Thanks again. I misunderstood. I did remove everything. I thought you wanted to see that log. Do you think I should delete Spyware Guard (an earlier version), Spybot, Ad-Adaware Personal SE & SpywareBlaster? Someone installed them on my machine without asking when he worked on it. I have McAfee through AOL. I've heard it's not good to have 2 virus programs. Here's the log you want - Malwarebytes' Anti-Malware 1.33 Database version: 1665 Windows 5.1.2600 Service Pack 2 1/18/2009 12:32:01 PM mbam-log-2009-01-18 (12-32-01).txt Scan type: Full Scan (C:\:D:\:J:\:) Objects scanned: 139689 Time elapsed: 1 hour(s), 38 minute(s), 26 second(s) Memory Processes Infected: 1 Memory Modules Infected: 3 Registry Keys Infected: 5 Registry Values Infected: 3 Registry Data Items Infected: 0 Folders Infected: 4 Files Infected: 27 Memory Processes Infected: C:\Program Files\Spyware Guard 2008\spywareguard.exe (Rogue.SpywareGuard) -> Unloaded process successfully. Memory Modules Infected: C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\dpqmhychnu.dll (Trojan.FakeAlert) -> Delete on reboot. C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\ieModule.dll (Trojan.FakeAlert) -> Delete on reboot. C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\moduleie.dll (Trojan.FakeAlert) -> Delete on reboot. Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\spyware guard 2008 (Rogue.SpywareGuard) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Spyware Guard 2008 (Rogue.SpywareGuard) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\spyware guard (Rogue.SpywareGuard) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\(55937e13-0442-41ea-a026-2604ff356d05) (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\(88796e8d-2186-47d8-978f-af18aa0965f8) (Trojan.FakeAlert) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spywareguard (Rogue.SpywareGuard) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\internetconnection (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\iemodule (Trojan.FakeAlert) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: C:\Program Files\Antivirus 2009 (Rogue.Antivirus 2009) -> Delete on reboot. C:\Program Files\Spyware Guard 2008 (Rogue.SpywareGuard) -> Delete on reboot. C:\Program Files\Spyware Guard 2008\quarantine (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Start Menu\Programs\Spyware Guard 2008 (Rogue.SpywareGuard) -> Quarantined and deleted successfully. Files Infected: C:\Documents and Settings\All Users\Application Data\winlogon.exe (Rogue.Installer) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\Microsoft\Protect\svhost.exe (Rogue.Installer) -> Quarantined and deleted successfully. C:\System Volume Information\_restore(F845E3DB-F751-4BE4-A620-64F2CA1BFB5F)\RP470\A0112617.exe (Rogue.Installer) -> Quarantined and deleted successfully. C:\System Volume Information\_restore(F845E3DB-F751-4BE4-A620-64F2CA1BFB5F)\RP470\A0112618.exe (Rogue.Installer) -> Quarantined and deleted successfully. C:\Program Files\Antivirus 2009\av2009.exe (Rogue.Antivirus 2009) -> Quarantined and deleted successfully. C:\Program Files\Spyware Guard 2008\conf.cfg (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\Program Files\Spyware Guard 2008\mbase.vdb (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\Program Files\Spyware Guard 2008\quarantine.vdb (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\Program Files\Spyware Guard 2008\queue.vdb (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\Program Files\Spyware Guard 2008\spywareguard.exe (Rogue.SpywareGuard) -> Delete on reboot. C:\Program Files\Spyware Guard 2008\uninstall.exe (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\Program Files\Spyware Guard 2008\vbase.vdb (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Start Menu\Programs\Spyware Guard 2008\Spyware Guard 2008.lnk (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Start Menu\Programs\Spyware Guard 2008\Uninstall.lnk (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\Microsoft\Protect\svhost2.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\Microsoft\Protect\track.sys (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\sysexplorer.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\system32\winscenter.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\dpqmhychnu.dll (Trojan.FakeAlert) -> Delete on reboot. C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\ieModule.dll (Trojan.FakeAlert) -> Delete on reboot. C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\moduleie.dll (Trojan.FakeAlert) -> Delete on reboot. C:\WINDOWS\reged.exe (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\WINDOWS\spoolsystem.exe (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\WINDOWS\sys.com (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\WINDOWS\syscert.exe (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\WINDOWS\vmreg.dll (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Desktop\Spyware Guard 2008.lnk (Rogue.SpywareGuard) -> Quarantined and deleted successfully.

