This is a VERY nasty piece of malware. You CANNOT get rid of Braviax by simply deleting both files with that name in c:\windows and c:\windows\system32, or by unmarking it in MSCFG . On the next reboot or start, they will be back, along with everything else in the payload the nasty delivered. Braviax (which actually may have different names)is just part of the pack. One of my employees carelessly clicked on a link that came up in Google when she was searching for a church! The malware unpacked its payload. It scooted past our two active antivirus programs and firewall. Then it sent up a barrage of popups. Many were phony virus alerts; a click would have launched or downloaded more bad stuff. But some alerts also were coming from AVG, McAfee, and Windows. I quickly fired up AVG, it found an infection right away, but before the scan could complete, the virus disabled AVG. AVG and McAfee won't run now, not even in Safe Mode. The nasty also shut down our cable access to the Internet, hijacking our connection -- and started sending out ITS stuff from OUR PC. What a mess. It's going to take an expert to clean it out, damaged files will need to be reinstalled, and it may be that the best solution will be FORMAT C: and reinstall XP from scratch. The fact that we don't have a dedicated removal tool from any of the big antivirus publishers yet suggests how well the bad guys did their nasty work. Send Bill Gates back to the drawing board, with a stop in the woodshed along the way. ed p.

Plumbing on an outside wall is a bad idea if you live where there is winter. It's never a good idea to rush into a remodeling project because you will end up with something you hate or something that is problem ridden. A good licensed contractor will help you plan your bath remodel so you won't have to worry about exploding pipes in the winter.

Yes thanks Corrine, and you too Ravencajun. I am running admin acct. Looks like that did it, but its always easier to see on preview. (Those logs aren't easy on the eyes. These old eyes like whitespace:) Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 4:01:01 PM, on 6/9/2012 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe c:\Program Files\Microsoft Security Client\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Digital Media Reader\shwiconem.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\system32\VTTimer.exe C:\WINDOWS\system32\VTtrayp.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Microsoft Security Client\msseces.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Xmarks\IE Extension\xmarkssync.exe C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe C:\PROGRA~1\COMMON~1\AOL\112263~1\EE\AOLHOS~1.EXE C:\PROGRA~1\COMMON~1\AOL\112263~1\EE\AOLServiceHost.exe C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Owner\My Documents\Downloads\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer, optimized for Bing and MSN R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http= O2 - BHO: AcroIEHelperStub - "18DF081C-E8AD-4283-A596-FA578C2EBDC3> - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: SSVHelper Class - "761497BB-D6F0-462C-B6EB-D4DAF1D92D43> - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: ST - "9394EDE7-C8B5-483E-8773-474BF36AF6E4> - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: MSNToolBandBHO - "BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0> - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - "DBC80044-A445-435b-BC74-9C25C1C588A9> - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - "E7E6F031-17CE-4C07-BC86-EABFE594F69C> - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: MSN - "BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0> - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1122639952\EE\AOLHostManager.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9 O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Xmarks] C:\Program Files\Xmarks\IE Extension\xmarkssync.exe -q O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - "08B0E5C0-4FCB-11CF-AAA5-00401C608501> - C:\Program Files\Java\jre6\bin\jp2iexp.dll O9 - Extra 'Tools' menuitem: Sun Java Console - "08B0E5C0-4FCB-11CF-AAA5-00401C608501> - C:\Program Files\Java\jre6\bin\jp2iexp.dll O9 - Extra button: Real.com - "CD67F990-D8E9-11d2-98FE-00C0F0318AFE> - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - "e2e2dd38-d088-4134-82b7-f2ba38496583> - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - "e2e2dd38-d088-4134-82b7-f2ba38496583> - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - "FB5F1910-F110-11d2-BB9E-00C04F795683> - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - "FB5F1910-F110-11d2-BB9E-00C04F795683> - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - "638F11AA-DF27-433b-BA2E-7281CE561D71> - C:\Program Files\Xmarks\IE Extension\xmarkssync.exe (HKCU) O9 - Extra 'Tools' menuitem: Xmarks for IE... - "638F11AA-DF27-433b-BA2E-7281CE561D71> - C:\Program Files\Xmarks\IE Extension\xmarkssync.exe (HKCU) O16 - DPF: "B38870E4-7ECB-40DA-8C6A-595F0A5519FF> (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab O22 - SharedTaskScheduler: Browseui preloader - "438755C2-A8BA-11D1-B96B-00A0C90312E1> - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - "8C7461EF-2B13-11d2-BE35-3078302C2030> - C:\WINDOWS\system32\browseui.dll O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Unknown owner - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (file missing) O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS -- End of file - 6503 bytes Looking Good.

I am wondering if this could be a run away log file. when you have a problem with hard drive space disappearing, look for a gigantic file. In Windows XP, open Windows Explorer (click Start, All Programs, Accessories, Windows Explorer). Click Search and All Files and Folders. Enter *.* in the file name. Tell it to search My Computer. Select Specify Size and pick At Least in the first box. Enter 1000000 in the second box. Click Search. We are looking for any really large files if you find something get the info on where it is and what it is. Also do this, click start, control panel, administrative tools, event viewer, there you will see 3 options double click on them one at a time and see if you have any warnings if you see anything unusual just double click on that entry and it will open a box with info and what the code is. In the security especially look closely for signs of any one other than you logging into your system. While in control panel open user accounts and look to see if you see any new or additional user accounts listed in there. do you have a firewall on your pc? if not at the very least get the windows one turned on but I would advise going and getting one of the free ones, and setting it up, just in case someone has gained access to your system. work with that program xinorbis it will tell you exactly where the big files are that is what it is for so you can see exactly what is taking up that space. It will make pie charts and lists and tell you a lot of info. Another thing to check is how much space are you allowing system restore to use? you can adjust the amount you let it have. Start, control panel, double click system click the system restore tab then settings if the slider is all the way on max move it down a bit hit apply ok, that might show you have some space back check and see. And just in case you have not done this already on your browsers clear all the cache, temp internet files, cookies, history, offline content, every thing. If you need directions just tell us. Go to your trash bin and make sure it is completely empty. do you have any type of peer to peer sharing programs on your pc? like sharing music of videos? If so lock them down and/ or get rid of them. Have you installed itunes by any chance and loaded music? sometimes it can duplicate files. you can download a free program called belarc advisor which will scan your pc and give you a list of everything that is on your pc, but it also has a function that will tell you if your hard drive is healthy or if may be failing, that would be something worth checking. I am just wracking my brain for things that could be causing this. But I tell ya I would be thinking of trying a system restore point prior to that date that you said it pointed to and see what happens before you no longer have the option to go back there. As I said if it does not help you can just turn right back around and tell it to undo it. To be doubly sure have it create a restore point right before you do the go back. Do that before you make any changes to your system restore like moving the slider to use less space, would not want to lose the restore point you needed. I will keep thinking on it as I am sure others are too.