4832 + Interview Questions in Computer viruses and spyware in Software Page 80 InterviewSolution

3951.	Solve : Norton or McAfee.......?
Answer» I have two free sercurity Cd's. One is McAfee Internet Sercurity SUITE 2008 w/ Site Advisor, the other, Norton Internet Sercurity 2008. I need to install one of these, if you had a choice, which do you think is the better one. I know many people don't either one, but I know a little more on how to work these two in case something should happen. I know nothing about that free AVG or if they even have a help support line. Thanks.............what is your computer specs? Free AVG...no support PHONE but an excellent Free Forum. I have enough space on my computer to hold either one. My new DELL computer came with a 90 day free trial of Norton. My 90 days are almost up, so I was wondering if it was just easier renewing my Norton seeing I already have it installed. I wasn't sure if McAfee was better.You do NOT want to run more than one Anti-Virus program on one machine... Since you are set on these two select one of them and stick with it. You will be sacrificing performance for a bloated protection package but at least you were offered choices.I didn't want to run both Norton and McAfee on my computer, just one. I have Norton installed now that came with my computer for 90 days. My 90 days are almost up. I either need to renew my Norton, or let it expire, and then install McAfee. I didn't know which security is better, Norton or McAfee.Believe me, leave BOTH of them alone. They will slow your computer down, and possibly cause all kind of other problems.Here are the reasons why I don't like Norton: Norton loads so many graphics and DLLs into memory, which slows your computer down. If you GET a virus, worm, trojan whatever it is, you must be logged on as an admin to remove the virus. If the admin is not there, you are on a limited account and there is a password on the admin account that you don't know about, you're screwed -- big TIME. Live Update is a pain in the a##. You have to choose updates, and most of the time, you cannot install them for some reason. I've read a lot of posts about Norton causing problems with the internet connection. You have to pay a lot of money every year to use this product. Virus scan takes too long. I agree with patio, AVG Free Edition is a great AV product.i agree with broni, because before, i am running with 2 AV... and thats really slows down my computer. that's why i reformat my computer. 1 AV is enough in your system. try AVG free edition.If i had that choice i will leave both Norton and Macfee and go for AVG free adition its better...Quote i am running with 2 AV It's always very bad idea....My friends Lap Top came with a 90 day free install of Norton...now he has had a @#$%load of problems & needed help to remove some trojans & viruses. He is now very happy with AVG Free.I had Norton three years ago and I thought all files were removed and gone and now out of the blue I'm having a problem with my emails because Norton is lurking somewhere on my computer and I haven't figured out a way to get rid of it. I have tried everything. I highly recommend AVG.Quote from: pepper on February 06, 2008, 07:15:15 PM I had Norton three years ago and I thought all files were removed and gone and now out of the blue I'm having a problem with my emails because Norton is lurking somewhere on my computer and I haven't figured out a way to get rid of it. I have tried everything. I highly recommend AVG. From Our Archives

3951.

Solve : Norton or McAfee.......?

Answer»

I have two free sercurity Cd's. One is McAfee Internet Sercurity SUITE 2008 w/ Site Advisor, the other, Norton Internet Sercurity 2008. I need to install one of these, if you had a choice, which do you think is the better one. I know many people don't either one, but I know a little more on how to work these two in case something should happen. I know nothing about that free AVG or if they even have a help support line.
Thanks.............what is your computer specs? Free AVG...no support PHONE but an excellent Free Forum.

I have enough space on my computer to hold either one. My new DELL computer came with a 90 day free trial of Norton. My 90 days are almost up, so I was wondering if it was just easier renewing my Norton seeing I already have it installed. I wasn't sure if McAfee was better.You do NOT want to run more than one Anti-Virus program on one machine...
Since you are set on these two select one of them and stick with it.

You will be sacrificing performance for a bloated protection package but at least you were offered choices.I didn't want to run both Norton and McAfee on my computer, just one. I have Norton installed now that came with my computer for 90 days. My 90 days are almost up. I either need to renew my Norton, or let it expire, and then install McAfee. I didn't know which security is better, Norton or McAfee.Believe me, leave BOTH of them alone. They will slow your computer down, and possibly cause all kind of other problems.Here are the reasons why I don't like Norton:

Norton loads so many graphics and DLLs into memory, which slows your computer down.
If you GET a virus, worm, trojan whatever it is, you must be logged on as an admin to remove the virus. If the admin is not there, you are on a limited account and there is a password on the admin account that you don't know about, you're screwed -- big TIME.
Live Update is a pain in the a##. You have to choose updates, and most of the time, you cannot install them for some reason.
I've read a lot of posts about Norton causing problems with the internet connection.
You have to pay a lot of money every year to use this product.
Virus scan takes too long.

I agree with patio, AVG Free Edition is a great AV product.i agree with broni, because before, i am running with 2 AV... and thats really slows down my computer. that's why i reformat my computer. 1 AV is enough in your system. try AVG free edition.If i had that choice i will leave both Norton and Macfee and go for AVG free adition its better...Quote

i am running with 2 AV

It's always very bad idea....My friends Lap Top came with a 90 day free install of Norton...now he has had a @#$%load of problems & needed help to remove some trojans & viruses. He is now very happy with AVG Free.I had Norton three years ago and I thought all files were removed and gone and now out of the blue I'm having a problem with my emails because Norton is lurking somewhere on my computer and I haven't figured out a way to get rid of it. I have tried everything. I highly recommend AVG.Quote from: pepper on February 06, 2008, 07:15:15 PM

I had Norton three years ago and I thought all files were removed and gone and now out of the blue I'm having a problem with my emails because Norton is lurking somewhere on my computer and I haven't figured out a way to get rid of it. I have tried everything. I highly recommend AVG.

From Our Archives

3954.	Solve : Just need to check something?
Answer» I was trying to find something that would record keystrokes on my computer and i downloaded this thing called keyprowlerhttp://www.download.com/KeyProwler-Pro-Keylogger/3000-2132_4-10767600.html and it didnt even work and now it won't uninstall at all so i need to know if there is something i can get to really check through my computer for spyware cause i think i got a bad program and now i don't wanna do like any online banking till i check it all out so thanks.System Restore?yeah that's a great idea thanks lol i should have thought of thatIf that fails, try this. (unless you already have) Note: You may have to re-download the installer. How To Uninstall: To Increase Stealth, KeyProwler is designed so that it cannot be uninstalled VIA Windows Add/Remove Programs, the only way KeyProwler can be removed is by using the same installer that is used to install KeyProwler. To Uninstall KeyProwler: 1. Run KeyProwler Installer that you downloaded. Just as if you were going to reinstall the program. 2. Click "Next" At the Welcome Screen 3. The user is presented with 3 Options, choose "Remove" and click "Next" 4. KeyProwler is now removed from the system. evilfantasy has it! That is the intended method of removal. robrowboski: When you set it up, how did you tell it to log keystrokes? I installed it and set it up to send the log to my gmail account. WORKED like it's supposed to for me. Whoa! Crappyness! After the uninstall components of the keylogger were still running on start-up. It increased my load time from 30 seconds to about 5 minutes! My network CONNECTION started dropping out, too. I did a system restore and all is well. I was lulled into believing it was a safe download because it CAME from Download.com. I am displeased. That's some crappy software. What lead you to believe download.com doesn't have baggage ? ? I haven't trusted that site in over 4 years.You may post your HJT log for us to see, if nothing is lurking there.I guess I just haven't been burned by Download.com before. Luck, I suppose. I've learned my lesson and Windows restore saved my bacon. The rule of thumb: if your computer knowledge is limited, always ask around before installing anything new.