Duh...Wasn't thinking at all....32 bit system! When I went to the link, my first thought was, should I even attempt this? Anyway, back to the link.

http://www.superantispyware.com/index.html Definitely have him install and use Superantispyware it is in my opinion the best of the free antispyware scanners. But it really sounds to me like his email has been taken over if not his entire pc. He should discontinue use of that email address for anything personal or sensitive. Plus consider that anything that he did have in there is now up for grabs. If I were him I would close that email account, let his ISP know about it, and set up a new one with a very secure password, which is NOT a real word but a combination of letters and symbols. NEVER make a password out of a real word they can be cracked in seconds. To see if his pc has been taken over and is now a part of a zombie bot owned by some hacker I would highly suggest he go to one of the Pro Tech Help forums and let them tell him exactly what to install and how to check. They are excellent at this kind of thing. These are some of them. http://www.dslreports.com/forum/cleanup http://www.castlecops.com/ http://www.temerc.com/forums/ http://forums.whatthetech.com/forums.html Visiting some of those forums and telling them in detail what is happening they will be able to guide him on what to do.

I read this forum quite regularly, but rarely post here...But sometimes.... I just gotta say it..... You people are nuts...... I am quite used to people telling me I am nuts and have no idea what I am talking about when it comes to such matters, BUT since I am never, make that NEVER the one who has neither virus/malware issues and problems and NEVER have spent even a dime nor any time on such matters, the reality of the situation is that I and the few other Linux users here are really the only ones who have any idea what they are talking about when it comes to PC Operating Systems and PC "security".... A whole forum of "what should I get","what's wrong" "I bought/installed and/but" "what should I do". Soon many reading this will be thinking "Oh he's just one of those Linux nutscases" But, ask yourself, does he "Buy this", "get this", "do this"......Oh yeah, and then ask yourself if your system can match mine on safety, security, performance. I have yet to have either of these boxes contract a virus or a worm or a root-kit nor any other form of malware, not bad for systems running zero AV/security software..... I very rarely ever disconnect from the W3 and rarely ever even turn either of these things off. I have 4 browsers running right now and my email account has been open for days. Other than an outgoing firewall, I am currently running absolutely zero "security" software of any kind. And no reformatting, no scans, no defrags, no registry anythings. I watch videos, play music, redo photo's, make phone calls and do all sorts of other sometimes fun stuff with neither and never a worry nor a care. And my total investment in Operating Systems and software on both boxes equals zero dollars and zero cents. And all my upgrades/dates are free too..... Do yourselves a big favor and go to distrowatch.com, read about the different flavors of Linux and pick yourself out a few LiveCD versions to trial. Or you can always just wait for MSWin7 to be released and start buying all sorts of new software to go along with your already penetrated and compromised, outdated and obsolete brand new high dollar Operating System. Some of the new Linus distro's are so simple to install and use that my best friends 59 y.o.wife has installed several different versions on the same hard-drive and has figured out how to use them all with little more than dang near no assistance from any body. She has even figured out how to use Knoppix6 full time and save everything she does/wants to a persistant image. Oh yeah, she is really good at kids and cooking and sewing and fishing and growing things and all sorts of DIY stuff, but, when it comes to computers, she has the techno-savvy and training of your average box of rocks..... Dang folks....even my daughter, whose "technotude" is somewhat close to absolutely zero has installed and has everything running and learned the ins and outs of both SimplyMepis and VectorLinux on her PC all by her little ol' self. And while her friends are having regular issues after frequenting such mandatory malware magnet sites as YouTube, and MySpace she has nothing of the sort, ever.... But, if you wanna believe that you must MUST have MSWin-something, feel free to spend way too much for way too little, and want to keep spending and installing/scanning/removing/etc for no other reason than you insist on running something as shaky and insecure as Vista1, hurry up and buy the fix for Vista1, Vista2, otherwise known as MSWin7, that's certainly your right.... Well, let's see...I may have exaggerated things a bit by stating the "free" thing........Getting Linux will cost you somewhere around $.125 for a blank CD-R, or the current cost of a blank DVD-R.... HAGD Here is a link that might be useful: better than MSWindows, IMHO it is anyway