I can't enable the windows firewall. Tried to install Zone Alarm firewall but I can't finalize the install. Most icons on desktop that worked now go to Windows open with screen. Same thing when trying to install things like Zone Alarm. Installation keeps getting inturupted by open with window popping up. When you think you almods have something installed the installation is canceled.

Please let me know if there is something else I can try.

Thanks,
John Lane

Welcome aboard

Please, observe following rules:

• Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
• If you're stuck, or you're not sure about certain step, always ask before doing anything else.
• Please refrain from running tools or applying updates other than those I suggest.
• Never run more than one scan at a time.
• Keep updating me regarding your computer behavior, good, or bad.
• The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
• If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
• I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

================================================== ===========================================

Download and run exeHelper.

• Please download exeHelper from Raktor to your desktop.
• Double-click on exeHelper.com to run the fix.
• A black window should pop up, press any key to close once the fix is completed.
• A log file named log.txt will be created in the directory where you ran exeHelper.com
• Attach the log.txt file to your next message.

Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

See, if you can open programs now.

Here are the results of the scan:

exeHelper by Raktor
Build 20100414
Run at 17:13:05 on 03/20/11
Now searching...
Checking for numerical processes...
Checking for sysguard processes...
Checking for bad processes...
Checking for bad files...
Checking for bad registry entries...
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values...
Resetting policies...
--Finished--

See, if you can open programs now.

.

I can open programs now. And I was able to enable the Windows firewall. Should I proceed with the rest of the sticky notes instructions now? Let me know.

Thanks,
John Lane

Absolutely. We have to check what happened.

I have been able to install the Avira virus protection program and install and run MalewareBytes program and scan log. I have posted the log results below. I have also downloaded and tried to run GMER. Unfortunately something happens when I try to run the scan and I am not able to get to the point wher I can save the log. On the third try at running the scan my screen went blank and I had to do a hard boot on the system. When I re-booted I was getting a Lime-Wire install screen that did not have an option button to close. I restarted the system in Safe mode and was able to shut down and get the system back up so I could send the email. This time the Lime wire install screen did not come up but I got a meassage asking me to give permission to my firewall to allow Limewire access to the internet. I of course said no to this request. Please let me know next steps.

Thanks,
John Lane

Malwarebytes' Anti-Malware 1.46
Malwarebytes

Database version: 4052

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

3/20/2011 10:53:38 PM
mbam-log-2011-03-20 (22-53-38).txt

Scan type: Quick scan
Objects scanned: 145725
Time elapsed: 12 minute(s), 44 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 0
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{2d4ce8ae-0cb9-9313-def5-5f1a81a1827b} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{0ed403e8-470a-4a8a-85a4-d7688cfe39a3} (Adware.Gamevance) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Settings\{0ed403e8-470a-4a8a-85a4-d7688cfe39a3} (Adware.Gamevance) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Skip GMER for now.
I still need MBRCheck and DDS logs.

