Author Topic: Restore points not working on windows xp (Read 29021 times)

sahmo4 · « **on:** February 12, 2008, 08:04:15 AM »

Hello all,

I first want to thank you for all of the help I've gotten reading your responses. In particular, the information on "Windows Update Failure".

Now, here's my problem. I successfully updated windows from windowsupdate.com, and set about cleaning up the files on my computer and hard drive. After uninstalling old programs and installing the more current ones, running windows update for all applicable software, hardware, etc., I finally got my computer to where I needed it to be.

The problem is this, while adjusting the settings for my children's log in, and trying to hide files I did not want them to access - I did this on the desktop and in the start>all programs menu. I did not realize this would make them disappear.

I lost desktop icons and links from the start menu. I have tried all of the show files, unhide files, search for hidden files fixes and to no avail. I even at last resort, tried to do a system restore. The message I get after rebooting is "Your computer cannot restore to (whichever point I chose). No changes have been made on your computer" I even went back 3 days.

I thought it could at least take me back to when I updated from the first issue. I'm pretty intelligent and catch on quick, however unless I have step by step instructions, I cannot fix, correct or otherwise do anything technical with my computer. So, please feel free to list tasks in the order they need to be done. Even sub-tasks ie: 1, 1.2, 1.3, 2, 2,1 etc.

Now I need to say this, what originally brought me to your site was I paid a computer company - very reputable - to clean the viruses that had invaded my computer, they felt pity on me and upgraded me to windows xp sp2 for free. However, when I got my computer back, I couldn't access click thru pages online and the updates from windows weren't taking. You guys/girls helped me out then, so, I am hoping you can and will help me out now.
I have 4 children who all need this 1 computer for school and I need it for work. Hence me trying to hide files so they couldn't access. I work part-time and am now running late.

Please help me, I am ready to tear out my hair, and throw something that will break. I hope I included enough information. If I have not, please tell me what to include. Should be home from work in about 3 hours.
Thank you sooooo muuuuch.

sahmo4 · « **Reply #1 on:** February 12, 2008, 09:09:12 AM »

Hello all,

when I posted this earlier, I locked the message not knowing it would keep me from getting replies.

Sorry about that. I think I fixed the problem so that I can receive replies.

Sorry again. Please reply.

Deerpark · « **Reply #2 on:** February 12, 2008, 11:16:06 AM »

You will need to tell us what you did to hide the icons on your desktop and start menu.

sahmo4 · « **Reply #3 on:** February 12, 2008, 11:56:55 AM »

Thanks for the response.

First I right-clicked on the desktop icon, went in to properties, on the general tab I checked the read-only box and the hide box.

On the start menu I did the same thing for the same program.

Upon further searching, the computer can find the file when I search for hidden files, however when I try to restore them or add a desktop shortcut, it is not happening.

My biggest question is why the computer is not actually processing when I try to do a system restore. I even tried to restore to the point the computer created after an update from windows.com.

That restore point is called Software Distribution Service 3.0.

Thanks

Deerpark · « **Reply #4 on:** February 12, 2008, 12:19:50 PM »

System Restore doesn't register a few hidden icons as a system change. So it is not letting you go back because nothing has changed.
To make your files reappear double click My Computer to open Windows Explorer.
Select Tools --> Folder Options
Select the View tab
Click Show hidden files and folders.
Hit OK a couple of times to close all open menus.
All hidden files are now visible.

sahmo4 · « **Reply #5 on:** February 12, 2008, 12:27:47 PM »

Thanks, I did try that before posting, along with that I also unchecked the hide extesions and unchecked the hide operating files. All to no avail.

That is why I finally tried to do a system retore from restore points.

Deerpark · « **Reply #6 on:** February 12, 2008, 12:41:15 PM »

And you're unable to create new desktop shortcuts?
You've done more than just hide icons then, because merely hiding icons would never make you unable to create new ones.
Have you deleted any files?

sahmo4 · « **Reply #7 on:** February 12, 2008, 12:54:44 PM »

The only files I recall deleting were adobe5, wordperfect/corell suite, office pre-2003 ( it was just a shell, I couldn't actually use any programs), and some pre-installed programs that came with the computer. the computer was originally windows 2000 operating system, and had programs with a creation date of 2001.

I did disk cleanup and de-frag after I updated from the windows. com, and before deleting anything; because I knew that would create a restore point by the computer.

Broni · « **Reply #8 on:** February 12, 2008, 01:35:52 PM »

Quote

I recall deleting

...deleting, or uninstalling?
I'm still unclear what is the current status of your computer.
What exactly you can't do, or you can't see?

sahmo4 · « **Reply #9 on:** February 12, 2008, 04:07:03 PM »

Some of the items I uninstalled and upon reboot if the folders were still there but empty, I deleted them.

The problem I am having is launching the programs in the folders I was trying to hide from my children's view.

Whenever I double-click on the folder, instead of launching, my search window comes up. Also, I can't seem to send a shortcut to desktop to help me launch the programs. I can't seem to get the files to come out of hiding either.

I'm begining to think that maybe a system recovery or re-install may be my only option. I have tried to use restore points, but, as I stated earlier, that is not working either.

Broni · « **Reply #10 on:** February 12, 2008, 04:16:13 PM »

Go Start>Run, and type in:
regsvr32 /i shell32.dll
Click OK.
Restart computer.

sahmo4 · « **Reply #11 on:** February 12, 2008, 04:56:05 PM »

I did that and a box popped up.

In the top it said "RegSvr32"

On the inside it had a yellow triangle with an exclamation mark, and this message:

No DLL name specified

Usage: regsvr32 [/u] [/s] [/n] [/i[:cmdline]] dllname
/u - Unregister server
/s - Silent; display no message boxes
/i - Call Dll Install passing it an optional [cmdline]; when used with /u calls dll uninstall
/n - do not call Dll Register Server; this option must be used with /i

OK (button)

I typed the message exactly as it appeared inside the box, no more and no less.

