laptop hijack logs

Thanks for sending your information. We are sorry for the delay in responding. The volunteers here are swamped, and unfortunately, not all logs get answered as quickly as we'd like. If you still need help with your problem, please reply to this message with a new HijackThis log. I will be notified automatically when you reply. wng

To start with I would like you to do this

Please delete your temporary files by deleting all files and folders that are in those folders (do not delete the temp folder itself) like for example
C:\WINDOWS\Temp\
C:\Temp\
C:\Documents and Settings\username\Local Settings\Temp\
Also delete your Temporary Internet Files, be sure to also select delete all offline content.

Do a virus scan here.
If you get report of files that can’t be cleaned / deleted please write down the filenames and locations and post that in your reply.

Then please do this since it’s better to use automated tools to get rid of the bad stuff use these 2 programs first before doing the final cleaning with HJT

First is Spybot S & D available from here.

1. Downloaded and Install Spybot S&D, accepting the Default Settings

2. In the Menu Bar at the top of the Spybot window you will see 'Mode'. Make certain that 'default mode' has a check mark beside it.

3. Close ALL windows except Spybot S&D

4. Click the button to ‘Search for Updates’ then download and install the Updates.

5. Next click the button ‘Check for Problems'

6. When Spybot is complete, it will be showing ‘RED’ entries bold 'Black' entries and ‘GREEN’ entries in the window

7. Make certain there is a check mark beside all of the RED entries ONLY.

8. Choose ‘Fix Selected Problems’ and allow Spybot to fix the RED entries.

9. REBOOT to complete the scan and clear memory.


Download Ad-aware Second Edition here and install it. If you already have Ad-aware Second Edition skip to the next step.

Open adaware and Click the "Check for updates now" line on the main screen. CLick the "Connect" button on the webupdate screen.

If an update is available download it and install it. Click the "Finish" button to go back to the main screen.

Click on the "Settings" button (gear symbol in the upper right corner of the main status screen) in the quick launch toolbar to open the General settings screen. Make sure the "Automatically quarantine objects prior to removal" setting is checked green and then click "Proceed" to save your changes.

Click the "Scan now" button in the main menu on the left side of the main status screen or use the "Start" button in lower right corner. This will open the Preparing System Scan screen. Please deselect "Search for negligible risk entries", as negligible risk entries (MRU's) are not considered to be a threat. Leave the option for low-risk threats unchecked also. Then select "Use custom scanning options" and click "CUstomize". This will open the "Scan Settings Page. Make sure all of the following are On with a green checkmark:

• Scan within archives

Then click on the "Tweak" Button to open up the tweak settings.

Open up the Scanning Engine section and make sure all of the following are On with a green checkmark:

• Scan registry for all users instead of current user only

Make sure the following is unchecked with a red X:

• Unload recognized processes & modules during scan.

Open up the Cleaning Engine section and make sure all of the following are On with a green checkmark:

• Always try to unload modules before deletion
• During Removal, unload Explorer and IE if necessary
• Let Windows remove files in use at next reboot.

Click the "Proceed" button to save settings. Click next to begin the scan. When the scan is completed, the Performing System Scan screen will change name to "Scan Complete".

Click the "Next" button to get to the Scanning Results screens where more information about the objects detected during the scan is available. Click the Critical Objects Tab. In general all of the items listed will be bad. To fix all the bad critical objects, right click on one of them to open up the selection screen. Click the "Select All" button to select all entries. Then all are selected Click "Next" and then "OK" in the pop-up window to confirm the removal.

Run the scan, and then reboot.