Here are the results of the scans

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000003d

Kernel Drivers (total 153):
0x804D7000 \windows\system32\ntoskrnl.exe
0x806EF000 \windows\system32\hal.dll
0xF79E3000 \windows\system32\KDCOM.DLL
0xF78F3000 \windows\system32\BOOTVID.dll
0xF7494000 ACPI.sys
0xF79E5000 \windows\System32\DRIVERS\WMILIB.SYS
0xF7483000 pci.sys
0xF74E3000 isapnp.sys
0xF7AAB000 pciide.sys
0xF7763000 \windows\System32\DRIVERS\PCIIDEX.SYS
0xF74F3000 MountMgr.sys
0xF7464000 ftdisk.sys
0xF776B000 PartMgr.sys
0xF7503000 VolSnap.sys
0xF744C000 atapi.sys
0xF7513000 disk.sys
0xF7523000 \windows\System32\DRIVERS\CLASSPNP.SYS
0xF742C000 fltmgr.sys
0xF73D5000 SYMDS.SYS
0xF73C3000 sr.sys
0xF731F000 SYMEFA.SYS
0xF7533000 PxHelp20.sys
0xF7308000 KSecDD.sys
0xF72F5000 WudfPf.sys
0xF7268000 Ntfs.sys
0xF723B000 NDIS.sys
0xF7543000 ohci1394.sys
0xF7553000 \windows\System32\DRIVERS\1394BUS.SYS
0xF7221000 Mup.sys
0xF7633000 \SystemRoot\System32\DRIVERS\intelppm.sys
0xF5FCB000 \SystemRoot\System32\DRIVERS\ialmnt5.sys
0xF5FB7000 \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS
0xF77BB000 \SystemRoot\System32\DRIVERS\usbuhci.sys
0xF5F93000 \SystemRoot\System32\DRIVERS\USBPORT.SYS
0xF77C3000 \SystemRoot\System32\DRIVERS\usbehci.sys
0xF7643000 \SystemRoot\System32\DRIVERS\bcm4sbxp.sys
0xF7653000 \SystemRoot\system32\drivers\Imapi.sys
0xF77CB000 \SystemRoot\System32\Drivers\MxlW2k.SYS
0xF7693000 \SystemRoot\System32\DRIVERS\cdrom.sys
0xF6121000 \SystemRoot\System32\DRIVERS\redbook.sys
0xF5F70000 \SystemRoot\System32\DRIVERS\ks.sys
0xF5F4F000 \SystemRoot\System32\Drivers\pwd_2k.SYS
0xF77D3000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0xF5ECB000 \SystemRoot\system32\drivers\smwdm.sys
0xF5EA7000 \SystemRoot\system32\drivers\portcls.sys
0xF6111000 \SystemRoot\system32\drivers\drmk.sys
0xF7A7B000 \SystemRoot\system32\drivers\aeaudio.sys
0xF77DB000 \SystemRoot\System32\DRIVERS\fdc.sys
0xF6101000 \SystemRoot\System32\DRIVERS\serial.sys
0xF68BB000 \SystemRoot\System32\DRIVERS\serenum.sys
0xF5E93000 \SystemRoot\System32\DRIVERS\parport.sys
0xF60F1000 \SystemRoot\system32\DRIVERS\dsNcAdpt.sys
0xF7C13000 \SystemRoot\System32\DRIVERS\audstub.sys
0xF60E1000 \SystemRoot\System32\DRIVERS\rasl2tp.sys
0xF68B7000 \SystemRoot\System32\DRIVERS\ndistapi.sys
0xF5E7C000 \SystemRoot\System32\DRIVERS\ndiswan.sys
0xF60D1000 \SystemRoot\System32\DRIVERS\raspppoe.sys
0xF60C1000 \SystemRoot\System32\DRIVERS\raspptp.sys
0xF77E3000 \SystemRoot\System32\DRIVERS\TDI.SYS
0xF5E6B000 \SystemRoot\System32\DRIVERS\psched.sys
0xF60B1000 \SystemRoot\System32\DRIVERS\msgpc.sys
0xF77EB000 \SystemRoot\System32\DRIVERS\ptilink.sys
0xF77F3000 \SystemRoot\System32\DRIVERS\raspti.sys
0xF60A1000 \SystemRoot\System32\Drivers\pcouffin.sys
0xF6091000 \SystemRoot\System32\DRIVERS\termdd.sys
0xF77FB000 \SystemRoot\System32\DRIVERS\kbdclass.sys
0xF7803000 \SystemRoot\System32\DRIVERS\mouclass.sys
0xF7A7D000 \SystemRoot\System32\DRIVERS\swenum.sys
0xF5E0D000 \SystemRoot\System32\DRIVERS\update.sys
0xF780B000 \SystemRoot\System32\DRIVERS\omci.sys
0xF7987000 \SystemRoot\System32\DRIVERS\mssmbios.sys
0xF5DDE000 \SystemRoot\system32\drivers\windrvr6.sys
0xF785B000 \SystemRoot\System32\Drivers\dvd_2K.SYS
0xF7863000 \SystemRoot\System32\Drivers\mmc_2K.SYS
0xF7753000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF75B3000 \SystemRoot\System32\DRIVERS\usbhub.sys
0xF7A8F000 \SystemRoot\System32\DRIVERS\USBD.SYS
0xF78BB000 \SystemRoot\System32\DRIVERS\flpydisk.sys
0xECEC1000 \SystemRoot\System32\Drivers\i2omgmt.SYS
0xF7997000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF76F3000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF7873000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xB452F000 \SystemRoot\System32\DRIVERS\usbccgp.sys
0xB4285000 \SystemRoot\System32\Drivers\Cdr4_xp.SYS