Broni · « **Reply #12 on:** February 12, 2008, 05:18:19 PM »

You sure, you hit SPACE bar where necessary (~ = SPACE)
regsvr32~/i~shell32.dll

sahmo4 · « **Reply #13 on:** February 12, 2008, 05:42:56 PM »

OK I noticed the first space, but, not the second one.

I did it and got this message"DllRegisterServer and DllInstall in shell32.dll succeeded".

Thank you so much. Now, does this mean I can now do a system retore from a previous restore point, recreate desktop icons and unhide folders, or what.

I am afraid to do anything on my own to get back to where I was before I obviously screwed something up. Especially, since I don't remember what I did to screw things up.

Also, since your'e my resident genious ;SMILE - there has got to be another way to restrict my children from seeing and/or affecting my programs and files, besides what I tried with the hiding thing - that obviously didn't work for me.

I appreciate you helping me and making it plain. BIG SMILE

Broni · « **Reply #14 on:** February 12, 2008, 06:26:26 PM »

Quote

does this mean I can now do a system retore from a previous restore point

The above command was one of possibilities to get your System Restore function back, so you can safely try it, and see, if it works.
We have to fix your main issue before we go to hide-and seek stuff.

sahmo4 · « **Reply #15 on:** February 12, 2008, 10:07:58 PM »

Hello, I'm back.

Itried to do a system restore, using three different points to no avail.

Here is what happens: The little window that shows what the computer is doing shows and says "preparing to restore" the bar only goes about 1/4 of the way - slowly- and then really fast it says "restoring settings". This takes about a total of 1-2 minutes from the time the box pops up.

After the automatic reboot, the System Restore screen comes back up and says "Restoration Incomplete" "Your computer cannoy be restored to (the point I designated).

Broni · « **Reply #16 on:** February 12, 2008, 10:39:50 PM »

What's the update on these:

Quote

Whenever I double-click on the folder, instead of launching, my search window comes up. Also, I can't seem to send a shortcut to desktop to help me launch the programs. I can't seem to get the files to come out of hiding either.

sahmo4 · « **Reply #17 on:** February 12, 2008, 10:54:00 PM »

That is working now. I also tried launching from the shortcut created and the program launched

Broni · « **Reply #18 on:** February 12, 2008, 11:15:53 PM »

Good, one thing fixed, couple more to go...
What is NOT working right now, beside System Restore?
If you use Norton, try to turn it off, and use System Restore again.
I'd like to see your HJT log: http://www.snapfiles.com/get/hijackthis.html

sahmo4 · « **Reply #19 on:** February 12, 2008, 11:48:27 PM »

I cut and paste the documents of the file, because I didn't know how else to get you the info.

I don't have Norton, and my computer gives me a pop up balloon that says I might be at risk because there is no anti-virus program.

My computer did contract a virus, and that is what I paid to have fixed. However, I don't own any software for that, because my previous computer- which was stolen- came with it. This computer was given to me by someone who upgraded.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:32:20 AM, on 2/13/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\SYSTEM32\Brmfrmps.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\WINDOWS\LTMSG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us4.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sbc.yahoo.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: Freedom BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\Zero Knowledge\Freedom\FreeBHOR.dll
O3 - Toolbar: &Zero-Knowledge Freedom - {FA91B828-F937-4568-82C1-843627E63ED7} - C:\Program Files\Zero Knowledge\Freedom\BandObjs.dll
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\WINDOWS\system32\PRISMSVR.EXE" /APPLY
O4 - HKLM\..\Run: [DDCActiveMenu] "C:\Program Files\WildTangent\DDC\ActiveMenu\DDCActiveMenu.exe" -boot
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [checktime] c:\program files\HPSelect\Frontend\ct.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - S-1-5-18 Startup: AutoPlay.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: AutoPlay.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoPlay.exe (User 'Default user')
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1202359862843
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Program Files\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Brother Industries, Ltd. - C:\WINDOWS\SYSTEM32\Brmfrmps.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

--
End of file - 6239 bytes

sahmo4 · « **Reply #20 on:** February 12, 2008, 11:49:55 PM »

i forgot to ask what you want me to do with the screen from Hijackthis. I currently have it minimized.

Broni · « **Reply #21 on:** February 13, 2008, 12:03:35 AM »

You can shut it down.

Broni · « **Reply #22 on:** February 13, 2008, 12:12:30 AM »

What is NOT working right now, beside System Restore?

We're not gonna worry about your System Restore, for now, because we have more serious issues.
Your computer can't be exposed to the internet without antivirus, and firewall, so this is what you're gonna do.

Check, if your Windows firewall is up...
Go Start>Control Panel. Click on the Security Center icon. Click on the Windows Firewall icon beneath the status updates. Make sure, it's ON

Download, and install AVG free antivirus: http://free.grisoft.com/
Update it, and run full scan.

When you're done...
Download SUPERAntiSpyware Free for Home Users:
http://www.superantispyware.com/

Print these instructions out.

* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
* Close SUPERAntiSpyware.

Restart computer in Safe Mode.
To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; pick Safe Mode; you'll see "Safe Mode" in all four corners of your screen

* Open SUPERAntiSpyware.
* Under "Configuration and Preferences", click the Preferences button.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):
o Close browsers before scanning.
o Scan for tracking cookies.
o Terminate memory threats before quarantining.
* Click the "Close" button to leave the control center screen.
* Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
* On the left, make sure you check C:\Fixed Drive.
* On the right, under "Complete Scan", choose Perform Complete Scan.
* Click "Next" to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
* Make sure everything has a checkmark next to it and click "Next".
* A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
* If asked if you want to reboot, click "Yes".
* To retrieve the removal information after reboot, launch SUPERAntispyware again.
o Click Preferences, then click the Statistics/Logs tab.
o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
o If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
o Please copy and paste the Scan Log results in your next reply with a new HijackThis log.
* Click Close to exit the program.
Post SUPERAntiSpyware log.

