Jerlyn, your system's also infected  with viruses. You're using iMesh P2P file sharing 
app, so you should not be surprised. Do you even have an antivirus program installed?? 
Get rid of it, you're wide open to all sorts of garbage, hackers, etc.

What's in your P2P "bundle"?

Trojan VBS Seeker virus: I can give you a start on it, but it's up to you to run 
a virus scan.  You're going to have to boot into Safe Mode, to run Hijack This and 
fix these entries, so it doesn't run>>> Internat.exe. 

First create a folder for Hijack This. You can't run it from your desktop, because 
it creates backups. Cut/Paste into a folder, any folder but a temp folder. 

Reboot into Safe Mode by pressing and holding the CTRL or F8 key, before Windows 
loads. Run Hijack This. Select these entries. Choose Fix Checked. Reboot into Safe 
Mode again to locate and delete the file mentioned below. 

C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM\P2P NETWORKING\P2P NETWORKING.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\RNATHCHK.EXE
C:\PROGRAM FILES\IMESH\CLIENT\IMESHCLIENT.EXE
C:\WINDOWS\SYSTEM\TLA.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.soucn.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soucn.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.soucn.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soucn.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.soucn.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.soucn.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.soucn.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R3 - URLSearchHook: (no name) - {BC207F7D-3E63-4ACA-99B5-FB5F8428200C} - (no file)
O2 - BHO: (no name) - {BC207F7D-3E63-4ACA-99B5-FB5F8428200C} - (no file)
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe??
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"-osboot
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [P2P NETWORKING] C:\WINDOWS\SYSTEM\P2P NETWORKING\P2P NETWORKING.EXE 
/AUTOSTART
O4 - HKLM\..\Run: [WlN32] regedit -s C:\$NtUninstallQ887508$\WINSYS.cer
O4 - HKLM\..\Run: [Intrenat] C:\WINDOWS\intrenat.exe
O4 - HKLM\..\Run: [IEXPLORE.EXE] IEXPLORE.EXE http://www.soucn.net
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [tlA] C:\WINDOWS\SYSTEM\tlA.exe
O4 - HKLM\..\RunServices: [Intrenat] C:\WINDOWS\intrenat.exe
O4 - HKCU\..\Run: [] regedit -s C:\$NtUninstallQ887508$\WINSYS.cer
O4 - HKLM\..\RunOnce: [WlN32] C:\$NtUninstallQ887508$\WINSYS.vbs
O4 - Startup: iMesh.lnk = C:\Program Files\iMesh\Client\iMeshClient.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Allow Popups - C:\Program Files\Meaya\Popup Ad Filter\WhiteGetUrl.js
O9 - Extra button: °Ù¶ÈËÑË÷°é (HKLM)
O11 - Options group: [!IESearch] !IESearch
O16 - DPF: {BC207F7D-3E63-4ACA-99B5-FB5F8428200C} - http://bar.baidu.com/update/IESearch.cab

Locate and delete any and all instances of Internat.exe. C:\WINDOWS\intrenat.exe 
You can use Find - Files to search for it.

Free online Virus Scans, whichever one you prefer:

Panda Active Scan

Bitdefender

Download this .reg file to your Desktop. Double-click on it and answer Yes, to merge 
into your registry. It will restore all the default Search settings for IE. IEFIX.reg

I suggest using SpywareBlaster for spyware prevention. Be sure to check for and download 
updates after installing it, and frequently thereafter. There's also SpywareGuard, 
if you want to use both.
http://www.javacoolsoftware.com/spywareblaster.html

Carol  

• Reply or follow-up to this message

• Search this forum
• Start a new thread on a different subject

• Report abuse of the forum