0xB4284000 \SystemRoot\System32\Drivers\Cdralw2k.SYS
0xF7A4F000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xB4283000 \SystemRoot\System32\Drivers\Null.SYS
0xF7A55000 \SystemRoot\System32\Drivers\Beep.SYS
0xB445F000 \SystemRoot\System32\drivers\vga.sys
0xF7A57000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7A51000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xB3837000 \SystemRoot\System32\Drivers\cdudf_xp.SYS
0xB4457000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF782B000 \SystemRoot\System32\Drivers\Npfs.SYS
0xB376F000 \SystemRoot\System32\Drivers\UdfReadr_xp.SYS
0xB48EA000 \SystemRoot\System32\DRIVERS\rasacd.sys
0xB374A000 \SystemRoot\System32\DRIVERS\ipsec.sys
0xB36F1000 \SystemRoot\System32\DRIVERS\tcpip.sys
0xB0799000 \SystemRoot\System32\Drivers\NAV\1205000.07D\SYMTD I.SYS
0xB0773000 \SystemRoot\System32\DRIVERS\ipnat.sys
0xB19DD000 \SystemRoot\System32\DRIVERS\wanarp.sys
0xB1D70000 \SystemRoot\System32\DRIVERS\mouhid.sys
0xB074D000 \??\C:\windows\system32\Drivers\SYMEVENT.SYS
0xB06F5000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\IPSDefs\20 110317.005\IDSxpx86.sys
0xB06CD000 \SystemRoot\System32\DRIVERS\netbt.sys
0xB19CD000 \??\C:\windows\system32\Drivers\NEOFLTR_600_12023. SYS
0xB064C000 \SystemRoot\System32\vsdatant.sys
0xB062A000 \SystemRoot\System32\drivers\afd.sys
0xB19BD000 \SystemRoot\System32\DRIVERS\netbios.sys
0xB0606000 \SystemRoot\system32\drivers\NAV\1205000.07D\Ironx 86.SYS
0xB1376000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xB0D3D000 \SystemRoot\system32\drivers\NAV\1205000.07D\SRTSP X.SYS
0xB05DB000 \SystemRoot\System32\DRIVERS\rdbss.sys
0xB056B000 \SystemRoot\System32\DRIVERS\mrxsmb.sys
0xB0D2D000 \SystemRoot\System32\Drivers\Fips.SYS
0xB49E1000 \SystemRoot\system32\DRIVERS\NuidFltr.sys
0xB0D1D000 \SystemRoot\system32\DRIVERS\WDFLDR.SYS
0xB04F0000 \SystemRoot\system32\DRIVERS\Wdf01000.sys
0xF78AB000 \SystemRoot\system32\DRIVERS\point32.sys
0xB0492000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
0xB0475000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
0xB03AE000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\BASHDefs\2 0110309.001\BHDrvx86.sys
0xB039D000 \SystemRoot\System32\Drivers\Udfs.SYS
0xB0385000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xB1ABD000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xB80D9000 \SystemRoot\System32\drivers\Dxapi.sys
0xB4006000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7B10000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF020000 \SystemRoot\System32\ialmdnt5.dll
0xBF012000 \SystemRoot\System32\ialmrnt5.dll
0xBF03F000 \SystemRoot\System32\ialmdev5.DLL
0xBF06B000 \SystemRoot\System32\ialmdd5.DLL
0xBF148000 \SystemRoot\System32\ATMFD.DLL
0xF68CB000 \SystemRoot\System32\DRIVERS\ndisuio.sys
0xB02F8000 \SystemRoot\system32\drivers\wdmaud.sys
0xB5334000 \SystemRoot\system32\drivers\sysaudio.sys
0xB015D000 \SystemRoot\System32\DRIVERS\mrxdav.sys
0xB2816000 \SystemRoot\System32\Drivers\GIVEIO.SYS
0xF7A91000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xF7A5D000 \SystemRoot\System32\Drivers\VICHW11.SYS
0xB00B5000 \SystemRoot\System32\DRIVERS\srv.sys
0xAFFF5000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xAFF29000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xAFFBD000 \SystemRoot\System32\Drivers\PEDRV.SYS
0xAFDA5000 \??\C:\WINDOWS\System32\drivers\tmcomm.sys
0xAFA04000 \SystemRoot\System32\Drivers\HTTP.sys
0xAF7FD000 \SystemRoot\System32\Drivers\NAV\1205000.07D\SRTSP .SYS
0xAF6B2000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\VirusDefs\ 20110321.019\NAVEX15.SYS
0xAF69E000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\VirusDefs\ 20110321.019\NAVENG.SYS
0xAF2B3000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\SYSTEM32\ntdll.dll