3. Post new HijackThis log.

You have a lot of things to do, then, so I can safely go to bed. See you tomorrow.

sahmo4 · « **Reply #23 on:** February 13, 2008, 12:15:45 AM »

Thank you very much for all of your help.

I will get started on this right now.

sahmo4 · « **Reply #24 on:** February 13, 2008, 08:13:20 PM »

Hi Broni, I'm back.

How are you today? I hope, well!

Please be patient with me, as I have tried to answer all and do all of the tasks that were before me. Today has been rather eventful for me, so if I forgot something, please remind me.

Thank you.

Right now it appears that everything is working properly, besides the system recovery. Wat I have found is this:

1. Before the scans, a little bit of crazy existed. Since the scans some of the crazy is fixed..I went in an unhid the folders, some showed up on the desktop, but, not in the start>all programs. Some are also missing files that I know I downloaded beefore the screw up.

2. I am not as concerned with that as I once was, because, I figure I can un-install the programs that I installed - the ones from disk and online- and then re-install them.

3. Firewall is on. Since the scan I don't get the unprotected warning balloon. However, I was getting a pop-up screen before the screw up, it went away after the screw up, and now it is back.

The screen is c:\Program Files\Microsoft and it contains a folder labeled MigWiz.

Broni · « **Reply #25 on:** February 13, 2008, 08:18:01 PM »

OK...firewall is up, you installed AVG, and you ran a full scan, correct?

If so, it's time for Superantispyware, and new HJT log.

sahmo4 · « **Reply #26 on:** February 13, 2008, 08:20:45 PM »

I have been trying to post them, but, they exceed the character limit.

So, I've been trying to figure out how to break them into sections to send to you.

sahmo4 · « **Reply #27 on:** February 13, 2008, 08:23:27 PM »

here is the HJT log. I added the number 2 so I could tell the difference if I needed them later- or if you needed them later- cause I don't know what I'm reading.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:48:14 PM, on 2/13/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\SYSTEM32\Brmfrmps.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\WINDOWS\LTMSG.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgw.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us4.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sbc.yahoo.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: Freedom BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\Zero Knowledge\Freedom\FreeBHOR.dll
O3 - Toolbar: &Zero-Knowledge Freedom - {FA91B828-F937-4568-82C1-843627E63ED7} - C:\Program Files\Zero Knowledge\Freedom\BandObjs.dll
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\WINDOWS\system32\PRISMSVR.EXE" /APPLY
O4 - HKLM\..\Run: [DDCActiveMenu] "C:\Program Files\WildTangent\DDC\ActiveMenu\DDCActiveMenu.exe" -boot
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [checktime] c:\program files\HPSelect\Frontend\ct.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - S-1-5-18 Startup: AutoPlay.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: AutoPlay.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoPlay.exe (User 'Default user')
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1202359862843
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Program Files\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Brother Industries, Ltd. - C:\WINDOWS\SYSTEM32\Brmfrmps.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

--
End of file - 7360 bytes

Broni · « **Reply #28 on:** February 13, 2008, 08:26:37 PM »

I need Superantispyware log, too.
I assume, HJT was run AFTER Super. If log is to big, just copy/paste half of it in one post, and another half in next post.

sahmo4 · « **Reply #29 on:** February 13, 2008, 08:30:11 PM »

Here is the first part, and they may be several. The scan took 5hours and 40 minutes.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 02/13/2008 at 01:25 PM

Application Version : 3.9.1008

Core Rules Database Version : 3401
Trace Rules Database Version: 1393

Scan type : Complete Scan
Total Scan Time : 05:40:41

Memory items scanned : 169
Memory threats detected : 0
Registry items scanned : 5955
Registry threats detected : 0
File items scanned : 120962
File threats detected : 465

Adware.Tracking Cookie
   C:\Documents and Settings\Owner\Cookies\owner@windowsmedia[1].txt
   C:\Documents and Settings\Owner\Cookies\owner@advertising[1].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][4].txt
   C:\Documents and Settings\Owner\Cookies\owner@tripod[2].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
   C:\Documents and Settings\Owner\Cookies\owner@findwhat[2].txt
   C:\Documents and Settings\Owner\Cookies\owner@questionmarket[2].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
   C:\Documents and Settings\Owner\Cookies\owner@realmedia[1].txt
   C:\Documents and Settings\Owner\Cookies\owner@tacoda[3].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
   C:\Documents and Settings\Owner\Cookies\owner@tribalfusion[1].txt
   C:\Documents and Settings\Owner\Cookies\owner@statcounter[1].txt
   C:\Documents and Settings\Owner\Cookies\owner@2o7[1].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
   C:\Documents and Settings\Owner\Cookies\owner@specificclick[2].txt
   C:\Documents and Settings\Owner\Cookies\owner@zedo[2].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
   C:\Documents and Settings\Owner\Cookies\owner@apmebf[1].txt
   C:\Documents and Settings\Owner\Cookies\owner@fastclick[1].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][3].txt
   C:\Documents and Settings\Owner\Cookies\owner@atdmt[3].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
   C:\Documents and Settings\Owner\Cookies\owner@burstnet[2].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][3].txt
   C:\Documents and Settings\Owner\Cookies\owner@trafficmp[1].txt
   C:\Documents and Settings\Owner\Cookies\owner@adrevolver[1].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
   C:\Documents and Settings\Owner\Cookies\owner@mediaplex[2].txt
   C:\Documents and Settings\Owner\Cookies\owner@spamblockerutility[2].txt
   C:\Documents and Settings\Owner\Cookies\owner@casalemedia[2].txt
   C:\Documents and Settings\Owner\Cookies\owner@partner2profit[1].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][3].txt
   C:\Documents and Settings\Owner\Cookies\owner@doubleclick[1].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][1].txt

sahmo4 · « **Reply #30 on:** February 13, 2008, 08:34:35 PM »

Part 2 is here.

