I should mention that I just took AOL off my computer after 8 years. I understand AOL leaves bits of itself all over as well. When I followed your instructions I ran into a snag but tried to continue on. Hopefully Norton is gone. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 4:17:56 PM, on 4/8/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\brsvc01a.exe C:\WINDOWS\system32\brss01a.exe C:\WINDOWS\system32\spoolsv.exe c:\windows\explorer.exe C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Microsoft Windows OneCare Live\OcHealthMon.exe C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe C:\Program Files\Microsoft Windows OneCare Live\winss.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr6/*http://www.yahoo.com/ext/search/search.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Comcast R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local F2 - REG:system.ini: Shell=c:\windows\explorer.exe F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe O2 - BHO: (no name) - "02478D38-C3F9-4efb-9B51-7695ECA05670> - (no file) O2 - BHO: Adobe PDF Reader Link Helper - "06849E9F-C8D7-4D59-B87D-784B7D6BE0B3> - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - "3CA2F312-6F6E-4B53-A66E-4E65E497C8C0> - C:\Program Files\AVG\AVG8\avgssie.dll (file missing) O2 - BHO: Spybot-S&D IE Protection - "53707962-6F74-2D53-2644-206D7942484F> - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Google Toolbar Helper - "AA58ED58-01DD-4d91-8333-CF10577473F7> - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - "AF69DE43-7D58-4638-B6FA-CE66B5AD205D> - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - "DBC80044-A445-435b-BC74-9C25C1C588A9> - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - "E7E6F031-17CE-4C07-BC86-EABFE594F69C> - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: &Google - "2318C2B1-4965-11d4-9B18-009027A5CD4F> - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [EPSON Stylus Photo R220 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE /P30 "EPSON Stylus Photo R220 Series" /O6 "USB001" /M "Stylus Photo R220" O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-18\..\Run: [Symantec Network Driver Update Warning] C:\PROGRA~1\Symantec\LIVEUP~1\SNDWarn.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [SRUUninstall] "C:\WINDOWS\System32\msiexec.exe" /x "6AF90EF6-F7F9-466C-99F4-1774826FBB40> /qn REBOOT=ReallySuppress (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Symantec Network Driver Update Warning] C:\PROGRA~1\Symantec\LIVEUP~1\SNDWarn.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [SRUUninstall] "C:\WINDOWS\System32\msiexec.exe" /x "6AF90EF6-F7F9-466C-99F4-1774826FBB40> /qn REBOOT=ReallySuppress (User 'Default user') O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Run WinHTTrack - "36ECAF82-3300-8F84-092E-AFF36D6C7040> - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll O9 - Extra 'Tools' menuitem: Launch WinHTTrack - "36ECAF82-3300-8F84-092E-AFF36D6C7040> - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll O9 - Extra button: ComcastHSI - "669B269B-0D4E-41FB-A3D8-FD67CA94F646> - http://www.comcast.net/ (file missing) O9 - Extra button: Support - "8828075D-D097-4055-AA02-2DBFA9D85E8A> - http://www.comcastsupport.com/ (file missing) O9 - Extra button: Research - "92780B25-18CC-41C8-B9BE-3C9C571A8263> - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Help - "97809617-3937-4F84-B335-9BB05EF1A8D4> - http://online.comcast.net/help/ (file missing) O9 - Extra button: Real.com - "CD67F990-D8E9-11d2-98FE-00C0F0318AFE> - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: (no name) - "DFB852A3-47F8-48C4-A200-58CAB36FD2A2> - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - "DFB852A3-47F8-48C4-A200-58CAB36FD2A2> - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - "FB5F1910-F110-11d2-BB9E-00C04F795683> - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - "FB5F1910-F110-11d2-BB9E-00C04F795683> - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Ebates - "6685509E-B47B-4f47-8E16-9A5F3A62F683> - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU) O16 - DPF: "01118400-3E00-11D2-8470-0060089874ED> (SdcNetCheckCtl Class) - http://activex.microsoft.com/objects/ocget.dll O16 - DPF: "17492023-C23A-453E-A040-C7C580BBF700> (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: "2253F320-AB68-4A07-917D-4F12D8884A06> (ChainCast VMR Client Proxy) - http://www.streamaudio.com/download/ccpm_0237.cab O16 - DPF: "231B1C6E-F934-42A2-92B6-C2FEFEC24276> (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll O16 - DPF: "6F750200-1362-4815-A476-88533DE61D0C> (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab O16 - DPF: "88D969C0-F192-11D4-A65F-0040963251E5> (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab O16 - DPF: "AD5AE604-34F2-4C7C-AEBB-14D424294A76> - http://www.interoagent.com/SyncInstaller/ReportGenerator/ReportGenerator.cab O16 - DPF: "B9191F79-5613-4C76-AA2A-398534BB8999> - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/autocomplete.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe O23 - Service: CarboniteService - Carbonite, Inc. (www.carbonite.com) - C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Documents and Settings\Ginny\My Documents\Jen\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Pml Driver HPZ12 - Unknown owner - C:\WINDOWS\system32\HPZipm12.exe (file missing) O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe -- End of file - 9201 bytes

