's true- I have no life...)


1. The command to find the hostname of a given IP address is "nslookup"; you can also do an online whois loookup.

2. The SpyBot log entries indicate nothing abnormal.

3. Your HJT log is clean.

4. There isn't really much you can do about the incoming ping (ICMP) requests/scans; attackers do that all the time. The report entries are just standardized firewall alerts notifying you of the scan; as long as your firewall is dealing with things correctly there's nothing to worry about.

5. As for the outbound P2P Fastrack GET request to Google: do you have (or have you had) a filesharing program such as Kazaa installed?

DMR 152 Wombat At Large Team Colleague

Good job; glad you got it :)

DMR 152 Wombat At Large Team Colleague

Due to the fact that the member who originally started this thread has not responded in quite a long time, this thread is considered abandoned and has been closed.

In accordance with our posting rules, other members having similar problems should start their own threads and post their questions there. In order to help us help you most quickly, please include as much information about your problem as possible in your posts.

If the member who originally started this thread wishes to have the thread reopened, please send your request, including a link to this thread, to one of our moderators via email or Private Message.

Thank you.

DMR 152 Wombat At Large Team Colleague

anetry,

I've split our posts into a separate thread for you. You can find your new thread here.

DMR 152 Wombat At Large Team Colleague

Because the problem posted by the member who originally started this thread was solved long ago, and given the numerous "piggybacked" questions from other members, this thread is now closed.

In accordance with our posting rules, members in need of assistance should start their own threads and post their questions there. In order to help us help you most quickly, please include as much information about your problem as possible in your posts.

Thanks in advance for understanding.

DMR 152 Wombat At Large Team Colleague

Hi akeja5a,

First of all- welcome to DaniWeb :)

We ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Please start your own thread, post your HijackThis log in that thread, and we will assist you from there.

For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_policies

Thanks for understanding.

DMR 152 Wombat At Large Team Colleague

Hi Keli, welcome to DaniWeb :)

- How are the two computers connecting to the cable modem? Does the cable modem itself allow multiple computers to be connected directly to it, or do you have the computers connected to a router or switch which then connects to the modem?

- Are the computers networked by Ethernet cables, wireless, or both?

- After moving the computer, did you hook everything back up exactly the way it was before the move? Did you use the same network wiring that you were using before the move (if you're using a wire, of course)?

If you can give us the answers to the above, we'll have a better idea of what might have happened and what you can do to fix it.

DMR 152 Wombat At Large Team Colleague

Aww... now stop that; you're making me blush :o :mrgreen:

Glad we help, Sonia. :)
Does everything seem to be running smoothly now?

DMR 152 Wombat At Large Team Colleague

You're welcome; glad we could help :)

DMR 152 Wombat At Large Team Colleague

Unfortunately, your problem could stem from anything from a corrupted driver to a faulty piece of hardware. Please try to give us more information to go on if at all possible; the "Stop:0xD1" error really doesn't narrow things down much at all.

DMR 152 Wombat At Large Team Colleague

the only thing that shows up... is a registry keys box

A what?? Can you please clarify that with more detail?

1. Does the computer/Explorer run properly when booted into Safe Mode? (you get to the safe mode boot option by hitting the F8 key as your computer is starting up).


2. Open the Event Viewer utility in your Administrative Tools control panel and look through your System and Application logs for entries flagged with "Error" or "Warning" which might be related to the Explorer problem. Double-clicking on such an entry will open a properties window with more detailed information on the error; post that info here. To do so:

In the Properties window of a given entry, click on the button with the graphic of two pieces of paper on it; the button is at the right of the window just below the up arrow/down arrow buttons. You won't see anything happen when you click the button, but it will copy all of the details to the Windows clipboard. You can then paste the details into your next post here.

DMR 152 Wombat At Large Team Colleague

Did you try hitting the NumLock key? :D

lol. No, but I did try mopping all of the fscking coffee out of it.
I think it might be working no~#y64BN mr":{}?" Oh crap- guess not... [img]http://www.stevewolfonline.com/Downloads/DMR/Visuals/confused2.gif[/img]

DMR 152 Wombat At Large Team Colleague

You're welcome; glad we could help :)

Should I keep all of these installed in my computer and use them regularly? Will this make my computer slow? (cause of all the protection on the computer?)

EWIDO security - The main portions of the program will still function after the trial period, but the automatic update and real-time protection features will stop working. I would suggest keeping ewido installed, as it is a very good antispyware utility, and can still be manually updated and used for system scans even after the trial expires.