Processes (total 42):
0 System Idle Process
4 System
632 C:\WINDOWS\SYSTEM32\smss.exe
688 csrss.exe
712 C:\WINDOWS\SYSTEM32\winlogon.exe
756 C:\WINDOWS\SYSTEM32\services.exe
768 C:\WINDOWS\SYSTEM32\lsass.exe
920 C:\WINDOWS\SYSTEM32\svchost.exe
992 svchost.exe
1136 C:\WINDOWS\SYSTEM32\svchost.exe
1220 C:\WINDOWS\SYSTEM32\svchost.exe
1312 svchost.exe
1472 svchost.exe
1580 C:\WINDOWS\SYSTEM32\spoolsv.exe
1968 C:\WINDOWS\explorer.exe
224 svchost.exe
296 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
324 C:\Program Files\Bonjour\mDNSResponder.exe
404 C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
560 C:\Program Files\Java\jre6\bin\jqs.exe
576 C:\Program Files\iTunes\iTunesHelper.exe
588 C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
972 C:\Program Files\Microsoft ActiveSync\wcescomm.exe
1036 C:\WINDOWS\SYSTEM32\ctfmon.exe
1052 C:\Program Files\Messenger\msmsgs.exe
1064 C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
1080 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
1348 C:\Program Files\LimeWire\LimeWire.exe
1620 C:\PROGRA~1\MICROS~1\rapimgr.exe
1664 C:\WINDOWS\SYSTEM32\lxdicoms.exe
1724 C:\Program Files\Norton AntiVirus\Engine\18.5.0.125\ccsvchst.exe
1980 C:\WINDOWS\SYSTEM32\snmp.exe
316 C:\WINDOWS\SYSTEM32\svchost.exe
456 C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
1180 C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
2208 C:\WINDOWS\SYSTEM32\wscntfy.exe
2316 C:\Program Files\iPod\bin\iPodService.exe
2768 alg.exe
3584 C:\Program Files\Internet Explorer\iexplore.exe
3924 wmiprvse.exe
1192 C:\Program Files\Norton AntiVirus\Engine\18.5.0.125\ccsvchst.exe
3596 C:\Documents and Settings\John\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\E: --> \\.\PhysicalDrive1 at offset 0x00000000`01f60800 (NTFS)

PhysicalDrive0 Model Number: ST3120814A, Rev: 3.AAJ
PhysicalDrive1 Model Number: WDCWD400BB-75DEA0, Rev: 05.03E05

Size Device Name MBR Status
--------------------------------------------
111 GB \\.\PhysicalDrive0 Legit MBR code detected
SHA1: 317A49A9E93F077F2D004734D2A7B6CA7E7B9495
37 GB \\.\PhysicalDrive1 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!

