Whenever I restart my computer

[*Pleasant Tomorrow*]

which lately is about 20 times a day, this muther pops up:

idctup20.exe Unable to locate componate

This application has failed to start because commcoss.dll was not found. Re-installing the application may fix this problem.


It's been doing this for quite awile, but being a computer moron I just let it go because it wasn't doing anything to it. Now my computer is freezing constantly, the icons are disappearing from my desktop and the windows won't minimize. I don't know if that's the problem because it wasn't doing anything before, but whether it is or not I don't know what to do. My computers too much of an ass right now for me to even get to click on any spyware things I have.

[robyrob]

Originally Posted by *Pleasant Tomorrow*

which lately is about 20 times a day, this muther pops up:

idctup20.exe Unable to locate componate

This application has failed to start because commcoss.dll was not found. Re-installing the application may fix this problem.


It's been doing this for quite awile, but being a computer moron I just let it go because it wasn't doing anything to it. Now my computer is freezing constantly, the icons are disappearing from my desktop and the windows won't minimize. I don't know if that's the problem because it wasn't doing anything before, but whether it is or not I don't know what to do. My computers too much of an ass right now for me to even get to click on any spyware things I have.

i think that you've got some spyware junk left over in there - at least "commcoss.dll" is, but to get it to stop popping up every time, run HijackThis and post your log, or just remove the entry from the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [intdctrr] C:\WINDOWS\System32\idctup20.exe

[Jenya]

I get an error alot when I'm on this forum using Firefox. It shuts down the browser and a pop-up window comes up and asks me what website I was at, and what error I keep getting. Then, I guess, it sends my complaint off to their website automatically.

This happens a lot, and I still get an error- even when I describe this in detail to them.

[EmoJoe]

That sort of sounds like what happened to my old computer. Yeah, we just gave up on it and got a new one, sorry, im not a big help...

[robyrob]

Originally Posted by Jenya

I get an error alot when I'm on this forum using Firefox. It shuts down the browser and a pop-up window comes up and asks me what website I was at, and what error I keep getting. Then, I guess, it sends my complaint off to their website automatically.

This happens a lot, and I still get an error- even when I describe this in detail to them.

what exactly are you doing when it happens?

have you tried creating a new profile to see if it fixes it? (close firefox, then type in firefox.exe -profilemanager into the Run command, then click on the Create Profile button - you can always switch back to your old profile afterwards)

[Jenya]

Originally Posted by robyrob

what exactly are you doing when it happens?

Just visiting, and quoting. Nothing fancey. I asked someone at work about this, and he told me to shut off the Firefox pop-up blocker option, and just download a seperate one. I did that today, and I don't have any problems so far. But if this happens again, I'll try your suggestion.

Thanks.

[*Pleasant Tomorrow*]

Originally Posted by robyrob

i think that you've got some spyware junk left over in there - at least "commcoss.dll" is, but to get it to stop popping up every time, run HijackThis and post your log, or just remove the entry from the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [intdctrr] C:\WINDOWS\System32\idctup20.exe

What do you mean by 'post your log?'

[*Pleasant Tomorrow*]

*le bump*

[robyrob]

Originally Posted by *Pleasant Tomorrow*

What do you mean by 'post your log?'

- download HijackThis!
- click on the Do a system scan and save a logfile button
- it will open up the log in Notepad, do a CTRL + A to select all, and CTRL C to copy, then paste it into your post here with a CTRL + V

when it is time to "fix" the problem, you will need to click on the box at the front of each line that needs to be removed in the HijackThis window, then click on the "Fix Checked" button

[*Pleasant Tomorrow*]