Microsoft anti-spyware beta - Keep it. In addition to doing a good job of scanning for and removing "unwanted guests", it also provides real-time protection against questionable and/or unauthorized changes to your system.

CLEANUP! - I'd keep it around, as it's a good idea to run a program like Cleanup! periodically to clean out temp files, cookies, and the like which accumulate in the normal course of using the computer.

AD-AWARE and SpyBot- Both of these programs used to be recommended "must-haves" in terms of adware/spyware removal, but unfortunately they have both fallen behind other utilities in terms of their abilities to deal with some of the newer, more "crafy" infections. It doesn't hurt to keep them installed though, as they do detect and remove a pretty large number of malicious programs.

AVG FREE - A good anti-virus program is an absolute must, and that's exactly what AVG is. Keep it.

DMR 152 Wombat At Large Team Colleague

There's nothing suspicious in your HJT log, and as far as the computer rebooting during the scans goes- yes, there are some infections which start kicking and screaming if they detect that you are trying to remove them. However, the scanning could also just be stressing some weak point (not related to infections) in your system; I honestly can't say at this point.

Here are some procedures you can perform to scan for and remove possible hidden "nasties":


You will need to close/quit all web browser programs and disconnect from the Internet for much of the following, so you should print out these instructions or save them into a text file with Notepad.

> Download and install the following utilities:

CCleaner - www.ccleaner.com
Webroot Spy Sweeper (14 day free trial) - http://www.webroot.com/shoppingcart...4011&vcode=DT02
Microsoft Anti-Spyware beta - http://www.microsoft.com/downloads/...&displaylang=en
ewido Anti-malware (14 day free trial) - http://www.ewido.net/en/download/

- Open Spy Sweeper, click on "Options", and then click on "Update Definitions" under the Program Options tab. Do not run a scan yet; just close the program once the update completes.

- Open ewido. In the main screen, click "Update" and click "Start Update". After the update process completes, exit from Ewido.

- Open MS Antispyware beta. Make sure the "AntiSpyware Autoupdater" feature is enabled, and that it has downloaded the most current antispyware updates. Close the program after you've verified this.

- Open your …

DMR 152 Wombat At Large Team Colleague

NO...

You don't have a virus. Your numlock key is turned on...

OMG Alex, please don't do that when I'm drinking coffee- it came right out of my nose and spewed all over my keyboard!!! [img]http://www.stevewolfonline.com/Downloads/DMR/Visuals/jesterlaugh.gif[/img]


Oh crud- now my keyboard is acting funky.... :mrgreen:

DMR 152 Wombat At Large Team Colleague

Hi shadow28,

To post a HijackThis log, please do the following:

Create a folder for HJT outside of any Temp/Temporary folders and move/extract HijackThis to that folder now. A folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do.

Run HijackThis, but do not have HJT fix anything yet; only have it scan your system! Once the scan is complete, the "Scan" button will turn into an option to "Save log...".
Save the log in the folder you created for HijackThis; the saved file will be named "hijackthis.log". Open the log file with Windows Notepad, and cut-n-paste the entire contents of the Notepad file here.

DMR 152 Wombat At Large Team Colleague

Good job- it looks like ewido and Spy Sweeper removed the remains of the WinFixer infection.
One last thing to check: open Windows Explorer and make sure the entire c:\program files\common files\winsoftware folder has been deleted. If the folder does still exist, delete it and then empty your Recycle Bin.

DMR 152 Wombat At Large Team Colleague

As you suggest, it could just be general "clutter"; temp files and other cruft will accumulate over time, and can sometimes cause performance hits when performing certain tasks. Another possibility is that you've added programs which have installed background processes that are nibbling away at your CPU and memory usage.

Open Task Manager and have a look at your list of running processes; I'll bet that more than a few of them can be disabled. If you have questions about what processes can or cannot be safely disabled, do the following:

Download the (free) HijackThis utility:

http://www.stevewolfonline.com/Downloads/DMR/Spyware%20Tools/HJT/HijackThis.exe

Once downloaded, follow these instructions to install and run the program:

Create a folder for HJT outside of any Temp/Temporary folders and move/extract HijackThis to that folder now. A folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do.

Run HijackThis, but do not have HJT fix anything yet; only have it scan your system! Once the scan is complete, the "Scan" button will turn into an option to "Save log...".
Save the log in the folder you created for HijackThis; the saved file will be named "hijackthis.log". Open the log file with Windows Notepad, and cut-n-paste the entire contents of the Notepad file here.

