Slow computer...

[X_Jado_X]

Ok, I followed ALL STEPS EXACTLY AS IT SAID. It took 8 hours! If somehow you think I didn't follow the steps, then something is wrong with those steps because I did it exactly. I am going to do what you said above, now.

[X_Jado_X]

jholland, I really appreciate how you are trying to help me, but I will finish this first, then go on to the xbox thing.

Want me to put it in safe mode?

Oh and I played a little bit of xbox live at the end of doing the last scan.

[X_Jado_X]

I just got that alert...

EDIT: also, at times I get this little window pop up in the system tray, it has no text in it, and like firefox, where it has the fox around the world icon thing, its a little white box, I just think thats suspicious...

[jholland1964]

That alert means you Norton Firewall is working correctly. The IP in the intrusion is Earthlink. Is Earthlink your ISP?

Yeah, one more time, go into Safe Mode for the scans. Update both your anti-virus program, the AVG cleaner before booting to Safe Mode. Also, disconnect completely from the internet too. I mean, actually remove the cable from the computer.

Be sure to run the ATF-Cleaner before doing any scans. Click on ATF-Cleaner to run it
-- Where it says Select Files To Delete, Check the Select All Option
-- Click Empty Selected > OK > EXIT

Next run you anti-virus cleaner. Run a full system scan and have it fix or quarantine anything found.
Next run the AVG anti-spy program
Launch AVG Anti-Spyware.
-- Click on the Scanner button and choose the Settings Tab.
---> Under How to act?, click on Recommended action and choose Quarantine to set default action for detected malware.
--->Under Reports make sure Automatically generate report after every scan is selected and UNCHECK the Only if threats were found box.
-- Leave everything else at their default settings and Select the Scan tab and CLICK Complete System Scan to scan your machine.
-- Upon completion of the scan, Click Apply all actions to place any detected baddies in Quarantine.
-- AFTER clicking Apply all actions, Click on Save Report and select Save the report to your Desktop.

Once you have completed the scans then shut down the computer. Reconnect the internet cable. Reboot to normal mode and make sure all unnecessary programs are closed including browsers or IM programs;

Go into the taskmanager by hitting Ctrl-Alt-Delete
and see if these processes are running, if they are end them;
qttask.exe
SweetIM.exe
iTunesHelper.exe
iPodService.exe
None of these are necessary to the running of the computer so they can be turned off.
Once they are turned off then run the new HJT scan. Save the log and post it here along with that new AVG log.
Judy

[X_Jado_X]

I ran an AVG in normal mode, I told my brother to do it overnight in safe, but he just did it in normal mode.... I got the scan and the HJT log. Tell me if it MUST be in safe mode, and I will do it again.

EDIT: My ISP is called "AAPT"

[jholland1964]

No action was taken on the AVG scan. It should have been set to delete or quarantine. It should ALWAYS be set that way. Now again in that scan there are not really bad items but a large number of tracking cookies. These cookies showing in the log should not be there. They should be blocked by Firefox. You must not have them set for blocking in Firefox.
To do this in Firefox go to Tools, Options, the Privacy Tab. Cookies, Exceptions. Make sure all of those listed in your AVG log are listed as blocked.
Getting ready for my grandson's 6th birthday dinner so I will be back later after I get a chance to check out the HJT log.
Judy

[X_Jado_X]

It says enter web address to block cookie, but I can't find any web addresses in there.

[jholland1964]

Give me a bit and I will get you a list.

First of all though you still have some nasty things showing in your HJT log.
Two KEY items showing are;

O4 - HKLM\..\Run: [DDCActiveMenu] "C:\Program Files\WildTangent\DDC\ActiveMenu\DDCActiveMenu.exe " -boot
1) Click on Start, Settings, Control Panel
2) Double-click on Add/Remove Programs
3) Click on the WildTangent selection and Change/Remove, Uninstall, or Add/Remove depending on the operating system. Then follow the onscreen prompts to remove the WT Driver.
If it DOES NOT appear in Add/Remove then try the following;

Delete the WildTangent folder in Program Files and Windows

• Open My Computer
• Double-click on Drive C
• Double-click on Program Files
• Right-click on WildTangent and choose Delete (if the folder exists)
• Go back to Drive C and double-click on Windows
• Right-click on the WT folder and choose Delete (if the folder exists)

Let me know if you are NOT able to do this.
The other baddie appearing in the HJT log is this one;

O4 - HKLM\..\Run: [explorer] C:\WINDOWS\system32\explorer.exe
This is RapidBlaster.
RapidBlaster is a task run on Windows startup. When an internet connection is present it periodically connects to its servers to retrieve advertising.
To remove RapidBlaster please do the following;
Update your Nortons.
Totally disconnect your internet connection, in other words, UNPLUG from the internet completely.

1. Press Ctrl+Alt+Delete once.
2. Click Task Manager.
3. Click the Processes tab.
4. Double-click the Image Name column header to alphabetically sort the processes.
5. Scroll through the list and look for Rb32.exe.
6. If you find the file, click it, and then click End Process.
7. Exit the Task Manager.

Uninstall RapidBlaster

1. Click Start > Control Panel.
2. In the Control Panel window, double-click Add or Remove Programs.
   Click "RapidBlaster" or "rb32 lptt01."
3. Remove

Next open your Norton Program.

1. Start Norton AntiVirus and make sure that it is configured to scan all the files.
2. Run a full system scan.
3. If any files are detected as infected with Dialer.Rapidblaster, click Delete.

Next, still disconnected from the internet I want you to run HiJackThis again and place checkmarks next to the following entries if still present;

O2 - BHO: SWEETIE Class - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll (file missing)
O2 - BHO: (no name) - {4B18DD50-C996-44fc-AC52-0FECFF82ED58} - (no file)

O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll (file missing)

O4 - HKLM\..\Run: [DDCActiveMenu] "C:\Program Files\WildTangent\DDC\ActiveMenu\DDCActiveMenu.exe " -boot
O4 - HKLM\..\Run: [explorer] C:\WINDOWS\system32\explorer.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://www.savewealth.com

Once you have placed the checkmarks then click the FIX button.
Exit HJT.
Shut down the computer. Reconnect the internet. Reboot the computer and run a NEW HJT scan, save the log and post back here.

[X_Jado_X]

WildTangent only has "WildTangent Channel" or something in add/remove, and its not in Program Files.

WILL EDIT WHEN I HAVE THE REST OF THE INFORMATION.
I can't do the virus scan right now, I'll try to do it tonight.

[jholland1964]

Remove whatever Wild Tangent entry there is in Add/Remove.