[headoperator]

Thanks Flashorn for all the help. Unfortunately I do not have access to another computer as of yet. I'll have to look into another option for downloading Hijackthis, I may be able to use a friends. The only thing I have noticed is that some websites are slow to download that were not before, as far as programs that deny me acess there were a few when I was researching this last week that said I did not have administrative rights, that really concerned me as to how those settings got changed. Also when I go to task manager to stop a process it also says I do not have adminstrative rights to stop a process, I've read a lot of info that instructs you to stop certain process so you can run a scan. I just don't know. I will upgrade to IE8. Unfortunately my STBX will have access to the house since my kids come over each week and they have a key to get in so she could get in anytime when I'm at work. The one thing I did do was put a password on the admin acct and my personal acct. However my daughter can still get on without a password, kind of hard to tell her to password protect and not tell her mother, that will just start more crap I don't neeed now. As far as surfing goes I havent had any problems, other than a few sites that lock up my computer. I'm seriously thinking of scraping that one and getting a laptop I can keep locked up.
I noticed when you reset a router it removes your password protection so I son't understand how I can be protected if someone can have access to your equipment. I just don't know enough about routers yet to protect myself.
I do have one more question, these new hard drives came with a ghost back up system, it's actually a second hard drive, I can't find much information about it?

[Flashorn]

Hey headoperator !
Well, if your going to get yourself a notebook, no need to go through all of these scans and waste anymore of your time.
It seems to make you more nervous than anything else. But, if you still want to go ahead then, I'll do my best to help as
much as I can.

Since you pass-worded your Admin account, and IF your daughter has her own account (guest or by name) it's not an
admin account and shouldn't be able to install anything on the PC since she doesn't have the authority to do so. Even
if someone should boot in safe mode and try to access your admin account, they can't because of the password. Those
persons trying to access your admin account (even in safe mode) would have to have a Very good understanding of how
to circumvent this locked account. I'm not saying it can't be done but, he/she would have to be good at hacking other
people's PCs.

IF you are going to get a notebook for yourself, try and get one with a Finger Print Reader to log in to the notebook. They
are not rare and can be found for a reasonable price. Do Not buy one with a Face Recognition program to access the notebook
as they easily fooled by simply holding a Picture of that person in front of the camera.

Your router having been pass-worded will only work IF you don't reset to factory specs. Then, you still have to reset
the password manually again. BUT, if you use wireless , then that Key (wep or WAP2) will absolutely be needed to access
the wireless function of the router. I hope I'm making sense for you here.

As for the Ghost backup program, it's from Norton. It actually is a very good program. I gather that having two Hard drives
installed would mean that whatever is written to the main drive (in this case would be the C:\\ drive) is automatically
Mirrored to the other drive. We call this operation RAID 0. (Redundancy Array). If you can access the Computer folder
you could locate that drive and scan it manually by Right Clicking on the drive and have it scanned by your antivirus
or by MalwareBytes if you installed it. It should show up in the Context Menu when you right click.

Finally, the last option is the one that was mentioned in the first post and that would be to format the C:\\ drive and re-install
XP. But, if you can download HijackThis from a friends computer to a USB Key, you could then run this program without
any interference from the OS. I could then be in a better position to evaluate the situation you're in.

This is up to you headoperator.

Let me know what you decide.



FLASHORN.

[headoperator]

Thanks again Flashorn I will try and download Hijackthis, it will probably be this weekend. My getting a laptop will be after the new year when funds are available. So I will continue to try and fix my PC in the meantime. I really do appreciate all your help. I'll let you know when I get hijack this installed. As far as the router goes I'm completly ignorant of how they work. I'm trying to find some tutorials online. I'm not sure I have the WEP or Wap2 properly configured. Thanks

[Flashorn]

Hey headoperator !

If you give me the name (make) of the router and the number (not the serial #) , I will also try and track down
any info I can relating to setting up this router.

I did ask if you used a CAT5 wire to connect your PC or if you use a wireless connection. I didn't get an
answer. CAT5 wire : 6foot long wire with a big telephone type connection on both ends. One to the Router
the other to the PC (probably the back).

As for HijackThis, it's not an installation, it's an .exe and you run it from the USB Key.
Start " Computer " locate the USB Key and open. Double click on the HjT .exe and run
a scan. Copy and Paste the results in your next post. No need to install on your PC.

OK, I'll be waiting well, watching, for your reply.



FLASHORN.

[headoperator]

Flashorn,
My PC is tied into my router via Cat 5. The router I got is a ASUS RT-N53, here is a link.
http://asusblackdiam...3/overview.htm. its working ok I just don't understand all the settings. And I haven't really had time to investigate.

