Help!!!

[jholland1964]

This is a free program. I have never had it ask for a registration. Are you absolutely certain you installed the correct program?

See this from their website;

Our software is called Spybot - Search & Destroy and does not need any registration or password.
You don't have to pay $ for Spybot - Search & Destroy, it's freeware and does not need to be purchased.

Further please have a look at this link on our website:
http://www.safer-networking.org/en/news/2006-08-04.html

You did not get Spybot - Search & Destroy, but some other software of low quality, probably called SpyWareBot.
Our software does not need any registering to work.

Uninstall whatever it is you installed it is NOT Spybot - Search & Destroy. That is why I told you to scroll down and install it from THEIR website.

[dinger1948]

I installed from the web site and it came out SpyWare Doctor. I will uninstall and try again. Maybe I should try the second download (I did the first).

[jholland1964]

I installed from the web site and it came out SpyWare Doctor. I will uninstall and try again. Maybe I should try the second download (I did the first).

This is the .exe file just click to download HERE

Save the file to the desktop. Doubleclick to install. Once installed update it and then run it.

[dinger1948]

Well, I dood it. I clicked on the link you sent and it downloaded. I updated and cancelled the teatimer. I have to say that the teatimer wasn't on the first spyware download and it looks different. I'm scanning as I write this and I'll send more info (logs and such) when it's done. Thanx again.

[dinger1948]

I used the correct spybot search & destroy. It fixed 52 of 55 then rebooted and came back 0 problems. I am having trouble attaching the hijackthis.log again, but I'm going to try one more thing. Whatever happens, I greatly appreciate all your help. One of my coworkers just spent over $400 to have the Geek Squad fix his computer, but he may not have been able to get to you for help. A nasty virus attached itself to his hard drive through his antivirus. He couldn't get online or bring up his desktop. I'll try to talk to the other one tonight. Okay, I tried to put the log in the manage attachments and renaming it four different ways, but it just says invalid file on everything I throw at it.

[jholland1964]

THis is what it should be named. hjt.txt

Nothing else, just that, it has to end with .txt that was why you couldn't attach it before because you didn't have the correct file extension on it.

.txt

If you cannot attach it, open it up. Go up to the top and Choose Edit, Select All. Once all of it is highlighted then Right Click ANYWHERE in that highlighted text and choose Paste. Then come here, open a new post, put your cursor in anywhere and go up to Edit on your browser and choose Paste. That log should then appear in your post. Then click Submit Reply

[dinger1948]

I guess my mistake was that I kept it as a log file. It looks like it worked this time. Thank you, John

[jholland1964]

First thing I see right away is you are running TWO antivirus programs;
panda antivirus + firewall AND Yahoo!\Antivirus. This is an ABSOLUTE NO-NO. The rule is ONE antivirus program and ONE firewall on a machine, NO MORE. You Choose...but one of these MUST be uninstalled immediately. Also check and see if you have the built in Windows Firewall Turned OFF, if it isn't then do so now.
If you want my recommendation then I would say UNINSTALL the Yahoo Antivirus, also possibly called eTrust™ EZ_Antivirus and/or Computer Associates. You will have to look in your Add/Remove and see if any of these are listed. Also look in there for a listing of Yahoo Antivirus. I recommend this one because the Panda antivirus and firewall is a paid program and I don't want you to lose the money. Now if this, the Panda program, is just a Trial version then by all means Uninstall that one.
Don't just delete which ever you choose....UNINSTALL.

You also are running Spybot TeaTimer. That part of Spybot is more trouble than it is worth, TURN IT OFF.
To do this is very easy. (See my Attachments Below) Open Spybot. Go up to the top left and you will see a button marked Mode. Click. When it opens there click on Advanced.
When it goes to Advanced Mode then you will see three buttons at the bottom Left. Settings, Tools, Info and License. Click on Tools. On the left side you will see another group of 7 buttons. The second one down is Resident. Click. When Resident opens you will see two boxes in the middle with checkmarks in them. Resident SD Helper (Leave this checked) The next one is Resident TeaTimer...Take the checkmark OUT of there. Close the program.

Next I want you to run HiJackThis again. This time place checkmarks next to the following entries if they still exist;

O3 - Toolbar: MYPOINTS - {A057A204-BACC-4D26-CEC4-75A487FD6484} - C:\PROGRA~1\mypoints\mypoints.dll
O3 - Toolbar: (no name) - {ABA69CF4-20FB-42CE-BB6D-B6171D64B8EC} - (no file)

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsAuxs.exe (file missing)
O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsSvc.exe (file missing)

Once you have placed the checkmarks then click the Fix Checked button on the lower right side.
Exit HJT.
Reboot the computer and then let us know how things are running.

[dinger1948]

Yesterday, I went in and uninstalled my Panda antivirus and firewall (three times). It had just expired and I figured that I would take your advice and go with the Yahoo antivirus. After I finished and rebooted, I was denied access to the internet completely. I tried all I knew to do, but could not even get on with dialup. I called AT&t's internet help line and (my first mistake) let the rep take control of my computer via remote. He found the Panda program had attached itself to the modem, Wireless router, and even the server. He went online and found a bunch of sites that complained about uninstalling Panda and a bunch of help sites. Instead of going to those sites, he went through the add/delete programs on the control panel. He could not find anything to uninstall, so he disabled the Panda clones. He then tried to install the AT&T/Yahoo antivirus program and it wouldn't install. His answer to this was to change my windows administrator signin on reboot. He got the antivirus program installed (after almost four hours), but now I can't get my old administrator name or signin back. I can't get into my Compuserve account other than to bring up the top toolbar (nothing comes up from anything I click-including the link to this thread. I lost all of My Documents, can't use any of the programs that you had me install, and have all new things on the start menu. The computer seems to be faster after all this, but I want all of my old things back. I did manage to complete all of the things you said to do on your last post

[jholland1964]

Do you know that password or did he change it and not tell you what it was?
You really need to call them back and tell them what happened, what the tech did and tell them now you can't access anything and you expect this to be corrected.