[twx]

i have this toolbar that opens up everytime i open I.E. and once and a while it places icons on my desktop for makemoney,music,travel and other crap what can i do to get rid of this?




Logfile of HijackThis v1.97.7
Scan saved at 8:55:32 AM, on 1/31/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Tim\Desktop\Tims Stuff\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.fckkqhjqx...8LDUmjjNfO.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
O4 - HKCU\..\Run: [skip bib] C:\DOCUME~1\Tim\APPLIC~1\01INTE~1\link this tons.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

[Advertisements]

I believe this (usually any program that ends... tons.exe) is the lop.com infection. Sometimes it puts a little round icon down by the clock... if so, right click on that, choose Menu, then Help, then Uninstall

Also, Spybot should be able to remove this

Here's more info
http://www3.ca.com/s...t.aspx?id=59266

[Tim Wellman]

I believe this (usually any program that ends... tons.exe) is the lop.com infection. Sometimes it puts a little round icon down by the clock... if so, right click on that, choose Menu, then Help, then Uninstall

Also, Spybot should be able to remove this

Here's more info
http://www3.ca.com/s...t.aspx?id=59266