[Kimmer37]

The icon is hard to make out, it almost looks like a baseball or a round metal shield with a red M on it. If I hover my mouse over it, or left or right click on it, it does nothing. I went through all my program files, do not see anything different. I run WinME and when I click start I don't see any new programs at the top nor over to the right when I go to programs. I ran a hijack this and didn't see anything unusual and also booted up the computer by step by step confirmation and didn't see anything unusual. I've searched almost all my files in Program files and Windows and do not see this icon anwhere else but in my systray! It comes up after my printer icon and before my AVG shield and ZoneAlarm icon. I've searched your forum under unknown icons and can't find anything. It scares me that it won't let me do a dang thing when trying to click on it! I also ran a hjt start-up list and didn't see anything unusual but I'm not an expert for sure. PLEASE help me if you can, it's making me really nervous!
Thank you!
Kim

[WhitPhil]

Start > Run > MSCONFIG > Startup tab

It is one of the processes displayed there, with a tick mark.

[Kimmer37]

Ok, thank you. I did what you said then clicked start-up tab the only thing i see that is possibly different is called: *StateMgr and when I scroll over it says C:\Windows\System\Restore\StateMgr.exe
Could this be what the icon is from?
Thank you.

[Kimmer37]

I hope I put this in the right forum but I'm scared about security with this icon that I didn't put there myself by choice!
Thank you!

[WhitPhil]

Originally Posted by Kimmer37

Could this be what the icon is from?

No, I don't think so. That is your System Restore program.

Download, install and run HiJackThis

Run the Scan and Save log option
When the file opens in Notepad, do a Select All, then Copy
Then, return here and in a reply post, Paste the contents.

[Kimmer37]

Thank you so much for your time WhitPhil!

Logfile of HijackThis v1.99.1
Scan saved at 5:19:52 PM, on 1/20/2008
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\GRISOFT\AVG7\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG7\AVGEMC.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\GRISOFT\AVG7\AVGAMSVR.EXE
C:\PROGRAM FILES\LEXMARK X1100 SERIES\LXBKBMGR.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\PROGRAM FILES\LEXMARK X1100 SERIES\LXBKBMON.EXE
C:\WINDOWS\SYSTEM\HKCMD.EXE
C:\WINDOWS\SYSTEM\MACROMED\SHOCKWAVE 10\SWHELPER_1020023.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;127.0.0.1;<local>
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\SYSTEM\igfxtray.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVG7\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVG7\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVG7\AVGAMSVR.EXE
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [LexStart] lexstart.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\SYSTEM\hkcmd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [KB918547] C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKCU\..\RunOnce: [Shockwave Updater] "C:\WINDOWS\SYSTEM\MACROMED\SHOCKWAVE 10\SWHELPER_1020023.EXE" -Update -1020023 -IEXPLORE.EXE6.0
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAM FILES\JAVA\JRE1.5.0_07\BIN\SSV.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAM FILES\JAVA\JRE1.5.0_07\BIN\SSV.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O15 - Trusted Zone: http://www.macromedia.com
O15 - Trusted Zone: http://fpdownload.macromedia.com
O15 - Trusted Zone: http://www.biola.edu
O15 - Trusted Zone: http://sdc.shockwave.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://ak.imgag.com/imgag/cp/install/Crusher.cab
O16 - DPF: {F09BFD07-20B5-46D8-A6D5-BE4EF22F1F4D} (DGTx.uc1) - http://members.driverguide.com/direc...e=toolkit_lite

[Deke123]

open as mentined above, disable all accept your security (norton ) or whatever, reboot computer, go to add and remove programs and make sure this icon is not there, if so remove, then chesk in windos files for same then remove, reboot and should be ok.

[Kimmer37]

I already tried all that Deke123 but thanks anyways for trying.

[Kimmer37]

Sorry to keep moving this to the front but I'm hoping WhitPhil will reply again!

[mrss]

How about a screen shot of the icon?

[Kimmer37]

I have the screenshot saved in MyPictures but don't know how to paste or insert the image here? Thank so much to everyone for your help, I appreciate it so much. Please let me know how to show you the screenshot.
Thanks again!
Kim

[WhitPhil]

Instead of selecting Post Quick Reply, choose Go Advanced.
Then at the bottom of that window is a Manage Attachments
Browse to where the JPG/BMP is, and upload it

It "could" be from MacroMedia

[Kimmer37]

I couldn't upload image, it's over the limit for the forum, I'll try cropping it....BBS!

[Kimmer37]

The unknown is right in the middle of my printer icon and AVG icon. screenshot3 is a bit bigger but a little fuzzy.
Thank you for your time!
Kim

[WhitPhil]

Run Msconfig, startup task

Is there an entry there, selected, called "Shockwave Updater"

If so, unselect it and reboot and see if the mysterious icon disappears.