Logfile of HijackThis v1.99.1
Scan saved at 8:09:00 PM, on 10/23/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINNT\System32\AOLMSNGR.EXE
C:\WINNT\System32\actxprxy.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\WINNT\System32\2r261bh4.exe
C:\windows\mrjj.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\WINNT\System32\n?lookup.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mim.exe
C:\Program Files\sder\dees.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Common Files\AOL\1126391078\ee\AOLHostManager.exe
C:\Program Files\Common Files\AOL\1126391078\ee\AOLServiceHost.exe
C:\Program Files\Common Files\AOL\1126391078\ee\AOLServiceHost.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINNT\System32\DlenJ.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\VjrU.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINNT\System32\wuauclt.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\AIM+\AIM+.exe
C:\Program Files\AIM95\aim.exe
C:\program files\internet explorer\iexplore.exe
C:\Documents and Settings\Owner\Local Settings\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\about.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;dynhost.inetcam.com...r.inetcam.com;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
F2 - REG:system.ini: UserInit=C:\WINNT\System32\Userinit.exe
O1 - Hosts: indows.
O1 - Hosts: tyfind.com
O1 - Hosts: tyfind.com
O1 - Hosts: styfind.com
O1 - Hosts: styfind.com
O1 - Hosts: estyfind.com
O1 - Hosts: estyfind.com
O1 - Hosts: .zestyfind.com
O1 - Hosts: .zestyfind.com
O1 - Hosts: ww.zestyfind.com
O1 - Hosts: .com
O1 - Hosts: ww.zestyfind.com
O1 - Hosts: on.com
O1 - Hosts: 127.0.0.
O1 - Hosts: ind.com
O1 - Hosts: yfind.com
O1 - Hosts: styfind.com
O1 - Hosts: w.zestyfind.com
O1 - Hosts: 127.0
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_3_16_0.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: CATLEvents Object - {55E301E5-BA44-4095-BB0B-14E0123CCF71} - C:\DOCUME~1\Owner\LOCALS~1\Temp\yek.dat
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: (no name) - {E7C11A5E-A2BB-824F-907D-DAC81E8E2C94} - C:\WINNT\System32\cgrg.dll
O2 - BHO: CATLEvents Object - {ED5ABC42-8E4F-4C39-9972-F0CF619D672F} - C:\DOCUME~1\Owner\LOCALS~1\Temp\niwnu.dat
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_3_16_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [intdctrr] C:\WINNT\System32\idctup20.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [GyArQRm] C:\documents and settings\owner\local settings\temp\GyArQRm.exe
O4 - HKLM\..\Run: [2SWZKN82R5K47C] C:\WINNT\System32\Cjp9g.exe
O4 - HKLM\..\Run: [AOL Instent Messenger] AOLMSNGR.EXE
O4 - HKLM\..\Run: [To] C:\documents and settings\owner\local settings\temp\To.exe
O4 - HKLM\..\Run: [da] C:\documents and settings\owner\local settings\temp\da.exe
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [31c696a648aa] C:\WINNT\System32\actxprxy.exe
O4 - HKLM\..\Run: [*WindowsUpd1] C:\WINNT\WindowsUpd1.exe
O4 - HKLM\..\Run: [*tapieula] C:\WINNT\repair\tapieula.exe
O4 - HKLM\..\Run: [*msdisk] C:\WINNT\msagent\chars\msdisk.exe
O4 - HKLM\..\Run: [*olecr] C:\WINNT\Web\printers\olecr.exe
O4 - HKLM\..\Run: [*key] C:\WINNT\Config\key.exe
O4 - HKLM\..\Run: [*unwin] C:\WINNT\Driver Cache\unwin.exe
O4 - HKLM\..\Run: [2MJ] C:\documents and settings\owner\local settings\temp\2MJ.exe
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1126391078\ee\AOLHostManager.exe
O4 - HKLM\..\Run: [2r261bh4] C:\WINNT\System32\2r261bh4.exe
O4 - HKLM\..\Run: [noC=] C:\windows\mrjj.exe
O4 - HKCU\..\Run: [SysUpd] C:\WINNT\WindowsUpd1.exe
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [Jmlhod] C:\WINNT\System32\n?lookup.exe
O4 - HKCU\..\Run: [Ltho] "C:\Program Files\sder\dees.exe" -vt rbnd
O4 - HKCU\..\RunOnce: [AOL Instent Messenger] AOLMSNGR.EXE
O4 - Startup: Download Plus.lnk = C:\Documents and Settings\Owner\Application Data\DownloadPlus.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINNT\System32\maxspeed.exe
O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINNT\System32\maxspeed.exe
O9 - Extra button: Whistle - {220E39C3-B081-4719-AB1A-9A884DCBD05C} - C:\Progra~1\whistlesoftware\WselServices\webband.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\EROProj.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.popuppers.com
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab28578.cab
O16 - DPF: {12589FA1-C456-11CE-BF01-10AA1055595A} - http://www.wsel.net/imcupdatefiles/whistlesilent610.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab28578.cab
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - http://www.miniclip.com/bestfriends/retro64_loader.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yaho...st20040510.cab
O16 - DPF: {7149E79C-DC19-4C5E-A53C-A54DDF75EEE9} (IObjSafety.DemoCtl) - http://cabs.media-motor.net/cabs/joysaver.cab
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} (MSN Chat Control 4.2) - http://fdl.msn.com/public/chat/msnchat42.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab28578.cab
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab28578.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary...t.cab28578.cab
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab28578.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://antu.popcap.com/games/popcaploader_v5.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: PictureTaker - Unknown owner - c:\fixit\pt\PCTKRNT.SYS (file missing)
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe



