3956.	Solve : http://gaigoibaucat.xlphp.net virus??
Answer» is there any kind of virus like this one??? there's a text oftenly appears on my powerpoint. HELP!!!We can't tell unless you read post #1 and #2 HERE and attach the logs.i also have the same problem. i am using windows xp and avg free edition and it has the LATEST updates. the avg cannot detect the problem. the virus or whatsoever... causes my yahoo messenger to send links to all in my address list. i cannot use regedit, task MANAGER, ipconfig and folder options. so far that is the problems that i encounter. i dont have the sp1 as you say but i want to know what you think about it before i download and install any. please do help... i found out that the virus is somewhat came from a thailander... im just not SURE... please helprosemichelle You NEED to start your own topic

3959.	Solve : Need help... Yahoo Messenger Virus??
Answer» i also have the same problem. i am using windows xp and avg free edition and it has the LATEST updates. the avg cannot detect the problem. the virus or whatsoever... causes my yahoo messenger to send links to all in my address list. i cannot use regedit, task manager, ipconfig and folder OPTIONS. so FAR that is the problems that i encounter. i dont have the sp1 as you say but i want to know what you think about it before i download and install any. please do help... i found out that the virus is somewhat came from a thailander... im just not sure... please help i also dont understand this one: C:\windows\hinhem.src -ZylstraStart with this thread. Then post the logs here so we can see what is going on.The link has been removed to prevent accidental clicking. A report of the website can be found here: http://www.siteadvisor.com/sites/gaigoibaucat.xlphp.net Also, as you can see in the address above and on the report, you could visit the site if you really WANTED to.

3961.	Solve : Bl4cK P3g4sUs virus help!?
Answer» I need help on this worm. It creates 240 kb files inside folders that when you try to open them, will freeze the computer. Won't allow system restore and can't start in safe mode. It disables antivirus softwares, or any other softwares. Missing RUN in start menu. And when you try to look at my computer properties, it is suddenly registerd to Bl4cK P3g4sUs. I'll attach some pics to better explain what i mean. Although recently I gained control of the computer and was able to succesfully open a few programs, I STILL wasn't TOTALLY clean. Tried to scan, but can't find anything with norton, kaspersky or nod 32. Dr. web found something though but it only moved it. PLEASE Help! [file cleanup - saving space - attachment deleted by admin]Go through the steps LISTED here. Please read this before requesting help.

3963.	Solve : need help recovering from trojan?
Answer» i recently encountered a Trojan, I'm confident that the original file (and the ones it brought in) are gone, i used AVG scanning in safe mode to FIND and heal everything and it seems it did. the problem is that somewhere during this something took away my administrative properties. along with this the only audio i can get are the microsoft sounds, anything playing out of winamp or anything else will not play. winamp will even tell me that the driver is missing. if i could get any information about restoring myself as an admin or about the sound issues it would be appreciated Try going to device manager and reinstalling the drivers. You may also want to go here and SCROLL down to the Hijackthis instructions and post a log so we can check it to be sure the malware is actually gone.i cant go to device manager and i cant even do the first step in your intructions, i don't have administrative powers and i need help on how to remedy thisYou are going to have to get logged on as an administrator. sigh how?Parents? Whos computer is it?NO ONE IS AN ADMINISTRATORHow is that possible? Someone had to make the limited account. Is this a public computer?well in guessing it was from the virus, and no its not a public computer. there are 4 accounts on the computer, when we first set everything up we were all admins but now no oneSorry, I just re-read your first post. I wasn't clear that all accounts have been restricted. If you see me not understanding something then tell me in more detail what is going on! Log off. On the welcome screen press and hold Ctrl+Alt (both at the same time) Then press the Delete button twice. This will bring up log on options. For the user name type administrator. Do not type in a password! You should be able to log in that way. Post a Hijackthis log. If it does ask for a password then type administrator for that as well.cant, it says that the system cannot log me on because the user name or password is incorrect, i tried it with and without the administrator as a password whats the likely hood that I'm just going to have to reformat?Last ditch effort...... http://home.eunet.no/pnordahl/ntpasswd/Hmm, this may be a bit above my level, i think i may just end up dumping everything and starting freshSometimes that is the best choice. Without knowing exactly what is on the computer I am going to include this speech on backdoor trojans. It has some information you may want to follow through with to do with personal information (identity theft) Again this MIGHT not apply but it never hurts to be on the safe side. Backdoor Trojans, IRCBots and rootkits are very dangerous because they provide a means of accessing a computer system that bypasses security mechanisms and steal SENSITIVE information like passwords, personal and financial data which they send back to the hacker. Remote attackers USE Backdoor Trojans as part of an exploit to to gain unauthorized access to a computer and take control of it without your knowledge. Read this article: Danger: Remote Access Trojans. If your computer was used for online banking, has credit card information or other sensitive data on it, all passwords should be changed immediately to include those used for banking, email, eBay and forums. You should consider them to be compromised. They should be changed by using a different computer and not the infected one! If not, an attacker may get the new passwords and transaction information. Banking and credit card institutions should be notified of the possible security breach. Your PC has likely been compromised and there is no way to be sure the computer can ever be trusted again. It is dangerous and incorrect to assume that because the Backdoor Trojan has been removed the computer is now secure. Many experts in the security community believe that once infected with this type of malware, the best course of action is to reformat and reinstall the OS. When should I re-format? How should I reinstall?. How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

3964.	Solve : Should i have this many??
Answer» i have 6 "svchost.exe" RUNNING in my PROCESSES and TWO "rundll32.exe"It's normal.ok THANKS

3965.	Solve : computer for mobile maintenence?
Answer» what r the tips 4 GOOD workig COMPUTER in mobile PHONE MAINTENANCE softwareDo you mean portable security?

3966.	Solve : Windows XP and gditst?
Answer» Hello I have Windows XP and I keep getting this gditst installing itself inprogram files and sometimes of the desktop. I delete it and it keeps coming back. Any Idea's?i'd get ahold of A-Squared free or Spybot SnD and scan your computer. And are you using a virus protection like Avast or AVG? From what I see you might have a virus or some kind of trojan or other infection since that file should not come back if you are certain it is not any of those windows system files that recreates itself upon reboot for PROPER computer running. It looks like a malware... 1. Run one of two free on-line scanners: * ESET Online Scanner at: http://www.eset.com/onlinescan/ Note: This Scanner is for Internet Explorer Only 1. You will notice that the "Start" button is grayed out. Place a check mark at "Yes, I accept the Terms of use". The "Start" button will become visible. Click on it. 2. If it wants to install an ActiveX component allow it 3. You will be asked to install an ActiveX, click the "Install" button (Note: If you have a Firewall install you may have to approve the installation) 4. Once ActiveX control is installed click on the "Start" button to initialize the scanner 5. After initialization is complete, make sure, that "Remove found threats", and "Scan unwanted applications" are checkmarked. 6. Click the "Scan" button 7. Once the scan is done, you will find a log in C:\Program Files\esetonlinescanner\log.txt Post ESET's log. * TrendMicro free on-line scan, HouseCall It works with Firefox, and Internet Explorer Click on http://prerelease.trendmicro-europe.com/hc66/launch/img/btn-launch_housecall.gif It'll ask you to download small housecall66.exe to your computer. Double click on the above file to BEGIN scanning process. HouseCall pop-up window will open. Accept the agreement. In next window, select Complete Scan, and click on Start Scanning button. Relax, it'll take a while. Upon completion HouseCall will displat results under Results tab. Write down list of INFECTIONS, and post it back here. Click CLEAN now button. Close application. 2. Download SUPERAntiSpyware Free for Home Users: http://www.superantispyware.com/ Print these instructions out. * Double-click SUPERAntiSpyware.exe and use the default settings for installation. * An icon will be created on your desktop. Double-click that icon to launch the program. * If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.) * Close SUPERAntiSpyware. Restart computer in Safe Mode. To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; pick Safe Mode; you'll see "Safe Mode" in all four corners of your screen * Open SUPERAntiSpyware. * Under "Configuration and Preferences", click the Preferences button. * Click the Scanning Control tab. * Under Scanner OPTIONS make sure the following are checked (leave all others unchecked): o Close browsers before scanning. o Scan for tracking cookies. o Terminate memory threats before quarantining. * Click the "Close" button to leave the control center screen. * Back on the main screen, under "Scan for Harmful Software" click Scan your computer. * On the left, make sure you check C:\Fixed Drive. * On the right, under "Complete Scan", choose Perform Complete Scan. * Click "Next" to start the scan. Please be patient while it scans your computer. * After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK". * Make sure everything has a checkmark next to it and click "Next". * A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu. * If asked if you want to reboot, click "Yes". * To retrieve the removal information after reboot, launch SUPERAntispyware again. o Click Preferences, then click the Statistics/Logs tab. o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log. o If there are several logs, click the current dated log and press View log. A text file will open in your default text editor. o Please copy and paste the Scan Log results in your next reply with a new HijackThis log. * Click Close to exit the program. Post SUPERAntiSpyware log. 3. Download HijackThis: http://www.snapfiles.com/get/hijackthis.html Post HijackThis log.