C:\Documents and Settings\Administrator\Cookies\owner@2o7[2].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator\Cookies\owner@advertising[2].txt
   C:\Documents and Settings\Administrator\Cookies\owner@adviva[2].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator\Cookies\owner@apmebf[1].txt
   C:\Documents and Settings\Administrator\Cookies\owner@atdmt[2].txt
   C:\Documents and Settings\Administrator\Cookies\owner@atwola[1].txt
   C:\Documents and Settings\Administrator\Cookies\owner@bannerspace[2].txt
   C:\Documents and Settings\Administrator\Cookies\owner@belnk[1].txt
   C:\Documents and Settings\Administrator\Cookies\owner@bluestreak[2].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator\Cookies\owner@casalemedia[1].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator\Cookies\owner@clickondetroit[1].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator\Cookies\owner@doubleclick[1].txt
   C:\Documents and Settings\Administrator\Cookies\owner@easywarez[1].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator\Cookies\owner@fastclick[2].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator\Cookies\owner@findwhat[1].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator\Cookies\owner@hitbox[2].txt
   C:\Documents and Settings\Administrator\Cookies\owner@kanoodle[2].txt
   C:\Documents and Settings\Administrator\Cookies\owner@linksynergy[1].txt
   C:\Documents and Settings\Administrator\Cookies\owner@maxserving[1].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator\Cookies\owner@mediaplex[1].txt
   C:\Documents and Settings\Administrator\Cookies\owner@mediax[1].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator\Cookies\owner@nextag[2].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator\Cookies\owner@overture[1].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator\Cookies\owner@qksrv[2].txt
   C:\Documents and Settings\Administrator\Cookies\owner@questionmarket[1].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator\Cookies\owner@realmedia[2].txt
   C:\Documents and Settings\Administrator\Cookies\owner@revsci[1].txt
   C:\Documents and Settings\Administrator\Cookies\owner@rightmedia[1].txt
   C:\Documents and Settings\Administrator\Cookies\owner@roiservice[1].txt
   C:\Documents and Settings\Administrator\Cookies\owner@serving-sys[1].txt
   C:\Documents and Settings\Administrator\Cookies\owner@sitestats[1].txt
   C:\Documents and Settings\Administrator\Cookies\owner@specificclick[1].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator\Cookies\owner@tacoda[1].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator\Cookies\owner@tribalfusion[2].txt
   C:\Documents and Settings\Administrator\Cookies\owner@valueclick[1].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator\Cookies\owner@zedo

sahmo4 · « **Reply #31 on:** February 13, 2008, 08:37:03 PM »

Here is part 3.

C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@2o7[2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@advertising[2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@adviva[2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@apmebf[1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@atdmt[2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@atwola[1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@bannerspace[2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@belnk[1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@bluestreak[2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@casalemedia[1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@clickondetroit[1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@doubleclick[1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@easywarez[1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@fastclick[2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@findwhat[1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@hitbox[2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@kanoodle[2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@linksynergy[1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@maxserving[1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@mediaplex[1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@mediax[1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@nextag[2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@overture[1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@qksrv[2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@questionmarket[1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@realmedia[2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@revsci[1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@rightmedia[1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@roiservice[1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@serving-sys[1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@sitestats[1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@specificclick[1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@tacoda[1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@tribalfusion[2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@valueclick[1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\[email protected][2].txt
   C:\Documents and Settings\Administrator.SHAWNTA\Cookies\owner@zedo[2].txt

sahmo4 · « **Reply #32 on:** February 13, 2008, 08:38:52 PM »

Here is Part 4.

C:\Documents and Settings\Default User\Cookies\owner@2o7[2].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][2].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][1].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][1].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][2].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][2].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][1].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][2].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][1].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][2].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][2].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][1].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][2].txt
   C:\Documents and Settings\Default User\Cookies\owner@advertising[2].txt
   C:\Documents and Settings\Default User\Cookies\owner@adviva[2].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][2].txt
   C:\Documents and Settings\Default User\Cookies\owner@apmebf[1].txt
   C:\Documents and Settings\Default User\Cookies\owner@atdmt[2].txt
   C:\Documents and Settings\Default User\Cookies\owner@atwola[1].txt
   C:\Documents and Settings\Default User\Cookies\owner@bannerspace[2].txt
   C:\Documents and Settings\Default User\Cookies\owner@belnk[1].txt
   C:\Documents and Settings\Default User\Cookies\owner@bluestreak[2].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][1].txt
   C:\Documents and Settings\Default User\Cookies\owner@casalemedia[1].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][1].txt
   C:\Documents and Settings\Default User\Cookies\owner@clickondetroit[1].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][1].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][1].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][2].txt
   C:\Documents and Settings\Default User\Cookies\owner@doubleclick[1].txt
   C:\Documents and Settings\Default User\Cookies\owner@easywarez[1].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][1].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][2].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][1].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][2].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][2].txt
   C:\Documents and Settings\Default User\Cookies\owner@fastclick[2].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][1].txt
   C:\Documents and Settings\Default User\Cookies\owner@findwhat[1].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][2].txt
   C:\Documents and Settings\Default User\Cookies\owner@hitbox[2].txt
   C:\Documents and Settings\Default User\Cookies\owner@kanoodle[2].txt
   C:\Documents and Settings\Default User\Cookies\owner@linksynergy[1].txt
   C:\Documents and Settings\Default User\Cookies\owner@maxserving[1].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][2].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][1].txt
   C:\Documents and Settings\Default User\Cookies\owner@mediaplex[1].txt
   C:\Documents and Settings\Default User\Cookies\owner@mediax[1].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][1].txt
   C:\Documents and Settings\Default User\Cookies\owner@nextag[2].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][1].txt
   C:\Documents and Settings\Default User\Cookies\owner@overture[1].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][1].txt
   C:\Documents and Settings\Default User\Cookies\owner@qksrv[2].txt
   C:\Documents and Settings\Default User\Cookies\owner@questionmarket[1].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][2].txt
   C:\Documents and Settings\Default User\Cookies\owner@realmedia[2].txt
   C:\Documents and Settings\Default User\Cookies\owner@revsci[1].txt
   C:\Documents and Settings\Default User\Cookies\owner@rightmedia[1].txt
   C:\Documents and Settings\Default User\Cookies\owner@roiservice[1].txt
   C:\Documents and Settings\Default User\Cookies\owner@serving-sys[1].txt
   C:\Documents and Settings\Default User\Cookies\owner@sitestats[1].txt
   C:\Documents and Settings\Default User\Cookies\owner@specificclick[1].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][2].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][1].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][2].txt
   C:\Documents and Settings\Default User\Cookies\owner@tacoda[1].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][1].txt
   C:\Documents and Settings\Default User\Cookies\owner@tribalfusion[2].txt
   C:\Documents and Settings\Default User\Cookies\owner@valueclick[1].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][1].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][1].txt
   C:\Documents and Settings\Default User\Cookies\[email protected][2].txt
   C:\Documents and Settings\Default User\Cookies\owner@zedo[2].txt

