Thanks again. I misunderstood. I did remove everything. I thought you wanted to see that log. Do you think I should delete Spyware Guard (an earlier version), Spybot, Ad-Adaware Personal SE & SpywareBlaster? Someone installed them on my machine without asking when he worked on it. I have McAfee through AOL. I've heard it's not good to have 2 virus programs. Here's the log you want - Malwarebytes' Anti-Malware 1.33 Database version: 1665 Windows 5.1.2600 Service Pack 2 1/18/2009 12:32:01 PM mbam-log-2009-01-18 (12-32-01).txt Scan type: Full Scan (C:\:D:\:J:\:) Objects scanned: 139689 Time elapsed: 1 hour(s), 38 minute(s), 26 second(s) Memory Processes Infected: 1 Memory Modules Infected: 3 Registry Keys Infected: 5 Registry Values Infected: 3 Registry Data Items Infected: 0 Folders Infected: 4 Files Infected: 27 Memory Processes Infected: C:\Program Files\Spyware Guard 2008\spywareguard.exe (Rogue.SpywareGuard) -> Unloaded process successfully. Memory Modules Infected: C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\dpqmhychnu.dll (Trojan.FakeAlert) -> Delete on reboot. C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\ieModule.dll (Trojan.FakeAlert) -> Delete on reboot. C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\moduleie.dll (Trojan.FakeAlert) -> Delete on reboot. Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\spyware guard 2008 (Rogue.SpywareGuard) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Spyware Guard 2008 (Rogue.SpywareGuard) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\spyware guard (Rogue.SpywareGuard) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\(55937e13-0442-41ea-a026-2604ff356d05) (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\(88796e8d-2186-47d8-978f-af18aa0965f8) (Trojan.FakeAlert) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spywareguard (Rogue.SpywareGuard) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\internetconnection (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\iemodule (Trojan.FakeAlert) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: C:\Program Files\Antivirus 2009 (Rogue.Antivirus 2009) -> Delete on reboot. C:\Program Files\Spyware Guard 2008 (Rogue.SpywareGuard) -> Delete on reboot. C:\Program Files\Spyware Guard 2008\quarantine (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Start Menu\Programs\Spyware Guard 2008 (Rogue.SpywareGuard) -> Quarantined and deleted successfully. Files Infected: C:\Documents and Settings\All Users\Application Data\winlogon.exe (Rogue.Installer) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\Microsoft\Protect\svhost.exe (Rogue.Installer) -> Quarantined and deleted successfully. C:\System Volume Information\_restore(F845E3DB-F751-4BE4-A620-64F2CA1BFB5F)\RP470\A0112617.exe (Rogue.Installer) -> Quarantined and deleted successfully. C:\System Volume Information\_restore(F845E3DB-F751-4BE4-A620-64F2CA1BFB5F)\RP470\A0112618.exe (Rogue.Installer) -> Quarantined and deleted successfully. C:\Program Files\Antivirus 2009\av2009.exe (Rogue.Antivirus 2009) -> Quarantined and deleted successfully. C:\Program Files\Spyware Guard 2008\conf.cfg (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\Program Files\Spyware Guard 2008\mbase.vdb (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\Program Files\Spyware Guard 2008\quarantine.vdb (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\Program Files\Spyware Guard 2008\queue.vdb (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\Program Files\Spyware Guard 2008\spywareguard.exe (Rogue.SpywareGuard) -> Delete on reboot. C:\Program Files\Spyware Guard 2008\uninstall.exe (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\Program Files\Spyware Guard 2008\vbase.vdb (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Start Menu\Programs\Spyware Guard 2008\Spyware Guard 2008.lnk (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Start Menu\Programs\Spyware Guard 2008\Uninstall.lnk (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\Microsoft\Protect\svhost2.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\Microsoft\Protect\track.sys (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\sysexplorer.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\system32\winscenter.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\dpqmhychnu.dll (Trojan.FakeAlert) -> Delete on reboot. C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\ieModule.dll (Trojan.FakeAlert) -> Delete on reboot. C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\moduleie.dll (Trojan.FakeAlert) -> Delete on reboot. C:\WINDOWS\reged.exe (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\WINDOWS\spoolsystem.exe (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\WINDOWS\sys.com (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\WINDOWS\syscert.exe (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\WINDOWS\vmreg.dll (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Desktop\Spyware Guard 2008.lnk (Rogue.SpywareGuard) -> Quarantined and deleted successfully.

As reported at Wilders Security Forums by Javacool, the developer of Spyware Blaster and the other wonderful Javacool software programs, "sbautoupdate.exe" is a legitimate component of SpywareBlaster 4.1. AVG is detecting "sbautoupdate.exe" as a trojan. The legitimate sbautoupdate.exe file is digitally signed by "Javacool Software LLC", and has the following checksums: MD5: 5D0E5821EB35CDA9C320C1BDF1A4B695 SHA1: 62B09B3503C05A3CC853BB8BDFCC8292FD200E53 Although originally reported at C:Net that the detection of "C:\Program Files\SpywareBlaster\sbautoupdate.exe" as a trojan was correct, Javacool recently indicated at Wilders that AVG has informed them that a fix will be pushed out for the false-positive detection in a new virus database update. Be sure to keep checking AVG for new updates. Visit Javacool Software to learn more about Spyware Blaster and EULAlyzer. this is from Corrine's site. here is the direct link. Here is a link that might be useful: security garden

see you got it sorted out, yes quarantine is a good choice when offered that locks it down so that it can not run on the computer. system restore does keep a back up of all of your settings and stuff so sometimes we will find that if you had an infection then cleaned it, a later scan will see that infection still listed in your system restore folder, system restore points do drop off in time so it will eventually drop out as newer restore points take over the space, if you had to restore to a point in time that did show that infection then it would be back in your system, being in system restore does not pose a threat till you would have to use it. Doing what you did and clearing the restore points is a good way to get rid of those, however that leaves you with no restore points in case of an emergency, so since you have done that it would be a good idea to go ahead and create a few restore points now with the pc running good and with the infection gone so that should you need them you have them. We never have anyone clear restore points till we are absolutely certain things are working properly because any restore point even an infected one is better than zero. So please be cautious when telling someone to clear their restore points that could be disastrous in some cases it is the absolute last step you want to take after everything is cleared. And since they do drop off in time we do not always have them clear them in some cases. this guide tells how to use system restore including how to create new restore points. System Restore

wait a minute you got a warning on your screen? it could well be you just happened upon a website that was one of the ones infected with antivirus xp. It pops up warnings saying you have a ton of infections on your pc and shows all these warnings which are actually just pictures not real scans of your pc. One way most realize that this is a fake is when you happen to visit those pages on a Mac or Linux machine, because it starts saying what is infected and Linux does not have any of those type files nor do Macs. I would definitely suspect that, but just what exactly showed up on your screen? what gave the warning? what did it say was infected? more info is definitely needed. I have purposely gone to some of the malicious antivirus xp sites on my linux machine and it starts popping up those warnings on my pc too but it is so obvious it is just a bunch of fake pics because it is showing windows file systems and well linux does not have em! Here is an excellent article about the dreaded antivirus xp The evil genius of XP Antivirus 2008 Not to say there are no mac malware and viruses there are indeed and I was just reading about some new ones last week. In fact Apple is suggesting AV for Mac OS Mac OS: Antivirus utilities