3967.	Solve : total soln 4 formating a computer??
Answer» slow n restarting COMPUTER due to virus... iwant to format it but dont know n dont want to loose my files data....i myself want to make it NORMAL after formatingThis can't be done... You can HOWEVER ATTEMPT a Repair install that may improve things. We'll need more DETAILS though.

3970.	Solve : I can only assume this is a virus??
Answer» I'd LIKE to try that Eg0Death, but when I go into My Computer, the only "Properties" I can find is in the menu under FILE, and it is grayed out. You really deserve an award for all this help.The beeps on IM's are from whatever IM Client you are using...look under Options/Tools for "play sound" etc. If it happens on DLoads this is either your browser settings or a DLoad Manager you use...again check the above options.Eg0Death, I figured out how to do all the things you suggested. Thank you, not let's see if it all worked!Okay, so I did everything but the second suggestion, II. Delete the Minidump Files and the Sysdata.xml File. I went to do it and couldn't find anything like that in there, so I didn't delete anything. But I did everything else, and I still get the MEMORY DUMP thing. D:I'm still getting quite frequent blue death screens. Tell us what STOP codes and file names (if any) those blue screens are giving you.

3953.	Solve : Trying to scan with ESET NOD32 to obtain log..problem?
Answer» Hi, I have to tell you upfront that I am not very computer savvy But, I take direction quite well and boy do I need help!!!!!!!!!!! I have been trying to get all my scans done to create the logs necessary to post for help with an invasion of malware (?) and worm win 32netsky(?) Not sure exactly of the culprits. I intended to start a thread about this issue but, I can't seem to get my ducks in a ROW I am not able to get ESET NOD32 to scan. I am running Windows XP and have upgraded my explorer to 7.0. I have Bitdefender for antivirus. Spy Sweeper and Superantispyware. I have my Superantispyware log ready and Hijackthis. Java is updated. When I go to the site to use the scan (Link provided in the "read this first" thread)......I hit the start button after I agree to the terms then I am taken to a page that I fully expected to be where it would require me to download active x. It takes me there but never offers me the option to download active x or to start the scan. I even waited for a bit to see if things were just running slow. Nada!!!!!! Tried it several times. Yes...I am infected with something (which has many friends) I have little control over my computer so it could be this not allowing the download also. Could it be my security settings? Bitdefender? Will you be able to help me if I can't get this to scan? my hijackthis log if it will help: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:36:49 PM, on 1/27/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Safe mode Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O2 - BHO: SXG Advisor - {2A694270-A5B8-49D5-980B-26A31981285A} - C:\WINDOWS\dopfwrlkdn.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file) O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: The egodktf - {639A02E7-1E2F-4870-83E8-75FDA08620D6} - C:\WINDOWS\egodktf.dll O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint2K\Apoint.exe" O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\DEFAULT Settings\cpqset.exe O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [HPHUPD05] "c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [eabconfg.cpl] "C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" /Start O4 - HKLM\..\Run: [2wSysTray] C:\Program Files\2Wire HomePortal Monitor\2portalmon.exe O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\BellSouth\hcenter.exe" /starthidden /tgcmdwrapper O4 - HKLM\..\Run: [eBayToolbar] "C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe" O4 - HKLM\..\Run: [FilmLoop] "C:\Program Files\FilmLoop Player\FilmLoop.exe" -hide O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe" O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {9B7E79AC-A646-4e45-A70F-1B3981FE370E} - C:\WINDOWS\system32\shdocvw.dll (HKCU) O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=presario&pf=laptop O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/PopularScreenSaversFWBInitialSetup1.0.0.15.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O21 - SSODL: bxsnvqt - {528597EE-13BE-4BB2-AE8D-CF2B9A4494F8} - C:\WINDOWS\bxsnvqt.dll O21 - SSODL: aslpmqk - {15790138-2910-4790-93A0-A3FA9BFFE89A} - C:\WINDOWS\aslpmqk.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe -- End of file - 9146 bytes Any ideas of how I can get this scan to run? TIA!!!!! Attach your Superantispyware log, then re-run HijackThis, but this time in Normal Mode, not Safe Mode. Post its log, as well.Sorry for the delayed response. I have been trying to get my superantispyware to scan in normal mode. What ever has a hold of my computer keeps the scan from completing or by bogging down my system to the point it freezes up. I have been scanning now for 6 hours in normal mode. But......my superantispyware is stuck scanning "backup files" over and over again. I have totally lost control of my computer. My desktop keeps turning blood red....I have trojans popping up everywhere. I keep getting redirected to other sites to download products. I had a similar issue with my husband's computer a few years ago....but, with help was able to fix it.........This time is different. As many as 6 screens at a time pop up. Now my computer is slow I feel it is on the verge of crashing. I have really been trying .....I just want to cry.... Thanks for trying to help......OK. First of all, Superantispyware should be run in Safe Mode. Try that. Post its log. If it still won't let you, we'll work on your HJT log created in Safe Mode. If Superantispyware in Safe Mode is successful, try to run HJT in Normal Mode, and post its log. If Superantispyware in Safe Mode won't be able to finish, again, we'll look at your HJT log from Safe Mode. Thank you I will try that. It will most likely be tonight (late) before I post as I have to go to work. But, I will let the scan run now in safe mode and hopefuly post itCool.Here is my superantivirus log run in safe mode: SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 01/29/2008 at 04:55 PM Application Version : 3.9.1008 Core Rules Database Version : 3390 Trace Rules Database Version: 1270 Scan type : Complete Scan Total Scan Time : 03:57:00 Memory items scanned : 165 Memory threats detected : 0 Registry items scanned : 6181 Registry threats detected : 0 File items scanned : 262796 File threats detected : 1 Trojan.Unclassified/FKN C:\WINDOWS\FKNXWQF.EXE Here is my hijackthis log run in normal mode: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 1:36:52 AM, on 1/30/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Apoint2K\Apoint.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Apoint2K\Apntex.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqnrs08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\system32\HPZinw12.exe C:\Program Files\Webroot\Spy Sweeper\SSU.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O2 - BHO: SXG Advisor - {2A694270-A5B8-49D5-980B-26A31981285A} - C:\WINDOWS\dopfwrlkdn.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file) O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint2K\Apoint.exe" O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [HPHUPD05] "c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [eabconfg.cpl] "C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" /Start O4 - HKLM\..\Run: [2wSysTray] "C:\Program Files\2Wire HomePortal Monitor\2portalmon.exe" O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\BellSouth\hcenter.exe" /starthidden /tgcmdwrapper O4 - HKLM\..\Run: [eBayToolbar] "C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe" O4 - HKLM\..\Run: [FilmLoop] "C:\Program Files\FilmLoop Player\FilmLoop.exe" -hide O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe" O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll same Hijackthis log continued: O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {9B7E79AC-A646-4e45-A70F-1B3981FE370E} - C:\WINDOWS\system32\shdocvw.dll (HKCU) O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=presario&pf=laptop O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/PopularScreenSaversFWBInitialSetup1.0.0.15.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O21 - SSODL: bxsnvqt - {528597EE-13BE-4BB2-AE8D-CF2B9A4494F8} - C:\WINDOWS\bxsnvqt.dll (file missing) O21 - SSODL: aslpmqk - {15790138-2910-4790-93A0-A3FA9BFFE89A} - C:\WINDOWS\aslpmqk.dll (file missing) O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe -- End of file - 10360 bytes I will check back again tomorrow and see what my next step is. Thanks for your patience Go Start>Control Panel>Add\Remove, and... Uninstall any of the following programs associated with Viewpoint: * Viewpoint Manager * Viewpoint Media Player * Viewpoint Toolbar 1. Print this post out, since you won't have an access to it, at some point. 2. CLOSE all windows, except for HijackThis. 3. Put a checkmark next to the following HijackThis entries (some entries will be checkmarked to disable UNNECESSARY startups; in those cases (marked with ), no actuall program will be removed): - O2 - BHO: SXG Advisor - {2A694270-A5B8-49D5-980B-26A31981285A} - C:\WINDOWS\dopfwrlkdn.dll (file missing) - O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file) - O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe - O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" - O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime - O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe - O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/PopularScreenSaversFW BInitialSetup1.0.0.15.cab - O21 - SSODL: bxsnvqt - {528597EE-13BE-4BB2-AE8D-CF2B9A4494F8} - C:\WINDOWS\bxsnvqt.dll (file missing) - O21 - SSODL: aslpmqk - {15790138-2910-4790-93A0-A3FA9BFFE89A} - C:\WINDOWS\aslpmqk.dll (file missing) - O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe 4. Click on "Fix checked" button. 5. Restart your computer in Safe Mode (keep tapping F8 key, when your computer starts) 6. Open Windows Explorer. Go Tools>Folder Options>View tab, put a checkmark next to "Show hidden files, and folders". 7. Delete following files/folders (if present): - dopfwrlkdn.dll, bxsnvqt.dll, aslpmqk.dll* files from C:\WINDOWS - Viewpoint folder from C:\Program Files 8. Turn off System Restore: - Windows XP: 1. Click Start. 2. Right-click the My Computer icon, and then click Properties. 3. Click the System Restore tab. 4. Check "Turn off System Restore". 5. Click Apply. 6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this. 7. Click OK. - Windows Vista: 1. Click Start. 2. Right-click the Computer icon, and then click Properties. 3. Click on System Protection under the Tasks column on the left side 4. Click on Continue on the "User Account Control" window that pops up 5. Under the System Protection tab, find Available Disks 6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:") 7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this. 8. Click OK 9. Restart in Normal Mode. 10. Turn System Restore on. 11. Post new HijackThis log.Here is my new hijackthis log::: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:08:26 AM, on 2/1/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Apoint2K\Apoint.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\system32\hphmon05.exe C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe C:\Program Files\2Wire HomePortal Monitor\2portalmon.exe C:\Program Files\Support.com\BellSouth\hcenter.exe C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\FilmLoop Player\FilmLoop.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Apoint2K\Apntex.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqnrs08.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\system32\HPZinw12.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint2K\Apoint.exe" O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [HPHUPD05] "c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe O4 - HKLM\..\Run: [eabconfg.cpl] "C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" /Start O4 - HKLM\..\Run: [2wSysTray] "C:\Program Files\2Wire HomePortal Monitor\2portalmon.exe" O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\BellSouth\hcenter.exe" /starthidden /tgcmdwrapper O4 - HKLM\..\Run: [eBayToolbar] "C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe" O4 - HKLM\..\Run: [FilmLoop] "C:\Program Files\FilmLoop Player\FilmLoop.exe" -hide O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe" O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe same hijackthis log continued: O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {9B7E79AC-A646-4e45-A70F-1B3981FE370E} - C:\WINDOWS\system32\shdocvw.dll (HKCU) O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=presario&pf=laptop O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBPRO.EXE O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBOID.EXE O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe -- End of file - 9781 bytes Very nice. The log is clean We need to remove couple of startups, and we're done with HJT. Open HJT, checkmark these: - O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" - O4 - HKCU\..\Run: [SUPERAntiSpyware] "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" - O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe Click "Fix checked". Close HJT. Last steps: 1. Download, and INSTALL CCleaner: http://www.ccleaner.com/download/builds. Get "Slim" version. 2. Read CCleaner instruction here: http://www.jahewi.nl/ccleaner/ccleaner.html, and run CCleaner 3. Download, and install free ThreatFire: http://www.threatfire.com/, which will give you real-time protection against malwares. It won't interfere with your antivirus, nor firewall. Report how your computer is doing.