sahmo4 · « **Reply #33 on:** February 13, 2008, 08:40:14 PM »

Here is Part 5.

C:\Documents and Settings\kids\Cookies\owner@2o7[2].txt
   C:\Documents and Settings\kids\Cookies\[email protected][2].txt
   C:\Documents and Settings\kids\Cookies\[email protected][1].txt
   C:\Documents and Settings\kids\Cookies\[email protected][1].txt
   C:\Documents and Settings\kids\Cookies\[email protected][2].txt
   C:\Documents and Settings\kids\Cookies\[email protected][2].txt
   C:\Documents and Settings\kids\Cookies\[email protected][1].txt
   C:\Documents and Settings\kids\Cookies\[email protected][2].txt
   C:\Documents and Settings\kids\Cookies\[email protected][1].txt
   C:\Documents and Settings\kids\Cookies\[email protected][2].txt
   C:\Documents and Settings\kids\Cookies\[email protected][2].txt
   C:\Documents and Settings\kids\Cookies\[email protected][1].txt
   C:\Documents and Settings\kids\Cookies\[email protected][2].txt
   C:\Documents and Settings\kids\Cookies\owner@advertising[2].txt
   C:\Documents and Settings\kids\Cookies\owner@adviva[2].txt
   C:\Documents and Settings\kids\Cookies\[email protected][2].txt
   C:\Documents and Settings\kids\Cookies\owner@apmebf[1].txt
   C:\Documents and Settings\kids\Cookies\owner@atdmt[2].txt
   C:\Documents and Settings\kids\Cookies\owner@atwola[1].txt
   C:\Documents and Settings\kids\Cookies\owner@bannerspace[2].txt
   C:\Documents and Settings\kids\Cookies\owner@belnk[1].txt
   C:\Documents and Settings\kids\Cookies\owner@bluestreak[2].txt
   C:\Documents and Settings\kids\Cookies\[email protected][1].txt
   C:\Documents and Settings\kids\Cookies\owner@casalemedia[1].txt
   C:\Documents and Settings\kids\Cookies\[email protected][1].txt
   C:\Documents and Settings\kids\Cookies\owner@clickondetroit[1].txt
   C:\Documents and Settings\kids\Cookies\[email protected][1].txt
   C:\Documents and Settings\kids\Cookies\[email protected][1].txt
   C:\Documents and Settings\kids\Cookies\[email protected][2].txt
   C:\Documents and Settings\kids\Cookies\owner@doubleclick[1].txt
   C:\Documents and Settings\kids\Cookies\owner@easywarez[1].txt
   C:\Documents and Settings\kids\Cookies\[email protected][1].txt
   C:\Documents and Settings\kids\Cookies\[email protected][2].txt
   C:\Documents and Settings\kids\Cookies\[email protected][1].txt
   C:\Documents and Settings\kids\Cookies\[email protected][2].txt
   C:\Documents and Settings\kids\Cookies\[email protected][2].txt
   C:\Documents and Settings\kids\Cookies\owner@fastclick[2].txt
   C:\Documents and Settings\kids\Cookies\[email protected][1].txt
   C:\Documents and Settings\kids\Cookies\owner@findwhat[1].txt
   C:\Documents and Settings\kids\Cookies\[email protected][2].txt
   C:\Documents and Settings\kids\Cookies\owner@hitbox[2].txt
   C:\Documents and Settings\kids\Cookies\owner@kanoodle[2].txt
   C:\Documents and Settings\kids\Cookies\owner@linksynergy[1].txt
   C:\Documents and Settings\kids\Cookies\owner@maxserving[1].txt
   C:\Documents and Settings\kids\Cookies\[email protected][2].txt
   C:\Documents and Settings\kids\Cookies\[email protected][1].txt
   C:\Documents and Settings\kids\Cookies\owner@mediaplex[1].txt
   C:\Documents and Settings\kids\Cookies\owner@mediax[1].txt
   C:\Documents and Settings\kids\Cookies\[email protected][1].txt
   C:\Documents and Settings\kids\Cookies\owner@nextag[2].txt
   C:\Documents and Settings\kids\Cookies\[email protected][1].txt
   C:\Documents and Settings\kids\Cookies\owner@overture[1].txt
   C:\Documents and Settings\kids\Cookies\[email protected][1].txt
   C:\Documents and Settings\kids\Cookies\owner@qksrv[2].txt
   C:\Documents and Settings\kids\Cookies\owner@questionmarket[1].txt
   C:\Documents and Settings\kids\Cookies\[email protected][2].txt
   C:\Documents and Settings\kids\Cookies\owner@realmedia[2].txt
   C:\Documents and Settings\kids\Cookies\owner@revsci[1].txt
   C:\Documents and Settings\kids\Cookies\owner@rightmedia[1].txt
   C:\Documents and Settings\kids\Cookies\owner@roiservice[1].txt
   C:\Documents and Settings\kids\Cookies\owner@serving-sys[1].txt
   C:\Documents and Settings\kids\Cookies\owner@sitestats[1].txt
   C:\Documents and Settings\kids\Cookies\owner@specificclick[1].txt
   C:\Documents and Settings\kids\Cookies\[email protected][2].txt
   C:\Documents and Settings\kids\Cookies\[email protected][1].txt
   C:\Documents and Settings\kids\Cookies\[email protected][2].txt
   C:\Documents and Settings\kids\Cookies\owner@tacoda[1].txt
   C:\Documents and Settings\kids\Cookies\[email protected][1].txt
   C:\Documents and Settings\kids\Cookies\owner@tribalfusion[2].txt
   C:\Documents and Settings\kids\Cookies\owner@valueclick[1].txt
   C:\Documents and Settings\kids\Cookies\[email protected][1].txt
   C:\Documents and Settings\kids\Cookies\[email protected][1].txt
   C:\Documents and Settings\kids\Cookies\[email protected][2].txt
   C:\Documents and Settings\kids\Cookies\owner@zedo[2].txt

