Hi and thanks for your help,
I ran the to programs which removed a couple of viruses, rebooted, but the problem still persists. Here are the log files:
Incident Status Location
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\OFESVR.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\APIFIL32.DLL
Adware:adware/alexa-toolbar No disinfected C:\PROGRAM FILES\Alexa Toolbar
Adware:adware/cws No disinfected C:\WINDOWS\FAVORITES\Health
Adware:adware/wupd No disinfected Windows Registry
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\MWAWT.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\DPKAPI16.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\OFESVR.DLL
Virus:Bck/Slep.A Disinfected C:\Windows\SYSTEM\Sleep.exe
Virus:Bck/Slep.A Disinfected C:\Windows\SYSTEM\appdl.exe
Adware:Adware/Alexa-Toolbar No disinfected C:\Windows\SYSTEM\ALXRES.DLL.bak
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\UpdInst.exe
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\IQETAB32.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\DZNPUT.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\WPNINET.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\CEUTOA.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\GOU32.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\MBDVDOPT.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\uxp10.dll
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\WCNNET16.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\DYKAPI16.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\CRGMGR32.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\SJC.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\phgfilt.dll
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\RXAUI.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\RJAENH.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\mjc71.dll
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\BSACKBOX.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\DD7VB.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\WZPUI.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\WDADRVUD.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\WPLP16T.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\AXCODC32.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\dsmap.dll
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\DETMSFT3.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\DULAY.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\QJSNAME.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\MKAB32.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\APIFIL32.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\Lronardo da Vinci.dll
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\TBAPI.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\DFTMSFT3.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\DLAO35.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\MGXDM.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\MQR2C.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\GLI32.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\TKISPLUS.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\JVT.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\SYSTEM\GPI32.DLL
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav1330.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav2022.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav3184.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav6103.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav7024.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav8056.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav8071.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav8083.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav8090.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav8095.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav80A5.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav80C2.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav80D0.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav80D4.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav80E2.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav80F1.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav8114.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav8123.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav8130.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav8134.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav8154.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav8161.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav8165.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav8173.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav8181.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav8185.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav8193.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav81A1.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav81B1.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav81B5.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav81C3.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav81D1.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav81E0.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav81E4.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav81F3.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav8201.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav8225.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav8233.TMP
Adware:Adware/Look2Me No disinfected C:\Windows\TEMP\pav8241.TMP
Possible Virus. No disinfected C:\Windows\Desktop\MISC\Merarite\free_pros_Merarite.exe
Possible Virus. No disinfected C:\Windows\Desktop\Freebies I can give away\Start Your Internet Business RIGHT.exe
Possible Virus. No disinfected C:\Windows\Desktop\JV Related\JV-Myths-Exploded1.exe
Possible Virus. No disinfected C:\Windows\Desktop\JV Related\Branded for me JV Ebook\rayschoicejvbook.exe
Adware:Adware/WinAD No disinfected C:\Windows\Desktop\HijackThis\backups\backup-20050803-155005-948.dll
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\BH32L60.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\MOLTUS40.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\EWSHARED.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\JFPROXY.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\DLGSIG.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\RDRC16.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\VJRSION.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\NMTFER~1.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\WOADEFUI.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\AKIFIL32.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\IDSS.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\MZJTER35.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\IHDKCS32.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\DL3J.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\MXXML3A.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\ODTWA400.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\TDEGOL~1.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\MYUTILSE.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\DPSBASE.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\MBHTML.