3962.	Solve : Adware Problems!?
Answer» I have 3 Adware bugs on my computer that I cannot get ride of even with Spyware Doctor. Spyware Doctor finds Them, Removes them But when I open Internet Explorer they reappear. The list of Adware Bugs go's as follows( Adware.Leorvbar), (Adware.Admedia ),( Adware.Agent.BN), Please help. Running windows xp. 1. Run free ESET Online Scanner at: http://www.eset.com/onlinescan/ Note: This Scanner is for Internet Explorer Only 1. You will notice that the "Start" button is grayed out. Place a check mark at "Yes, I accept the Terms of use". The "Start" button will become visible. Click on it. 2. If it wants to install an ActiveX component allow it 3. You will be asked to install an ActiveX, click the "Install" button (Note: If you have a Firewall install you may have to approve the installation) 4. Once ActiveX CONTROL is installed click on the "Start" button to initialize the scanner 5. After initialization is complete, make sure, that "Remove found threats", and "Scan unwanted applications" are checkmarked. 6. Click the "Scan" button 7. Once the scan is done, you will find a log in C:\Program Files\esetonlinescanner\log.txt Post ESET's log. 2. Download SUPERAntiSpyware Free for Home Users: http://www.superantispyware.com/ Print these instructions out. * Double-click SUPERAntiSpyware.exe and use the default settings for installation. * An icon will be created on your desktop. Double-click that icon to launch the program. * If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.) * Close SUPERAntiSpyware. Restart computer in Safe Mode. To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; pick Safe Mode; you'll see "Safe Mode" in all four corners of your screen * Open SUPERAntiSpyware. * Under "Configuration and Preferences", click the Preferences button. * Click the Scanning Control tab. * Under Scanner Options make sure the following are checked (leave all others unchecked): o Close browsers before scanning. o Scan for tracking cookies. o Terminate memory threats before quarantining. * Click the "Close" button to leave the control center screen. * Back on the main screen, under "Scan for Harmful Software" click Scan your computer. * On the left, make sure you check C:\Fixed Drive. * On the right, under "Complete Scan", choose Perform Complete Scan. * Click "Next" to start the scan. Please be patient while it scans your computer. * After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK". * Make sure everything has a checkmark next to it and click "Next". * A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu. * If asked if you want to reboot, click "Yes". * To retrieve the removal information after reboot, launch SUPERAntispyware again. o Click Preferences, then click the Statistics/Logs tab. o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log. o If there are several logs, click the current DATED log and press View log. A text file will open in your default text editor. o Please copy and paste the Scan Log results in your next reply with a new HijackThis log. * Click Close to exit the program. Post SUPERAntiSpyware log. 3. Download HijackThis: http://www.snapfiles.com/get/hijackthis.html Post HijackThis log.Thanks for the help, But I am getting a (Error update failed )on the Eset online scanner any ideas?Run TrendMicro free on-line scan, HouseCallHey Broni, Hijack this Info-Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:36:35 AM, on 2/9/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\PROGRA~1\SPYWAR~1\swdoctor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Dell Support Center\bin\sprtcmd.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bellsouth.net/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O3 - Toolbar: emotrlq - {71043D18-3FC1-46BD-B1AF-2342E18DBAE3} - C:\WINDOWS\emotrlq.dll (file missing) O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" O4 - HKCU\..\Run: [Spyware Doctor] C:\PROGRA~1\SPYWAR~1\swdoctor.exe /Q O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] D:\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-18\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - https://support.dell.com/systemprofiler/SysPro.CAB O16 - DPF: {321FB770-1FBE-4BFE-BDC1-6F622D4FA499} - https://setup.bellsouth.net/wizlet/PWReset/static/controls/WebflowActiveXInstaller_4-2-1.cab O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1182202701703 O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O21 - SSODL: bdmnopx - {78AF4938-E2FE-4FA5-A525-7453F921B6AC} - C:\WINDOWS\bdmnopx.dll O21 - SSODL: admggxp - {574A97C0-0CFE-4AB1-AD7E-4ACF49F4BF81} - C:\WINDOWS\admggxp.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- End of file - 7431 bytes Me again Superantispyware log-SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 02/09/2008 at 00:12 AM Application Version : 3.9.1008 Core Rules Database Version : 3399 Trace Rules Database Version: 1391 Scan type : Complete Scan Total Scan Time : 00:20:21 Memory items scanned : 174 Memory threats detected : 0 Registry items scanned : 4433 Registry threats detected : 13 File items scanned : 22118 File threats detected : 13 Adware.SXGAdvisor HKLM\Software\Classes\CLSID\{FD66D953-73D5-4A4B-8D97-A3E505C24121} HKCR\CLSID\{FD66D953-73D5-4A4B-8D97-A3E505C24121} HKCR\CLSID\{FD66D953-73D5-4A4B-8D97-A3E505C24121} HKCR\CLSID\{FD66D953-73D5-4A4B-8D97-A3E505C24121}\InprocServer32 HKCR\CLSID\{FD66D953-73D5-4A4B-8D97-A3E505C24121}\InprocServer32#ThreadingModel HKCR\CLSID\{FD66D953-73D5-4A4B-8D97-A3E505C24121}\ProgID HKCR\CLSID\{FD66D953-73D5-4A4B-8D97-A3E505C24121}\Programmable HKCR\CLSID\{FD66D953-73D5-4A4B-8D97-A3E505C24121}\TypeLib HKCR\CLSID\{FD66D953-73D5-4A4B-8D97-A3E505C24121}\VersionIndependentProgID C:\WINDOWS\DMDQDRXGLR.DLL HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD66D953-73D5-4A4B-8D97-A3E505C24121} Adware.Tracking Cookie C:\Documents and Settings\Tony T\Cookies\[emailprotected][2].txt C:\Documents and Settings\Tony T\Cookies\[emailprotected][1].txt C:\Documents and Settings\Tony T\Cookies\[emailprotected][2].txt C:\Documents and Settings\Tony T\Cookies\[emailprotected][2].txt C:\Documents and Settings\Tony T\Cookies\[emailprotected][1].txt C:\Documents and Settings\Tony T\Cookies\[emailprotected][1].txt C:\Documents and Settings\Tony T\Cookies\[emailprotected][1].txt C:\Documents and Settings\Tony T\Cookies\[emailprotected][1].txt C:\Documents and Settings\Tony T\Cookies\[emailprotected][2].txt C:\Documents and Settings\Tony T\Cookies\[emailprotected][2].txt C:\Documents and Settings\Tony T\Cookies\[emailprotected][1].txt Trojan.Net-MU/Gen HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebVideo HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebVideo#uninstallString HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebVideo#DisplayName Trojan.Unclassified/EGO C:\RECYCLER\S-1-5-21-1123561945-1647877149-1606980848-1004\DC15.DLL Broni, Thank you so much dude!You're welcome 1. Print this post out, since you won't have an ACCESS to it, at some point. 2. Close all windows, except for HijackThis. 