spambot,smitfraud,bluescreen,winlogon error

HI Mark, welcome


As you have completed the steps in the Read ME prep steps, you will have a set of logs? please attach those logs and the malware guys will be able to help you remove these malwares.

 

Hi Mark, we will also need the other three logs as in ShowNew Getrunkeys and Hijackthis.

 

Next time this happens exit the Managing Attachments window and try the below (assuming you are using IE as your browser)

1. Click Tools and select Internet Options
2. then on the General tab, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.
3. Now click Refresh
4. Now try uploading your attachments again.

If this still does not work tell us how large each file is!

 

The below are not typical default Policies. Did you set these policies yourself?

You must install HijackThis where we requested and you must rename it as requested. You have it installed exactly where we specify not to install it and you did not rename it. You must correct this now. You have it here:

C:\Documents and Settings\USER\Start Menu\Programs\analyse.exe\HijackThis.exe

It must be here:

C:\Program Files\HJT\analyse.exe

 

You still have HijackThis installed incorrectly. You have this:

C:\Program Files\analyse.exe\HijackThis.exe

You need to rename the analyse.exe folder to HJT

Then you need to rename the actual HijackThis.exe file to analyse.exe


When you are finished it should look like I previously told you:

C:\Program Files\HJT\analyse.exe

 

Once you get HJT installed and renamed properly, continue onto the below!


Uninstall the Sunbelt CounterSpy trial since we are finished with it now! Then delete the below two folders left behind by the uninstall:
C:\Documents and Settings\USER\Local Settings\Application Data\Sunbelt Software
C:\Program Files\Sunbelt Software

Uninstall the below old versions of software:
J2SE Runtime Environment 5.0 Update 6


Now download HOSTER and then follow the below steps.

• Unzip Hoster to a convenient folder such as C:\Hoster
• Run Hoster.exe, click Restore Microsoft's Hosts File and then click OK.
• Click the X to exit the program

Continue by downloading two tools we will need

• Process Explorer
• Pocket KillBox

Extract them to their own folders somewhere that you will be able to locate them later.

Make sure you have rebooted in Normal Mode (do not open any other processes)

Also make sure that one and only one Internet Explorer browser is opened up

- Run Process Explorer

In the top section of the Process Explorer screen double click on winlogon.exe to bring up the winlogon.exe properties screen. Click on the Threads tab at the top.

Once you see this screen click on each instance of instcat.dll once and then click the kill button. After you have killed all of the instcat.dll under winlogon click ok. (If you do not find the dll, just continue on.)

Next double click on explorer.exe and again click once on each instance of instcat.dll and kill it. (If you do not find the dll, just continue on.)

Next double click on iexplore.exe and again click once on each instance of instcat.dll and kill it. (If you do not find the dll, just continue on.)


Now just exit Process Explorer.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - Default URLSearchHook is missing
O1 - Hosts: localhost 127.0.0.1
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe/asinst.cab
O18 - Protocol: bw+0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {BF47CF26-9128-4E9D-A058-D251E10A24CB} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - Winlogon Notify: instcat - C:\WINDOWS\SYSTEM32\instcat.dll
O20 - Winlogon Notify: partnershipreg - C:\Documents and Settings\All Users\Documents\Settings\partnership.dll (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: COM+ Messages - C-Media Inc - (no file)

After clicking Fix, exit HJT.

Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Now run Pocket Killbox by doubleclicking on killbox.exe

• select File, Cleanup, Delete All Backups
• Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
• Then after it deletes the files click the Exit (Save Settings) button.

NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\WINDOWS\system32\CMMGR32.EXE
C:\WINDOWS\system32\vidaccess1253.exe
C:\WINDOWS\system32\instcat.dll
C:\WINDOWS\system32\13.tmp
C:\WINDOWS\system32\14.tmp
C:\WINDOWS\SYSTEM32\DGFLIB.DLL
C:\WINDOWS\system32\directprt.sys

• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.

If you receive a PendingFileRenameOperations prompt, just click OK to continue (But please let me know if you receive this message!).

If Killbox does not reboot just reboot your PC yourself.

After reboot locate the below folders and delete if found:
C:\Documents and Settings\USER\Application Data\AVG7
C:\Documents and Settings\All Users\Application Data\AVG7
C:\Program Files\Avg Anti Virus v7.0.143 Keymaker-Core (works)
C:\Program Files\Common Files\{84615596-0823-1033-0125-050117050001}

Now run Ccleaner!

Now attach the below new logs and tell me how the above steps went.

1. GetRunKey
2. ShowNew
3. HJT

Make sure you tell me how things are working now!

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

 

You have a new item that just showed up on Feb 1st it was not in your log before. It is this:
O4 - HKCU\..\Run: [Blah about] C:\DOCUME~1\USER\APPLIC~1\DVDENC~1\infoseeksite.exe

The below folder is where it really is located:

Code:

"C:\Documents and Settings\USER\Application Data\
DVDENC~1      Feb  1 2007              "Dvd Enc" 

Also I see this folder which is new:

Code:

"C:\Documents and Settings\All Users\Application Data\"
MEETWI~1      Feb  1 2007              "meetwindowlivefour"

What have you installed? You must make sure that while we are trying to fix your PC that you do not install anything new at all. Only do what we request. If the above are not things you knowingly installed then we will need to fix them by having HJT fix the O4 line and then you should delete the shown Dvd Enc and meetwindowlivefour folders.


