Help HJT please

[vancek]

My computer is moving slow, slow, slow and I am getting killed by pop-ups. Sometimes when I boot up, Windows attempts to read my A drive. There is nothing in my A drive. Did I mention my computer was moving slow?

Attached is my HJT log and my Kaspersky log. I couldn't get AVS to save my log.

Words cannot begin to describe my frustration. Your help is appreciated.

[jholland1964]

Obviously there are multiple problems on the computer as showing in both logs.
You will need to begin by following all steps, exactly as given here;

READ ME Before Posting A Request For Assistance!

Be sure to follow all instructions, especially those requiring the use of Safe Mode AND the proper location of HiJackThis.
Once you have completed all steps then again run a new Kaspersky scan AND a new HiJackThis scan and post those new logs along with the log from the AVG Anti-spy program (be sure you tell that program to fix everything found)
Post back with those logs and we can then see what else needs to be done.
Judy

[vancek]

That's just it. I did follow it.

Am I not running HiJack This from the right location? Am I not saving it to the right location? I can't get the "Save Report" button from the AVG program to even become active for me to click on, much less to get it work.

Please let me know exactly what I've done wrong because with as slow as my computer is I'm looking at a five to six hour process.

[jholland1964]

Ok, you are running HiJackThis from here;
C:\Documents and Settings\Owner\Desktop\hjtscan.exe.exe

It should be saved to a folder which you create;
C:\Program Files\HijackThis OR C:\HijackThis

To create a new folder:
Click START > My Computer > Local Disc C: > Program Files
Now, RightClick on an Empty Area and select New > Folder & name it HijackThis and Click ENTER. Then put HiJackThis in That new folder.
This is so that a backup of fixes can be made in case they have to be "undone". This is very important.

Now, as far as AVG Anti-spy. You say that you cannot run it. Can you tell me EXACTLY what happens when you do try to run it.
Please see my attachments regarding buttons you need to press.
The buttons "look" greyed out, but if you click on them they should work, unless the program is not correctly installed.

When you click on the Scanner Button, Choose Full System Scan.
When that opens click on the Settings Tab. On the top right, Under Reports, please choose Automatically Generate Report After Every Scan

I realize this is very frustrating, but there is no quick fix here, it WILL be a time consuming process. I will stick with you as long as it takes but you have to give me time to determine what all needs to be done.
One of these, hopefully, is running a successful AVG Anti-Spy scan. It WILL remove many items if it can run correctly, and in SAFE MODE.
Judy

[vancek]

I'll make sure I get HJT into the correct file.

Whle in Safe Mode, after I run AVG and tell it to Apply All Actions, the Save Report button remains grayed out. I've tried pushing it even as a grayed out button and nothing happens. Nothing ever happens. I'll reinstall the entire program tonight to see if I can improve it.

Thanks for your help.

[jholland1964]

Have you run the ATF-Cleaner? If not, be sure to do so using BOTH the Internet Explorer option and then click the Firefox button and do the same. You will get a message asking you if you wish to save your Firefox passwords, you may say YES.

You have numerous trojans on the system, this is why I hope that you will be able to run the AVG program as it will remove many of them.
If you are unable to get it to run then we will do it another way.

For now;
Here are files you should also empty manually while in safe mode;

Go into Search & Destroy\Recovery\ and delete all recovery files.

C:\Program Files\Norton AntiVirus\Quarantine\

C:\VundoFix Backups\

Now you will have to be certain to enable the viewing of hidden files and folders

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\
In the Content.IE5 file above you will see a lot of oddly named file folders...things like AL6TYB0P. There could be numerous folders like this with random letter and number names. Open each folder and delete the contents of the folder, not the folder itself.

Follow as many of the steps as possible. Reboot the system to normal mode and run a new Kaspersky scan and then a new HJT scan. Post all available logs back here.

Judy

P.S. I do have a list of files you will have to clear manually but let's see what automated steps you can get to run first and then we will go from there, as this list could change...hopefully for the better.

[jholland1964]

One more thing...your Windows XP is way out of date, part of which can explain the multitude of infections on the computer since you obviously do not have the latest security updates on the computer. Current version is XP SP2 and just the latest Security Updates were released on August 14, 2007. XP SP2 has been available since sometime in the fall of 2004 with many security updates released between then and now. Your computer is truly and has truly been at great risk since then.

[vancek]

Will I have to clean it up before downloading the updates or can I do this at any time?

[jholland1964]

I believe I would advise that you clean up the computer FIRST. After the computer is clean THEN and only then you must update to the latest version of Windows XP which is SP2 and also update to IE7.

You are running java version j2re1.4.2_03 and the most recent version is 1.6.0_02 so you will need to update that also.

Couple things you need to UNINSTALL first via Add/Remove are
Many of them may not be found there but look and if you find it UNINSTALL it;
AlcxMonitor
SystemOptimizer (have no idea what this is, or if you will find it in Add/Remove. If you can't find it there then we can wait, but let me know.
WebBuying
Digital Distribution Channel
TA_Start
Also please TURN OFF Spyware Doctor for the duration, it obviously is doing nothing.

[vancek]

I still can't get the AVG report to save. Do you think that because I am running on outdated software, I won't be able to save it?