then update your java from 1.4.2 to 1.5.0_06, per directions lower-down in that same link
**********************
You're running HJT from a TEMP directory:
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\8H09M7GP\HijackThis[1].exe
When you do so, either HJT will not create its log files and backup files; or if it does, you risk losing them when the TEMP's cache is cleared. It's important that you save these backup files, in case you have to "undo" [restore] some of the things you "FIX" incorrectly.
So you need to move HJT into a separate, non-temporary, non-Desktop, directory of its own. We recommend using the directory C:\HJT , so that it will then appear in your log, under running processes, as C:\HJT\HiJackThis.exe
*********************
after you move HJT, as i've just instructed:
close your internet browser
Run HJT. click on DO A SYSTEM SCAN ONLY
Place a check-mark in the box in front of the lines:
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
Click on FIX CHECKED. Close HJT. Reboot
**************
when you're done, generate a brand-new HiJackThis log.
REPLY to this thread, and post the HJT log.
please also post a copy of your VundoFix.txt log, which you should find in your ROOT directory, C:\
and be sure to let us know if this fixed your Winfixer/virtumundo popup problem.
Close Internet Explorer and run Hijackthis (scan only) and then check this line and then Fix Checked.
O2 - BHO: (no name) - {635589D3-7C39-4C29-A76D-9FB93D9456D3} - C:\WINNT\system32\hcsnnfth.dll
Restart Internet Explorer and do a new scan. Does the line come back?
No idea what it is but it's something with a random name (no hits on google) and that is always a bad sign. That's what KY331 was suspecting was a morwill infection.
You can delete any programs we had you install but leave Hijackthis for now. You can also run Hijackthis, View the List of Backups and Delete All. If we used killbox its backup files can be removed now too. Run Killbox and select File, Cleanup, Delete All Backups. If you have an antivirus, check its quarantined files and delete any it had found.
You should also definitely toggle System Restore Off and then back On.
Following site has very clear instructions for turning it off. To turn it back on you just repeat the instructions but uncheck the box where it says to Turn Off System Restore on all Drives.
The reason we do this is to remove any archived copies of the infection from System Restore so that if you have to use SYstem Restore to fix a problem you won't accidentally reinfect your system. The next link explains how to use System Restore to go back in time if you hit a bad site or get infected.
One way to make an infection more obvious is to check everything in your current HijackThis and Add to Ignore List then set up Hijackthis to run at boot and to show you if it finds anything new. You do this by None of the Above Just start the program, Config (Main) and then check the box in front of Run Hiajckthis at startup and show it when items are found. OK. Then if Hijackthis opens after a boot it will show you any new programs that have been added. You can then decide if you want to keep them or not. If in doubt you can google for the .exe or .dll file at the end of the entry and see if what other people think of it.
Make sure you have removed any older versions of Java or JRE with Control Panel, Add/Remove Programs. Updates do not remove the older versions which have exploitable flaws.
If you have an older PC get rid of Microsoft Java Virtual Machine.
Following site explains how to tell if you have it:
If you feel that Internet Explorer is running a bit slower after the latest Java update you can try checking this line and then Fix Checked.
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
It was added by the latest version of Java. We don't know why. Earlier versions did not have it. It has been proven to slow down connections on some systems and removing it doesn't seem to hurt anything.
Other items you may wish to get rid of if you own a Dell are:
THese are from the MyWay Adware program installed on most Dells. The uninstaller was broken on many of them. To remove just close Internet Explorer, run HijackThis (scan only) and check them then Fix Checked.
If you are not running the latest version of Adobe you should consider updating. There are reports of a loophole for hackers in pre 7.03 versions. As an alternative you can dump adobe completely and use fox-it instead: http://www.foxitsoftware.com/pdf/rd_intro.php
If you do not have an antivirus program or the one you have was a trial that has expired then try the free antivirus for home users from Avast! http://www.avast.com/eng/download-avast-home.html (Uninstall any other antivirus program first.)
If you run Macromedia Flash make sure you have the latest version. We just got a warning the following versions are vulnerable: * Flash Player 8.0.22.0 and earlier * Flash Professional 8 * Flash Basic * Flash MX 2004 * Flash Debug Player 7.0.14.0 and earlier * Flex 1.5 * Breeze Meeting Add-In 5.1 and earlier * Adobe Macromedia Shockwave Player 10.1.0.11 and earlier
ky331
3 Apprentice
•
15.6K Posts
0
April 23rd, 2006 13:00
You're running HJT from a TEMP directory:
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\8H09M7GP\HijackThis[1].exe
When you do so, either HJT will not create its log files and backup files; or if it does, you risk losing them when the TEMP's cache is cleared. It's important that you save these backup files, in case you have to "undo" [restore] some of the things you "FIX" incorrectly.So you need to move HJT into a separate, non-temporary, non-Desktop, directory of its own. We recommend using the directory C:\HJT , so that it will then appear in your log, under running processes, as C:\HJT\HiJackThis.exe
*********************
after you move HJT, as i've just instructed:
close your internet browser
Run HJT. click on DO A SYSTEM SCAN ONLY
Place a check-mark in the box in front of the lines:
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
Click on FIX CHECKED. Close HJT. Reboot
**************
meters14
5 Posts
0
April 23rd, 2006 14:00
And my VundoFix log is below.