3. Put a checkmark next to the following HijackThis entries (some entries will be checkmarked to disable unnecessary startups; in those cases (marked with ), no actual program will be removed): - O3 - Toolbar: emotrlq - {71043D18-3FC1-46BD-B1AF-2342E18DBAE3} - C:\WINDOWS\emotrlq.dll (file missing) - O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k (disable these by - right clicking on My Computer, selecting Properties and then the Advanced tab. Click on the Settings button in 'Startup and Recovery'. In the bottom pane - under 'Write debugging information' - click on the down arrow and then select 'None' - OK your way out) - O21 - SSODL: bdmnopx - {78AF4938-E2FE-4FA5-A525-7453F921B6AC} - C:\WINDOWS\bdmnopx.dll - O21 - SSODL: admggxp - {574A97C0-0CFE-4AB1-AD7E-4ACF49F4BF81} - C:\WINDOWS\admggxp.dll 4. Click on "Fix checked" button. 5. Restart your computer in Safe Mode (keep tapping F8 key, when your computer starts) 6. Open Windows Explorer. Go Tools>Folder Options>View tab, put a checkmark next to "Show hidden files, and folders". 7. Delete following files/folders (if present): - emotrlq.dll, bdmnopx.dll, admggxp.dll files from C:\WINDOWS\ 8. Turn off System Restore: - Windows XP: 1. Click Start. 2. Right-click the My Computer icon, and then click Properties. 3. Click the System Restore tab. 4. Check "Turn off System Restore". 5. Click Apply. 6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this. 7. Click OK. - Windows Vista: 1. Click Start. 2. Right-click the Computer icon, and then click Properties. 3. Click on System Protection under the Tasks column on the left side 4. Click on Continue on the "User Account Control" window that pops up 5. Under the System Protection tab, find Available Disks 6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:") 7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this. 8. Click OK 9. Restart in Normal Mode. 10. Turn System Restore on. 11. Post new HijackThis log.Well, I think I did that right. New post- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:13:22 AM, on 2/9/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\PROGRA~1\SPYWAR~1\swdoctor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Dell Support Center\bin\sprtcmd.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bellsouth.net/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" O4 - HKCU\..\Run: [Spyware Doctor] C:\PROGRA~1\SPYWAR~1\swdoctor.exe /Q O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] D:\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-18\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - https://support.dell.com/systemprofiler/SysPro.CAB O16 - DPF: {321FB770-1FBE-4BFE-BDC1-6F622D4FA499} - https://setup.bellsouth.net/wizlet/PWReset/static/controls/WebflowActiveXInstaller_4-2-1.cab O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1182202701703 O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O21 - SSODL: bdmnopx - {787B02F5-0015-46EB-8574-18EB793FEDCF} - C:\WINDOWS\bdmnopx.dll O21 - SSODL: admggxp - {F6625C6B-47AA-466F-8243-242D2728E77D} - C:\WINDOWS\admggxp.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- End of file - 7276 bytes Thanks again, I think we got It!!!!!Not quiet, yet. Go Start>Run, type in: regedit Click OK. Registry Editor will open. Go File>Export, and save your registry to safe location. Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad In right pane (look under Data column), you'll see two entries: - {787B02F5-0015-46EB-8574-18EB793FEDCF} - {F6625C6B-47AA-466F-8243-242D2728E77D} In each case, right click on the entry, and click Delete. Disregard Windows warnings. Restart to Safe Mode. Using Windows Explorer, delete admggxp.dll, bdmnopx.dll files from C:\WINDOWS\ Restart in Normal Mode, and check, if the above files are gone. Post new HJT log. Wow, You blow my mind with your computer skills! Hijack this log-Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:40:09 PM, on 2/9/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\PROGRA~1\SPYWAR~1\swdoctor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Dell Support Center\bin\sprtcmd.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files\Opera\Opera.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://bellsouth.net/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" O4 - HKCU\..\Run: [Spyware Doctor] C:\PROGRA~1\SPYWAR~1\swdoctor.exe /Q O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] D:\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-18\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - https://support.dell.com/systemprofiler/SysPro.CAB O16 - DPF: {321FB770-1FBE-4BFE-BDC1-6F622D4FA499} - https://setup.bellsouth.net/wizlet/PWReset/static/controls/WebflowActiveXInstaller_4-2-1.cab O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - http://www.eset.eu/buxus/docs/OnlineScanner.cab O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1182202701703 O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O21 - SSODL: bdmnopx - {60D9C175-975A-49C5-B5CB-26F7FFB750F6} - C:\WINDOWS\bdmnopx.dll (file missing) O21 - SSODL: admggxp - {0F263273-8013-4D96-820C-40F08456EEF3} - C:\WINDOWS\admggxp.dll (file missing) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- End of file - 7280 bytes This is better... Open HJT again, checkmark these two: - O21 - SSODL: bdmnopx - {60D9C175-975A-49C5-B5CB-26F7FFB750F6} - C:\WINDOWS\bdmnopx.dll (file missing) - O21 - SSODL: admggxp - {0F263273-8013-4D96-820C-40F08456EEF3} - C:\WINDOWS\admggxp.dll (file missing) Click "Fix checked". Close HJT. Turn System Restore off. Restart computer. Turn System Restore on. Post new HJT log. Alrighty than! Hijack this log-Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 1:25:36 PM, on 2/9/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\PROGRA~1\SPYWAR~1\swdoctor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Dell Support Center\bin\sprtcmd.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://bellsouth.net/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" O4 - HKCU\..\Run: [Spyware Doctor] C:\PROGRA~1\SPYWAR~1\swdoctor.exe /Q O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] D:\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-18\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - https://support.dell.com/systemprofiler/SysPro.CAB O16 - DPF: {321FB770-1FBE-4BFE-BDC1-6F622D4FA499} - https://setup.bellsouth.net/wizlet/PWReset/static/controls/WebflowActiveXInstaller_4-2-1.cab O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - http://www.eset.eu/buxus/docs/OnlineScanner.cab O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1182202701703 O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- End of file - 7072 bytes Cool All nice, and clean. One more housekeeping move... Open HJT, and checkmark: - O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe Click "Fix checked". You don't need it as a startup. Actual program won't be removed. Now... Download, and install CCleaner: http://www.ccleaner.com/download/builds. Get "Slim" version. Read CCleaner instruction here: http://www.jahewi.nl/ccleaner/ccleaner.html, and run CCleaner How is your computer doing?Did what you said, I ALREADY have CC Cleaner but will run It. You Are so awsome dude! Thank you. Also I em dropping Internet Explorer, And using opera for browsing. Internet Explorer gets hacked to much! I'm glad, thing worked out You may... Download, and install free ThreatFire: http://www.threatfire.com/, which will give you real-time protection against malwares. It won't interfere with your antivirus, nor firewall.

