Thank you again raven....I ran Malwarebytes anti-malware here's what it found and removed (I hope). Am I safe? ML Malwarebytes' Anti-Malware 1.33 Database version: 1666 Windows 5.1.2600 Service Pack 3 1/19/2009 10:30:33 AM mbam-log-2009-01-19 (10-30-33).txt Scan type: Full Scan (C:\:) Objects scanned: 197451 Time elapsed: 1 hour(s), 56 minute(s), 45 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 15 Registry Values Infected: 1 Registry Data Items Infected: 0 Folders Infected: 3 Files Infected: 4 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\"e4e3e0f8-cd30-4380-8ce9-b96904bdefca> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\"fe8a736f-4124-4d9c-b4b1-3b12381efabe> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\"4d25f920-b9fe-4682-bf72-8ab8210d6d75> (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\"4d25f923-b9fe-4682-bf72-8ab8210d6d75> (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\"4d25f921-b9fe-4682-bf72-8ab8210d6d75> (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\"4d25f921-b9fe-4682-bf72-8ab8210d6d75> (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\"4d25f921-b9fe-4682-bf72-8ab8210d6d75> (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\"4d25f924-b9fe-4682-bf72-8ab8210d6d75> (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\"4d25f926-b9fe-4682-bf72-8ab8210d6d75> (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\"df780f87-ff2b-4df8-92d0-73db16a1543a> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\"c9c5deaf-0a1f-4660-8279-9edfad6fefe1> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\"df780f87-ff2b-4df8-92d0-73db16a1543a> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\MSFox (Trojan.Agent) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\"4d25f926-b9fe-4682-bf72-8ab8210d6d75> (Adware.MyWebSearch) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: C:\Program Files\MyWaySA (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWaySA\SrchAsDe (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWaySA\SrchAsDe\1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully. Files Infected: C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\System Volume Information\_restore"202550A8-7A33-4BCA-9586-051D24DDBF8F>\RP1338\A0323718.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\rdno5MqT.exe.a_a (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Catherine\Local Settings\Temp\~tmpb.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

I am suspicious that such a message is from MSE. I am inclined to think you have a virus. Download and run Malwarebytes (www.malwarebytes.org) and Super Antispyware (www.superantispyware.com) -- both free -- run their scans, and report back. And, as azinoh says, if you are running both Avast and MSE at the same time, stop: choose one and disable the other.

no no you do not clean anything with hijack this you must go to the landzdown forum that was listed and start a thread there in the hijackthis area then post your results from hijack this there in your post, also tell them everything you have done they will come and help you with step by step directions, the hijackthis produces a log file that is what you need to post there for them to review so they know what steps to take, the team there is one of the best on the net so be assured they will help you but it takes time it is not a one deal cure all it is a step by step proceedure. Just tell Corrine that I and Zep sent you there and you can also link back to this thread here so they can see this info. There have been many with that infection recently and they are able to be cleaned. go here register at the forum and post your thread in this area HijackThis Logs

ld12.exe seems to be harmful file from what I see on a search. Guessing its still starting and keys or components have been removed so the start up process is incomplete & giving that error ... I'm suprised you dont see something in Event Viewer . Dont have XP here to refresh my memory but maybe similar, in Vista's Management console you could look at Reliability and Performance / Reliability Monitor. And maybe see what is failing. If you are familiar with regedit maybe search that file then look in the Run keys to see if you can recognise what process or program maybe is firing up that actually used that file - to give you something to work on.