Uninstallation Problems

Hi, I began having problems a few weeks ago when I noticed that Windows Updates I watched installing in the dialog box were not showing up as updates in Add/Remove Programs with the Show Updated box checked. I was running AVG Free 2011 and noticed it was supposedly updating but at one point no longer displayed the version or database numbers. I tried to use the Repair feature by using the Change button in Add/Remove Programs. The Window would open allowing me to select Repair and the program would start copying files then stop with an error message saying The installation failed because the MSI Installer could not be reached. I used the AVG Remover tool to uninstall AVG before trying to reinstall a fresh download of AVG Free 2011. Now I cannot install AVG at all, I keep getting an error message that says," General Internal Error: The MSI Installer could not be reached. This can happen if you are running Windows in safe mode (Which I was not). I looked into the AVG 2011 folder and saw a very unusual sight, a WMP icon showing as a DAT file. When right clicking this file and opening Properties It shows the WMP icon and says it opens with Notepad. I opened this and read through it it mentioned installing fake updates and fake scan logs. This is also a bit shocking because I had uninstalled and deleted Windows Media Player. At the first hint of problems I tried using some of the Microsoft Automated Fixes at MS Support some ran or appeared to but fixed nothing, some hung and some wouldn't run at all. I had Spybot S&D installed and ran it then the next day all the exe files were gone, shortcuts from the desktop, start menu, and the files in the Program Files folder were all changed to Unknown File Type icons and would not work. Also in there was another WMP icon DAT file that when properties was opened said it opened with Notepad. This same thing happened to my Malwarebytes. This tells me something evil is afoot. Also looking at running processes in HJT there were 25 running processes. I opened Task Manager for comparison and there were 32 processes running in Task Manager, struck me as odd that some things were hiding from HJT and not Task Manager. Prior to this I also noticed there were some programs in Add/Remove Programs I did not want or need, such as MS Office 60 Day Free Trial, Microsoft Visual J# .NET Framework Redistributable Package 1.1. I researched the MS Visual J# and found it was a developer tool that I did not want or need. I tried to uninstall both these programs but could not. The Office program had a Remove Button, but did nothing. The MS Visual J# didn't have a Remove button and I could not locate it using Search, HJT, OTL, or Systemlook. While trying to locate this file I was looking in Control Panel>Admin Tools>Services and was researching any service that had no discription or Company Name. One of these I found was get Plus® Helper 3004. My research took me to Adobe where they said this was a part of the install files for Adobe 6.0 and should have deleted upon completion of install. They also said that if you still had this file in a NOS folder in C:\Program Files you should delete it since this had a vulnerability that can be exploited by a backdoor. I deleted the folder at C:\Program Files\NOS which contained the get Plus® Helper 3004 file, but after reboot get Plus® Helper 3004 is still running as a service. It was found by HJT and supposedly deleted with HJT, yet still remains. I was trying to remove this service with HJT and went to Services and clicked on Properties and to find the location of the file in C:\WINDOWS\System32\ but in C:\WINDOWS there was not a System32 folder only a system32 folder. While looking for the get Plus file I looked in the folder Installer, which was hidden. In there I found a Microsoft .NET folder and in there