3975.	Solve : SOMEONE PLEAAASEEEE HEELPP?!!?!?!?
Answer» when i try to CHECK my messages or send a message on myspace i GET taken to this link... it was fine yesterday.. COULD it be a virus that norton is not FINDING??? http://gateway.2wire.net/xslt?PAGE=HURL00Start here post the logs when FINISHED.

3977.	Solve : An interesting tidbit of info about AVG?
Answer» I DOUBT this would affect the average user, but for those of you that solve problems for others it just might someday be SOMETHING to know. Maybe it is common knowledge already..... I don't know. Check out: http://forums.mozillazine.org/viewtopic.php?t=631529 Presently there are 11 posts. The last one says: "Apparently, the POP server in AVG only allows 10 connections. I would check with their SUPPORT forums for a SOLUTION." The prior posts explain how they arrived there.

3973.	Solve : can not coplete a syware scan?
Answer» i run a a spyware scan and when it get to a FILE CALLED c:\WINDOWS\system32\aux.dyr it freezes. what is this file and how can i fix it? also when i put a disk in my cd drive it wont open automatically like it use to how can i fix that?What scan do you try to run? Windows version?and what spyware PROGRAM are you using?im am trying to run SUPERANTISPYWARE free edition. aux.dyr << Are you sure that is right? Have you tried running it in safe mode?

3974.	Solve : CMIII running in the background?
Answer» Hi, when I start Windows XP and I check the task manager I see 3 instances of CMIII running in the background and its USING up 100% of the cpu. I need to CLOSE all of them from the task manager or else everything SLOWS down. Is this a trojan and how do I get rid of it?Start here post the logs when finished.

3976.	Solve : Hijackthis.com help- Computer keeps freezing up- please help?
Answer» ok so i just rebooted the computer and this message comes up, windows cannot find 'C:\WINDOWS\system32\sstqo.exe' make sure you typed the name correctly and then try again. then its followed by Cannot load or run 'C:\WINDOWS\system32\sstqo.exe' SPECIFIED in registry. make sure the file exists in your computer or remove the reference to it in the registry.I have to apologize...I missed one entry... Open HJT, and checkmark: - F3 - REG:win.ini: load=C:\WINDOWS\system32\sstqo.exe Click "Fix checked". RESTART in Safe Mode. Using Windows Explorer, delete sstqo.exe (if exist) from C:\WINDOWS\system32 Turn SYSTEM Restore off. Restart in Normal Mode. Turn System Restore on. Post new HJT log.

3978.	Solve : Has anyone heard of Output.cab??
Answer» I found this on my DESKTOP tonight and I don't know what it is or where it came from. I went to Add/Remove and I can't find it there. I'm sure I did something stupid again but I even GOOGLED it and couldn't find anything. Does anyone have any ideas on this one?How big is it? Usually a .CAB file is a package that contains other files. The fact that it is named output.cab leads me to believe you might have accidentally created it. If it's a 0 BYTE file you can delete it. If it's a largeish file you may want to find out what's in it first.I couldn't find anything in my Add/Remove programs so I right clicked it and deleted it. Do you think there's something else I should do?We cleaned your computer pretty recently, right? You should be OK. In the future, as The Emperor said, it's better to ask a question here, before deleting. Now, it's gone, so be it.Oh my word that was THE Emperor??? I remember what happened now. When I was having that PROBLEM with the Symantec message (previous post) in my Incredimail emails I emailed Incredimail and they asked me to download Output.cab which I did and I received an email from them tonight saying they are working on it. I'll keep you posted. So it wasn't a bad thing Emporer!!!!

3981.	Solve : what is a good/free spyware program??
Answer» Thanks, I probably will retry the spybot s&d and maybe the other ones too. I'm just a little gunshy RIGHT now because of my recent ordeal! Also, I still don't know why the Trend Micro Housecall WOULD not run. I use FireFox. Would it be better to run it in IE? Or more to the POINT, If I feel McAfee has MISSED something, and I want to run ANOTHER virus scan, are there other/better options than "housecall"? If I download another antivirus program i.e. AVG, it conflicts with McAfee and funny things happen. JImGo in to add/remove programs and uninstall the Housecall entry and then try it again. If it doesn't work after that then try it in IE.OK

3982.	Solve : MS Office & Norton AntiVirus definition issue.?
Answer» Hello everyone, I have an issue with Norton LiveUpdate associated with MS OFFICE. The Norton LiveUpdate Utility activates EVERYTIME SOMEONE opens an office file. The utility SUGGESTS that the virus definitions are out of date and liveupdate needs to obtain new definitions. LiveUpdate runs and says that the latest definitions are up to date. Every computer in our office running Norton is experiencing the same issue. Has ANYONE heard or experienced this issue before? Your help will be appreciated. Thanks in advance.One more reason to dislike Norton... Anyway, try to disable Norton AntiVirus Office plug-in: http://support.microsoft.com/kb/329820Thank you for the reply and it looks as if this has solved our issue.