The log contents will tell us a lot about what programs and processes are automatically starting when Windows boots; we can then tell you which of those processes can be safely disabled.

DMR 152 Wombat At Large Team Colleague

Yes- I'd check with your ISP. Also, you can do the following to see if there are any clues to possible problems on your end:

Open the Event Viewer utility in your Administrative Tools control panel and look through your System and Application logs for entries flagged with "Error" or "Warning" which might be related to the lock-ups. Double-clicking on such an entry will open a properties window with more detailed information on the error; post that info here. To do so:

In the Properties window of a given entry, click on the button with the graphic of two pieces of paper on it; the button is at the right of the window just below the up arrow/down arrow buttons. You won't see anything happen when you click the button, but it will copy all of the details to the Windows clipboard. You can then paste the details into your next post here.

DMR 152 Wombat At Large Team Colleague

1. Your log is clean now :)


2. The Z1.adserver.com popups (and others) can sometimes be difficult to stop, as they aren't necessarilly delivered by an infection living on your computer, but are instead delivered by/through web pages you visit. Here are some things you can do minimize such annoyances:

A) Download and install SpyWareBlaster. Make sure to use the program's online update function fairly frequently.

B) Download and install IE-Spyad.

C) Use Mozilla Firefox as your Web browser instead of using Internet Explorer. Among other benefits, Firefox has a built-in popup blocker.

D) Install a specially-modified "hosts" file to block many of the known Internet ad servers. An explanation of this method and a link to a good, freely-downloadable hosts file can be found here.

DMR 152 Wombat At Large Team Colleague

1. Run Hijackthis again, put a check in the boxes to the left of the following entries, and then click the "Fix Checked" button:

O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKCU\..\Run: [WinFixer_2005] C:\Program Files\WinFixer_2005\uwfx5.exe /scan


2. Delete the entire C:\Program Files\WinFixer_2005 folder and then empty your Recycle Bin.


3. Perform the following procedures to clean up loose ends which don't show up in a HijackThis log:

You will need to close/quit all web browser programs and disconnect from the Internet for much of the following, so you should print out these instructions or save them into a text file with Notepad.

> Download and install the following utilities:

CCleaner - www.ccleaner.com
Webroot Spy Sweeper (14 day free trial) - http://www.webroot.com/shoppingcart...4011&vcode=DT02
Microsoft Anti-Spyware beta - http://www.microsoft.com/downloads/...&displaylang=en
ewido Anti-malware (14 day free trial) - http://www.ewido.net/en/download/

- Open Spy Sweeper, click on "Options", and then click on "Update Definitions" under the Program Options tab. Do not run a scan yet; just close the program once the update completes.

- Open ewido. In the main screen, click "Update" and click "Start Update". After the update process completes, exit from Ewido.

- Open MS Antispyware beta. Make sure the "AntiSpyware Autoupdater" feature is enabled, and that it has downloaded the most current antispyware updates. Close the program …

DMR 152 Wombat At Large Team Colleague

how do u post new threads

Near the top of each forum's main window, just above the list of threads, there is a button labelled "Post a New Thread". Clicking that button opens up a "Post New Thread" window where you can compose your message and give it a title. Once you've finished composing your post, just click on the button below the message window labelled "Submit New Thread". That's all.

In terms of your actual problem though:

One common cause, and the fix, are described in this article in Microsoft's KnowledgeBase:

http://support.microsoft.com/kb/q270008/

Although the article pertains to Win 2000, I've seen the problem occur with XP as well; the fix described for Win 2000 works for XP. You may need to reboot after performing the fix.

Please note that although the article only refers to the "UpperFilters" and "LowerFilters" entries in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet registry subkey, I've had to apply the fix to the similar entries (if found) in the HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00x subkeys as well in order to make it work.

DMR 152 Wombat At Large Team Colleague

By the way: I've deleted the other thread you had started, as it was just a duplicate of the issues we're dealing with here.