You can have HJT fix the below left over that did not finish getting fix in the previous procedure.
O20 - Winlogon Notify: instcat - instcat.dll (file missing)


Also we have one more registry fix to do for another policy.

Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

 

You are not supposed to be able to get into the Windows firewall settings. You have McAfee firewall installed.

Let's see if the below addresses your error at shutdown. The below is taken from a Microsoft Knowledgebase article ( http://support.microsoft.com/kb/282599 ) I pasted in here the specifics you need to be concerned with.

Step 1:

1. Quit all Office programs.
2. Click Start, point to Settings, and then click Control Panel. NOTE: In Windows XP, click Start and then click Control Panel.
3. In Control Panel, double-click Add/Remove Programs.NOTE: In Windows XP, click Add or Remove Programs.
4. In the Currently installed programs list, click to select Microsoft Office XP product, where Office XP product is the name of the specific Office product being used. If you are using a standalone version of one of the Office programs, click to select the appropriate product in the list. Click Change.
5. In the Maintenance Mode Options dialog box, select Add or Remove Features, and then click Next. This displays the Choose installation options for all Office applications and tools dialog box.
6. Click the plus sign (+) next to Office Shared Features to expand it.
7. Click the icon next to Alternative User Input, and then select Not Available.
8. Click Update.

Step 2: Remove Alternative User Input Services from Text Services

1. Click Start, point to Settings, and then click Control Panel.
2. In the Control Panel, double-click Text Services.NOTE: In Windows XP, click Date, Time, Language, and Regional Options, and then click Regional and Language Options. On the Languages tab, click Details.
3. Under Installed Services, select each input item that is listed, and then click Remove to remove the item. All items must be removed, one by one, except the following input service:
   • English (United States)- default Keyboard United States 101

Step 3: Run Regsvr32 /U on the Msimtf.dll and Msctf.dll Files

1. Click Start and then click Run.
2. In the Run dialog box, type the following command: Regsvr32.exe /u msimtf.dll
3. Click OK.
4. Now Click Start and then click Run
5. In the Run dialog box, type the following command: Regsvr32.exe /u Msctf.dll
6. Click OK.

Now let me know if you still have that error message! Double check after trying to shutdown/reboot.

Attach a new HJT log.

 

Good news! And your log is okay! I just wanted to veryify that ctfmon.exe was no longer trying to load.

If you are not having any other malware problems, it is time to do our final steps:

1. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
2. If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
5. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
6. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
7. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
8. If you are running Windows XP or Windows ME, do the below:
   • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
9. After doing the above, you should work thru the below link:
   • How to Protect yourself from malware!

 

Not necessarily! It is too soon to know judge Vista. Also you are running VM Ware for multiple boot partitions I assume. I'm not sure if it is compatible. I'm sure that many people are going to like the new interface and easy of use offered by Vista; however, my attitude is that I will buy it only when I really need it. Also I will still keep most of my PCs running WinXP and Win2K since much of the software and hardware I have may not be supported under Vista.
.

It is all in the How to protect thread.

Actually as far as we are concerned, all of McAfee is more trouble than it is worth, and it slows down PCs too much. But if you like it and feel comfortable with it, stick with! As far as the Privacy Service is concerned, your best bet would be to enable it and see how you feel about it. I honestly don't have an opinion on it. If you have children and think this feature would be of use, by all means check it out. Perhaps reading the below would be of use to you:

http://familyinternet.about.com/cs/productreviews/gr/mcafeeprivacy.htm

On the last three PCs that I had with McAfee on it (shipped that way), I uninstalled it in less than a week because it slowed the PCs down tremendously, interfered with everyday operation of email, and was in general a waste of system resources since other free tools worked to provide the protection I needed and did not impact the system so harshly.

 

We do not recommend full security suite packages as they all are resource hogs. Some are worse than others. We actually recommend separate tools as given in the How to protect link I gave you. I would uninstall ALL of McAfee and install the below:

- AVG Antivirus
- ZoneAlarm firewall
- Spybot with SDhelper and use the Immunize feature as given in the READ ME
- SpywareBlaster and activate all protection
- SpywareTerminator for a free realtime spyware blocking tool!

With free tools you can try before you make up your mind to buy! If you don't like them, you can uninstall and try something else without cost to you. If you like them, you should buy them to get more features and support if needed.

 

You're welcome! If they told you the problems with the software, they would not make any money selling it too you.

 

Actually it should be asked in the Hardware Forum but here are two ideas.

Delete the drive from Device Manager and then reboot and let Windows try to reload the drivers automatically.

If that does not work or it cannot find the drivers, you may need to reinstall whatever software you installed for it previously or you may need to just allow Windows to find the drivers on the CD.

 

If you have the CD and if you can locate the folder/files you need from it on another PC, you could copy to a USB flashdrive or share drives on a network etc, to get them to the PC that needs them.