3983.	Solve : major help needed fast have had no luck elsewhere and need my computer 4 school!?
Answer» im not enitrly sure of what it is yet ive tryed about 8 to 10 different instructions on how to GET rid of that icon in the tray with a red dot with a white X accross. i keep getting the balloon every 1 to 2 min saying your computer is infected! windows has detected spyware infrection! ... blah blah recomendes blah blah you know how its installs fake anti spyware and crap but yes majority of instructions calles for avg anti virus and hijackthis to install and run well when i try this i install like the instructions say and the instructions say start the avg and run the scan and then later use the hijackthis .SEE this is where the problem is everytime i try to start the program i CANT it just trys to load then nothing niether avg or hijackthis will load ? any way to get them to work or to get rid of this crap? (also i have unstalled and reinstalled both programs quiet a few times and same result and have tryed starting them in safe mode and still same problem) i also have a FAKE windows UPDATE icon and help and support center icon on my desktop and i dont want to CLICK it because i can see it has a shortcut to the internet then some website ALSO i have a balloon with a red dot and white X saying "a critical error could occur *STOP: 0x000007B (0xF20184, 0x00000, 0xCC0034)** Inaccessible handler or device. Click balloon to fis the problem" , obvously a fake random code to scare me but how to i get rid of the balloon and the fake windows icon (i have tried deleting the icons and new ones magicaly appear on my desktop LOL ok well im running XP on a DELL and i have used the smitfraud.exe program a good 12 times and followed online instructions about the same problem but still havent been fixed i have tried to download hijackthis and avg and go figure they wont START!!!! i have trend-micro anti spyware and ad-aware and they find the problem i think but never deletes it even thou it says it does. We at least need a Hijackthis log to start with. How did you get smitfraud fix to run but not the other programs? idk i just dowload smitfraud to my desktop when into safe mode and clicked it it worked but avg and hijackthis every time i install them and then try and run them they dont work?Go to this post and work as many as the steps as you can. Boot into safe mode to run Dr Web and SuperAntispyware. Then run the Online scan from normal boot mode. Like I said, we will need to get some logs to see what is going on.

3984.	Solve : Please spare a moment to help me out if you can??
Answer» Okay.. I got a NEW laptop last week and I'm over the moon, but despite all my research before hand i cant help but think I've already screwed it up >.> This morning i TURNED it on and started about my normal business only to have it suddenly freeze on me. I turned it off and on again and had a look at that nifty gadget vista has which checks CPU/RAM usage and saw that it was working incredibly hard considering what little i was doing, heck I opened mozilla and it SHOT up to 100%. Uh-oh. so I decide the best thing to do would be to run a virus scan but the results I got weren't what i was expecting and i could really do with being told what to do here : (a screen shot SEEMED the best way to ask for help, hope I'm not breaking any rules here) Additional info you may need to know: ~I'm running vista home premium ~on an Acer aspire 5920 with 2GHz processing power, 2GB ram and 120 GB HDD ~However that 120GB came split into two drives ~and under someone else's advice i moved my documents to drive D. (but i doubt that's important) I asked if you could spare a moment not a morning so i'm sorry if i just RAMBLED away there..Try to uninstall/reinstall AVG. If you have Windows Defender running, turn it off during the above process.You may want to run chkdsk /r on both of those partitions....

3985.	Solve : Need help toRemove amvo.exe from my PC?
Answer» Please help.........Please see this POST to begin the MALWARE REMOVAL process.

3986.	Solve : Help don't know what to do?
Answer» I think I have a VIRUS or something My computer just stopped working at full capacity my cd drive doesn't read cd's any memory drive/flashdisk is atumatically asked to be formatted even though I have used it on my computer before Any antivirus/spyware has benn disabled Avg, Spybot, CCleaner, Hijackthis When I try to open the programs mention above, the computer immediatly closes them I can't reinstall the programs my wireless card has been disabled Does anyone have a solutionCan you boot into safemode?If you can boot to Safe Mode, try to run HijackThis from there.nope doesn't let me reboot in safe mode I tried it by doing.... run..msconfig and at startup pressing f8 when I choose safe mode it starts booting up and then upruptly restarts stating an error messege we appologize for the inconvinience but windows did not start succesfully a RECENT hardware or software CHANGE might have caused this I tried selecting to boot up with last known good configuration and it just boots up like normal *While in msconfig I saw system resote would that help in any way??? *would it be safe to take all my pics and info and burn it onto a cd and just restore settings or have a tech erase the harddrive and reinstall everything again??You can try System Restore. You don't have to worry about your pictures, and data. System Restore won't touch them.dont have that option anymore i am in a ENDLESS loop of restartsit gets up to the windows logo and a blue SCREEN flashes really quickly then it restarts. If you have your windows XP cd or your manufacturers recovery CD boot from that CD, choose to Install windows, press F8, then choose Repair windows. That will replace all of your system files without damaging your data. You should then be able to boot back into windows and continue cleaning your system.

Explore topic-wise InterviewSolutions in .

Solve : Norton or McAfee.......?

Solve : Analyse hijack log and combofix?

Solve : Trying to scan with ESET NOD32 to obtain log..problem?

Solve : Just need to check something?

Solve : My computer restartes itself?

Solve : http://gaigoibaucat.xlphp.net virus??

Solve : Symantec email problem....help!!!?

Solve : this computer make the internet slow when it turn on.?

Solve : Need help... Yahoo Messenger Virus??

Solve : how to enable the registry editor?

Solve : Bl4cK P3g4sUs virus help!?

Solve : Adware Problems!?

Solve : need help recovering from trojan?

Solve : Should i have this many??

Solve : computer for mobile maintenence?

Solve : Windows XP and gditst?

Solve : total soln 4 formating a computer??

Solve : Help!! How to stop all the Popups, Adwares and Trojans??!!!?

Solve : Buffer Overflows?

Solve : I can only assume this is a virus??

Solve : trojan i ant get healed?

Solve : Hi !?

Solve : can not coplete a syware scan?

Solve : CMIII running in the background?

Solve : SOMEONE PLEAAASEEEE HEELPP?!!?!?!?

Solve : Hijackthis.com help- Computer keeps freezing up- please help?

Solve : An interesting tidbit of info about AVG?

Solve : Has anyone heard of Output.cab??

Solve : PC Tools Threat Fire (Free) update problem.?

Solve : New and need help?

Solve : what is a good/free spyware program??

Solve : MS Office & Norton AntiVirus definition issue.?

Solve : major help needed fast have had no luck elsewhere and need my computer 4 school!?

Solve : Please spare a moment to help me out if you can??

Solve : Need help toRemove amvo.exe from my PC?

Solve : Help don't know what to do?

Solve : stubbern trojan?

Solve : trojan horse in captivity?

Solve : IE Freezes or closes and lags bad!!?

Solve : Can Not Reboot In Safe Mode?

Solve : WinNT/Bagel.gen and Win32/Bagel.gen!C ARE THESE NEW??

Solve : Multiple Personalitys!?

Solve : dns spoofing?

Solve : Does anyone know what this error message means??

Solve : Patch Tuesday - Microsoft releases six critical patches?

Solve : avg antivirus need local mirror?

Solve : please help me i m have trouble with computer?

Solve : Why some email addressee's are refused delivery??

Solve : Its a virus..?

Solve : Computer running slow... HJT log posted?