Mmkaye, got it. Now you said to post it here?...

[robyrob]

Originally Posted by *Pleasant Tomorrow*

Mmkaye, got it. Now you said to post it here?...

stuff to fix/remove:

Running processes: (you can't fix these with HijackThis, you'll need to close in task manager CTRL+ALT+DEL, or run your scans in SAFEMODE)
C:\WINNT\System32\actxprxy.exe - SPYWARE - run your Spybot and Adaware
C:\WINNT\System32\2r261bh4.exe - VIRUS - please update your AV software and run a scan
C:\windows\mrjj.exe - SPYWARE
C:\WINNT\System32\n?lookup.exe - SPYWARE

C:\Program Files\sder\dees.exe - SPYWARE

C:\Program Files\LimeWire\LimeWire.exe - PROBABLY THE CAUSE OF ALL THIS SPYWARE!!!
C:\WINNT\System32\DlenJ.exe - SPYWARE
C:\WINNT\System32\VjrU.exe - SPYWARE
C:\Program Files\AIM+\AIM+.exe - SPYWARE

Fix ALL of these items by checking them then click on "FIX CHECKED" in HijackThis
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;dynhost.inetcam.com...r.inetcam.com;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
F2 - REG:system.ini: UserInit=C:\WINNT\System32\Userinit.exe
O1 - Hosts: indows.
O1 - Hosts: tyfind.com
O1 - Hosts: tyfind.com
O1 - Hosts: styfind.com
O1 - Hosts: styfind.com
O1 - Hosts: estyfind.com
O1 - Hosts: estyfind.com
O1 - Hosts: .zestyfind.com
O1 - Hosts: .zestyfind.com
O1 - Hosts: ww.zestyfind.com
O1 - Hosts: .com
O1 - Hosts: ww.zestyfind.com
O1 - Hosts: on.com
O1 - Hosts: 127.0.0.
O1 - Hosts: ind.com
O1 - Hosts: yfind.com
O1 - Hosts: styfind.com
O1 - Hosts: w.zestyfind.com
O1 - Hosts: 127.0

O2 - BHO: CATLEvents Object - {55E301E5-BA44-4095-BB0B-14E0123CCF71} - C:\DOCUME~1\Owner\LOCALS~1\Temp\yek.dat
O2 - BHO: (no name) - {E7C11A5E-A2BB-824F-907D-DAC81E8E2C94} - C:\WINNT\System32\cgrg.dll
O2 - BHO: CATLEvents Object - {ED5ABC42-8E4F-4C39-9972-F0CF619D672F} - C:\DOCUME~1\Owner\LOCALS~1\Temp\niwnu.dat