Doubleclick on HijackThis.
Then click on the button that says run a system scan
Then place a check next to the following items and click "fix"

O2 - BHO: (no name) - {815952F7-7E41-4D13-B269-79777546BCDB} - (no file)
O2 - BHO: (no name) - {C54EB61A-3E92-4042-81F7-A6BD55956C5D} - (no file)
O16 - DPF: {9BED3AC7-E6D4-43E7-B8A1-1FA502F639E1} (XTools Control) - http://player.bugs.co.kr/install/mv/XTools.cab


reboot, post a new HJT log, and specific symptoms of your computer.

wng

the reason you have lots of processes running is that Vios come loaded with sony programs. They are mostly useful, but if you'd like some help getting rid of the uneccesary items, just ask and I'll give some advice. Your HJT log looks good to me, but that doesn't look everywhere. I would like to try 2 more scans to be sure.

Download http://www.bleepingcomputer.com/files/winpfind.php

Extract WinPFind.zip to your c:\ folder.
Please print these instructions as you will be going into safe mode.
Reboot your computer into Safe Mode by following the following steps:

Reboot.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode

Then open c:\WinPFind and double-click on WinPFind.exe. When the program is open, click on the Start Scan button to scart scanning your computer. Be patient as this scan may take a while. When it is done, it will show a log and tell you the scan is completed. Reboot your computer back to normal mode and and post the contents of c:\WinPFind\WinPFind.txt as a reply to this topic.


also,
Please do an online scan with Kaspersky Online Scanner

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then start to download the latest definition files.
• Once the scanner is installed and the definitions downloaded, click Next.
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
    • Extended (If available otherwise Standard)
  • Scan Options:
    • Scan Archives
    • Scan Mail Bases
• Click OK
• Now under select a target to scan select My Computer
• The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
• Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