I found the Microsoft Visual J# folder with several JSharp files. After much frustration and very careful reading I downloaded ComboFix, saved it as Combo-Fix to desktop and ran a scan only. Lo and Behold the elusive jsharp files turned up for the first time. These appear to me to be malicious since the appear to self install and replace and/or block other files. I am posting the ComboFix log for your review. Thank you in advance for your time and your help. I am currently without any AV at all since I cannot install one. I would also like to get a reccomendation for a user friendly firewall since in my research I have discovered that Windows Firewall is pretty much swiss cheese. BTW, I have started getting a dialog box on boot up between the Windows black screen and my Log In box that has a 0 in the blue title bar and only a 0 in the dialog box. The only way to get past this is to click OK since the X to close does not work and there are no other buttons available. I am copying a portion of the Combo Fix Log that I sent to the Malware & Virus Forum. Since their help I was able to reinstall AVG but am not sure if all is well there since I had reinstalled it before and it worked fine but later became corrupted. The Malware & Virus Removal Forum asked me to post a topic here to see if we can work this out.. FYI the CF scans and others showed four user accounts. There are only two listed in Usre Accounts, not sure what is going on with the other two or where they came from. The CF Log "FIND 3M REPORT follows. (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-01-21 14:44 . 2004-06-07 22:09 439296 —-a-w- c:\windows\system32\shimgvw.dll 2011-01-10 18:16 . 2011-01-10 18:17 73728 —-a-w- c:\windows\system32\javacpl.cpl 2011-01-10 18:16 . 2011-01-10 18:17 472808 —-a-w- c:\windows\system32\deployJava1.dll 2011-01-07 14:09 . 2004-06-07 22:32 290048 —-a-w- c:\windows\system32\atmfd.dll 2011-01-06 16:09 . 2011-01-06 16:09 32768 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\jsharpde\pchapi.dll 2011-01-06 16:09 . 2011-01-06 16:09 114688 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\jsharpde\ZipLib.dll 2011-01-06 16:09 . 2011-01-06 16:09 315392 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\jsharpde\pchmsxml.dll 2011-01-06 16:09 . 2011-01-06 16:09 26572 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\jsharpde\INV16.dll 2011-01-06 16:09 . 2011-01-06 16:09 3072 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\jsharpde\pchealthde.exe 2011-01-06 16:09 . 2011-01-06 16:09 5632 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\jsharpde\GUI.dll 2011-01-06 16:09 . 2011-01-06 16:09 139264 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\ContentUpdater.exe 2011-01-06 16:09 . 2011-01-06 16:09 45056 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\jsharpde\util.dll 2011-01-06 16:09 . 2011-01-06 16:09 24576 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\jsharpde\pcdapi.dll 2011-01-06 16:09 . 2011-01-06 16:09 98304 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\PluginCtrl.dll 2011-01-06 16:09 . 2011-01-06 16:09 69632 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\msxmlwrapper.dll 2011-01-06 16:09 . 2011-01-06 16:09 344064 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\jsharpde\api.dll 2011-01-06 16:09 . 2011-01-06 16:09 114688 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\jsharpde\asst_ui.dll 2011-01-06 16:08 . 2011-01-06 16:08 282624 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\jsharpde\clientutil52.dll 2011-01-06 16:08 . 2011-01-06 16:08 356352 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\jsharpde\client_motkt.dll 2011-01-06 16:08 . 2011-01-06 16:08 20480 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\InetCheckWrap.dll 2011-01-06 16:08 . 2011-01-06 16:08 49152 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\PCHI18N.dll 2011-01-06 16:08 . 