Hi jack this log.

cedjordan · May 28, 2004, 07:48 AM

hi - I've got some random CPU issues, when I use a search engine it comes up with some wierd screen that has a bunch of sponsor links everytime, I'm also getting lots of popups and it's quite annoying. I'm wondering how I'm to rid of this?
Athlon Xp 2400+
1024 DDR
MSI Mainboard
30 gig 7200 RPM HDD
SCSI driven cd-rom
TDK 24/10/40 re-writable
geforce fx 5600 ultra 256

Logfile of HijackThis v1.97.7
Scan saved at 10:45:11 PM, on 5/27/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
D:\Program Files\Winamp\winampa.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Program Files\Common files\WinTools\WSup.exe
C:\Program Files\Common files\WinTools\WToolsA.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common files\WinTools\WToolsS.exe
D:\Unzipped\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = sas.r1.attbi.com:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = sas.r1.attbi.com;<local>
R3 - URLSearchHook: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - C:\Program Files\TV Media\TvmBho.dll
O2 - BHO: (no name) - {00A0A40C-F432-4C59-BA11-B25D142C7AB7} - C:\WINDOWS\System32\mskceo.dll
O2 - BHO: (no name) - {0982868C-47F0-4EFB-A664-C7B0B1015808} - C:\WINDOWS\System32\mskhhe.dll
O2 - BHO: (no name) - {0BA1C6EB-D062-4E37-9DB5-B07743276324} - C:\WINDOWS\System32\msdaim.dll
O2 - BHO: (no name) - {25F7FA20-3FC3-11D7-B487-00D05990014C} - C:\WINDOWS\System32\mseggo.gif
O2 - BHO: (no name) - {447160CD-ECF5-4EA2-8A8A-1F70CA363F85} - C:\WINDOWS\System32\msibkd.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll (file missing)
O2 - BHO: (no name) - {5886A6DC-AAF4-45E9-979A-8E5E6DEE30E7} - C:\Program Files\zSearch\zSearch.dll
O2 - BHO: (no name) - {94927A13-4AAA-476A-989D-392456427688} - C:\WINDOWS\System32\msjfbl.dll
O2 - BHO: (no name) - {CC916B4B-BE44-4026-A19D-8C74BBD23361} - C:\WINDOWS\System32\msedah.dll
O2 - BHO: (no name) - {FCADDC14-BD46-408A-9842-CDBE1C6D37EB} - C:\WINDOWS\System32\msnkmi.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SysUpd] C:\WINDOWS\sysupd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - HKLM\..\Run: [zSearch] C:\Program Files\zSearch\Zstb.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [TB_setup] C:\DOCUME~1\Garren\LOCALS~1\Temp\tb_setup.exe /dcheck
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Steam] D:\Program Files\Steam\Steam.exe -silent
O4 - HKCU\..\Run: [msmc] C:\WINDOWS\System32\msgked.exe
O4 - HKCU\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - HKCU\..\Run: [zSearch] C:\Program Files\zSearch\Zstb.exe
O4 - Startup: MemTurbo.lnk = D:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {12F7F128-B36C-4843-8AA4-A5F71A969331} (Launcher Control) - https://horizons.istaria.com/controls/launcher.ocx
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/downlo...22/wmv9VCM.CAB
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/ca...C_1_0_0_41.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.blizzard.com/register/wowbeta/si.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} (CustomerCtrl Class) - http://cs5b.instantservice.com/jars/...rxsigned41.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...970.3957986111
O16 - DPF: {B3872502-F9FD-4E96-93FF-0D37298F0689} (SOESysInfo Control) - http://everquest2.station.sony.com/b...soesysinfo.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {EFAEF0E4-F044-4D57-9900-1C3FF18524C9} (AV Class) - http://www.pcpitstop.com/antivirus/PitPav.cab

thanks for any possible help you can provide.

note - WtoolsA and WtoolsS are uncloseable, after I close them in the process window, they start back up every time.

Thanks in advance for any possible help.

kemet64 · May 28, 2004, 08:25 AM

Okayu, to get rid of the wtools stuff, go to start-Settings-Control Panel-Administrative Tools-Services. Look for "WinTools for IE service". If you find that, right click it and click stop. Then right click again and go to properties. Once in properties, go to the dropdown window for startup type and click "disable".

Then end task for:
WToolsA.exe
WToolsS.exe
WSup.exe

Then, if you want, look for Wintools in add/remove programs and uninstall. But, careful to create restore point first because that can mess up computer.

As for the pop-up program...have you run Spybot: Search and destroy?

Vampyromaniac · May 28, 2004, 08:38 AM

Have you scanned for spyware?

cedjordan · May 28, 2004, 07:06 PM

Yes. I've run Spybot S&D, and I've run Ad-aware. I've also ran a few virus scanes. Pcpitstop.com and housecall.trendmicro.com. I've found a few files and I can't delete them with anything, Analogx Super Shredder, Hijackthis, nothing gets rid of them.

zerodamage · May 28, 2004, 07:23 PM

Wintools is the spyare there.