DMR 152 Wombat At Large Team Colleague

thanks

You're welcome :)

1. Your HJT log shows signs of at least three different infections, but the following info in your log's header also shows that you are running a "virgin" version of Windows XP (no Service Packs, Security/Bug Fixes, etc. appear have been installed):

Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running such an outdated, unpatched version of Windows, your system will almost certainly get reinfected in no time.
Once we get Internet Explorer functioning again (you can only download the updates through IE), you will need to use the Windows Update feature to bring your system up to a fully-patched version of Service Pack 1 (note that upgrading to Service Pack 2 on an infected system is not recommended!). Once you've done that, the info in your log's header should read as follows:

Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)


You will need to close/quit all web browser programs and disconnect from the Internet for much of the following, so you should print out these instructions or save them into a text file with Notepad.

> Download and install the following utilities:

CCleaner - www.ccleaner.com
Webroot Spy Sweeper (14 day free trial) - http://www.webroot.com/shoppingcart...4011&vcode=DT02
Microsoft Anti-Spyware beta - http://www.microsoft.com/downloads/...&displaylang=en
ewido Anti-malware (14 day free trial) - http://www.ewido.net/en/download/

- Open Spy Sweeper, click on …

DMR 152 Wombat At Large Team Colleague

Errors from rundll32.exe can be hard to track down, because that program is responsible for loading and managing a number of of different Windows library files (.dll files). In other words, it is often not rundll32.exe itself which is crashing/hanging, but one of the dlls that it is managing.


Please do the following to see if we can find more specific information on the problem:

Open the Event Viewer utility in your Administrative Tools control panel and look through your System and Application logs for entries flagged with "Error" or "Warning" which might be related to the rundll32 crashes. Double-clicking on such an entry will open a properties window with more detailed information on the error; post that info here. To do so:

In the Properties window of a given entry, click on the button with the graphic of two pieces of paper on it; the button is at the right of the window just below the up arrow/down arrow buttons. You won't see anything happen when you click the button, but it will copy all of the details to the Windows clipboard. You can then paste the details into your next post here.

DMR 152 Wombat At Large Team Colleague

Yes- all looks good now :)

* You'll probably want to uninstall Spy Sweeper through your Add/Remove Programs control panel, because the program will entirely cease to function after the 14 day trial period expires. Of course, if you want to pay the registration fee for the product, it is a good tool to have...

* I'd keep ewido, CCleaner, and MS Antispyware installed. MS Antispyware provides good "real-time" spyware protection, and ewido can still be used after the trial period expires; it's only the real-time protection and auto-update functions that will stop woking.

DMR 152 Wombat At Large Team Colleague

Due to the fact that the member who originally started this thread has not responded in quite a long time, this thread is considered abandoned and has been closed.

In accordance with our posting rules, other members having similar problems should start their own threads and post their questions there. In order to help us help you most quickly, please include as much information about your problem as possible in your posts.

If the member who originally started this thread wishes to have the thread reopened, please send your request, including a link to this thread, to one of our moderators via email or Private Message.

Thank you.

DMR 152 Wombat At Large Team Colleague

Hi akshay174,

First of all- welcome to TechTalk :)

We ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Please start your own separate thread for your problem and post your HijackThis log there.

For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_policies

Thanks for understanding.

DMR 152 Wombat At Large Team Colleague

1. C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe

Odd- the above log entry indicates that you seem to have run HijackThis from a temp folder again. How many copies of HJT do you have in that computer??


2. Ewido detected and cleaned one element of the "PurityScan" infection, but judging from a couple of entries in your latest HJT log, I don't think it got the entire infection. Please do the following:

* Run the PurityScan uninstaller.


* Visit at least two of the following sites for an online virus scan:

BitDefender Free Online Virus Scan
http://www.bitdefender.com/scan/licence.php
Make sure you tick AutoClean under Scan Options.

Panda ActiveScan
http://www.pandasoftware.com/active...n_principal.htm
Make sure you tick Disinfect automatically under Scan Options.

Housecall at TrendMicro
http://housecall60.trendmicro.com/e...orp.asp?id=scan
Make sure you tick Auto Clean.

eTrust Antivirus Web Scanner
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx


* Run HijackThis again, put a check in the box to the left of the following two entries, and then hit the "Fix checked" button (note that the entries might not appear in the new scan; the above utilities may already have removed one or both of them):

O2 - BHO: (no name) - {E5130262-9D84-E770-855F-C83EC75026E0} - C:\WINDOWS\system32\wjl.dll (file missing)
O4 - HKCU\..\Run: [Aktm] C:\WINDOWS\system32\??stem32\wowexec.exe


* Open Windows Explorer, and in the Folder Options->View settings under the Tools menu, select "show hidden files and folders", and uncheck …

DMR 152 Wombat At Large Team Colleague

Which Anti-virus program do you use? Symantec has removal instructions here if you use Norton.

