Hi again Crunchie,

Most of the things had already been deleted and were inactive items on the start up but I double checked and did the fixes on hijack this too.

Then it gets messy, I ran the scan at Jotti's which was a problem because I cannot find the file in question on my system as previously mentioned. So I copied the path shown in msconfig start up and here is the result from Jotti's

Service load: 0% 100%

File: etkiaheclc.exe
Status: INFECTED/MALWARE
MD5: 75d1a72744a09ae06d956a8fecd92785
Packers detected: PE_PATCH
Bit9 reports: File not found


Scan taken on 25 Jun 2007 10:57:25 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found Heur.W32
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Rising Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing


Scanner Malware name
A-Squared X
AntiVir X
ArcaVir X
Avast Win32:Crypt-EM
AVG Antivirus X
BitDefender X
ClamAV X
Dr.Web X
F-Prot Antivirus X
F-Secure Anti-Virus X
Fortinet X
Kaspersky Anti-Virus X
NOD32 X
Norman Virus Control X
Panda Antivirus X
Rising Antivirus X
VirusBuster X
VBA32 X


I need now to find out what is generating the etkiaheclc.exe in star up, and also to find out what Heur.W32 is, and Win32:Crypt-EM. Any ideas where to start? AVG and Adaware were run at the start of this problem, the problem still exists

Virtual Patient