Gimme a winpfind log and a kaparsky log.
wng

here is the kaspersky scan results… ——————————————————————————- KASPERSKY ON-LINE SCANNER REPORT Monday, November 21, 2005 12:49:11 Operating System: Microsoft Windows XP Home Edition, Service Pack 1 (Build 2600) Kaspersky On-line Scanner version: 5.0.67.0 Kaspersky Anti-Virus database last update: 21/11/2005 Kaspersky Anti-Virus database records: 160898 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ F:\ Scan Statistics: Total number of scanned objects: 49008 Number of viruses found: 1 Number of infected objects: 2 Number of suspicious objects: 0 Duration of the scan process: 8357 sec Infected Object Name - Virus Name C:\Program Files\Trend Micro\Internet Security 2005\Quarantine\E.tmp/javainstaller/InstallerApplet.class Infected: Trojan-Downloader.Java.OpenStream.w C:\Program Files\Trend Micro\Internet Security 2005\Quarantine\E.tmp Infected: Trojan-Downloader.Java.OpenStream.w Scan process completed. here is the WinPF scan result… WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding. If you see a message in the titlebar saying "Not responding…" you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly. »»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Product Name: Microsoft Windows XP Current Build: Service Pack 1 Current Build Number: 2600 Internet Explorer Version: 6.0.2800.1106 »»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»» Checking %SystemDrive% folder… Checking %ProgramFilesDir% folder… Checking %WinDir% folder… PECompact2 11/7/2005 12:42:32 PM 16367437 C:\WINDOWS\lpt$vpn.933 qoologic 11/7/2005 12:42:32 PM 16367437 C:\WINDOWS\lpt$vpn.933 SAHAgent 11/7/2005 12:42:32 PM 16367437 C:\WINDOWS\lpt$vpn.933 UPX! 5/3/2005 11:44:44 AM 25157 C:\WINDOWS\RMAgentOutput.dll UPX! 1/10/2005 4:17:24 PM 170053 C:\WINDOWS\tsc.exe UPX! 2/8/2005 9:19:58 AM 57344 C:\WINDOWS\Unwash5.exe PECompact2 11/7/2005 12:42:32 PM 16367437 C:\WINDOWS\VPTNFILE.933 qoologic 11/7/2005 12:42:32 PM 16367437 C:\WINDOWS\VPTNFILE.933 SAHAgent 11/7/2005 12:42:32 PM 16367437 C:\WINDOWS\VPTNFILE.933 UPX! 2/18/2005 6:40:14 PM 1044560 C:\WINDOWS\vsapi32.dll aspack 2/18/2005 6:40:14 PM 1044560 C:\WINDOWS\vsapi32.dll Checking %System% folder… PEC2 3/31/2003 7:00:00 AM 41397 C:\WINDOWS\SYSTEM32\dfrg.msc PEC2 9/3/2004 1:03:48 PM 716800 C:\WINDOWS\SYSTEM32\DivX.dll PECompact2 9/3/2004 1:03:48 PM 716800 C:\WINDOWS\SYSTEM32\DivX.dll PECompact2 11/2/2005 12:34:18 AM 2368864 C:\WINDOWS\SYSTEM32\MRT.exe aspack 11/2/2005 12:34:18 AM 2368864 C:\WINDOWS\SYSTEM32\MRT.exe Umonitor 3/31/2003 7:00:00 AM 631808 C:\WINDOWS\SYSTEM32\rasdlg.dll aspack 2/24/2004 9:56:36 AM 180736 C:\WINDOWS\SYSTEM32\Sony XBRITE.scr winsync 3/31/2003 7:00:00 AM 1309184 C:\WINDOWS\SYSTEM32\wbdbase.deu Checking %System%\Drivers folder and sub-folders… UPX! 2/18/2005 6:43:18 PM 962672 C:\WINDOWS\SYSTEM32\drivers\VsapiNT.sys aspack 2/18/2005 6:43:18 PM 962672 C:\WINDOWS\SYSTEM32\drivers\VsapiNT.sys Items found in C:\WINDOWS\SYSTEM32\drivers\etc\hosts Checking the Windows folder and sub-folders for system and hidden files within the last 60 days… 11/21/2005 6:50:54 AM S 2048 C:\WINDOWS\bootstat.dat 11/2/2005 2:14:50 PM H 66704 C:\WINDOWS\MEMORY.DMP 10/5/2005 8:33:38 PM S 12849 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB896424.cat 10/4/2005 12:16:36 PM S 20086 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB896688-IE6SP1-20051004.130236.cat 9/28/2005 10:53:30 AM S 17402 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB900725.cat 11/21/2005 6:50:36 AM H 8192 C:\WINDOWS\system32\config\default.LOG 11/21/2005 6:51:32 AM H 1024 C:\WINDOWS\system32\config\SAM.LOG 11/21/2005 6:50:58 AM H 12288 C:\WINDOWS\system32\config\SECURITY.LOG 11/21/2005 6:52:14 AM H 65536 C:\WINDOWS\system32\config\software.LOG 11/21/2005 6:50:54 AM H 7249920 C:\WINDOWS\system32\config\system.LOG 11/11/2005 3:44:14 PM H 1024 C:\WINDOWS\system32\config\systemprofile\NTUSER.DAT.LOG 11/14/2005 1:23:42 AM HS 388 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\78737889-f10b-46b6-9191-cee78ce92be3 11/14/2005 1:23:42 AM HS 24 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\Preferred 11/21/2005 6:49:30 AM H 6 C:\WINDOWS\Tasks\SA.DAT Checking for CPL files… Microsoft Corporation 3/31/2003 7:00:00 AM 66048 C:\WINDOWS\SYSTEM32\access.cpl Microsoft Corporation 5/29/2003 1:47:38 PM 579584 C:\WINDOWS\SYSTEM32\appwiz.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 129024 C:\WINDOWS\SYSTEM32\desk.cpl Microsoft Corporation 9/24/2002 3:25:18 PM 151040 C:\WINDOWS\SYSTEM32\hdwwiz.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 292352 C:\WINDOWS\SYSTEM32\inetcpl.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 121856 C:\WINDOWS\SYSTEM32\intl.cpl Microsoft Corporation 9/24/2002 3:25:18 PM 111104 C:\WINDOWS\SYSTEM32\irprops.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 65536 C:\WINDOWS\SYSTEM32\joy.cpl Sun Microsystems 8/19/2003 7:23:34 PM 61547 C:\WINDOWS\SYSTEM32\jpicpl32.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 187904 C:\WINDOWS\SYSTEM32\main.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 559616 C:\WINDOWS\SYSTEM32\mmsys.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 35840 C:\WINDOWS\SYSTEM32\ncpa.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 256000 C:\WINDOWS\SYSTEM32\nusrmgr.