Hi zep516, How did you know beanwabr was infected with Palladium Pro? I could not find out any info about this from beanwabr. You said my link leaded to a possible infected web site? I can tell you that this site (teesupport.com) is safe. I know this because this site keeps posting blogs (http://blog.teesupport.com/) for virus removal and legit applications uninstall instructions each day. Teesupport starts its blogs for over one year and some of blogs are even listed on the top search on Google. I do not think Google will allow sites that will damage your computer to exist for such a long time. I have also tested this site using online anti-virus scanners from various security vendors and all test show that it is a safe site. What is more, as far as I know, TeeSupport is an online company to provide remote tech support and they receive payment via PayPal or Safe Cart. Will a virus maker dare to receive payment via PayPal or Safe Cart? Talking about spam..There is a very interesting thing. See two latest posts from two different sites here: http://www.bleepingcomputer.com/virus-removal/remove-master-utilities http://www.citruscomputers.com/2011/09/01/remove-master-utilities-uninstall-guide/ "Your computer should now be free of the Master Utilities program. If your current anti-virus solution let this infection through, you may want to consider purchasing the PRO version of Malwarebytes' Anti-Malware to protect against these types of threats in the future." -- This is the bleeping computer site that you won't doubt. I know bleeping computer site very well and I like it so much as you guys and I just want to list an example here to support my opinion. So far, I don't think there is any pure site without promoting anything. My principal is to choose info that I need and ignore the unwanted info on the internet. If a site does not force you to buy anything in an illegal way like rogue software and it can provide you some useful info, then that is not a bad site. By the way, I admit that sometimes I will buy things from the internet because of those sites' promotion but I don't think it is bad because they provide useful things to me and I think they deserve my payment for hard work of making such useful things. Enjoy the internet! Regards, Alan_hoicns

Here's the issue with firefox, FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=109936&tt=100512_2_ FF - user.js: extensions.BabylonToolbar_i.babExt - FF - user.js: extensions.BabylonToolbar_i.srcExt - ss FF - user.js: extensions.BabylonToolbar_i.id - b8457168000000000000bc7737387210 FF - user.js: extensions.BabylonToolbar_i.hardId - b8457168000000000000bc7737387210 FF - user.js: extensions.BabylonToolbar_i.instlDay - 15473 FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1715:35:37 FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar_i.aflt - babsst FF - user.js: extensions.BabylonToolbar_i.smplGrp - none FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9 FF - user.js: extensions.BabylonToolbar_i.instlRef - sst FF - user.js: network.protocol-handler.warn-external.dnupdate - false FF - user.js: browser.sessionstore.resume_from_crash - false We will be getting rid of that, by running the tools above.

Looked in Control Panel at Internet Options, Connections tab. Usually DSL and regular networking would have absolutely nothing checked in that window or in the Lan Settings window. Look in Internet Explorer for the same settings.. should match control panel with absolutely nothing checked. Look in your other browsers too... Firefox options its the last tab, Advanced, then Network, internet Settings button ... make sure its checked 'No Proxy' Control Panel, Network & Sharing Center.. on left, Change Adapter Settinngs, then right click and select Properties... See anything in there that may be a proxy program ?