Thanks again! This has made my weekend.
VundoFix V4.2.71
Checking Java version...
Scan started at 11:04:15 AM 4/23/2006
Listing files found while scanning....
C:\WINNT\system32\jkkjh.dll
C:\WINNT\system32\hjkkj.ini
C:\WINNT\system32\hjkkj.bak1
C:\WINNT\system32\hjkkj.bak2
C:\WINNT\system32\hjkkj.ini2
C:\WINNT\system32\hjkkj.tmp
C:\WINNT\system32\hjkkj.bak1
C:\WINNT\system32\hjkkj.bak2
C:\WINNT\system32\hjkkj.tmp
C:\WINNT\system32\hjkkj.ini
C:\WINNT\system32\hjkkj.ini2
C:\WINNT\system32\jkkjh.dll
C:\WINNT\system32\hjkkj.ini2
C:\WINNT\system32\hjkkj.bak2
C:\WINNT\system32\hjkkj.tmp
C:\WINNT\system32\hjkkj.ini
C:\WINNT\system32\hjkkj.ini2
C:\WINNT\system32\jkkjh.dll
Attempting to delete C:\WINNT\system32\jkkjh.dll
C:\WINNT\system32\jkkjh.dll Has been deleted!
Attempting to delete C:\WINNT\system32\hjkkj.ini
C:\WINNT\system32\hjkkj.ini Has been deleted!
Attempting to delete C:\WINNT\system32\hjkkj.bak1
C:\WINNT\system32\hjkkj.bak1 Has been deleted!
Attempting to delete C:\WINNT\system32\hjkkj.bak2
C:\WINNT\system32\hjkkj.bak2 Has been deleted!
Attempting to delete C:\WINNT\system32\hjkkj.ini2
C:\WINNT\system32\hjkkj.ini2 Has been deleted!
Attempting to delete C:\WINNT\system32\hjkkj.tmp
C:\WINNT\system32\hjkkj.tmp Has been deleted!
Performing Repairs to the registry.
Done!
meters14
5 Posts
0
April 23rd, 2006 14:00
It seems so far that your instructions did the trick, and I am very very grateful. Below is my new hjt log.
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\wscntfy.exe
C:\WINNT\AGRSMMSG.exe
C:\Program Files\Gateway Utilities\GWInkMonitor.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Google\Gmail Notifier\G001-1.0.25.0\gnotify.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\TiVo Shared\Transfer\TivoTransfer.exe
C:\Program Files\TiVo\Desktop\TiVoServer.exe
C:\Program Files\Bloglines Notifier\Notifier.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.google.com/news?hl=en&ned=us&ie=UTF-8&scoring=d&q=%22john+tanner%22&btnG=Search+News
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.google.com/news?hl=en&ned=us&ie=UTF-8&scoring=d&q=%22john+tanner%22&btnG=Search+News
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {635589D3-7C39-4C29-A76D-9FB93D9456D3} - C:\WINNT\system32\hcsnnfth.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Gateway Ink Monitor] "C:\Program Files\Gateway Utilities\GWInkMonitor.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\G001-1.0.25.0\gnotify.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [TivoTransfer] "C:\Program Files\Common Files\TiVo Shared\Transfer\TivoTransfer.exe" /auto:TivoTransfer /registry /service
O4 - HKCU\..\Run: [TivoServer] "C:\Program Files\TiVo\Desktop\TiVoServer.exe" /auto:TivoServer /registry /service
O4 - HKCU\..\Run: [BloglinesNotifier] C:\Program Files\Bloglines Notifier\Notifier.exe
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: TiVo Beacon (TivoBeacon2) - TiVo Inc. - C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe
O23 - Service: WUSB54GCSVC - Unknown owner - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe" "WUSB54GC.exe (file missing)
ky331
3 Apprentice
•
15.6K Posts
0
April 23rd, 2006 22:00
ky331
3 Apprentice
•
15.6K Posts
0
April 23rd, 2006 22:00
looks like vundofix did its job.
please be sure to update (or install) the latest JAVA 1.5.0_06 ... it's our best belief as to how to prevent a re-infection.
i'm gonna have someone else analyze the remainder of your log for additional problems (if any).
good luck.
meters14
5 Posts
0
April 23rd, 2006 23:00
RKinner
2 Intern
•
5.9K Posts
0
April 24th, 2006 19:00
Close Internet Explorer and run Hijackthis (scan only) and then check this line and then Fix Checked.
O2 - BHO: (no name) - {635589D3-7C39-4C29-A76D-9FB93D9456D3} - C:\WINNT\system32\hcsnnfth.dll
Restart Internet Explorer and do a new scan. Does the line come back?