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 36864 C:\WINDOWS\SYSTEM32\odbccp32.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 109056 C:\WINDOWS\SYSTEM32\powercfg.cpl Sony Corporation 8/6/2002 7:00:00 PM 53248 C:\WINDOWS\SYSTEM32\SNSetup.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 268288 C:\WINDOWS\SYSTEM32\sysdm.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 28160 C:\WINDOWS\SYSTEM32\telephon.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 90112 C:\WINDOWS\SYSTEM32\timedate.cpl Microsoft Corporation 5/26/2005 5:16:30 AM 174360 C:\WINDOWS\SYSTEM32\wuaucpl.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 66048 C:\WINDOWS\SYSTEM32\dllcache\access.cpl Microsoft Corporation 5/29/2003 1:47:38 PM 579584 C:\WINDOWS\SYSTEM32\dllcache\appwiz.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 129024 C:\WINDOWS\SYSTEM32\dllcache\desk.cpl Microsoft Corporation 9/24/2002 3:25:18 PM 151040 C:\WINDOWS\SYSTEM32\dllcache\hdwwiz.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 292352 C:\WINDOWS\SYSTEM32\dllcache\inetcpl.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 121856 C:\WINDOWS\SYSTEM32\dllcache\intl.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 65536 C:\WINDOWS\SYSTEM32\dllcache\joy.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 187904 C:\WINDOWS\SYSTEM32\dllcache\main.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 559616 C:\WINDOWS\SYSTEM32\dllcache\mmsys.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 35840 C:\WINDOWS\SYSTEM32\dllcache\ncpa.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 256000 C:\WINDOWS\SYSTEM32\dllcache\nusrmgr.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 36864 C:\WINDOWS\SYSTEM32\dllcache\odbccp32.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 109056 C:\WINDOWS\SYSTEM32\dllcache\powercfg.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 147456 C:\WINDOWS\SYSTEM32\dllcache\sapi.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 268288 C:\WINDOWS\SYSTEM32\dllcache\sysdm.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 28160 C:\WINDOWS\SYSTEM32\dllcache\telephon.cpl Microsoft Corporation 3/31/2003 7:00:00 AM 90112 C:\WINDOWS\SYSTEM32\dllcache\timedate.cpl Microsoft Corporation 9/24/2002 3:25:18 PM 111104 C:\WINDOWS\SYSTEM32\ReinstallBackups\0010\DriverFiles\i386\irprops.cpl »»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»» Checking files in %ALLUSERSPROFILE%\Startup folder… 4/27/2004 2:26:36 PM HS 84 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini Checking files in %ALLUSERSPROFILE%\Application Data folder… 4/27/2004 7:18:16 AM HS 62 C:\Documents and Settings\All Users\Application Data\desktop.ini 8/16/2004 4:16:20 PM 1130 C:\Documents and Settings\All Users\Application Data\hpzinstall.log Checking files in %USERPROFILE%\Startup folder… 4/27/2004 2:26:36 PM HS 84 C:\Documents and Settings\crystal\Start Menu\Programs\Startup\desktop.ini 11/17/2005 1:24:56 PM 1685 C:\Documents and Settings\crystal\Start Menu\Programs\Startup\Stardock ObjectDock.lnk Checking files in %USERPROFILE%\Application Data folder… 4/27/2004 7:18:16 AM HS 62 C:\Documents and Settings\crystal\Application Data\desktop.ini 9/14/2004 1:35:20 PM 33168 C:\Documents and Settings\crystal\Application Data\GDIPFONTCACHEV1.DAT »»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»» [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers] HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files {750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With {09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\SHELL32.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu {A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu {5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Program Files\Norton AntiVirus\NavShExt.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinRAR {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{48F45200-91E6-11CE-8A4F-0080C81A28D4} = C:\Program Files\Trend Micro\Internet Security 2005\Tmdshell.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} Start Menu Pin = %SystemRoot%\system32\SHELL32.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu {5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Program Files\Norton AntiVirus\NavShExt.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\{48F45200-91E6-11CE-8A4F-0080C81A28D4} = C:\Program Files\Trend Micro\Internet Security 2005\Tmdshell.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EncryptionMenu {A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files {750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = ntshrui.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE} = %SystemRoot%\system32\SHELL32.dll [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} AcroIEHlprObj Class = C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F} = C:\Program Files\Spybot - Search & Destroy\SDHelper.dll HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872} CNavExtBho Class = C:\Program Files\Norton AntiVirus\NavShExt.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376} &Tip of the Day = %SystemRoot%\System32\shdocvw.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar] {8E718888-423F-11D2-876E-00A0C9082467} = &Radio : C:\WINDOWS\system32\msdxm.ocx {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} = Norton AntiVirus : C:\Program Files\Norton AntiVirus\NavShExt.