DDS Scans

.
DDS (Ver_11-03-05.01) - NTFSx86
Run by John at 18:32:53.82 on Tue 03/22/2011
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_14
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.766.200 [GMT -4:00]
.
AV: Bitdefender Antivirus *Disabled/Updated* {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
AV: Norton AntiVirus *Enabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
FW: ZoneAlarm Firewall *Enabled*
.
============== Running Processes ===============
.
C:\windows\system32\svchost -k DcomLaunch
svchost.exe
C:\windows\System32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\windows\system32\spoolsv.exe
C:\windows\Explorer.EXE
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\PROGRA~1\MICROS~1\rapimgr.exe
C:\windows\system32\lxdicoms.exe
C:\Program Files\Norton AntiVirus\Engine\18.5.0.125\ccSvcHst.exe
C:\windows\System32\snmp.exe
C:\windows\System32\svchost.exe -k imgsvc
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\windows\system32\ZoneLabs\vsmon.exe
C:\windows\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Norton AntiVirus\Engine\18.5.0.125\ccSvcHst.exe
C:\Documents and Settings\John\Desktop\dds.scr
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://news.google.com/nwshp?hl=en&tab=wn
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = 127.0.0.1;hxxp://localhost;*.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*Yahoo! UK
uURLSearchHooks: H - No File
uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - c:\program files\ask.com\GenericAskToolbar.dll
mURLSearchHooks: H - No File
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - c:\program files\lexmark toolbar\toolband.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton antivirus\engine\18.5.0.125\ips\IPSBHO.DLL
BHO: WOT Helper: {c920e44a-7f78-4e64-bdd7-a57026e7feb7} - c:\program files\wot\WOT.dll
BHO: Gamevance Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - c:\program files\lexmark toolbar\toolband.dll
TB: WOT: {71576546-354d-41c9-aae8-31f2ec22bf0d} - c:\program files\wot\WOT.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: Gamevance Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"
uRun: [Search Protection] c:\program files\yahoo!\search protection\SearchProtection.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [TomTomHOME.exe] "c:\program files\tomtom home 2\TomTomHOMERunner.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
StartupFolder: c:\docume~1\john\startm~1\programs\startup\limewi~ 1.lnk - c:\program files\limewire\LimeWire.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ado ber~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~1\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~1\INetRepl.dll
Trusted Zone: ebay.com\www
Trusted Zone: lmdeals.com\travelocity
Trusted Zone: southernsavers.com\www
Trusted Zone: travelocity.com\www
Trusted Zone: west.com
Trusted Zone: westathome.com
Trusted Zone: westathome.net
Trusted Zone: workathomeagent.net
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab
DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://pcpitstop.com/betapit/PCPitStop.CAB
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE}
DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} - hxxp://www.linkedin.com/cab/LinkedInContactFinderControl.cab
DPF: {4B48D5DF-9021-45F7-A240-60304302A215} - hxxp://download.microsoft.com/download/5/c/2/5c2fc4b7-3875-4eec-946b-ffe15472cabc/WebCleaner.cab
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21}
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}
DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} - hxxp://www.sidestep.com/get/k42037/sb02a.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1095180586841
DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5}
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1244763754296
DPF: {72D59B9C-1E59-4958-803A-ABDEE2D4CFA6} - hxxp://download.divx.com/player/DivXPlayerInstaller.exe
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {A1337CC4-FF8E-11D1-9C48-00A0CC20E0D2} - hxxp://www.therealyellowpageslive.net/live/ezinit.cab
DPF: {A959E4A5-0B3D-449E-9998-348705BD4092} - hxxp://www.servicemagic.com/smod/smdesktop.CAB
DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389}
DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_08-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} - hxxps://access.ghsnet.org/dana-cached/setup/JuniperSetupSP1.cab
Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - c:\program files\wot\WOT.dll
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
LSA: Notification Packages = scecli scecli
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\docume~1\john\applic~1\mozilla\firefox\profiles \hq62ndaz.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://start.mozilla.org/firefox?client=firefox-a&rls=org.mozilla:en-USfficial
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - component: c:\program files\avg\avg8\toolbarff\components\vmAVGConnector .dll
.
============= SERVICES / DRIVERS ===============
.
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\nav\1205000.07d\ symds.sys [2011-3-21 340016]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nav\1205000 .07d\symefa.sys [2011-3-21 652336]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_18.1.0.37\definitions\bashdefs\2 0110309.001\BHDrvx86.sys [2011-3-9 800376]
R1 NEOFLTR_600_12023;Juniper Networks TDI Filter Driver (NEOFLTR_600_12023);c:\windows\system32\drivers\NE OFLTR_600_12023.sys [2007-8-10 63024]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\nav\1205000.07d \ironx86.sys [2011-3-21 136312]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2011-3-20 532224]
R2 lxdi_device;lxdi_device;c:\windows\system32\lxdico ms.exe -service --> c:\windows\system32\lxdicoms.exe -service [?]
R2 NAV;Norton AntiVirus;c:\program files\norton antivirus\engine\18.5.0.125\ccsvchst.exe [2011-3-21 130000]
R2 PEDRV;P&E Microcomputer System PCI Driver.;c:\windows\system32\drivers\pedrv.sys [2007-2-2 23296]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2010-8-24 92008]
R2 VICHW11;P&E BDM Cable Driver II;c:\windows\system32\drivers\vichw11.sys [2007-2-2 5200]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2011-3-21 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_18.1.0.37\definitions\ipsdefs\20 110317.005\IDSXpx86.sys [2011-3-21 341944]
R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_18.1.0.37\definitions\virusdefs\ 20110321.019\NAVENG.SYS [2011-3-21 86008]
R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_18.1.0.37\definitions\virusdefs\ 20110321.019\NAVEX15.SYS [2011-3-21 1360760]
S2 lxdiCATSCustConnectService;lxdiCATSCustConnectServ ice;c:\windows\system32\spool\drivers\w32x86\3\lxd iserv.exe [2008-1-5 99248]
.
=============== Created Last 30 ================
.
2011-03-21 05:28:16 330360 ----a-w- c:\windows\system32\drivers\nav\1205000.07d\symtdi v.sys
2011-03-21 05:28:15 368248 ----a-w- c:\windows\system32\drivers\nav\1205000.07d\symtdi .sys
2011-03-21 05:28:13 295032 ----a-w- c:\windows\system32\drivers\nav\1205000.07d\symnet s.sys
2011-03-21 05:28:10 652336 ----a-w- c:\windows\system32\drivers\nav\1205000.07d\symefa .sys
2011-03-21 05:28:08 340016 ----a-w- c:\windows\system32\drivers\nav\1205000.07d\symds. sys
2011-03-21 05:28:06 50168 ----a-w- c:\windows\system32\drivers\nav\1205000.07d\srtspx .sys
2011-03-21 05:28:03 509560 ----a-w- c:\windows\system32\drivers\nav\1205000.07d\srtsp. sys
2011-03-21 05:28:02 136312 ----a-w- c:\windows\system32\drivers\nav\1205000.07d\ironx8 6.sys
2011-03-21 05:23:34 -------- d-----w- c:\windows\system32\drivers\nav\1205000.07D
2011-03-21 02:11:43 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2011-03-21 02:11:43 126512 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2011-03-21 02:11:42 -------- d-----w- c:\program files\Symantec
2011-03-21 02:11:42 -------- d-----w- c:\program files\common files\Symantec Shared
2011-03-21 02:10:38 -------- d-----w- c:\windows\system32\drivers\NAV
2011-03-21 02:10:30 -------- d-----w- c:\program files\Norton AntiVirus
2011-03-21 02:10:28 -------- d-----w- c:\docume~1\alluse~1\applic~1\Norton
2011-03-21 02:10:06 -------- d-----w- c:\program files\NortonInstaller
2011-03-20 20:28:47 -------- d-----w- c:\docume~1\alluse~1\applic~1\NortonInstaller
2011-03-20 19:59:28 1238528 ----a-w- c:\windows\system32\zpeng25.dll
2011-03-20 19:59:27 -------- d-----w- c:\windows\system32\ZoneLabs
2011-03-20 19:59:22 -------- d-----w- c:\program files\Zone Labs
2011-03-16 22:38:18 -------- d-----w- c:\docume~1\alluse~1\applic~1\oHkNlOg05200
2011-02-26 02:32:36 -------- d-----w- c:\docume~1\john\locals~1\applic~1\AskToolbar
2011-02-26 02:30:37 -------- d-----w- c:\docume~1\john\locals~1\applic~1\The Weather Channel
.
==================== Find3M ====================
.
2011-02-09 13:53:52 270848 ----a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53:52 186880 ----a-w- c:\windows\system32\encdec.dll
2011-02-02 07:58:35 2067456 ----a-w- c:\windows\system32\mstscax.dll
2011-01-27 11:57:06 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-01-21 14:44:37 439296 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-07 14:09:02 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-12-31 13:10:33 1854976 ----a-w- c:\windows\system32\win32k.sys
.
============= FINISH: 18:36:05.31 ===============

