You might want to print this out.
 
Question for you: Did you install and Do you what "SurfBuddy"?
If not uninstall it via your control panels add/remove programs.

Also please look through your control panels add/remove programs and uninstall any 
programs you don't recognize or didn't install - if you're not sure please ask first.

Next:

Go to Start->Run and type "Services.msc" (without quotes) then hit Ok 
Scroll down and find the service called: WinTools for IE service 
It will look something like this - note the file name "WToolsS.exe"

WinTools for IE service - Unknown - D:\Program Files\Common Files\WinTools\WToolsS.exe 

If you find it:  Double-click on it. In the next window that opens, click the Stop 
button, then click on properties and under the General Tab, change the Startup Type 
to Disabled. Now hit Apply and then Ok and close any open windows. If you don´t find 
this service listed go ahead with the next steps.

Next:

Press Control-Alt-Del to enter the Task Manager.
Click on the Processes tab and end the following processes if listed:

180ax.exe
WToolsA.exe
WSup.exe

Exit the Task Manager when finished

Close all programs down, leaving only HijackThis running.
Place a check against the following items:


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50195

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50195

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50195

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
 
R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - D:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll

O1 - Hosts: 255.255.255.255 www.casinoxo.com

O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com

O1 - Hosts: 255.255.255.255 www.theblackjacktable.com

O2 - BHO: (no name) - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - (no file)

O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - D:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll

O2 - BHO: (no name) - {D848A3CA-0BFB-4DE0-BA9E-A57F0CCA1C13} - (no file)

 O4 - HKLM\..\Run: [ViewMgr] D:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

O4 - HKLM\..\Run: [180ax] d:\winnt\180ax.exe

O4 - HKLM\..\Run: [WinTools] D:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe

O4 - HKCU\..\Run: [Tsa2] D:\PROGRA~1\COMMON~1\tsa\tsm2.exe

O4 - HKLM\..\Run: [qrkjub] D:\WINNT\qrkjub.exe

O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} - http://static.topconverting.com/activex/loader2.ocx

 O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} - http://cabs.media-motor.net/cabs/mmed.cab

O16 - DPF: {084F552D-19EB-4668-9788-984CBC781A8F} (AsyncDownloader Class) - http://survey.otxresearch.com/Preloader.dll

O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/minibug/tricklers/AWS/MiniBugTransporter.cab?

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab27513.cab

O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab

O16 - DPF: {FA13A9FA-CA9B-11D2-9780-00104B242EA3} (WildTangent Control) - file://E:\games\WebDriverFullInstall.exe

O23 - Service: WinTools for IE service - Unknown - D:\Program Files\Common Files\WinTools\WToolsS.exe

Click on Fix Checked and exit HijackThis

Next:
Please enable -HowToShowHiddenFiles 

Now delete these files/folders:

D:\winnt\180ax.exe <---files
D:\WINNT\qrkjub.exe

 D:\Program Files\Common Files\WinTools <---folders
 D:\Program Files\Common Files\tsa

Next:

Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. 
Let it scan your system for files to remove. Make sure these 3 are checked and then 
press *ok* to remove:

Temporary Files
Temporary Internet Files
Recycle Bin

Reboot and post a fresh log and lets see how we did - MrC

• Reply or follow-up to this message

• Search this forum
• Start a new thread on a different subject

• Report abuse of the forum