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\OSGFS400.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\NUSWAN32.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\MHCTRL.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\OTFIL400.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\PVWEROLD.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\VWUTIL.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\MAJAVA.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\SDSTHUNK.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\AAPXEC32.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\IWWPHBK.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\PEPNDI.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\MTPISTUB.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\IQ41_QC.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\TWID_KEY.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\MRDOCS.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\SEDPAPI.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\RLCLTC5.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\AOVIEW32.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\DUMSRPCN.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\WRADRVUD.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\WZDMLOG.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\SODOCVW.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\SOTUPAPI.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\DXSPEX.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\CCTDLL.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\TYIDICDP.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\LUEXPAND.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\PHISDECD.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\DLSBASE.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\MCREPL40.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\CYRVIDDC.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\MCCONF.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\MGOEACCT.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\NIMKCERT.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\ITETCPLC.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\WUPLOC.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\MRRD3X40.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\MRVCP50.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\WG5INF16.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\MISTERY.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\LUEXPAND.1
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\JEEG2X32.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\SWSINV.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\IBSENG.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\VMREGEXP.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\WQLP32T.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\NTSWAN16.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\MVDE.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\MZSIGN32.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\IF50_QCX.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\COL3DV2.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\MXVBVM50.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\TJAVEL.0
Adware:Adware/IGetNet No disinfected C:\_RESTORE\ARCHIVE\FS667.CAB[W0075954.CPY]
Adware:Adware/IGetNet No disinfected C:\_RESTORE\ARCHIVE\FS667.CAB[W0075955.CPY]
Adware:Adware/Alexa-Toolbar No disinfected C:\_RESTORE\ARCHIVE\FS667.CAB[W0075956.CPY]
Possible Virus. No disinfected C:\My Documents\Back Up\Freebies I can give away\Start Your Internet Business RIGHT.exe
Possible Virus. No disinfected [rayschoicejvbook.zip][rayschoicejvbook.exe]
"Silent Runners.vbs", revision 39,
http://www.silentrunners.org/Operating System: Windows Me (Millennium Edition)
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
---------------------------------
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"VCatch" = "C:\PROGRAM FILES\COMMONSEARCH\VCATCH\VCATCH.EXE" ["MinuteGroup (CommonSearch)"]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"ScanRegistry" = "C:\WINDOWS\scanregw.exe /autorun" [MS]
"TaskMonitor" = "C:\WINDOWS\taskmon.exe" [MS]
"PCHealth" = "C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s" [MS]
"OEMCleanup" = "C:\WINDOWS\OPTIONS\OEMRESET.EXE /O" [file not found]
"SystemTray" = "SysTray.Exe" [MS]
"LoadPowerProfile" = "Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" [MS]
"Zone Labs Client" = ""C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"" ["Zone Labs Inc."]
"dont-touch-my-ads" = "C:\\Dont-Touch-My-Ads.exe" [file not found]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\ {++}
"LoadPowerProfile" = "Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" [MS]
"SchedulingAgent" = "mstask.exe" [MS]
"SSDPSRV" = "C:\WINDOWS\SYSTEM\ssdpsrv.exe" [MS]
"*StateMgr" = "C:\WINDOWS\System\Restore\StateMgr.exe" [MS]
"StillImageMonitor" = "C:\WINDOWS\SYSTEM\STIMON.EXE" [MS]
"TrueVector" = "C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service" ["Zone Labs Inc."]
"AutomatedBackupDaemon" = ""C:\Program Files\Depositit\Automated Backup\RunDaemon.exe"" [null data]
"KB891711" = "C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE" [MS]
HKLM\Software\Microsoft\Active Setup\Installed Components\
PerUser_CVT_Inis\(Default) = "Windows Setup - FAT32 Converter"
\StubPath = "rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_CVT_Inis 64 C:\WINDOWS\INF\applets1.inf" [MS]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = "Google Toolbar Helper" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL" ["Adobe Systems Incorporated"]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]
HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
Active Desktop and Wallpaper:
-----------------------------
Active Desktop is enabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\Desktop\VALLEY MINISTRIES\WEBSITE\New website\Image27.jpg"
Startup items in "Startup" & "All Users...Startup" folders:
-----------------------------------------------------------
C:\Windows\Start Menu\Programs\StartUp
"WinZip Quick Pick" -> shortcut to: "C:\Program Files\WinZip\WZQKPICK.EXE" ["WinZip Computing, Inc."]
"Free WebSite Tools" -> shortcut to: "C:\Program Files\CoffeeCup Software\CoffeeCup Free FTP\ThirtyDayTimer.exe" [null data]
Enabled Scheduled Tasks:
------------------------
"PCHealth Scheduler for Data Collection" -> launches: "C:\WINDOWS\PCHEALTH\SUPPORT\PCHSCHD.EXE -c" [MS]
Winsock2 Service Provider DLLs:
-------------------------------
Namespace Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "C:\WINDOWS\SYSTEM\rnr20.dll" [MS]
Transport Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
00000000000#\PackedCatalogItem (contains) DLL [Company Name], (at) # range:
C:\WINDOWS\SYSTEM\mswsosp.dll [MS], 1
C:\WINDOWS\SYSTEM\msafd.dll [MS], 2 - 4
C:\WINDOWS\SYSTEM\rsvpsp.dll [MS], 5 - 6
Toolbars, Explorer Bars, Extensions:
------------------------------------
Toolbars
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{A58686ED-FC46-44C3-95C6-4A812AB776F1}" = "WebFerret" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\FerretSoft\WebFerret\FerretBand.
Edited by Cyberchoices, 03 August 2005 - 10:57 PM.