sahmo4 · « **Reply #34 on:** February 13, 2008, 08:41:20 PM »

Here is Part 6.

C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
   C:\Documents and Settings\Owner\Cookies\owner@adinterax[1].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
   C:\Documents and Settings\Owner\Cookies\owner@agoramedia[1].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
   C:\Documents and Settings\Owner\Cookies\owner@apmebf[2].txt
   C:\Documents and Settings\Owner\Cookies\owner@atdmt[1].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
   C:\Documents and Settings\Owner\Cookies\owner@centralmediaserver[1].txt
   C:\Documents and Settings\Owner\Cookies\owner@collective-media[2].txt
   C:\Documents and Settings\Owner\Cookies\owner@coolsavings[1].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
   C:\Documents and Settings\Owner\Cookies\owner@findarticles[2].txt
   C:\Documents and Settings\Owner\Cookies\owner@findwhat[1].txt
   C:\Documents and Settings\Owner\Cookies\owner@hypertracker[1].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
   C:\Documents and Settings\Owner\Cookies\owner@lynxtrack[2].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
   C:\Documents and Settings\Owner\Cookies\owner@optimost[1].txt
   C:\Documents and Settings\Owner\Cookies\owner@partner2profit[2].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
   C:\Documents and Settings\Owner\Cookies\owner@revsci[1].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
   C:\Documents and Settings\Owner\Cookies\owner@roiservice[2].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
   C:\Documents and Settings\Owner\Cookies\owner@smileycentral[1].txt
   C:\Documents and Settings\Owner\Cookies\owner@tacoda[2].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
   C:\Documents and Settings\Owner\Cookies\owner@trafficvenuedirect[2].txt
   C:\Documents and Settings\Owner\Cookies\owner@uclick[1].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][2].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][1].txt
   C:\Documents and Settings\Owner\Cookies\[email protected][2].txt

sahmo4 · « **Reply #35 on:** February 13, 2008, 08:43:19 PM »

Here is Part 7.

C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@2o7[2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@advertising[2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@adviva[2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@apmebf[1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@atdmt[2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@atwola[1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@bannerspace[2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@belnk[1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@bluestreak[2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@casalemedia[1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@clickondetroit[1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@doubleclick[1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@easywarez[1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@fastclick[2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@findwhat[1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@hitbox[2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@kanoodle[2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@linksynergy[1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@maxserving[1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@mediaplex[1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@mediax[1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@nextag[2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@overture[1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@qksrv[2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@questionmarket[1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@realmedia[2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@revsci[1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@rightmedia[1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@roiservice[1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@serving-sys[1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@sitestats[1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@specificclick[1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@tacoda[1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@tribalfusion[2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@valueclick[1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][1].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\[email protected][2].txt
   C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\owner@zedo[2].txt

Adware.E404 Helper/Variant
   C:\SYSTEM VOLUME INFORMATION\_RESTORE{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP88\A0011643.DLL

Adware.AdBreak
   C:\WINDOWS\FHFMM-UNINSTALLER.EXE
   C:\WINDOWS\LIQUI-UNINSTALLER.EXE
   C:\WINDOWS\XADBRK_.EXE

I believe this is all of it. I am operating on 2 1/2 hours of sleep and lots of caffeine.

sahmo4 · « **Reply #36 on:** February 13, 2008, 08:49:43 PM »

By the way, I noticed the time log on the scans.

I am in michigan, and the current time here is 10:46pm.

The time at the top of Computer Hope forum is 8:46pm.

For some reason I thought you might need that info. Don't know why I thought it, maybe its the caffeine or sleep depravation. However, I hope this helps.

Broni · « **Reply #37 on:** February 13, 2008, 08:52:12 PM »

*** Go here: http://www.javatester.org/version.html, and post back about your Java version.

*** 1. Print this post out, since you won't have an access to it, at some point.

2. Close all windows, except for HijackThis.

3. Put a checkmark next to the following HijackThis entries (some entries will be checkmarked to disable unnecessary startups; in those cases (marked with *), no actual program will be removed):

- O4 - HKLM\..\Run: [DDCActiveMenu] "C:\Program Files\WildTangent\DDC\ActiveMenu\DDCActiveMenu.exe" -boot
- *O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
- *O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
- *O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
- *O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
- *O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
- *O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
- *O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
- O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)

4. Click on "Fix checked" button.

5. Restart your computer in Safe Mode (keep tapping F8 key, when your computer starts)

6. Open Windows Explorer. Go Tools>Folder Options>View tab, put a checkmark next to "Show hidden files, and folders".

7. Delete following files/folders (if present):

- WildTangent folder from C:\Program Files

8. Turn off System Restore:

- Windows XP:
   1. Click Start.
   2. Right-click the My Computer icon, and then click Properties.
   3. Click the System Restore tab.
   4. Check "Turn off System Restore".
   5. Click Apply.
   6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
   7. Click OK.
- Windows Vista:
   1. Click Start.
   2. Right-click the Computer icon, and then click Properties.
   3. Click on System Protection under the Tasks column on the left side
   4. Click on Continue on the "User Account Control" window that pops up
   5. Under the System Protection tab, find Available Disks
   6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:")
   7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
   8. Click OK

9. Restart in Normal Mode.

10. Turn System Restore on.

11. Post new HijackThis log.

sahmo4 · « **Reply #38 on:** February 13, 2008, 10:15:18 PM »

Method 1 results

Java Version 1.1.4 from Microsoft Corp

Method 2 results

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Owner>jview
Microsoft (R) Command-line Loader for Java Version 5.00.3810
Copyright (C) Microsoft Corp 1996-2000. All rights reserved.