3988.	Solve : trojan horse in captivity?
Answer» ... for me too,.. thanks BroniDisable TeaTimer, as it'll interfere with the cleaning process: Right click Spybot's TeaTimer System Tray Icon. Click Exit Spybot-S&D Resident. TeaTimer closes. 1. Print this post out, since you won't have an access to it, at some point. 2. Close all windows, except for HijackThis. 3. Put a checkmark next to the following HijackThis entries (some entries will be checkmarked to disable unnecessary startups; in those cases (marked with ), no actual program will be removed): - O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) - O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe - O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup - O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start - O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" - O4 - HKLM\..\Run: [EarthLink Installer] " /C - O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe - O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime - O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\4.bin\MWSBAR.DLL,S - O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9 - O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe - O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe - O4 - HKCU\..\RunOnce: [SpybotDeletingB6312] command /c del "C:\Documents and Settings\Richard\Local Settings\Temp\laf1.exe_old" - O4 - HKCU\..\RunOnce: [SpybotDeletingD8742] cmd /c del "C:\Documents and Settings\Richard\Local Settings\Temp\laf1.exe_old" - O4 - HKCU\..\RunOnce: [SpybotDeletingB3511] command /c del "C:\Program Files\Online Add-on\ictun.exe" - O4 - HKCU\..\RunOnce: [SpybotDeletingD1541] cmd /c del "C:\Program Files\Online Add-on\ictun.exe" - O4 - HKCU\..\RunOnce: [SpybotDeletingB8255] command /c del "C:\Program Files\Online Add-on\ictmdl.dll_old" - O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe - O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE - O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZRfox000 - O20 - WINLOGON Notify: ACNotify - ACNotify.dll (file missing) 4. Click on "Fix checked" button. 5. Restart your computer in Safe Mode (keep tapping F8 key, when your computer starts) 6. Open Windows Explorer. Go Tools>Folder Options>View tab, put a checkmark next to "Show hidden files, and folders". 7. Delete following files/folders (if present): - MyWebSearch folder from C:\Program Files 8. Turn off System Restore: - Windows XP: 1. Click Start. 2. Right-click the My Computer icon, and then click Properties. 3. Click the System Restore tab. 4. Check "Turn off System Restore". 5. Click Apply. 6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this. 7. Click OK. - Windows Vista: 1. Click Start. 2. Right-click the Computer icon, and then click Properties. 3. Click on System Protection under the Tasks column on the left side 4. Click on Continue on the "User Account Control" window that pops up 5. Under the System Protection tab, find Available Disks 6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:") 7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this. 8. Click OK 9. Restart in Normal Mode. 10. Turn System Restore on. 11. Post new HijackThis log.hey Broni,.. well,.. when i opened up hijackthis to "fix" the selected files,.. i couldn't find all the files you wanted me to fix. there were 6 files i couldn't find ,... 5 were " -04 - HKCU\..\runonce: [spybotdeletingB6312, D8742, B3511, D1541, and B8255,] ,.. and one was -08 - extra context menu item & search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZRfox000,.. i checked and fixed all the others,.. but i'm GUESSING these "missing " files need to be fixed too,. so here's a new HJT log [file cleanup - saving space - attachment deleted by admin]It looks much better... Open HJT one more timr, and checkmark: - O8 - Extra context menu item: &Search - ?p=ZRfox000 Click "Fix checked". Restart computer, and post new HJT log.hi Broni,... here's the newest hjt log [file cleanup - saving space - attachment deleted by admin]The log is clean. Download, and install CCleaner: http://www.ccleaner.com/download/builds. Get "SLIM" version. Read CCleaner instruction here: http://www.jahewi.nl/ccleaner/ccleaner.html, and run CCleaner How is your computer doing?Hi Broni,.. the computer seems to be doing much better ,.. thanks very much to you. I do still have a question or two. Since i've deleted my Norton Anti-virus, what protection do i have now? Is the AVG a good anti-virus/malware protection?... and is my Windows firewall sufficient? Thanks again for all your help,.. it's GREATLY appreciated Good... AVG is very good AV program. As for malware real time protection, you may WANT to download, and install free ThreatFire: http://www.threatfire.com/, which will give you real-time protection against malwares. It won't interfere with your antivirus, nor firewall. Windows firewall has pretty poor ratings, so I recommend, you download free Comodo firewall: http://www.personalfirewall.comodo.com/, turn off Windows Firewall, and install Comodo.

3990.	Solve : Can Not Reboot In Safe Mode?
Answer» Among other problems (mentioned in previous post) I can not reboot in safemode. So I can not download and anti virus , spyware or HJT software. Can the safe MODE prob be handled FIRST? WinXP Home Dell Dimension 4550 Pen 4 1gb Ram 60gb HD 2.5ghz How are you accessing safemode ? ? Tap F8 repeatedly when booting before you see the windows splash screen... If this stiil does not work INSERT your Windows XP CD and got to Start/Run and type in sfc /scannow and hit Enter...let it run and re-boot.Why is not booting into safe mode stopping you from downloading? There are many ways to get to safe mode but if it is the malware that is blocking it then DO NOT FORCE SAFE MODE Instead continue on with any malware removal the best you can and post any logs you can get. Many Dell computers (mine included) the keyboard is the last thing to load so safe mode is impossible with the F8 method. If this is the case then use the tools below. If safe mode is "broken" then use SafeBootKeyRepair. Download & run this tool SafeBootKeyRepair-CF. It will only take a short moment for it to finish running. A log will be produced at C:\SafeBoot_Repair.txt. Please post that in your next reply. Do you have SUPERAntiSpyware installed? If so go to C:\Program Files\SUPERAntiSpyware and right click BootSafe.exe and send it to the desktop as a shortcut. Use it to boot into safe mode. If not then download the STAND alone version here

3991.	Solve : WinNT/Bagel.gen and Win32/Bagel.gen!C ARE THESE NEW??
Answer» Three days I have been working on this. I cannot get rid of this. My anti virus quit working. I downloaded a new one and I get the MESSAGE that it "is not a vaid Win32 application". I have done the same with various spyware programs to the same result. I just download HJT but when it installed and I clicked on the desktop icon, I get "this is not a valid Win32 application" THe one adaward program that did work as far as scaning my machine reported the trojan and worm in the title above but with no way to remove with out buying the program. But is I do that an then install I will get "is not a Win32 application" I am about ready to just dump the Hard drive for a new one. DELL Diminsion 4450 2.5ghz 1GB Ram 60GB H Intel Pen 4 Please help. __________________ William R. Bogart Edit \| Quote \| Quick Reply wrbogart View Public Profile Send a private message to wrbogart Send EMAIL to wrbogart Visit wrbogart's homepage! Find all posts by wrbogart Add wrbogart to Your Buddy List Computer Specifications [edit] Dell Computer Corporation Dimension 4550 Windows XP Home Edition Service Pack 2 (build 2600) 2.53 GIGAHERTZ Intel Pentium 4 8 kilobyte primary memory cache 512 kilobyte secondary memory cache NVIDIA GeForce4 MX 420 [Display adapter] 768 Megabytes Installed Memory Sony DRU-810A DVD/CD RW Drive LITEON DVD-ROM LTD163 [CD-ROM drive] 3.5" format removeable media [Floppy drive] #2 1 Minute Ago wrbogart Member Posts: 70 Join Date: Mar 1999 Experience: Intermediate PS Will not start in Safe Mode and cannot do a system restore either __________________ William R. Bogart Do you have Windows XP CD?Yes, Have Win XP CD but CD rom and DVD rom will not read either.Those drives won't read ANY CD?

3993.	Solve : dns spoofing?
Answer» is there any body run dnsspoof from dsniff program or dnsa program. i try to run these program to implement DNS SPOOFING but no RESULT appear to me. any body can help me please Be more specific on what you're trying to ACCOMPLISH. With the information you've give, there's no way anyone can help you.

3996.	Solve : avg antivirus need local mirror?
Answer» Hello everyone. I live in Serbia( thats in europe, sorry not sure if you know) I want to download AVG. I have a very slow dial up connection and was wondering if anyone knew of a site that had a mirror site I could download closer to HOME ( i can only FIND U.S and Austrailia)ok I just tried downloading it, 1 hour 30 into it the connect broke. I got to START over. is there any option?What site are you trying to download from?major geeks. I tried the file hippo site and its SLOWER. I got 2.6 kpbs around there. the most i get to dowmload is around 4.5Maybe you should ask a friend with broadband to download it for you...If FileHippo is slow then you may be out of luck. Have you tried the UK AVG site? http://www.avg.co.uk/doc/products-comparison-home-and-office/uk/crp/2?utm_source=Adwords&utm_medium=PPC no, but I will! thanks

3999.	Solve : Its a virus..?
Answer» THANKS man. I have an admin account that i think can do that also but i dont want to change ANYTHING i might get in trouble. Thanks alot man this computer should be ok now. I'll just RESTART now and i'll let you know about the status. Thanks alotNo probllem, glad we got it sorted out. Safe surfing...........Looks EVERYTHING is ok but its only background picture is not displaying COMPLETELY its only half way. ThanksNo now its showing