2011-01-06 16:08 307200 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\pchnotify.exe 2011-01-06 16:08 . 2011-01-06 16:08 77824 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\WinVerifyTrust.dll 2011-01-06 16:08 . 2011-01-06 16:08 4096 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\winverifytrustwrapper.dll 2011-01-06 16:08 . 2011-01-06 16:08 315392 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\pchmsxml.dll 2011-01-06 16:08 . 2011-01-06 16:08 212992 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\jsharpde\jsharpinterp.dll 2011-01-06 16:08 . 2011-01-06 16:08 159744 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\PCHButton.exe 2011-01-06 16:08 . 2011-01-06 16:08 434176 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\jsharpde\motivede.dll 2011-01-06 16:08 . 2011-01-06 16:08 36864 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\jsharpde\gnu.dll 2011-01-06 16:08 . 2011-01-06 16:08 49152 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\jsharpde\hwinv.dll 2011-01-06 16:08 . 2011-01-06 16:08 126976 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\SearchCtrl.dll 2011-01-06 16:08 . 2011-01-06 16:08 77824 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\FDIWrapper.dll 2011-01-06 16:08 . 2011-01-06 16:08 69632 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\jsharpde\msxmlwrapper.dll 2011-01-06 16:08 . 2011-01-06 16:08 307200 —-a-w- c:\windows\pchealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS4EN\plugin\bin\pchealthplugin.dll 2010-12-31 13:10 . 2004-04-02 06:52 1854976 —-a-w- c:\windows\system32\win32k.sys 2010-12-22 12:34 . 2004-06-07 22:32 301568 —-a-w- c:\windows\system32\kerberos.dll 2010-12-20 23:59 . 2004-01-22 07:16 916480 —-a-w- c:\windows\system32\wininet.dll 2010-12-20 23:59 . 2004-06-07 22:33 43520 —-a-w- c:\windows\system32\licmgr10.dll 2010-12-20 23:59 . 2004-06-07 22:32 1469440 —-a-w- c:\windows\system32\inetcpl.cpl 2010-12-20 17:26 . 2004-06-07 22:33 730112 —-a-w- c:\windows\system32\lsasrv.dll 2010-12-20 12:55 . 2011-01-06 16:07 385024 —-a-w- c:\windows\system32\html.iec 2010-12-09 15:15 . 2004-04-02 06:52 718336 —-a-w- c:\windows\system32\ntdll.dll 2010-12-09 14:30 . 2004-06-07 22:32 33280 —-a-w- c:\windows\system32\csrsrv.dll 2010-12-09 13:38 . 2004-04-02 06:52 2192768 —-a-w- c:\windows\system32\ntoskrnl.exe 2010-12-09 13:07 . 2002-08-29 08:04 2069376 —-a-w- c:\windows\system32\ntkrnlpa.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-08-20 118784] "KBD"="c:\hp\KBD\KBD.EXE" [2003-02-12 61440] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472] "AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 88363] "Reminder"="c:\windows\Creator\Remind_XP.exe" [2003-12-18 118784] "AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 57344] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648] "EKIJ5000StatusMonitor"="c:\windows\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe" [2010-09-02 1638400] "Conime"="c:\windows\system32\conime.exe" [2008-04-14 27648] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\mmc.exe"= S2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files\Kodak\AiO\Center\ekdiscovery.exe [9/13/2010 5:18 PM 308656] S2 LinksysUpdater;Linksys Updater;"c:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe" -s "c:\program files\Linksys\Linksys Updater\conf\wrapper.conf" –> c:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [?] S4 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [6/7/2004 4:09 PM 14336] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper . ************************************************************************** I am comcerned about the entries in the report that contain \jsharpde\ near the end. These are the files I believe may be causing my problems. Thank you in advance for your help. Tim K