DMR 152 Wombat At Large Team Colleague

Download the (free) HijackThis utility...

Hmm- I just saw your other posts; seems like you can't download anything right now. See my response in your other thread.

DMR 152 Wombat At Large Team Colleague

You have a Winfixer/Virtumundo infection; please do the following:

Download VundoFix.exe to your desktop.
1. Double-click VundoFix.exe to run it.
2. Click the "Scan for Vundo" button.
3. Once it's done scanning, click the "Remove Vundo" button.
4. You will receive a prompt asking if you want to remove the files, click "YES".
5. Once you click yes, your desktop will go blank as it starts removing Vundo.
6. When completed, VundoFix will prompt that it will shutdown your computer; click "OK".
7. Turn your computer back on.
8. Please post the contents of C:\vundofix.txt and a new HiJackThis log.

DMR 152 Wombat At Large Team Colleague

You say you've run antispyware programs; did they find anything? Do you suspect viruses/spyware to be the cause of the slowdowns (this is the virus/spyware forum, after all)?

DMR 152 Wombat At Large Team Colleague

That's a clean log, and it doesn't look like you're running very many non-essential startup processes; can you give us a little more background/history on the slowdown?

DMR 152 Wombat At Large Team Colleague

Your log shows signs of a couple of malicious entities; please do the following:

You will need to disconnect from the Internet for some of the following, so you'll need to print out the following instructions, or save them into a text file with Notepad.

1. Download and install these utilities (but do not run scans with them yet):

ewido Security Suite (trial version) - http://www.ewido.net/en/download/
Microsoft Anti-Spyware beta - http://www.microsoft.com/downloads/...&displaylang=en

- Open ewido. In the main screen, click "Update" and click "Start Update". After the update process completes, exit from Ewido.

- Open MS Antispyware beta. Make sure the "AntiSpyware Autoupdater" feature is enabled, and that it has downloaded the most current antispyware updates. Close the program after you've verified this.

- Open your anti-virus program and use its update feature to make sure that you have the most current virus definitions installed. As with the above programs, don't run a scan with it; just close it once it is updated.


2. Download and install the Cleanup! utility, but don't run it yet.


3. Close all open programs, run HijackTHis again, put a check mark in the boxes to the left of the following entries, and then hit the "Fix checked" button:

R3 - URLSearchHook: (no name) - {12C41435-D5D2-A37C-DD5B-DD7F136DD5EC} - C:\WINDOWS\system32\olhb.dll
O2 - BHO: (no name) - {12C41435-D5D2-A37C-DD5B-DD7F136DD5EC} - C:\WINDOWS\system32\olhb.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common …

DMR 152 Wombat At Large Team Colleague

Download the (free) HijackThis utility. Once downloaded, follow these instructions to install and run the program:


Create a folder for HJT outside of any Temp/Temporary folders and move the HijackThis.exe file to that folder now. A folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do.

Run HijackThis, but do not have HJT fix anything yet; only have it scan your system! Once the scan is complete, the "Scan" button will turn into an option to "Save log...".
Save the log in the folder you created for HijackThis; the saved file will be named "hijackthis.log". Open the log file with Windows Notepad, and cut-n-paste the entire contents of the Notepad file here.

The log contents will tell us a lot about what "nasties" have crept into your system, and once we analyse the log we can tell you what to do from there.

DMR 152 Wombat At Large Team Colleague

While the motherboard is 1st Mainboard the bios seems to be from American Megatrends, Inc.

Yes, it isn't uncommon for the BIOS to be manufactured by a third party. American Megatrends (AMI) is one such popular BIOS brand; Phoenix and Award are two other BIOS manufacturers that have been around for quite some time.

DMR 152 Wombat At Large Team Colleague

I have to find the revision of my AMD athlon 3200+ before i Know the BIOS on that....

CPUs don'thave a BIOS of their own; the reason you need the CPU's revision number is to check it against Asus' BIOS/CPU compatibility list for the A8N-E mobo. Judging from a quick glance at that list, it appears to me that only rev.E4 of the 3200+ CPU requires the newest (v.1010) BIOS; your techs should be able to verify that for you.

Preliminary information on flashing to BIOS v.1010 can be found here. If you do have to upgrade the BIOS, please pay attention to the fact that the instructions indicate that you need to update the motherboard chipset drivers to v6.65 before updating the BIOS.