Good idea owbist! salbwil, Here are instructions for Hijackthis, Click Here to download HJTInstall.exe Save HJTInstall.exe to your desktop. Doubleclick on the HJTInstall.exe icon on your desktop. Right click the Hijackthis Icon and Run as Adminstrator if you use Vista or Windows 7 By default it will install to C:\Program Files\Trend Click on Install. It will create a HijackThis icon on the desktop. Once installed, it will launch Hijackthis. Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad. Click on "Edit > Select All" then click on "Edit > Copy" and Paste the entire contents of the log into your next post. DO NOT use the AnalyzeThis button, its findings are dangerous if misinterpreted. DO NOT have Hijackthis fix anything yet. Most of what HJT lists will be harmless or even required by your Operating System.

# AdwCleaner v2.115 - Logfile created 03/28/2013 at 21:45:52 # Updated 17/03/2013 by Xplode # Operating system : Windows Vista (TM) Business Service Pack 2 (32 bits) # User : Judy - JUDY-PC # Boot Mode : Normal # Running from : C:\Users\Judy\Desktop\adwcleaner.exe # Option [Delete] ***** [Services] ***** Stopped & Deleted : CltMngSvc ***** [Files / Folders] ***** Deleted on reboot : C:\Users\Judy\AppData\Local\Google\Chrome\User Data\Default\Extensions\jndeiekmdhemaggmkgljlpdeaomeplbp File Deleted : \END File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\SearchResults.xml File Deleted : C:\user.js File Deleted : C:\Users\Judy\AppData\Roaming\Mozilla\Firefox\Profiles\g264jafr.default\searchplugins\Askcom.xml File Deleted : C:\Users\Judy\AppData\Roaming\Mozilla\Firefox\Profiles\g264jafr.default\searchplugins\BrowserProtect.xml File Deleted : C:\Users\Judy\AppData\Roaming\Mozilla\Firefox\Profiles\g264jafr.default\searchplugins\delta.xml File Deleted : C:\Users\Judy\AppData\Roaming\Mozilla\Firefox\Profiles\g264jafr.default\searchplugins\SearchResults.xml Folder Deleted : C:\Program Files\Conduit Folder Deleted : C:\Program Files\hdvidcodec.com Folder Deleted : C:\Program Files\Movie2KDownloader.com Folder Deleted : C:\Program Files\Qwiklinx Folder Deleted : C:\Program Files\SearchProtect Folder Deleted : C:\Program Files\Windows Searchqu Toolbar Folder Deleted : C:\ProgramData\~0 Folder Deleted : C:\ProgramData\Babylon Folder Deleted : C:\ProgramData\blekko toolbars Folder Deleted : C:\ProgramData\boost_interprocess Folder Deleted : C:\ProgramData\Tarma Installer Folder Deleted : C:\ProgramData\WeCareReminder Folder Deleted : C:\Users\Judy\AppData\Local\Conduit Folder Deleted : C:\Users\Judy\AppData\Local\Google\Chrome\User Data\Default\Extensions\blaofbhgbmeikidhlkmjhbkbfohpgekf Folder Deleted : C:\Users\Judy\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnfaglepmjgohnkcoieaijlheabmcdeo Folder Deleted : C:\Users\Judy\AppData\Local\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde Folder Deleted : C:\Users\Judy\AppData\Local\Google\Chrome\User Data\Default\Extensions\jndeiekmdhemaggmkgljlpdeaomeplbp Folder Deleted : C:\Users\Judy\AppData\Local\Google\Chrome\User Data\Default\Extensions\niapdbllcanepiiimjjndipklodoedlc Folder Deleted : C:\Users\Judy\AppData\Local\PackageAware Folder Deleted : C:\Users\Judy\AppData\Local\Temp\CT3281348 Folder Deleted : C:\Users\Judy\AppData\LocalLow\AskToolbar Folder Deleted : C:\Users\Judy\AppData\LocalLow\Conduit Folder Deleted : C:\Users\Judy\AppData\LocalLow\Delta Folder Deleted : C:\Users\Judy\AppData\Roaming\Babylon Folder Deleted : C:\Users\Judy\AppData\Roaming\Mozilla\Firefox\Profiles\g264jafr.default\Conduit Folder Deleted : C:\Users\Judy\AppData\Roaming\Mozilla\Firefox\Profiles\g264jafr.default\ConduitCommon Folder Deleted : C:\Users\Judy\AppData\Roaming\Mozilla\Firefox\Profiles\g264jafr.default\ConduitEngine Folder Deleted : C:\Users\Judy\AppData\Roaming\Mozilla\Firefox\Profiles\g264jafr.default\CT3281348 Folder Deleted : C:\Users\Judy\AppData\Roaming\Mozilla\Firefox\Profiles\g264jafr.default\extensions\(6921B3CC-9935-4D28-9A83-B3D824210580) Folder Deleted : C:\Users\Judy\AppData\Roaming\Mozilla\Firefox\Profiles\g264jafr.default\extensions\(94193c2f-e73f-4feb-b393-2b95f0a01430) Folder Deleted : C:\Users\Judy\AppData\Roaming\Mozilla\Firefox\Profiles\g264jafr.default\extensions\staged Folder Deleted : C:\Users\Judy\AppData\Roaming\Mozilla\Firefox\Profiles\g264jafr.default\extensions\wecarereminder@bryan Folder Deleted : C:\Users\Judy\AppData\Roaming\Mozilla\Firefox\Profiles\g264jafr.default\jetpack Folder Deleted : C:\Users\Judy\AppData\Roaming\Mozilla\Firefox\Profiles\g264jafr.default\Smartbar Folder Deleted : C:\Users\Judy\AppData\Roaming\OpenCandy Folder Deleted : C:\Users\Judy\AppData\Roaming\Qwiklinx Folder Deleted : C:\Users\Judy\AppData\Roaming\SearchProtect Folder Deleted : C:\Users\Judy\Desktop\Programs\hdvidcodec.com ***** [Registry] ***** Key Deleted : HKCU\Software\1ClickDownload Key Deleted : HKCU\Software\5d538a8bb46eec10 Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar Key Deleted : HKCU\Software\AppDataLow\Software\xfin_portal Key Deleted : HKCU\Software\BabylonToolbar Key Deleted : HKCU\Software\Conduit Key Deleted : HKCU\Software\DataMngr Key Deleted : HKCU\Software\DataMngr_Toolbar Key Deleted : HKCU\Software\delta LTD Key Deleted : HKCU\Software\Google\Chrome\Extensions\jndeiekmdhemaggmkgljlpdeaomeplbp Key Deleted : HKCU\Software\Headlight Key Deleted : HKCU\Software\InstallCore Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\(0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9) Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\(9BB47C17-9C68-4BB3-B188-DD9AF0FD2102) Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\(15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693) Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\(2E497885-E60B-420A-832D-0148B392E058)_is1 Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\1ClickDownload Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SearchProtect Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\xfin_portal Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\(82E1477C-B154-48D3-9891-33D83C26BCD3) Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\(C1AF5FA5-852C-4C90-812E-A7F75E011D87) Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\(D824F0DE-3D60-4F57-9EB1-66033ECD8ABB) Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\(FD72061E-9FDE-484D-A58A-0BAB4151CAD8) Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\(82E1477C-B154-48D3-9891-33D83C26BCD3) Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\(9D425283-D487-4337-BAB6-AB8354A81457) Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\(C1AF5FA5-852C-4C90-812E-A7F75E011D87) Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\(D824F0DE-3D60-4F57-9EB1-66033ECD8ABB) Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\(DF7770F7-832F-4BDF-B144-100EDDD0C3AE) Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\(FD72061E-9FDE-484D-A58A-0BAB4151CAD8) Key Deleted : HKCU\Software\Qwiklinx Key Deleted : HKCU\Software\SearchCore for Browsers Key Deleted : HKCU\Software\SearchProtect Key Deleted : HKCU\Software\wecarereminder Key Deleted : HKCU\Software\Zugo Key Deleted : HKLM\SOFTWARE\5d538a8bb46eec10 Key Deleted : HKLM\Software\Babylon Key Deleted : HKLM\SOFTWARE\Classes\AppID\(49BC4DD1-0E69-4611-9164-0009538C5E46) Key Deleted : HKLM\SOFTWARE\Classes\AppID\(4FBBF769-ECEB-420A-B536-133B1D505C36) Key Deleted : HKLM\SOFTWARE\Classes\AppID\(608D3067-77E8-463D-9084-908966806826) Key Deleted : HKLM\SOFTWARE\Classes\AppID\(BDB69379-802F-4EAF-B541-F8DE92DD98DB) Key Deleted : HKLM\SOFTWARE\Classes\AppID\(C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3) Key Deleted : HKLM\SOFTWARE\Classes\AppID\IEHelperv2.5.0.DLL Key Deleted : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr Key Deleted : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1 Key Deleted : HKLM\SOFTWARE\Classes\CLSID\(0214A12B-C5A3-437F-A6F3-068ABCD8C85E) Key Deleted : HKLM\SOFTWARE\Classes\CLSID\(08635077-8829-49E2-B338-C968817EB460) Key Deleted : HKLM\SOFTWARE\Classes\CLSID\(20A3F109-F7C1-47B4-8098-8E654B264B1D) Key Deleted : HKLM\SOFTWARE\Classes\CLSID\(2EECD738-5844-4A99-B4B6-146BF802613B) Key Deleted : HKLM\SOFTWARE\Classes\CLSID\(3C471948-F874-49F5-B338-4F214A2EE0B1) Key Deleted : HKLM\SOFTWARE\Classes\CLSID\(4B9BCCE8-A70B-402A-A7E1-DB96831EE26F) Key Deleted : HKLM\SOFTWARE\Classes\CLSID\(80922EE0-8A76-46AE-95D5-BD3C3FE0708D) Key Deleted : HKLM\SOFTWARE\Classes\CLSID\(8C7478AB-3155-463E-936F-55F91F0F10D0) Key Deleted : HKLM\SOFTWARE\Classes\CLSID\(96DD9437-5D20-4EFB-BF52-A4A605A4E0AA) Key Deleted : HKLM\SOFTWARE\Classes\CLSID\(D824F0DE-3D60-4F57-9EB1-66033ECD8ABB) Key Deleted : HKLM\SOFTWARE\Classes\CLSID\(E46C8196-B634-44A1-AF6E-957C64278AB1) Key Deleted : HKLM\SOFTWARE\Classes\CLSID\(F773BB94-6C19-4643-A570-0E429103D1C3) Key Deleted : HKLM\SOFTWARE\Classes\IEHelperv250.WeCareReminder Key Deleted : HKLM\SOFTWARE\Classes\IEHelperv250.WeCareReminder.1 Key Deleted : HKLM\SOFTWARE\Classes\Interface\(96DD9437-5D20-4EFB-BF52-A4A605A4E0AA) Key Deleted : HKLM\SOFTWARE\Classes\Interface\(E2C1A522-B8E1-45D1-B316-F5625004A28C) Key Deleted : HKLM\SOFTWARE\Classes\Interface\(F773BB94-6C19-4643-A570-0E429103D1C3) Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap Key Deleted : HKLM\SOFTWARE\Classes\QwiklinxBHO Key Deleted : HKLM\SOFTWARE\Classes\QwiklinxBHO.1 Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3281348 Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\(204C0025-C26A-43E2-853C-D8A8EB1BCE51) Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\(B12920CF-BE13-4C09-890D-1B6EFFFE2FBE) Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\Software\DataMngr

Here's the new log. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:08:10 PM, on 4/7/2010 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\stsystra.exe C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\Alwil Software\Avast5\AvastSvc.exe C:\Program Files\Alwil Software\Avast5\avastUI.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\YCPlus\YANKCLIP.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://login.passport.net/uilogin.srf?lc=1033&id=2 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.shreve.net O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - "3CA2F312-6F6E-4B53-A66E-4E65E497C8C0> - (no file) O2 - BHO: DriveLetterAccess - "5CA3D70E-1895-11CF-8E15-001234567890> - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - "DBC80044-A445-435b-BC74-9C25C1C588A9> - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - "E7E6F031-17CE-4C07-BC86-EABFE594F69C> - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE O9 - Extra button: Messenger - "FB5F1910-F110-11d2-BB9E-00C04F795683> - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - "FB5F1910-F110-11d2-BB9E-00C04F795683> - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: linkscanner - "F274614C-63F8-47D5-A4D1-FBDDE494F8D1> - (no file) O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Inkjet Printer/Scanner Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Outpost Firewall Service (OutpostFirewall) - Unknown owner - E:\Program Files\Agnitum\Outpost Firewall 1.0\outpost.exe (file missing) O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 4810 bytes

Do Ctrl-Alt-Del to bring up your Task Manager, click on the Processes tab, and click once or twice on the CPU tab at the top of the listings: this will show what process is chewing up the most resources (which will probably be the culprit). Also, look at the CPU Usage line at the bottom of Task Manager and see what the % Usage is. Then report back here on what you found out.