Hi there Tim K, You obviously have a Melware infected PC. Could you please go to the "Virus, Spyware & Malware Removal" section here at WTT, where the experts there can help you. Cheers, Lee

@lee,

He has already been to malware removal and LDTate sent him here. http://forums.whatthetech.com/index.php?sh…=117427&hl=

Thanks Tomk

Tim K, your problem is a little confusing as you have some software either partly installed (corrupted) or maybe not installed at all but showing as installed and some software that won't install. Is that correct?

A bit of backgrounf info. might help. How old and exactly what model is your PC?

Firstly I'd try a system restore to a date before you started having problems. If that works or even if it doesn't, check to make sure you have Net framework 2 installed. If not, download and save it to your desktop but don't install it yet http://www.microsoft.com/downloads/en/deta…;displaylang=en

In your Melware thread you wrote:

Any help getting rid of these two Microsoft J# . NET Redistributable Package 1.1 and get Plus ® Helper 3004 would be appreciated.

The best way to remove software is with a good uninstaller that does a complete job. Download the freeware version of RevoUninstaller and use carefully: http://www.revouninstaller.com/revo_uninst…e_download.html

You should install Netframework 2 after any uninstalls and you have rebooted and defraged. See how you go up to this point.

Cheers,
Lee

Hi Lee, While at the Malware/Virus Removal forum I installed .NET Framework 4. I have multiple versions if this installed. 1.1, 2, 3, 3.5, and now 4. I was looking around while waiting for a reply from M/V Removal and found a hidden folder in system32 called Installer. In there was a few files involving the MS Visual J# Redistributable Package 1.1. Told them about it but they didn't seem interested. I have never seen this program on a computer before and researched on Google and at MS and it is a developer tool to create and run Java programs with windows, anyway it's something I don't want or need. I also researched the get Plus ® Helper 3004 which is running as a service. It is part of Adobe Reader 6.0 install files that should have been deleted upon install. Adobe's site said if you have this file you need to get rid of it because it leaves open vuneralabilities. I did delete a file in C:\Program Files calles NOS which Adobe said contained the file for this, but it is still running as a service although a HJT scan shows it with a file missing at the end. This is a Compaq Presario model # SR1123WM, not exactly sure how old it is. I did do a format & reinstall from the D:\ but whatever is infecting me has apparently backed itself up there. I will try a restore point, but am not very optomistic about it. I do not have a XP Home disc to do a total strip and reinstall if it will even let me do a complete format. I have ran C prompt and looked under DIR and there are two strange directories. If this restore doesn't work I'll look there and get the names for you if you like. Also M/V removal had me do the One Care scan and it found 1 issue it could not clean. Afterward I tried to reinstall my AVG and it did install, but I believe it to be corrupted because when you mouse across the buttons on the left of the title bar the title bar flashes blue and the menu bar flashes gray/ white. Also the Ad for the paid version at the bottom no longer has the "Hide Message" to hide the ad, rather a white X in a red square in the upper right corner of the ad. When hidden it does have the "Show Message" option in the lower left corner of the interface below the version info. Just seems odd. It did not do that when first installed as before it has changed since install and finds nothing.

Rather than trying to fix up your AVG program, I'd recommend uninstalling it with RevoUninstaller. AVG freeware is a rather bloated program and there are better Virus protection programs around. Windows Security Essentials, Avast (free version) or Avira (free version) are all good and often recommended here. I use Avira at the moment but that's just my personal preference.

I would also remove Abode, as apart from being bloatware, It has security issues. Revo will remove all of it, including "Plus ® Helper 3004" as part of Abode.

Replace with "Foxit Reader" (free) as it has no security issues and a small footprint http://www.foxitsoftware.com/downloads/index.php#editor
Make sure you untick the add-on option of "Ask toolbar" when installing or just remove it with Revo if you accidentally install it.

According to the Malware Tech team, you have no infections. If you suspect Malware residing in you D drive, download and run Malwarebytes (free version) if you don't already have it. It's a worthwhile program to have http://download.cnet.com/Malwarebytes-Anti…&tag=button

I can't see how Malware would infect your factory back-up image though.

Are you having any problems with your normal Microsoft downloads or any other installation problems? Always remember to re-boot after installing any software as not doing so can cause problems.

Cheers,
Lee

Hi Lee, Decided against using the system restore, didn't want to undo what good we did at M/V Removal. I did get the Revo Uninstaller. It appeared to uninstall the Microsoft Visual J# .NET Framework 1.1. I also uninstalled AVG and Adobe 6.0, used the cleanup utility and erased the tracks. After reboot I still have the dialog box come up with 0 in the title bar and 0 in the dialog area. The only way past it is to click OK. There is the red square with white X to close but it "pushes" but does nothing. I believe there is more to find here since the machine is slow. I noticed on some of the logs from M/V Removal showed like 247 MB of memory on the machine when it actually has 512 MB. I will uninstall the Malwarebytes I have and reinstall a fresh copy. I have been having problems with Windows and AVG updates. Windows would appear to update in the Update/Installation dialog box but when I'd look in Control Panel>Add/Remove Programs with Show Updates checked the updates that supposedly installed weren't there after reboot when required. As for the D:\ drive, since I don't save anything there at all there should only be the Recovery file with the padlock icon, right ? There are other loose files on the drive and I am tempted to delete these but want to be sure they're not needed since I don't have the restore discs for it. I have a question about the Foxit Reader. Can it create PDF files ? I do a lot of scanning and save them as PDFs so I want to be able to continue to do that as well as acess my current files. While we're on the subject of PDFs, I scan and save PDFs as thumbnails however they have stoppd saving as thumbnails with images. Now they show up as Tiles with just the icon and not the thumb image. I'll give you a further update tomorrow after running another One Care scan after the Malwarebytes reinstall & scan.