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_11-03-05.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 7/14/2003 9:28:50 PM
System Uptime: 3/22/2011 6:16:05 PM (0 hours ago)
.
Motherboard: Dell Computer Corporation | | 07W080
Processor: Intel(R) Pentium(R) 4 CPU 2.20GHz | Socket 478 | 2193/400mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 112 GiB total, 17.812 GiB free.
D: is CDROM ()
E: is FIXED (NTFS) - 37 GiB total, 1.073 GiB free.
F: is CDROM (UDF)
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: 1394 Net Adapter
Device ID: V1394\NIC1394\3187793D5042A1
Manufacturer: Microsoft
Name: 1394 Net Adapter #2
PNP Device ID: V1394\NIC1394\3187793D5042A1
Service: NIC1394
.
==== System Restore Points ===================
.
RP663: 12/22/2010 3:00:47 AM - Software Distribution Service 3.0
RP664: 12/23/2010 3:00:41 AM - Software Distribution Service 3.0
RP665: 12/24/2010 3:00:43 AM - Software Distribution Service 3.0
RP666: 12/25/2010 3:00:33 AM - Software Distribution Service 3.0
RP667: 12/26/2010 3:01:29 AM - Software Distribution Service 3.0
RP668: 12/27/2010 3:00:26 AM - Software Distribution Service 3.0
RP669: 12/28/2010 3:00:39 AM - Software Distribution Service 3.0
RP670: 12/29/2010 3:00:52 AM - Software Distribution Service 3.0
RP671: 12/30/2010 3:01:03 AM - Software Distribution Service 3.0
RP672: 12/31/2010 3:00:39 AM - Software Distribution Service 3.0
RP673: 1/1/2011 3:00:38 AM - Software Distribution Service 3.0
RP674: 1/2/2011 3:00:43 AM - Software Distribution Service 3.0
RP675: 1/3/2011 3:00:25 AM - Software Distribution Service 3.0
RP676: 1/4/2011 3:00:28 AM - Software Distribution Service 3.0
RP677: 1/5/2011 3:00:28 AM - Software Distribution Service 3.0
RP678: 1/6/2011 3:00:37 AM - Software Distribution Service 3.0
RP679: 1/7/2011 3:00:35 AM - Software Distribution Service 3.0
RP680: 1/8/2011 3:00:31 AM - Software Distribution Service 3.0
RP681: 1/9/2011 3:00:34 AM - Software Distribution Service 3.0
RP682: 1/10/2011 3:00:36 AM - Software Distribution Service 3.0
RP683: 1/11/2011 3:01:00 AM - Software Distribution Service 3.0
RP684: 1/12/2011 3:04:00 AM - Software Distribution Service 3.0
RP685: 1/13/2011 3:01:08 AM - Software Distribution Service 3.0
RP686: 1/14/2011 3:00:28 AM - Software Distribution Service 3.0
RP687: 1/15/2011 3:00:52 AM - Software Distribution Service 3.0
RP688: 1/16/2011 3:00:49 AM - Software Distribution Service 3.0
RP689: 1/17/2011 3:00:34 AM - Software Distribution Service 3.0
RP690: 1/18/2011 3:00:46 AM - Software Distribution Service 3.0
RP691: 1/19/2011 3:00:45 AM - Software Distribution Service 3.0
RP692: 1/20/2011 3:00:31 AM - Software Distribution Service 3.0
RP693: 1/21/2011 3:00:33 AM - Software Distribution Service 3.0
RP694: 1/22/2011 3:00:31 AM - Software Distribution Service 3.0
RP695: 1/23/2011 3:00:58 AM - Software Distribution Service 3.0
RP696: 1/24/2011 3:00:31 AM - Software Distribution Service 3.0
RP697: 1/25/2011 3:00:36 AM - Software Distribution Service 3.0
RP698: 1/26/2011 3:00:47 AM - Software Distribution Service 3.0
RP699: 1/27/2011 3:00:30 AM - Software Distribution Service 3.0
RP700: 1/28/2011 3:00:29 AM - Software Distribution Service 3.0
RP701: 1/29/2011 3:00:48 AM - Software Distribution Service 3.0
RP702: 1/30/2011 3:00:53 AM - Software Distribution Service 3.0
RP703: 1/31/2011 3:00:39 AM - Software Distribution Service 3.0
RP704: 2/1/2011 3:00:29 AM - Software Distribution Service 3.0
RP705: 2/2/2011 3:00:38 AM - Software Distribution Service 3.0
RP706: 2/3/2011 7:44:08 PM - Software Distribution Service 3.0
RP707: 2/4/2011 3:00:38 AM - Software Distribution Service 3.0
RP708: 2/5/2011 3:00:26 AM - Software Distribution Service 3.0
RP709: 2/6/2011 3:00:41 AM - Software Distribution Service 3.0
RP710: 2/7/2011 3:00:32 AM - Software Distribution Service 3.0
RP711: 2/8/2011 3:00:31 AM - Software Distribution Service 3.0
RP712: 2/9/2011 3:00:29 AM - Software Distribution Service 3.0
RP713: 2/9/2011 9:31:57 PM - Installed H&R Block Deluxe + Efile + State 2010.
RP714: 2/9/2011 11:58:45 PM - Installed H&R Block South Carolina 2010.
RP715: 2/10/2011 3:00:25 AM - Software Distribution Service 3.0
RP716: 2/11/2011 3:00:32 AM - Software Distribution Service 3.0
RP717: 2/12/2011 3:00:28 AM - Software Distribution Service 3.0
RP718: 2/13/2011 3:00:30 AM - Software Distribution Service 3.0
RP719: 2/14/2011 3:00:41 AM - Software Distribution Service 3.0
RP720: 2/16/2011 5:22:08 PM - Software Distribution Service 3.0
RP721: 2/17/2011 3:00:43 AM - Software Distribution Service 3.0
RP722: 2/18/2011 3:00:24 AM - Software Distribution Service 3.0
RP723: 2/19/2011 3:00:36 AM - Software Distribution Service 3.0
RP724: 2/20/2011 3:00:32 AM - Software Distribution Service 3.0
RP725: 2/21/2011 3:01:13 AM - Software Distribution Service 3.0
RP726: 2/22/2011 3:00:43 AM - Software Distribution Service 3.0
RP727: 2/23/2011 3:00:29 AM - Software Distribution Service 3.0
RP728: 2/24/2011 3:00:45 AM - Software Distribution Service 3.0
RP729: 2/25/2011 3:00:29 AM - Software Distribution Service 3.0
RP730: 2/26/2011 3:00:59 AM - Software Distribution Service 3.0
RP731: 2/27/2011 3:00:47 AM - Software Distribution Service 3.0
RP732: 2/28/2011 3:00:38 AM - Software Distribution Service 3.0
RP733: 3/1/2011 3:00:33 AM - Software Distribution Service 3.0
RP734: 3/2/2011 3:00:29 AM - Software Distribution Service 3.0
RP735: 3/3/2011 3:00:29 AM - Software Distribution Service 3.0
RP736: 3/4/2011 3:00:43 AM - Software Distribution Service 3.0
RP737: 3/5/2011 3:00:58 AM - Software Distribution Service 3.0
RP738: 3/6/2011 3:00:48 AM - Software Distribution Service 3.0
RP739: 3/7/2011 3:00:25 AM - Software Distribution Service 3.0