[headoperator]

Flashorn,
Well after a day off I was able to upgrade to IE8 and I ran hijackthis. ere is the log. There is also a box with any applications/programs that can be checked to fix I have left this alone until further instructions.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 6:06:52 PM, on 8/15/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Zune\ZuneBusEnum.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\AntiLogger\AntiLogger.exe
C:\Documents and Settings\Rich\Application Data\Smilebox\SmileboxTray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Documents and Settings\Rich\Local Settings\Temporary Internet Files\Content.IE5\2R6FUF0J\HijackThis[1].exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jw.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [AntiLogger] "C:\Program Files\AntiLogger\AntiLogger.exe" /minimized
O4 - HKCU\..\Run: [SmileboxTray] "C:\Documents and Settings\Rich\Application Data\Smilebox\SmileboxTray.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell....iler/SysPro.CAB
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://aic.lgservice...ntrol-6.1.4.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.co.../sysreqlab3.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1152257750906
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.mi...b?1344989493234
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Broadcom ASF IP Monitor (ASFIPmon) - Broadcom Corporation - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: npkcmsvc - Unknown owner - C:\Nexon\MapleStory\npkcmsvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe

--
End of file - 10635 bytes

[headoperator]

I found this on my desktop in notebook. I hadn't notice it before. Any idea what it is referring to?


Hi, I have remove that string of numbers. As Flashorn has suggested, it appears to be a Key of some sort and not something you should be posting. I know you were asking what it was and that is fine, but a description would have sufficed. coastie

This post has been edited by coastie65: 16 August 2012 - 05:57 AM
Reason for edit: Removed a possible software key.

[Flashorn]

headoperator, on 15 August 2012 - 03:56 PM, said:

I found this on my desktop in notebook. I hadn't notice it before. Any idea what it is referring to?

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Removed Product Key.

Hey headoperator !

That looks like a key of some sorts. It might be the XP registration code to validate your XP OS
(in which case, it shouldn't be on here . I will ask a moderator to delete this key from your post.)
or did it have brackets like these [ ...] - {...} in front and back ??. If it did then, it could be a registry key
but, I doubt it. It is more some sort of install key for activating a program.

When you say 'you found it in notebook" what do you mean exactly? Is this a folder on your desktop?
and what else does it contain.


OK, I looked through the HjT log and to tell you the truth, there are allot of programs that are most likely
conflicting with each other and others that are out of date. There are no .exes out of place or infected
keys.Only too many programs of the same kind and / or out of date.

Are you using a proxie to access the web? If not then, we will deal with it latter. For now I would need
you to take one or more screen shots of the Add / Remove folder to see exactly what's installed on
your PC. I will then instruct on which ones to remove and keep. Also will tell you which ones to update.
I only need the programs. Not the updates for XP which, if I remember correctly, are also in that folder.
The Versions and the Dates of those programs would be helpful. All of this info. is in that same folder.
Just expand those columns to expose the data I need.

That's , if you're willing. If you would rather PM (private message) me with those details because of
privacy matters, you can do that also.
It's up to you.

Could you answer all my questions pls.



FLASHORN.

This post has been edited by coastie65: 16 August 2012 - 10:43 AM

[headoperator]

Moderators I appreciate you removing the key from my post but I noticed its on Flashorns response, can yu please delete. Thanks

[coastie65]

headoperator, on 16 August 2012 - 09:51 AM, said:

Moderators I appreciate you removing the key from my post but I noticed its on Flashorns response, can yu please delete. Thanks

Got it. I overlooked that when I took care of the other.

[LiveBrianD]

I saw it before it was removed, and I don't think it's a serial key. I've seen things like that used for installer and temporary folders before. I think Windows uses them to refer to various things - for instance, %SystemRoot%\explorer.exe /e,::{20D04FE0-3AEA-1069-A2D8-08002B30309D} launches Explorer, showing the 'Computer' screen. Don't ask me how they came up with that code...

[Flashorn]

coastie65, on 16 August 2012 - 10:44 AM, said:

headoperator, on 16 August 2012 - 09:51 AM, said:

Moderators I appreciate you removing the key from my post but I noticed its on Flashorns response, can yu please delete. Thanks

Got it. I overlooked that when I took care of the other.

Hey coastie !

Actually, it's my fault for not noticing that my reply had that key in it.
I should have mentioned it when I asked you to alter headoperator's
reply. Sorry!


FLASHORN.

[Flashorn]

LiveBrianD, on 16 August 2012 - 11:47 AM, said:

I saw it before it was removed, and I don't think it's a serial key. I've seen things like that used for installer and temporary folders before. I think Windows uses them to refer to various things - for instance, %SystemRoot%\explorer.exe /e,::{20D04FE0-3AEA-1069-A2D8-08002B30309D} launches Explorer, showing the 'Computer' screen. Don't ask me how they came up with that code...

Hey Brian !

Well, if you'd looked closely to the way the key was spaced out, it was pretty obvious that it wasn't what
you posted. It had 10 blocks of 5 letters and numbers just like a program key or Microsoft's registration
keys. Just thought I'd clarify that for you.


FLASHORN.

[LiveBrianD]

Yes, but that still didn't look like any Microsoft registration keys I'd seen. For instance, Windows Update temp folders have names like that sometimes.

[Flashorn]

But, we still don't know who made that folder. I just happen to have
my key for Roxio and it has the same configuration.

The registration key for Classic Start Menu is exactly the same also.

Seems like a registration key to me.


FLASHORN.