Usage: JView [options] <classname> [arguments]

Options:
/? displays usage text
/cp <classpath> set class path
/cp:p <path> prepend path to class path
/cp:a <path> append path to class path
/n <namespace> namespace in which to run
/p pauses before terminating if an error occurs
/v verify all classes
/d:<name>=<value> define system property
/a execute AppletViewer
/vst print verbose stack traces (requires debug classes)
/prof[:options] enable profiling (/prof:? for help)

Classname:
.CLASS file to be executed.

Arguments:
command-line arguments to be passed on to the class file

C:\Documents and Settings\Owner>

Broni · « **Reply #39 on:** February 13, 2008, 10:29:23 PM »

You need to update your Java:
http://java.sun.com/javase/downloads/index.jsp
#4 - Java Runtime Environment (JRE) 6 Update 4
Uninstall all previous versions of Java through Add\Remove.

sahmo4 · « **Reply #40 on:** February 13, 2008, 10:48:47 PM »

I was getting ready to do the other items on your list when I encountered a problem I was having with Microsoft word. I totally forgot about this issue, it's been happening since nefor the screw up.

1. When I dbl-click to open MS word I get a box with no heading.

Inside there are letters in what appear to be an Asian language, and at the end of the lettters - but in conjuntion with- is this in English:
uments and Settings\Owner\Application Data\Micromso.acl

2. When I click OK, another box without a heading pops up, and everything appears to be in Asian.

3. When trying to save a file created in word, I get a box with this message:
Word cannot save or create this file. Make sure that the disk you want to save the file on is not full, write protected, or damaged.
(C:\Documents and Settings\...\Normal.dot)

4. When I click OK, I get a box with the heading Save As
Inside it reads C:\Documents and Settings\Owner\Application Data\Microsoft\Templates is not accessible.
Access is denied.

5 When trying to exiting I get a box that says "Changes have been made that affect the global templat, Normal.dot.
Do tou want to save these changes?

It then goes on to offer a box with details/options:

turn off prompt to save normal template Save tab, options (tool menu) or look up knowledge base article 291352

However, when all is said and done it saves the file.

I'm getting ready to do the other stuff and then I will upgrade my java version

Broni · « **Reply #41 on:** February 13, 2008, 10:50:27 PM »

MS Word...later

sahmo4 · « **Reply #42 on:** February 13, 2008, 11:27:42 PM »

big problem!!!!!?

?

I went in to hijack this, made the adjustments. Made the other adjustments in safe mode. Logged back in ran another hijack this scan, went to connect to the internet so I could send it to you.

I CANNOT CONNECT TO THE INTERNET.

I tried other websites, and nothing. I am currently using the laptop loaned to my daughter from her school- they know about our computer woes- to send you this.

PLEASE TELL ME WHAT TO DO TO CONNECT.

sahmo4 · « **Reply #43 on:** February 14, 2008, 10:40:18 AM »

hello Broni,

The problem fixed itself, and I am back online on my computer. Here is the HJT log that I ran after the changes. I also updated Java, so I will run another HJT and send it to you.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:10:19 AM, on 2/14/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\SYSTEM32\Brmfrmps.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\WINDOWS\LTMSG.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us4.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sbc.yahoo.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: Freedom BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\Zero Knowledge\Freedom\FreeBHOR.dll
O3 - Toolbar: &Zero-Knowledge Freedom - {FA91B828-F937-4568-82C1-843627E63ED7} - C:\Program Files\Zero Knowledge\Freedom\BandObjs.dll
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\WINDOWS\system32\PRISMSVR.EXE" /APPLY
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04a\BrStDvPt.exe
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [checktime] c:\program files\HPSelect\Frontend\ct.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - S-1-5-18 Startup: AutoPlay.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: AutoPlay.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoPlay.exe (User 'Default user')
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1202359862843
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Program Files\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Brother Industries, Ltd. - C:\WINDOWS\SYSTEM32\Brmfrmps.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

--
End of file - 6168 bytes

sahmo4 · « **Reply #44 on:** February 14, 2008, 10:52:23 AM »

Here is the latest HJT log - after JAVA was installed and updated.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:46:14 PM, on 2/14/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\SYSTEM32\Brmfrmps.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\WINDOWS\LTMSG.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us4.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sbc.yahoo.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: Freedom BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\Zero Knowledge\Freedom\FreeBHOR.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O3 - Toolbar: &Zero-Knowledge Freedom - {FA91B828-F937-4568-82C1-843627E63ED7} - C:\Program Files\Zero Knowledge\Freedom\BandObjs.dll
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\WINDOWS\system32\PRISMSVR.EXE" /APPLY
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04a\BrStDvPt.exe
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [checktime] c:\program files\HPSelect\Frontend\ct.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - S-1-5-18 Startup: AutoPlay.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: AutoPlay.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoPlay.exe (User 'Default user')
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1202359862843
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Program Files\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Brother Industries, Ltd. - C:\WINDOWS\SYSTEM32\Brmfrmps.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

--
End of file - 6765 bytes

Again, I cannot THANK YOU enough for your time and expertise.

Broni · « **Reply #45 on:** February 14, 2008, 05:32:54 PM »

Nice, and clean!!!