RP740: 3/8/2011 3:00:40 AM - Software Distribution Service 3.0
RP741: 3/9/2011 3:00:29 AM - Software Distribution Service 3.0
RP742: 3/10/2011 3:00:29 AM - Software Distribution Service 3.0
RP743: 3/11/2011 3:00:30 AM - Software Distribution Service 3.0
RP744: 3/12/2011 3:00:30 AM - Software Distribution Service 3.0
RP745: 3/13/2011 4:00:21 AM - Software Distribution Service 3.0
RP746: 3/14/2011 3:00:24 AM - Software Distribution Service 3.0
RP747: 3/15/2011 3:00:32 AM - Software Distribution Service 3.0
RP748: 3/16/2011 3:00:34 AM - Software Distribution Service 3.0
RP749: 3/17/2011 10:51:39 PM - System Checkpoint
RP750: 3/18/2011 11:06:34 PM - System Checkpoint
RP751: 3/20/2011 10:37:16 AM - System Checkpoint
RP752: 3/20/2011 9:57:06 PM - Removed AVG Free 8.5
RP753: 3/20/2011 10:02:59 PM - Installed AVG Free 8.5
RP754: 3/22/2011 4:13:17 PM - System Checkpoint
.
==== Installed Programs ======================
.
ABBYY FineReader 6.0 Sprint
Adobe AIR
Adobe Atmosphere Player for Acrobat and Adobe Reader
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Media Player
Adobe Photoshop Album 2.0 Starter Edition
Adobe Reader 7.0.8
All-Pro Software Tournament Scheduler Pro Free Trial 5.0
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ArcSoft PhotoStudio 2000
Ask Toolbar
AutoUpdate
BACS
BaDoink 2.2
Banctec Service Agreement
Bonjour
Britannica Ready Reference
Broadcom Advanced Control Suite
BroadJump Client Foundation
Canon ScanGear Toolbox CS 2.2
CCScore
CDex - Open Source Digital Audio CD Extractor
Citrix XenApp Web Plugin
CodeWarrior Development Studio for HC08 V5.0
CodeWarrior for HC08 V5.1
Coupon Printer for Windows
Critical Update for Windows Media Player 11 (KB959772)
DAO
DAO 3.5
DeductionPro 2004-05
DeductionPro 2007
Dell Networking Guide
Dell Picture Studio - Dell Image Expert
Dell Solution Center
DerbyMaster
DiscWizard for Windows
DivX Codec
DivX Content Uploader
DivX Player
DivX Web Player
DivxToDVD 0.5.2
DVDSentry
Easy CD Creator 5 Basic
ESSBrwr
ESSCDBK
ESScore
ESSgui
ESSini
ESSPCD
ESSPDock
ESSSONIC
ESSTOOLS
essvatgt
fflink
Free CD to MP3 Converter
FW LiveUpdate
GSview 4.6
H&R Block Deluxe + Efile + State 2010
H&R Block South Carolina 2010
Help and Support Customization
HighMAT Extension to Microsoft Windows XP CD Writing Wizard
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB932716-v2)
Hotfix for Windows XP (KB945060-v3)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
hp deskjet 5550 series
hp deskjet 5550 series (Remove only)
hp instant support
hp print screen utility
Intel(R) Extreme Graphics Driver
iTunes
J2SE Runtime Environment 5.0 Update 8
J2SE Runtime Environment 5.0 Update 9
Java(TM) 6 Update 14
Juice 2.2
Juniper Networks Network Connect 5.3.0
Juniper Networks Network Connect 5.5.0
Juniper Networks Secure Application Manager
Juniper Terminal Services Client
kgcbaby
kgcbase
kgchday
kgchlwn
kgcinvt
kgckids
kgcmove
kgcvday
Kids Cam Sticker Factory
Kodak EasyShare software
Lexmark 3500-4500 Series
Lexmark Fax Solutions
Lexmark Toolbar
LightScribe 1.4.89.1
LimeWire 5.5.8
Macromedia Shockwave Player
Malwarebytes' Anti-Malware
MediaCoder 0.5.1
Microsoft .NET Framework (English)
Microsoft .NET Framework (English) v1.0.3705
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft ActiveSync 4.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft IntelliPoint 6.01
Microsoft IntelliType Pro 6.01
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft National Language Support Downlevel APIs
Microsoft Office 2000 Professional
Microsoft Office Excel Viewer 2003
Microsoft Office Live Meeting 2007
Microsoft Office Word Viewer 2003
Microsoft Outlook 2000 SR-1
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Windows Journal Viewer
Mobileplay for Pocket PC
Mozilla Firefox (1.5.0.12)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6 Service Pack 2 (KB954459)
MUSICMATCH® Jukebox
Nero Suite
netbrdg
Norton AntiVirus
OfotoXMI
Paint Shop Pro 7
Pdf995 (installed by TaxCut)
PDFCreator 0.8.0
PdfEdit995 (installed by TaxCut)
PERFECT SERIES Optical MOUSE 4.0
PowerDVD
QuickTime
RapidPlayer v5.0 ActiveX Control
RealOne Player
Roxio VideoWave Movie Creator
Scholastic's I SPY Fantasy
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB2183461)
Security Update for Windows Internet Explorer 7 (KB2360131)
Security Update for Windows Internet Explorer 7 (KB2416400)
Security Update for Windows Internet Explorer 7 (KB2482017)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Internet Explorer 7 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
SFR
SHASTA
Shockwave
skin0001
SKINXSDK
staticcr
SyncBack
TaxCut 2004
TaxCut Basic 2006
TaxCut Georgia 2007
TaxCut Georgia 2008
TaxCut Premium + Efile 2008
TaxCut Premium + State + Efile 2007
TaxCut South Carolina 2008
TaxCut Standard 2005
TomTom HOME 2.7.6.2056
TomTom HOME Visual Studio Merge Modules
tooltips
Uninstall Dual Mode Camera
University of Tennessee Screen Saver
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows Internet Explorer 7 (KB980182)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
URGE
VPRINTOL
VSO Inspector 1.2.5
WAH Assistant
WAH System Verification
WebFldrs XP
West At Home Gateway V2
Windows 7 Upgrade Advisor Beta
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Installer Clean Up
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 9 Hotfix [See KB885492 for more information]
Windows Resource Kit Tools - SubInAcl.exe
Windows XP Service Pack 3
WinZip
WIRELESS
Wizard101
WordPerfect Office 11
WOT for Internet Explorer
You Don't Know Jack The Ride
ZoneAlarm
.
==== Event Viewer Messages From Past Week ========
.
3/22/2011 6:20:58 PM, error: System Error [1003] - Error code 1000000a, parameter1 00000166, parameter2 00000002, parameter3 00000000, parameter4 804e5443.