I have a question about the Foxit Reader. Can it create PDF files ?

Yes, Foxit can do anything Abode can do but without the bloatware.

If you are having W7 update problems, you will have to be more specific. Are you receiving updates that don't install properly or updates that won't download etc.

Personally I would remove and replace AVG. However, if you are particularly enamored with that program, it's your PC, so soldier on with it. You might try a reinstall, but choose the 'repair' option which might fix the issues you are having with it.

Cheers,
Lee

Hi Lee, I took your advice and uninstalled the AVG with Revo and installed Avir. Also uninstalled Adobe 6.0 using Revo and installed Foxit. This morning I tried to do some scanning and my Kodak AIO Homecenter said there wasn't enough memory to scan after only two images scanned. Yesterday I scanned in 20 images with no problem. After using Revo to uninstall Adobe and checking all the bolded entries I still have the NOS Get Plus ® Helper 1003 running as a service. Tried to tremove it with the NT Service removal in HJT to no avail. I went to Control Panel> Administrative Tools> Services and found the get Plus ® Helper 1003 in the Services list, right clicked and opened Properties and copied the path from the dialog box into the dialog box in the HJT Remove NT Service dialog box but got an error message saying the entry was not valid. After my scanner problems this morning I ran a deep scan on all files with Avira and it found 8 instances of APP/KILLApplicat which I quarantined along with 115 warnings. There is a complete report that is very lengthy that I have not completely reviewed yet, but about a fourth of the way down the page there is a very extensive list of Java items a good number of which appear suspicious to me. I would like to send it for your review but I give you fair warning it's a HUGE list. The scan took over four hours. I have considered using Revo to uninstall Java but when right clicking on the Java icon there is no Force Uninstall option as in other programs. Also after using Revo to uninstall AVG there are still numerous files with AVG in the name when I ran a search from the Start menu. I like the Avir so far. It seems to be doing it's job well, in fact this afternoon the Guard found another instance of APPL/KILLApplicat which I clicked on Remove. Thank you for you help and advice. We are making progress but whatever is in there appears to be buried pretty deep. I know that malware isn't your particular area but I am relying more on your expertise to focus on what IS supposed to be there and what is not. Thanks Again ! Looking forward to your reply. Tim K

I'm glad you decided to remove AVG as it was obviously causing issues you don't need.
The only thing that might annoy you in Avira is the nagware advert. that appears after each update. If you wish to disable this nagware, follow these steps:

For Windows XP Home (only, as there are different methods for XP pro. and W7).

1.Boot into Safe Mode (tap F8 after powering on your PC for a menu).
2.Log into an account with administrator privileges.
3.Navigate to your Avira program folder.
4.Right click on the file avnotify.exe and select Properties.
5.Click Edit > Traverse Folder/Execute File > Deny > OK.
Reboot and enjoy.

You should be able to remove Java through add and remove programs.
Click Start
Select Control Panel
Click the Add/Remove Programs control panel icon
The Add/Remove control panel displays a list of software on your system, including any Java software products that are on your computer. Select any that you want to uninstall by clicking on it, and then click the Remove button.

OR: You may have Microsoft JVM (Microsoft Java Virtual Machine). If so go here for removal and replace with Sun Java: http://www.helpwithwindows.com/WindowsXP/howto-21.html

I'm surprised that there is still AVG files on your PC . Go to AVG http://www.avg.com/us-en/download-tools
and download the AVG removal tool.

get Plus ® Helper 1003

getPlus_HelperSvc.exe
This is an Adobe downloader used to download updates for Adobe applications.
If you cannot uninstall it, disable it in your start-up menu. Go to Start / run and type in msconfig. Go to startup tab / untick getPlus_HelperSvc / apply and close.


Cheers,
Lee