You also have this: O4 - HKCU\..\Run: [zSearch] C:\Program Files\zSearch\Zstb.exe

Not sure what this is: O4 - HKCU\..\Run: [msmc] C:\WINDOWS\System32\msgked.exe
Sounds suspicious to me

This also is suspisous: O4 - HKLM\..\Run: [SysUpd] C:\WINDOWS\sysupd.exe

Is this for your TV capture card or something? O4 - HKLM\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe

This looks like it should not be there:
O4 - Startup: MemTurbo.lnk = D:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe

So let me post everything you have there. Everything I have in bold should NOT be checked in your start up menu.

O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SysUpd] C:\WINDOWS\sysupd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - HKLM\..\Run: [zSearch] C:\Program Files\zSearch\Zstb.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [TB_setup] C:\DOCUME~1\Garren\LOCALS~1\Temp\tb_setup.exe /dcheck
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Steam] D:\Program Files\Steam\Steam.exe -silent
O4 - HKCU\..\Run: [msmc] C:\WINDOWS\System32\msgked.exe
O4 - HKCU\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - HKCU\..\Run: [zSearch] C:\Program Files\zSearch\Zstb.exe
O4 - Startup: MemTurbo.lnk = D:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe

Basically disable everything there except the Nvidia startup.

Make sure you have the latest 1.3 of Spybot S&D and the latest update for Adaware. That will fix your problems.

Let us know if this works for you.

May 28, 2004, 07:48 AM	#1
cedjordan DriverHeaven Newbie Join Date: Jan 2004 Posts: 19 Rep Power: 0	Hi jack this log. hi - I've got some random CPU issues, when I use a search engine it comes up with some wierd screen that has a bunch of sponsor links everytime, I'm also getting lots of popups and it's quite annoying. I'm wondering how I'm to rid of this? Athlon Xp 2400+ 1024 DDR MSI Mainboard 30 gig 7200 RPM HDD SCSI driven cd-rom TDK 24/10/40 re-writable geforce fx 5600 ultra 256 Logfile of HijackThis v1.97.7 Scan saved at 10:45:11 PM, on 5/27/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE D:\Program Files\Winamp\winampa.exe C:\Program Files\AIM\aim.exe C:\WINDOWS\System32\taskmgr.exe C:\Program Files\Common files\WinTools\WSup.exe C:\Program Files\Common files\WinTools\WToolsA.exe C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common files\WinTools\WToolsS.exe D:\Unzipped\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = sas.r1.attbi.com:8000 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = sas.r1.attbi.com;<local> R3 - URLSearchHook: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - C:\Program Files\TV Media\TvmBho.dll O2 - BHO: (no name) - {00A0A40C-F432-4C59-BA11-B25D142C7AB7} - C:\WINDOWS\System32\mskceo.dll O2 - BHO: (no name) - {0982868C-47F0-4EFB-A664-C7B0B1015808} - C:\WINDOWS\System32\mskhhe.dll O2 - BHO: (no name) - {0BA1C6EB-D062-4E37-9DB5-B07743276324} - C:\WINDOWS\System32\msdaim.dll O2 - BHO: (no name) - {25F7FA20-3FC3-11D7-B487-00D05990014C} - C:\WINDOWS\System32\mseggo.gif O2 - BHO: (no name) - {447160CD-ECF5-4EA2-8A8A-1F70CA363F85} - C:\WINDOWS\System32\msibkd.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll (file missing) O2 - BHO: (no name) - {5886A6DC-AAF4-45E9-979A-8E5E6DEE30E7} - C:\Program Files\zSearch\zSearch.dll O2 - BHO: (no name) - {94927A13-4AAA-476A-989D-392456427688} - C:\WINDOWS\System32\msjfbl.dll O2 - BHO: (no name) - {CC916B4B-BE44-4026-A19D-8C74BBD23361} - C:\WINDOWS\System32\msedah.dll O2 - BHO: (no name) - {FCADDC14-BD46-408A-9842-CDBE1C6D37EB} - C:\WINDOWS\System32\msnkmi.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SysUpd] C:\WINDOWS\sysupd.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe O4 - HKLM\..\Run: [zSearch] C:\Program Files\zSearch\Zstb.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe O4 - HKLM\..\Run: [TB_setup] C:\DOCUME~1\Garren\LOCALS~1\Temp\tb_setup.exe /dcheck O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [Steam] D:\Program Files\Steam\Steam.exe -silent O4 - HKCU\..\Run: [msmc] C:\WINDOWS\System32\msgked.exe O4 - HKCU\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe O4 - HKCU\..\Run: [zSearch] C:\Program Files\zSearch\Zstb.exe O4 - Startup: MemTurbo.lnk = D:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) O9 - Extra button: AIM (HKLM) O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Messenger (HKLM) O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {12F7F128-B36C-4843-8AA4-A5F71A969331} (Launcher Control) - https://horizons.istaria.com/controls/launcher.ocx O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/downlo...22/wmv9VCM.CAB O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/ca...C_1_0_0_41.cab O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.blizzard.com/register/wowbeta/si.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O16 - DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} (CustomerCtrl Class) - http://cs5b.instantservice.com/jars/...rxsigned41.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...970.3957986111 O16 - DPF: {B3872502-F9FD-4E96-93FF-0D37298F0689} (SOESysInfo Control) - http://everquest2.station.sony.com/b...soesysinfo.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab O16 - DPF: {EFAEF0E4-F044-4D57-9900-1C3FF18524C9} (AV Class) - http://www.pcpitstop.com/antivirus/PitPav.cab thanks for any possible help you can provide. note - WtoolsA and WtoolsS are uncloseable, after I close them in the process window, they start back up every time. Thanks in advance for any possible help.