3/21/2011 9:46:26 PM, error: DCOM [10000] - Unable to start a DCOM Server: {73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}. The error: "%1450" Happened while starting this command: C:\windows\system32\wbem\wmiprvse.exe -Embedding
3/21/2011 11:09:13 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
3/21/2011 11:09:01 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD BHDrvx86 cdudf_xp eeCtrl Fips intelppm IPSec MRxSmb NEOFLTR_600_12023 NetBIOS NetBT RasAcd Rdbss SRTSPX SymIRON SYMTDI Tcpip vsdatant
3/21/2011 10:35:39 PM, error: System Error [1003] - Error code 1000000a, parameter1 7fff0000, parameter2 00000002, parameter3 00000001, parameter4 805f66cf.
3/20/2011 7:20:18 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
3/20/2011 4:13:45 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the lxdiCATSCustConnectService service to connect.
3/20/2011 4:13:45 PM, error: Service Control Manager [7000] - The lxdiCATSCustConnectService service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
3/20/2011 11:19:05 PM, error: atapi [11] - The driver detected a controller error on \Device\Ide\IdePort0.
3/20/2011 11:18:39 PM, error: atapi [9] - The device, \Device\Ide\IdePort0, did not respond within the timeout period.
3/20/2011 10:05:06 PM, error: System Error [1003] - Error code 000000f4, parameter1 00000003, parameter2 83a65900, parameter3 83a65a74, parameter4 805fb1d6.
3/19/2011 8:47:58 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
3/19/2011 8:44:28 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AvgLdx86 AvgMfx86 AvgTdiX cdudf_xp Fips intelppm IPSec MRxSmb NEOFLTR_600_12023 NetBIOS NetBT RasAcd Rdbss Tcpip
3/19/2011 8:44:28 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning.
3/19/2011 8:44:28 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
3/19/2011 8:44:28 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
3/19/2011 8:44:28 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
3/19/2011 8:44:28 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
3/19/2011 8:44:28 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
3/16/2011 7:15:56 PM, error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
3/16/2011 6:49:26 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Apple Mobile Device service to connect.
3/16/2011 6:49:26 PM, error: Service Control Manager [7000] - The Apple Mobile Device service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
3/16/2011 6:48:56 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Juniper Network Connect Service service to connect.
3/16/2011 6:48:56 PM, error: Service Control Manager [7000] - The Juniper Network Connect Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
3/16/2011 6:48:27 PM, error: Service Control Manager [7034] - The TomTomHOMEService service terminated unexpectedly. It has done this 1 time(s).
3/16/2011 6:48:27 PM, error: Service Control Manager [7034] - The SNMP Service service terminated unexpectedly. It has done this 1 time(s).
3/16/2011 6:48:27 PM, error: Service Control Manager [7034] - The lxdi_device service terminated unexpectedly. It has done this 1 time(s).
3/16/2011 6:48:27 PM, error: Service Control Manager [7034] - The LightScribeService Direct Disc Labeling Service service terminated unexpectedly. It has done this 1 time(s).
3/16/2011 6:48:27 PM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
3/16/2011 6:48:27 PM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s).
3/16/2011 6:48:27 PM, error: Service Control Manager [7031] - The Juniper Network Connect Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
3/16/2011 6:48:27 PM, error: Service Control Manager [7031] - The AVG Free8 WatchDog service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
3/16/2011 6:48:27 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
3/16/2011 6:48:27 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the AVG Free8 WatchDog service to connect.
3/16/2011 6:48:27 PM, error: Service Control Manager [7000] - The AVG Free8 WatchDog service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
3/16/2011 6:31:32 PM, error: Print [19] - Sharing printer failed + 1722, Printer PDFCreator share name Printer.
3/16/2011 3:03:56 AM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Microsoft .NET Framework 1.0 Service Pack 3, English Version.
3/16/2011 3:01:18 AM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Microsoft .NET Framework 1.1 Service Pack 1.
.
==== End Of File ===========================


BTW LimeWire Update Screen is still opening on restart and can't be closed.

Please let me know next steps.

Thanks,
John Lane

Please download Rootkit Unhooker from one of the following links and save it to your desktop.

• Link 1 (.exe file)
  Link 2 (zipped file)
  Link 3 (.rar file)

In order to use this tool if you downloaded from either of the second two links, you will need to extract the RKUnhookerLE.exe file using a program capable of extracing ZIP and RAR compressed files. If you don't have an extraction program, you can downlaod, install and use the free 7-zip utility.

• Double-click on RKUnhookerLE.exe to start the program.
  Vista/Windows 7 users right-click and select Run As Administrator.
• Click the Report tab, then click Scan.
• Check Drivers, Stealth, and uncheck the rest.
• Click OK.
• Wait until it's finished and then go to File > Save Report.
• Save the report to your Desktop.
• Copy and paste the contents of the report into your next reply.

-- Note: You may get this warning...just ignore it, click OK and continue: "Rootkit Unhooker has detected a parasite inside itself! It is recommended to remove parasite, okay?".