Tarun

It's sad how many people actually try to pass of malicious programs as being helpful ones.

You have a worm. Possible solutions: WORM_WUKILL.A WORM_WUKILL.B WORM_WUKILL.C WORM_WUKILL.D WORM_WUKILL.E WORM_WUKILL.F WORM_WUKILL.H WORM_WUKILL.I

Even though it's beta it's highly stable. After all, it's on my tech cd.

EVEREST Beta 0325

Any information on getting a torrent started would be helpful. Also, I'm updating the cd with a few things I forgot, so the original post will update frequently. I'll also add in the size of all the folders via a notation beside them.

I've got to find a host for it. I may look into some friends who can support it on their server pc's and thus would be a lot less bandwidth limitations.

I checked into it, and this is from the AIM Ad-Hack site. Kinda hard to say from that, as they do not say whether it is or is not. I'll investigate further when I have time.

Yeah, I got down to it and made a Tech Cd. This file is 506MB and holds a bunch of goodies that I feel people would need. If you think of something that should be on the tech cd, post here and please stay on topic. Feel free to voice any questions, comments, or suggestions. Current contents: Tarun's TechCd v1.03 ---------------------------------------------------------------------- Legend: + Folder * Application / Executable ---------------------------------------------------------------------- +BootCD *autorun.com +Vdefs ---------------------------------------------------------------------- +Tech +Anti-Malware *CWShredder 2.15 *Spyware Blaster 3.4 *Ad-Aware SE Personal 1.06 *Spybot S&D 1.4 *Microsoft AntiSpyware 1.0.501 *CCleaner 1.19.108 *HijackThis 1.99.1 ------------------------------------------------------------------ +Drivers +ATi *5.04 Win98ME *5.6 WinXP2000 +nVidia *71.84 Win9xME *71.89 WinXP2000 ------------------------------------------------------------------ +Everest *2.00.325 Beta (including needed files and multi-languages) ------------------------------------------------------------------ +Security +Anti-Virus *Avast Free *AVG Free *F-Secure Free +Firewall +Agnitum Outpost *Outpost Pro 2.7.485.403 *Outpost Free 1.0.1817.1645 AdsToBlock.ad +ZoneAlarm *ZoneAlarm Free 5.5.094 *ZoneAlarm Pro 5.5.094 *Sygate Firewall Microsoft Free Anti-Virus.url ------------------------------------------------------------------ +Software +Acrobat Reader +5.0.5 for Win95 - 98FE *Acrobat 505 +6.0.3 *Acrobat 603 Silent +7.01 *Acrobat 701 Silent +Browsers +IE6 Full *IE 6 Setup +Java *jre-1.5.0.03-windows +PlugIns *FlashIE *FlashMozilla *Shockwave And Flash *Shockwave *Firefox 1.0.4 Setup +Compression *Winzip 9.0 *WinRAR 3.5 Beta 3 +Defrag +PerfectDisk 6 (For 9x/ME) *PerfectDisk Trial *PerfectDisk Trial Update +PerfectDisk 7 (For XP/2000/NT) *PerfectDisk 7 Trial +EMail Clients *Thunderbird Setup 1.0.2 +Instant Messengers *AIM 5.5.3598 *AIM Ad-Hack for 5.5.3599 *Msn Messenger 7.0.0813 *Mess.be Patch for Msn 7 +Multimedia +Codecs *Kazaa Lite Full 2.49 *Quicktime Alt 1.50 b1 *Real Alt 1.41 +WMP *MP9Setup *MP9SetupXP *MP10Setup *Winamp 5.093 +Password Related *Password Generator *Revelation +Registry Cleaners +Registry First Aid *RFASetup *RegClean *a² HiJackFree ------------------------------------------------------------------ +Utilities +LSPFix *LSPFix LspFix.txt *Killbox *SymNRT ------------------------------------------------------------------ +Windows +9x & ME *98SE SP2.0.1 *TweakUi 1.33 +DirectX9 *DirectX9c +DotNET *DotNET 1.1 +Keyfinder *Keyfinder +Runtimes *VB6 SP6 +XP & 2000 +2000 *TweakUi 1.33 *Win2000 MsConfig +RegOpt XP 2000 NT *NTREGOPT +XP +GUI Changers *Royale Theme *XPize 3.2 +Xp-AntiSpy *xp-AntiSpy 3.94-1 *CmdHereXP *Keygen *Prefetch Edit *TweakUi Powertoy 2.10 *UXTheme Multi-Patcher 4.0 *RegCompact.NET 1.8 UninstallMSJava.exe ---------------------------------------------------------------------- Changelog.txt Lunarsoft Homepage.url TechCdDist.txt ----------------------------------------------------------------------

I agree, I've submitted news too (such as the recent news with CCleaner 1.19.105) and no mention that I submitted. I've talked with him about it, and frankly if I submit news I still want to be mentioned.