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} MenuText = Sun Java Console : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{92780B25-18CC-41C8-B9BE-3C9C571A8263} ButtonText = Research : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} ButtonText = AIM : C:\Program Files\AIM\aim.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683} ButtonText = Messenger : C:\Program Files\Messenger\MSMSGS.EXE [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478} Media Band = %SystemRoot%\System32\browseui.dll HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E61-B078-11D0-89E4-00C04FC9E26E} Favorites Band = %SystemRoot%\System32\shdocvw.dll [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} = Norton AntiVirus : C:\Program Files\Norton AntiVirus\NavShExt.dll {2318C2B1-4965-11D4-9B18-009027A5CD4F} = : HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser {01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\System32\browseui.dll {2318C2B1-4965-11D4-9B18-009027A5CD4F} = : {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} = : {40D41A8B-D79B-43D7-99A7-9EE0F344C385} = : {014DA6C9-189F-421A-88CD-07CFE51CFF10} = : [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] Apoint C:\Program Files\Apoint\Apoint.exe SonyPowerCfg C:\Program Files\Sony\VAIO Power Management\SPMgr.exe ISBMgr.exe C:\Program Files\Sony\ISB Utility\ISBMgr.exe HKSERV.EXE C:\Program Files\Sony\HotKey Utility\HKserv.exe ATIModeChange Ati2mdxx.exe DeadAIM rundll32.exe "C:\PROGRA~1\AIM\\DeadAIM.ocm",ExportedCheckODLs gcasServ "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" ccApp "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" SSC_UserPrompt C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe ezShieldProtector for Px C:\WINDOWS\System32\ezSP_Px.exe iTunesHelper "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] IMAIL Installed = 1 MAPI Installed = 1 MSFS Installed = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ctfmon.exe C:\WINDOWS\System32\ctfmon.exe AIM C:\Program Files\AIM\aim.exe -cnetwait.odl [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk path C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup location Common Startup command C:\PROGRA~1\HP\DIGITA~1\bin\hpqtra08.exe item HP Digital Imaging Monitor path C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup location Common Startup command C:\PROGRA~1\HP\DIGITA~1\bin\hpqtra08.exe item HP Digital Imaging Monitor HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk path C:\Documents and Settings\All Users\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk backup C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup location Common Startup command C:\PROGRA~1\INTERV~1\Common\Bin\WINCIN~1.EXE item InterVideo WinCinema Manager path C:\Documents and Settings\All Users\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk backup C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup location Common Startup command C:\PROGRA~1\INTERV~1\Common\Bin\WINCIN~1.EXE item InterVideo WinCinema Manager HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office OneNote 2003 Quick Launch.lnk path C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office OneNote 2003 Quick Launch.lnk backup C:\WINDOWS\pss\Microsoft Office OneNote 2003 Quick Launch.lnkCommon Startup location Common Startup command C:\PROGRA~1\MICROS~3\OFFICE11\ONENOTEM.EXE /tsr item Microsoft Office OneNote 2003 Quick Launch path C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office OneNote 2003 Quick Launch.lnk backup C:\WINDOWS\pss\Microsoft Office OneNote 2003 Quick Launch.lnkCommon Startup location Common Startup command C:\PROGRA~1\MICROS~3\OFFICE11\ONENOTEM.EXE /tsr item Microsoft Office OneNote 2003 Quick Launch HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk path C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup location Common Startup command C:\PROGRA~1\MICROS~3\Office10\OSA.EXE -b -l item Microsoft Office path C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup location Common Startup command C:\PROGRA~1\MICROS~3\Office10\OSA.EXE -b -l item Microsoft Office HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\BluetoothAuthenticationAgent key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item rundll32 hkey HKLM command rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item rundll32 hkey HKLM command rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\EPSON Stylus Photo R300 Series key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item E_S4I2F1 hkey HKLM command C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB002" /M "Stylus Photo R300" inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item E_S4I2F1 hkey HKLM command C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB002" /M "Stylus Photo R300" inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ezShieldProtector for Px key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item ezSP_Px hkey HKLM command C:\WINDOWS\System32\ezSP_Px.exe inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item ezSP_Px hkey HKLM command C:\WINDOWS\System32\ezSP_Px.exe inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\HP Component Manager key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item hpcmpmgr hkey HKLM command "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item