O4 - HKLM\..\Run: [intdctrr] C:\WINNT\System32\idctup20.exe
O4 - HKLM\..\Run: [GyArQRm] C:\documents and settings\owner\local settings\temp\GyArQRm.exe
O4 - HKLM\..\Run: [2SWZKN82R5K47C] C:\WINNT\System32\Cjp9g.exe
O4 - HKLM\..\Run: [To] C:\documents and settings\owner\local settings\temp\To.exe
O4 - HKLM\..\Run: [da] C:\documents and settings\owner\local settings\temp\da.exe
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [31c696a648aa] C:\WINNT\System32\actxprxy.exe
O4 - HKLM\..\Run: [*WindowsUpd1] C:\WINNT\WindowsUpd1.exe
O4 - HKLM\..\Run: [*tapieula] C:\WINNT\repair\tapieula.exe
O4 - HKLM\..\Run: [*msdisk] C:\WINNT\msagent\chars\msdisk.exe
O4 - HKLM\..\Run: [*olecr] C:\WINNT\Web\printers\olecr.exe
O4 - HKLM\..\Run: [*key] C:\WINNT\Config\key.exe
O4 - HKLM\..\Run: [*unwin] C:\WINNT\Driver Cache\unwin.exe
O4 - HKLM\..\Run: [2MJ] C:\documents and settings\owner\local settings\temp\2MJ.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1126391078\ee\AOLHostManager.exe
O4 - HKLM\..\Run: [2r261bh4] C:\WINNT\System32\2r261bh4.exe
O4 - HKLM\..\Run: [noC=] C:\windows\mrjj.exe
O4 - HKCU\..\Run: [SysUpd] C:\WINNT\WindowsUpd1.exe
O4 - HKCU\..\Run: [Jmlhod] C:\WINNT\System32\n?lookup.exe
O4 - HKCU\..\Run: [Ltho] "C:\Program Files\sder\dees.exe" -vt rbnd
O4 - Startup: Download Plus.lnk = C:\Documents and Settings\Owner\Application Data\DownloadPlus.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINNT\System32\maxspeed.exe
O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINNT\System32\maxspeed.exe
O9 - Extra button: Whistle - {220E39C3-B081-4719-AB1A-9A884DCBD05C} - C:\Progra~1\whistlesoftware\WselServices\webband.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.popuppers.com
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone

O16 - DPF: {12589FA1-C456-11CE-BF01-10AA1055595A} - http://www.wsel.net/imcupdatefiles/whistlesilent610.cab
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - http://www.miniclip.com/bestfriends/retro64_loader.dll
O16 - DPF: {7149E79C-DC19-4C5E-A53C-A54DDF75EEE9} (IObjSafety.DemoCtl) - http://cabs.media-motor.net/cabs/joysaver.cab
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} (MSN Chat Control 4.2) - http://fdl.msn.com/public/chat/msnchat42.cab
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://antu.popcap.com/games/popcaploader_v5.cab

O23 - Service: PictureTaker - Unknown owner - c:\fixit\pt\PCTKRNT.SYS (file missing)

...in other words, you have a TON of crap on there; after removing these items with Hijack this you are going to need to run CoolwebShredder, AdAware and Spybot in SAFEMODE - it also looks like you've got VX2 on there, try downloading Adaware's tool for removing it

run ALL of those programs then reboot back into normal mode. run HijackThis again and post a new log to see what's left.

[*Pleasant Tomorrow*]

Thankssss Roby, this is really helping alot. Quick question...I'm not trying to restart in safemode...one of the steps is to go to System Configuration Utility...where's this? erm...

[robyrob]

Originally Posted by *Pleasant Tomorrow*

Thankssss Roby, this is really helping alot. Quick question...I'm not trying to restart in safemode...one of the steps is to go to System Configuration Utility...where's this? erm...

to get there you go to the Run command on the Start menu (or hold down the Windows key and press the R) then type in msconfig and go to the Startup tab...

the problem is most of that spyware will just put itself back in there if you try to disable it from the System Configuration utility - you NEED to run CoolwebShredder and the VX2 cleaner, probably in safemode too.

[*Pleasant Tomorrow*]

Originally Posted by robyrob

to get there you go to the Run command on the Start menu (or hold down the Windows key and press the R) then type in msconfig and go to the Startup tab...

the problem is most of that spyware will just put itself back in there if you try to disable it from the System Configuration utility - you NEED to run CoolwebShredder and the VX2 cleaner, probably in safemode too.

Startup tag...erm...do you mind taking a screen cap?

ARgh, am I driving you crazy? I'm sorrrry

[PZelda]

Originally Posted by *Pleasant Tomorrow*

Startup tag...erm...do you mind taking a screen cap?

ARgh, am I driving you crazy? I'm sorrrry

Roby is talking about this tab. The checked boxes are the programs (your printer, speakers, instant messaging programs, etc) that automatically start up when you start up your computer. It's a very helpful thing to have...Helps your computer start up faster.