The true star:

Ice Age 2 (Shockwave Flash) Ice Age 2 (Quicktime) Enjoy!

My site also did this when I got emails from the php I use. Tried to add the address to the safe list but it didn't work.

Generated by Tarun's HijackThis Converter. Changed registry value. Safe to remove: R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p...B_PVER}&ar=home R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.vt.edu/ Virginia Tech eh? Go Hokies! Created registry value. Safe to remove: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?p...er=6&ar=msnhome R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/keyword/%s Enumeration of existing IE's BHO's. Safe to remove: O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - f:\program files\google\googletoolbar1.dll (filesize 720896 bytes, MD5 D4E9B7B696E8C40A0E5CB76621A03EE4) Enumeration of existing IE's toolbars. Safe to remove: O3 - Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - f:\program files\google\googletoolbar1.dll (filesize 720896 bytes, MD5 D4E9B7B696E8C40A0E5CB76621A03EE4) Enumeration of suspicious auto-loading registry entries. Safe to remove: O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack (filesize 33280 bytes, MD5 DA285490BBD8A1D0CE6623577D5BA1FF) O4 - HKLM\..\Run: [sunJavaUpdateSched] F:\Program Files\Java\jre1.5.0_02\bin\jusched.exeF:\Program Files\Java\jre1.5.0_02\bin\jusched.exe O4 - HKLM\..\Run: [HostManager] F:\Program Files\Common Files\AOL\1114308405\EE\AOLHostManager.exeF:\Program Files\Common Files\AOL\1114308405\EE\AOLHostManager.exe O4 - HKLM\..\Run: [AOLDialer] F:\Program Files\Common Files\AOL\ACS\AOLDial.exeF:\Program Files\Common Files\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [AOL Spyware Protection] "F:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" (filesize 79448 bytes, MD5 747F55208A1508DB7B91E0E1FE0EF23A) O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime (filesize 98304 bytes, MD5 C341CCFBE98BC7DF6E0B856BB9FC265A) O4 - HKLM\..\Run: [TkBellExe] "F:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot (filesize 180269 bytes, MD5 77ED13FD3196EBC7311CCD6899C7488C) O4 - HKLM\..\Run: [Pure Networks Port Magic] "F:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run (filesize 99480 bytes, MD5 BA99C608A075C44026720D5383F3D75B) O4 - HKLM\..\Run: [NeroCheck] F:\WINDOWS\system32\NeroCheck.exeF:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [inCD] F:\Program Files\Ahead\InCD\InCD.exeF:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [CoolSwitch] F:\WINDOWS\system32\taskswitch.exeF:\WINDOWS\system32\taskswitch.exe O4 - Startup: OpenOffice.org 1.9.95.lnk = F:\Program Files\OpenOffice.org 1.9.95\program\quickstart.exe (filesize 61440 bytes, MD5 F629F72337A4E5E81B65976DA53904CD) O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (filesize 29696 bytes, MD5 DEB88AEF013DD1EEFB462D7CAD642166) O4 - Global Startup: InterVideo WinCinema Manager.lnk = F:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe (filesize 184320 bytes, MD5 B43EC2FD9819A4D428E63F59E57A8589) O4 - Global Startup: PowerMenu.lnk = F:\Program Files\PowerMenu\PowerMenu.exe (filesize 57344 bytes, MD5 CD1606AC1029DFCBE630F86598133635) Extra IE context menu items. Safe to remove: O8 - Extra context menu item: &AOL Toolbar search - res://F:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: &Google Search - res://F:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &ieSpell Options - res://F:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM O8 - Extra context menu item: Backward Links - res://F:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://F:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Check &Spelling - res://F:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM O8 - Extra context menu item: Similar Pages - res://F:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://F:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html Extra "Tools" menu items and buttons. Safe to remove: O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\j2re1.4.2_08\bin\npjpi142_08.dll (filesize 65650 bytes, MD5 F0D7F1B4A1D8053917B9E913B0E33A73) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\j2re1.4.2_08\bin\npjpi142_08.dll (filesize 65650 bytes, MD5 F0D7F1B4A1D8053917B9E913B0E33A73) O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - F:\Program Files\ieSpell\iespell.dll (filesize 212992 bytes, MD5 4EABC79426C1895ADA0E06948AAB3F5D) O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - F:\Program Files\ieSpell\iespell.dll (filesize 212992 bytes, MD5 4EABC79426C1895ADA0E06948AAB3F5D) O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - F:\Program Files\ieSpell\iespell.dll (filesize 212992 bytes, MD5 4EABC79426C1895ADA0E06948AAB3F5D) O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - F:\Program Files\ieSpell\iespell.dll (filesize 212992 bytes, MD5 4EABC79426C1895ADA0E06948AAB3F5D) O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file) O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file) O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - F:\WINDOWS\system32\Shdocvw.dll (filesize 1483264 bytes, MD5 AE8AB1175327702D3A6F10DC122C254E) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe (filesize 1611480 bytes, MD5 8B04AE828D82F74BCEE9FDF3F7A4AC00) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe (filesize 1611480 bytes, MD5 8B04AE828D82F74BCEE9FDF3F7A4AC00) Broken Internet access. To fix these you will need LSPFix. Safe to remove: O10 - Broken Internet access because of LSP provider 'connwsp.dll' missing ------------------------------------------------------------------------------- Get yourself Real Alternative and Quicktime Alternative. These work far better and aren't as weedlike. Are you a Firefox user? If not, you may wish to get Firefox 1.0.3. You can safely uninstall any Toolbars, and AOL's spyware protection is a joke. Do you use AOL as your primary Internet access?