hpcmpmgr hkey HKLM command "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\HP Software Update key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item HPWuSchd hkey HKLM command "C:\Program Files\HP\HP Software Update\HPWuSchd.exe" inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item HPWuSchd hkey HKLM command "C:\Program Files\HP\HP Software Update\HPWuSchd.exe" inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\iTunesHelper key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item iTunesHelper hkey HKLM command "C:\Program Files\iTunes\iTunesHelper.exe" inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item iTunesHelper hkey HKLM command "C:\Program Files\iTunes\iTunesHelper.exe" inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Mouse Suite 98 Daemon key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item ICO hkey HKLM command ICO.EXE inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item ICO hkey HKLM command ICO.EXE inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\pccguide.exe key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item pccguide hkey HKLM command "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe" inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item pccguide hkey HKLM command "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe" inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QuickTime Task key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item qttask hkey HKLM command "C:\Program Files\QuickTime\qttask.exe" -atboottime inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item qttask hkey HKLM command "C:\Program Files\QuickTime\qttask.exe" -atboottime inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SpySweeper key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item SpySweeper hkey HKCU command "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0 inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item SpySweeper hkey HKCU command "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0 inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Symantec NetDriver Monitor key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item SNDMon hkey HKLM command C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item SNDMon hkey HKLM command C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\VAIO Recovery key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item PartSeal hkey HKLM command C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item PartSeal hkey HKLM command C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ViewMgr key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item ViewMgr hkey HKLM command C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item ViewMgr hkey HKLM command C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\WildTangent CDA key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item cdaEngine0400 hkey HKLM command RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item cdaEngine0400 hkey HKLM command RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\zsxstn key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item zsxstn hkey HKLM command c:\windows\system32\zsxstn.exe inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item zsxstn hkey HKLM command c:\windows\system32\zsxstn.exe inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state system.ini 0 win.ini 0 bootini 0 services 0 startup 2 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum {BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL {6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} = {0DF44EAA-FF21-4412-828E-260A8728E7F1} = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system dontdisplaylastusername 0 legalnoticecaption legalnoticetext shutdownwithoutlogon 1 undockwithoutlogon 1 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies] HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer NoDriveTypeAutoRun 255 _NoDriveTypeAutoRun 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] PostBootReminder {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll CDBurn {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll WebCheck {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll SysTray {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] UserInit = C:\WINDOWS\system32\userinit.exe, Shell = Explorer.exe System = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent = Ati2evxx.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain = crypt32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet = cryptnet.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll = cscdll.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp = wlnotify.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule = wlnotify.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy = sclgntfy.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn = WlNotify.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv = wlnotify.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon = wlnotify.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path Debugger = ntsd -d [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] AppInit_DLLs »»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» WinPFind v1.4.1 - Log file written to "WinPFind.Txt" in the WinPFind folder. Scan completed on 11/21/2005 7:01:36 AM