May 28, 2004, 08:25 AM	#2
kemet64 DriverHeaven Senior Member Join Date: Jan 2004 Posts: 457 Rep Power: 0	Okayu, to get rid of the wtools stuff, go to start-Settings-Control Panel-Administrative Tools-Services. Look for "WinTools for IE service". If you find that, right click it and click stop. Then right click again and go to properties. Once in properties, go to the dropdown window for startup type and click "disable". Then end task for: WToolsA.exe WToolsS.exe WSup.exe Then, if you want, look for Wintools in add/remove programs and uninstall. But, careful to create restore point first because that can mess up computer. As for the pop-up program...have you run Spybot: Search and destroy? __________________ Inspiron XPS Intel 3.4 ghz 1gb Corsair XMS DDR PC3200 60gig 7200 HD 128mb Radeon Mobility 9700 Creative Soundblaster Audigy 2 NX Logitech z680 Speakers

May 28, 2004, 08:38 AM	#3
Vampyromaniac confutatis maledictis Join Date: May 2002 Location: somewhere dark Posts: 5,974 Rep Power: 74 System Specs	Have you scanned for spyware? __________________ *Digitalis 3.3* Athlon 64 3000 // ASUS K8V SE Deluxe // 1024MB PC3200 (2-2-2-10 1T) ATI All-In-Wonder 9700 Pro // 20" Dell 2005FPW (DVI) M-Audio Revo 7.1 + Philips Acoustic Edge // Klipsch ProMedia 2.1 320/16 Western Digital WD3200KS + 120/8 Seagate 7200.7 NEC ND-3550A 16x DVD±RW + Lite-On 52x24x CD-RW Antec Sonata case // 480W Antec TruePower personal bests \|\| Aq'3: 46796 \| 3D'01: 20461 \| 3D'03: 6336 \| 3D'05: 2677 \| PC'04: 4605 \| PC'02: 7691,9092,1250

May 28, 2004, 07:23 PM	#5
zerodamage HardwareHeaven Extreme Member Join Date: May 2003 Location: Virginia, USA Posts: 3,478 Rep Power: 0 System Specs	Wintools is the spyare there. You also have this: O4 - HKCU\..\Run: [zSearch] C:\Program Files\zSearch\Zstb.exe Not sure what this is: O4 - HKCU\..\Run: [msmc] C:\WINDOWS\System32\msgked.exe Sounds suspicious to me This also is suspisous: O4 - HKLM\..\Run: [SysUpd] C:\WINDOWS\sysupd.exe Is this for your TV capture card or something? O4 - HKLM\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe This looks like it should not be there: O4 - Startup: MemTurbo.lnk = D:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe So let me post everything you have there. Everything I have in bold should NOT be checked in your start up menu. O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SysUpd] C:\WINDOWS\sysupd.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe O4 - HKLM\..\Run: [zSearch] C:\Program Files\zSearch\Zstb.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe O4 - HKLM\..\Run: [TB_setup] C:\DOCUME~1\Garren\LOCALS~1\Temp\tb_setup.exe /dcheck O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [Steam] D:\Program Files\Steam\Steam.exe -silent O4 - HKCU\..\Run: [msmc] C:\WINDOWS\System32\msgked.exe O4 - HKCU\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe O4 - HKCU\..\Run: [zSearch] C:\Program Files\zSearch\Zstb.exe O4 - Startup: MemTurbo.lnk = D:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe Basically disable everything there except the Nvidia startup. Make sure you have the latest 1.3 of Spybot S&D and the latest update for Adaware. That will fix your problems. Let us know if this works for you. Last edited by zerodamage; May 28, 2004 at 07:36 PM.

May 28, 2004, 07:06 PM	Thread Starter #4
cedjordan DriverHeaven Newbie Join Date: Jan 2004 Posts: 19 Rep Power: 0	Yes. I've run Spybot S&D, and I've run Ad-aware. I've also ran a few virus scanes. Pcpitstop.com and housecall.trendmicro.com. I've found a few files and I can't delete them with anything, Analogx Super Shredder, Hijackthis, nothing gets rid of them.