mfisher

Thanks for all your help Matt, the computer is now so much easier to use. I'll pass on your suggestions to the main users of the computer and hopefully nothing like this happens again. Cheers!

Hi Matt, Thanks for re-opening this topic. There has been no re-occurance of the problem but I've followed your instructions (somewhat belatedly) as requested. However I was unable to remove the file c:\program files\common files\system\ms1src.exe as it didn't seem to exist. I did the rest of the stuff though no probs. Here is the latest HJT log: Logfile of HijackThis v1.99.1 Scan saved at 07:49:55 PM, on 04/04/2006 Platform: Windows 2000 SP3 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\

Hi Matt, Thanks for taking over from Danny, I really appreciate it. What you got me to do seemed to solve the problem - for now anyway, but I'll post the logs in case there is anything else you think I should do. Things like this sometimes seem to re-appear. --------------------------------------------------------- ewido anti-malware - Scan report --------------------------------------------------------- + Created on: 06:59:16 PM, 16/03/2006 + Report-Checksum: 4823F11 + Scan result: HKLM\SOFTWARE\Classes\NaviPromo.EGNaviScoring -> Adware.NaviPromo : Cleaned with backup HKLM\SOFTW

Hi Danny, Here are the log files you requested. Thanks again for all your help. Cheers, Matt Logfile of HijackThis v1.99.1 Scan saved at 07:40:46 PM, on 01/03/2006 Platform: Windows 2000 SP3 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\Program Files\NavNT\defwatch.exe C:\WINNT\System32\svchost.exe C:\Program Files\NavNT\rtvscan.exe C:\WINNT\System32\nvsvc32.exe C:\WINNT\sys

Hi Danny, Thanks for your quick reply. I followed your instructions but when I ran the vbs script it didn't give me the prompts you talked about. All I could see it do was create a file on the desktop called runnow.txt which I have pasted below. Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Synchronization Manager"="mobsync.exe /logon" "NvCplDaemon"="RUNDLL32.EXE NvQTwk,NvCplDaemon initialize" "nwiz"="nwiz.exe /install" "Smapp"="C:\\Program Files\\Analog Devices\\SoundMAX\\Smtray.exe" "vptray"="C:\\Program Files\\NavNT\\vptray.exe" "

Hi, I've never done this before so I hope I'm in the right place. I'm yet another person trying to remove sweepstakes.com wih no luck so far. I have run HiJackThis and the log file is below. Can anyone help??? I'm desparate! Logfile of HijackThis v1.99.1 Scan saved at 12:39:56 PM, on 18/02/2006 Platform: Windows 2000 SP3 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\Progra