majorgeeks.com for Prefetch. There's a great util there.

Generated by Tarun's HijackThis Converter. Created registry value. Safe to remove: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = C:\WINDOWS\blank.htm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/mywaybiz Changed registry value. Safe to remove: R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/mywaybiz R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Created extra registry value where only one should be. Safe to remove: R3 - Default URLSearchHook is missing Enumeration of existing IE's BHO's. Safe to remove: O2 - BHO: (no name) - {962F12AE-2773-4BEB-99EA-B5C3AB9A6606} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: (no name) - {B73F75B8-93F3-429D-FF34-660B206D897A} - C:\WINDOWS\System32\pifn.dll O2 - BHO: (no name) - {E437B5F3-5F14-56CC-49FE-05E2EA5376B2} - C:\WINDOWS\System32\xfr.dll Enumeration of existing IE's toolbars. Safe to remove: O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll Enumeration of suspicious auto-loading registry entries. Safe to remove: O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [updateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [DwlClient] c:\Program Files\Common Files\Dell\EUSW\Support.exe O4 - HKLM\..\Run: [sSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe Definitely remove these. Virus/trojan related: O4 - HKLM\..\Run: [systemos Restart] Rundll32.exe pifn.dll, DllRegisterServer O4 - HKLM\..\Run: [Rra] C:\WINDOWS\Lfo.exe O4 - HKLM\..\Run: [iqd] C:\WINDOWS\Erd.exe O4 - HKLM\..\Run: [Mcg] C:\WINDOWS\System32\Ikj.exe O4 - HKLM\..\Run: [Noe] C:\WINDOWS\System32\Cha.exe O4 - HKLM\..\Run: [shell] open32.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Rra] C:\WINDOWS\Lfo.exe O4 - HKCU\..\Run: [iqd] C:\WINDOWS\Erd.exe O4 - HKCU\..\Run: [Mcg] C:\WINDOWS\System32\Ikj.exe O4 - HKCU\..\Run: [Noe] C:\WINDOWS\System32\Cha.exe O4 - HKCU\..\Run: [Aida] C:\Documents and Settings\Christopher\Application Data\eetu.exe O4 - HKCU\..\Run: [xservice] C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\temp25.exe O4 - Startup: winupdate00479110[1].exe Extra IE context menu items. Safe to remove: O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html Extra "Tools" menu items and buttons. Safe to remove: O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Microsoft AntiSpyware helper - {9BC603C0-C00A-4910-9E57-65DBE757B270} - (no file) (HKCU) O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {9BC603C0-C00A-4910-9E57-65DBE757B270} - (no file) (HKCU) Trusted Zone Autoadd. Safe to remove: O15 - Trusted Zone: *.blazefind.com O15 - Trusted Zone: *.clickspring.net O15 - Trusted Zone: *.flingstone.com O15 - Trusted Zone: *.horse-active.net O15 - Trusted Zone: *.mt-download.com O15 - Trusted Zone: *.my-internet.info O15 - Trusted Zone: *.searchbarcash.com O15 - Trusted Zone: *.searchmiracle.com O15 - Trusted Zone: *.skoobidoo.com O15 - Trusted Zone: *.slotch.com O15 - Trusted Zone: *.slotchbar.com O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.xxxtoolbar.com O15 - Trusted Zone: *.ysbweb.com O15 - Trusted Zone: *.blazefind.com (HKLM) O15 - Trusted Zone: *.clickspring.net (HKLM) O15 - Trusted Zone: *.flingstone.com (HKLM) O15 - Trusted Zone: *.horse-active.net (HKLM) O15 - Trusted Zone: *.mt-download.com (HKLM) O15 - Trusted Zone: *.my-internet.info (HKLM) O15 - Trusted Zone: *.searchbarcash.com (HKLM) O15 - Trusted Zone: *.searchmiracle.com (HKLM) O15 - Trusted Zone: *.skoobidoo.com (HKLM) O15 - Trusted Zone: *.slotch.com (HKLM) O15 - Trusted Zone: *.slotchbar.com (HKLM) O15 - Trusted Zone: *.windupdates.com (HKLM) O15 - Trusted Zone: *.xxxtoolbar.com (HKLM) O15 - Trusted Zone: *.ysbweb.com (HKLM) O15 - Trusted IP range: 64.62.171.156 O15 - Trusted IP range: 64.62.171.156 (HKLM) Downloaded Program Files item. Safe to remove: O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsIns....cab?refid=4604 AppInit_DLLs autorun Registry value, Winlogon Notify Registry keys. Safe to remove: O20 - Winlogon Notify: drct16 - drct16.dll (file missing) O20 - Winlogon Notify: Sebring - C:\WINDOWS\System32\LgNotify.dll Enumeration of NT Services. Safe to remove: O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe (file missing) --------------------------------------------------------------- Disable System Restore. Right-click My Computer, and then click Properties. Click the System Restore tab. Check the "Turn off System Restore" or "Turn off System Restore on all drives". Reboot into Safe Mode (F8 at Windows splash screen) and run HijackThis to remove the entries above. Start > Run... > regsvr32 /u /s C:\Windows\System32\LgNotify.dll Upon reboot, re-enable System Restore if you use it. Since you use Quicktime, uninstall it and get yourself Quicktime Alternative as well. Also, uninstall Google Toolbar; especially if you use Firefox. If you don't use Firefox, get it here. After your system is fully clean, it is recommended to upgrade to XP SP2.

Well first we need to get you to the right forum. Here is where you should be. Then, read this topic and do as instructed. A format is NOT recommended and is a last resort.

If need be, as said prior; post a HijackThis log.

Did Ad-Aware detect anything? If concerned, post a HijackThis log after running Ad-Aware and Spybot. Also, you may wish to get Spybot 1.4RC1 (RC2 is unstable) <{POST_SNAPBACK}> Thanks Tarun, Ad-aware didn't hit anything. I only use Ad-Aware SE Pro and Spybot S&D 1.3. I already tried trial versions of spysweeper, spyware doctor, counterspy and windows antispyware beta. None of these can detect the adware 'backweb lite' that only spybot 1.3 can (with latest definitions released yesterday). I'm guessing it is associated to legit programs so I decided to wait and investigate. I'll try spybot 1.4 beta as last resort <{POST_SNAPBACK}> MSAS also does a great job for a beta.

Did Ad-Aware detect anything? If concerned, post a HijackThis log after running Ad-Aware and Spybot. Also, you may wish to get Spybot 1.4RC1 (RC2 is unstable)

Which Spybot are you using?

Here's a start for you, XPerties. Google Translated

Wow, I did a basic Google and got this. Adding website to search engines.

I never added mine or anything. Yet if you google Lunarsoft, it's the second one in the list. Though, I admit I'd like to know too.

Before you post a HijackThis log, go here and follow the detailed instructions.

Sometimes Windows has flukes. I had a *.inf fluke that was a pain. I didn't bother fixing it cause I had a new hard drive coming.