Hi Marge
The following should be roved:
WToolsA.exe
Description:
wtoolsa.exe is registered as the Adware.Huntbar. is an advertising program. This process monitors your browsing habits and distributes the data back to the author's servers for analysis. This also prompts advertising popups. This program is a registered security risk and should be removed immediately
WSup.exe
Description:
wsup.exe is a hijacker which means it will intermittently change your Internet Explorer settings / Desktop to the link of itââ‚ ¬ÃƒÂ¢Ã¢â‚¬Å¾Ã‚¢s authorââ‚Ã⠀šÃ‚¬ÃƒÂ¢Ã¢â‚¬Å¾Ã‚¢s sponsors. This program is usually installed through consent, however is sometimes packaged as another product. It is a registered security risk and should be removed immediately.
salm.exe
Description:
salm.exe is an advertising program by 180Search. This process monitors your browsing habits and distributes the data back to the author's servers for analysis. This also prompts advertising popups. This program is a registered security risk and should be removed immediately.
tbps.exe
Description:
tbps.exe is a part of WebSearch toolbar, HuntBar parasite variant
HuntBar is a search-hijacker from Traffic Syndicate, with various additional features depending on version.
tbps.exe is Spyware! Remove immediately.
PIB.exe
Description:
PIB.exe is an advertising program. This process monitors your browsing habits and distributes the data back to the author's servers for analysis. This also prompts advertising popups. This program is a registered security risk and should be removed immediately.
TBPSSvc.exe
Description:
TBPSSvc.exe is a part of the Neo Toolbar. There's several variants of this.
TBPSSvc.exe is Spyware! Remove immediately.
wtoolss.exe
Description:
wtoolss.exe is registered as the Adware.Huntbar. is an advertising program. This process monitors your browsing habits and distributes the data back to the author's servers for analysis. This also prompts advertising popups. This program is a registered security risk and should be removed immediately.
00000010-6F7D-442C-93E3-4A4827C2E4C8
Description:
nem219.dll, nem220.dll - DyFuCa/Internet Optimizer, http//www.doxdesk.com/parasite/InternetOptimizer
should be removed immediately.
87766247-311C-43B4-8499-3D5FEC94A183
Description:
WToolsB.dll - HuntBar/Wintools, http//doxdesk.com/parasite/HuntBar.html
should be removed immediately.
8952A998-1E7E-4716-B23D-3DBE03910972
Description:
Toolbar.dll - HuntBar, http//www.doxdesk.com/parasite/HuntBar.html
should be removed immediately.
F4E04583-354E-4076-BE7D-ED6A80FD66DA
Description:
msbe.dll - eXact Advertising,
http//www.doxdesk.com/parasite/BargainBuddy.html
should be removed immediately.
339BB23F-A864-48C0-A59F-29EA915965EC
Description:
toolbar.dll - Huntbar, http//www.doxdesk.com/parasite/HuntBar.html
should be removed immediately.
wtoolsa.exe
Description:
WinTools appears to be a variant of Huntbar. It is very persistent and extremely difficult to remove. It creates its own folder under Program Files/Common Files called WinTools. All of its files appear to be contained within this folder.
should be removed immediately.
WinComm.exe
Description:
wincomm.exe is a process which is registered as the w32.agobot.bg worm. This virus is distributed via the Internet through e-mail and comes in the form of an e-mail message, in the hopes that you open itâ₠¬ÃƒÂ¢Ã¢â‚¬Å¾Ã‚¢s hostile attachment. The worm has itâ₠¬ÃƒÂ¢Ã¢â‚¬Å¾Ã‚¢s own SMTP engine which means it gathers E-mails from your local computer and re-distributes itself. In worst cases this worm can allow attackers to access your computer, stealing passwords and personal data. It is a registered security risk and should be removed immediately.
optimize.exe
Description:
optimize.exe is a virus which is installed by consent from websites, and attempts to dial expensive pornography servers. This program is a registered security risk and should be removed immediately.
bargains.exe
Description:
bargains.exe is a spyware which generates pop-up advertisements and analyses your computer usage for analysis by Exact Advertising. This program is a registered security risk and should be removed immediately.
ctfmon.exe
Description:
ctfmon.exe is a part of the Microsoft Office suite. It activates the Alternative User Input Text Input Processor (TIP) and the Microsoft Office XP Language Bar. This program is a non-essential system process, but should not be terminated unless suspected to be causing problems.
TBPSSvc.exe
TBPSSvc.exe is a part of the Neo Toolbar. There's several variants of this. Please use our HJT log analyzer and HJT forum to make sure you get rid of it all.
TBPSSvc.exe is Spyware! and should be removed immediately.
wtoolss.exe
Description:
wtoolss.exe is registered as the Adware.Huntbar. is an advertising program. This process monitors your browsing habits and distributes the data back to the author's servers for analysis. This also prompts advertising popups. This program is a registered security risk and should be removed immediately.
zeta.exe
Description:
What does it do?
Details are sketchy, and it seems ZESOFT, the owners of the zeta.exe file, are no longer in business (atleast, zesoft.com doesn't seem to be working). According to this page on Paretologic.com, ZESOFT are associated with adware, specifically the AdWare.P2PNetworking, however zeta.exe itself is not mentioned there but it is adware regardless, probably just another name for the same AdWare.P2PNetworking, perhaps to create confusion.
I hope this helps you