Please clear out your java cache by following the instructions here:
http://www.java.com/en/download/help/5000020300.xml

Also, We are going to install Ewido AV. I have included instructions below, but there is also a PDF created by Spydie here if that suits you better.


Please download Ewido Security Suite it is a trial version of the program.

• Install ewido security suite
• Launch ewido, there should be an icon on your desktop double-click it.
• The program will now go to the main screen

You will need to update ewido to the latest definition files.

• On the left hand side of the main screen click update
• Then click on Start Update

The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use this link to manually update Ewido.
Ewido manual updates

Once the updates are installed do the following:

• Click on scanner
• Click on Complete System Scan and the scan will begin.
• NOTE: During some scans with ewido it is finding cases of false positives.**
  • You will need to step through the process of cleaning files one-by-one.
  • If ewido detects a file you KNOW to be legitimate, select none as the action.
  • DO NOT select "Perform action on all infections"
  • If you are unsure of any entry found select none for now.
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report
• Click Save report.
• Save the report .txt file to your desktop.

Now close ewido security suite.
**(Ewido for example has been flagging parts of AVG Anti-Virus, pcAnywhere and the game "Risk")

lastly,
please download Rootkit Revealer to your desktop. Unzip the file. Turn off your real time antivirus for a moment. Then go to file->scan
This will take some time. When it's done, go to file->save
save the logfile to the desktop, and then past the contents here.
*Don't forget to turn your AV back on afterwards*

Gimme a RKR log and an ewido log please.
wng

this thread has taken longer than expected, and I'm going to be away for the thanksgiving holiday. I will see if another helper can cover for me, and I will be back on Sunday. I will try and check in once in awhile, but if not someone else will help you if that's ok. wng

Hello tigerjk1410,

As wng_z3r0 said there are some holidays waiting for him.

With your permission I will take over till he comes back.
As earlier was noticed you have two antivirusprograms running. That is too much and can actually freeze the computer.

Try this:
Go to taksmanager (ctr + alt + del) en end the below process:

C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe

Reboot the computer and tell me how things are.

why of course i appreciate any and all help that i can get. i have trend micro on there but the thing is that i can't uninstall it because i did not install it and whoever did put a password on it. so all i can do is termintate it from the task manager like you stated….any ideas as to how to get rid of it? i have another AV program i want to use instead.

Go to taksmanager (ctr + alt + del) en end the below processes:

C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe

Go to Start > Settings > Control Panel >Add/Remove Programs
Remove the following (if they are there):
Trendmicro

Reboot the computer, run HijackThis again and post that log here.

i made sure to terminate those processes but it will still not let me uninstall trend micro because of a password that i did not put on there and don't know.

whoever did put a password on it

I am pretty sure that is the reason of the "slow down" of your computer.
Is there by any change a way to get that password?

HI there. I am back from thanksgiving break. Thanks to toscane for helping me out. Which AV do you want to use as your primary one? also, please go to start->run paste this in: regedit.exe c:\output.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" hit enter. then go to c:\output.txt paste the contents of that box here. wng