No idea what it is but it's something with a random name (no hits on google) and that is always a bad sign. That's what KY331 was suspecting was a morwill infection.
Ron
meters14
5 Posts
0
April 25th, 2006 02:00
RKinner
2 Intern
•
5.9K Posts
0
April 25th, 2006 13:00
A Few Recommendations.
You can delete any programs we had you install but leave Hijackthis for now. You can also run Hijackthis, View the List of Backups and Delete All. If we used killbox its backup files can be removed now too. Run Killbox and select File, Cleanup, Delete All Backups. If you have an antivirus, check its quarantined files and delete any it had found.
You should also definitely toggle System Restore Off and then back On.
Following site has very clear instructions for turning it off. To turn it back on you just repeat the instructions but uncheck the box where it says to Turn Off System Restore on all Drives.
http://www.f-secure.com/v-descs/sfc_dis1.shtml
The reason we do this is to remove any archived copies of the infection from System Restore so that if you have to use SYstem Restore to fix a problem you won't accidentally reinfect your system. The next link explains how to use System Restore to go back in time if you hit a bad site or get infected.
http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/systemrestore.mspx
One way to make an infection more obvious is to check everything in your current HijackThis and Add to Ignore List then set up Hijackthis to run at boot and to show you if it finds anything new. You do this by None of the Above Just start the program, Config (Main) and then check the box in front of Run Hiajckthis at startup and show it when items are found. OK. Then if Hijackthis opens after a boot it will show you any new programs that have been added. You can then decide if you want to keep them or not. If in doubt you can google for the .exe or .dll file at the end of the entry and see if what other people think of it.
To avoid going to a bad site you might want to install IE-SpyAd and SpywareBlaster and make the other changes recommended at:.
http://www.mvps.org/winhelp2002/restricted.htm
I used to recommend Spybot's Immunize system but have recently learned it is not as good as the one at:
http://www.mvps.org/winhelp2002/hosts.htm
Always run a firewall. The one in XP SP2 is pretty good tho I think the free one from Zone Alarm is better.
http://www.zonelabs.com/store/content/company/products/trial_zaFamily/trial_zaFamily.jsp?lid=home_freedownloads
Turn on Autoupdates so you always get the latest patches from Windows.
Never hurts to do one of the free on line scans from Panda or Trend. They take a while but are pretty good.
www.pandasoftware.com/activescan/activescan.asp?
http://housecall.trendmicro.com/
I like to run Spybot S&D.
http://www.safer-networking.org/en/download/index.html
Also like to run AdAware once in a while.
http://www.lavasoftusa.com/software/adaware/
Get the latest version of
Java:
http://www.java.com/en/download/windows_automatic.jsp
Make sure you have removed any older versions of Java or JRE with Control Panel, Add/Remove Programs. Updates do not remove the older versions which have exploitable flaws.
If you have an older PC get rid of Microsoft Java Virtual Machine.
Following site explains how to tell if you have it:
http://www.java.com/en/download/help/uninstall_msvm.xml
The automated removal tool is no longer available on Microsoft's site but can be obtained here:
Download the MSJVM Removal Tool from:
http://www.majorgeeks.com/download4158.html
and run it.
If you feel that Internet Explorer is running a bit slower after the latest Java update you can try checking this line and then Fix Checked.
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
It was added by the latest version of Java. We don't know why. Earlier versions did not have it. It has been proven to slow down connections on some systems and removing it doesn't seem to hurt anything.
Other items you may wish to get rid of if you own a Dell are:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
THese are from the MyWay Adware program installed on most Dells. The uninstaller was broken on many of them.
To remove just close Internet Explorer, run HijackThis (scan only) and check them then Fix Checked.
If you are not running the latest version of Adobe you should consider updating. There are reports of a loophole for hackers in pre 7.03 versions.
As an alternative you can dump adobe completely and use fox-it instead:
http://www.foxitsoftware.com/pdf/rd_intro.php
If you do not have an antivirus program or the one you have was a trial that has expired then try the free antivirus for home users from Avast!
http://www.avast.com/eng/download-avast-home.html (Uninstall any other antivirus program first.)
If you run Macromedia Flash make sure you have the latest version. We just got a warning the following versions are vulnerable:
* Flash Player 8.0.22.0 and earlier
* Flash Professional 8
* Flash Basic
* Flash MX 2004
* Flash Debug Player 7.0.14.0 and earlier
* Flex 1.5
* Breeze Meeting Add-In 5.1 and earlier
* Adobe Macromedia Shockwave Player 10.1.0.11 and earlier
Also advise you to dump weatherbug if you have it. Start, Control Panel, Add/Remove Programs.
If you need weather then get The Weather Channel's program at:
http://www.weather.com/services/desktop.html?from=wxtoolspage&refer=wxtoolspage
If you run HP software read this:
http://support.microsoft.com/default.aspx/kb/918165?
we are getting a lot of complaints about this upgrade. Following may fix it.
http://www.kellys-korner-xp.com/regs_edits/hp.vbs
a new patch will be out April 25 which claims to fix the problem.
Ron