Download, and install CCleaner: http://www.ccleaner.com/download/builds. Get "Slim" version.
Read CCleaner instruction here: http://www.jahewi.nl/ccleaner/ccleaner.html, and run CCleaner

How is your computer doing?

sahmo4 · « **Reply #46 on:** February 14, 2008, 07:46:32 PM »

So far so good. I just printed the instructions for ccleaner. Are there any files or folders in particular that you want me to pay attention to, when I set up the options and settings.

by the way, how are you today?

Broni · « **Reply #47 on:** February 14, 2008, 07:51:29 PM »

I'm fine, thank you...
Set CCleaner as instructed in manual, nothing special, I can think of.

sahmo4 · « **Reply #48 on:** February 14, 2008, 08:44:28 PM »

Here is the HJT log after I ran the cleaner.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:41:30 PM, on 2/14/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\SYSTEM32\Brmfrmps.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\WINDOWS\LTMSG.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us4.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sbc.yahoo.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: Freedom BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\Zero Knowledge\Freedom\FreeBHOR.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O3 - Toolbar: &Zero-Knowledge Freedom - {FA91B828-F937-4568-82C1-843627E63ED7} - C:\Program Files\Zero Knowledge\Freedom\BandObjs.dll
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\WINDOWS\system32\PRISMSVR.EXE" /APPLY
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04a\BrStDvPt.exe
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [checktime] c:\program files\HPSelect\Frontend\ct.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - S-1-5-18 Startup: AutoPlay.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: AutoPlay.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoPlay.exe (User 'Default user')
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1202359862843
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Program Files\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Brother Industries, Ltd. - C:\WINDOWS\SYSTEM32\Brmfrmps.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

--
End of file - 6761 bytes

sahmo4 · « **Reply #49 on:** February 14, 2008, 09:18:07 PM »

COMMENT and QUESTION

As I was looking at the C: drive, as well as, documents and settings, I noticed some things.

1. There are some folders and documents there that looked like shortcut icons, and indeed they are. I was wondering where they came from and is it safe to delete them? I checked the original location and they appear to be intact there.

2. In documents and settings, there are 6 folders, which I have figured out are created for each user and/or log on.Since the computer creates them, they all have some of the same folders - App. data, desktop, favorites, etc. They all also have a My documents folder, which stores -documents- LOL.

The folders are titled,
1. Owner 2. Administrator 3. Administrator.Shawnta

4. All Users 5. Kids 6. Default User

My question is this, if I know which documents I want to keep, from all of the folders, is it safe to delete some of the extra folders that were automatically created? I also know when and why the computer created them, if that helps.

I'm just thinking that it would eliminate uneccesary space due to the duplication of information.

3. There is a temp folder, with a lot of empty folders in it. Do I leave that there or delete it?

Maybe I'm jumping the gun and we aren't there yet, but I wanted to throw that out there

Broni · « **Reply #50 on:** February 14, 2008, 09:28:50 PM »

Your log was, and is clean...

1. Shortcuts can be safely deleted, since they can be easily re-created.
2. I wouldn't play with deleting automatically created folders. However, you can always safely remove some unneeded stuff, like documents, from INSIDE of the folders.
3. Empty folders don't take any space, so leave them alone. It's always recommended to clean temporary FILES, once in a while, and for that purpose, you have CCleaner.

sahmo4 · « **Reply #51 on:** February 14, 2008, 09:40:50 PM »

Are we in the place to begin addressing some of the other word issues?

Broni · « **Reply #52 on:** February 14, 2008, 09:50:50 PM »

I assume, your computer cleanup is done, so it'll be better, if you start a new topic about it. You'll get more attention from Word pros.

sahmo4 · « **Reply #53 on:** February 14, 2008, 09:53:38 PM »

Thank you for all of your help. I wish I could send you flowers or something.

By the way, Happy Valentine's Day.

Broni · « **Reply #54 on:** February 14, 2008, 09:56:18 PM »

You're very welcome

Beer would be better...LOL.....kidding

sahmo4 · « **Reply #55 on:** February 14, 2008, 10:01:32 PM »

Now your'e talking. Imported, domestic or tap?

Broni · « **Reply #56 on:** February 14, 2008, 10:09:30 PM »

I'll take Beck's...

sahmo4 · « **Reply #57 on:** February 14, 2008, 10:12:34 PM »

Great choice. What do you think about Sam Adams? Where are you?

Broni · « **Reply #58 on:** February 14, 2008, 10:24:39 PM »

Right here.....just kidding
I'm in US, but they don't make any beer here...They call it beer, but it has nothing to do with a real beer.
Sam Adams is OK, some microbreweries make pretty good beers, but other then that...forget it.
I prefer German beer.
Like with many alcoholic beverages, you have to be in making them for centuries to make them tasting good.

tarren · « **Reply #59 on:** February 15, 2008, 08:59:14 AM »

Hi,

Just read all the above, and have to remark how patient and knowledgeable Broni has been throughout, well done that man.

Broni · « **Reply #60 on:** February 15, 2008, 05:32:16 PM »

Thank you, tarren...

Computer Hope Forum

News:

Author Topic: Restore points not working on windows xp (Read 29021 times)

sahmo4

sahmo4

Deerpark

sahmo4

Deerpark

sahmo4

Deerpark

sahmo4

Broni

sahmo4

Broni

sahmo4

Broni

sahmo4

Broni

sahmo4

Broni

sahmo4

Broni

sahmo4

sahmo4

Broni

Broni

sahmo4

sahmo4

Broni

sahmo4

sahmo4

Broni

sahmo4

sahmo4

sahmo4

sahmo4

sahmo4

sahmo4

sahmo4

sahmo4

Broni

sahmo4

Broni

sahmo4

Broni

sahmo4

sahmo4

sahmo4

Broni

sahmo4

Broni

sahmo4

sahmo4

Broni

sahmo4

Broni

sahmo4

Broni

sahmo4

Broni

sahmo4

Broni

tarren

Broni