[lauraocal]

I'll start with AdAwear SE Personal 1.06 I'm running.
When I set it to run a full system scan it goes so far then stops just freezes on a file and after running Adawear several times it continues to freeze on the same file.
I have 2 partitions on my pc, c:\ (this one i use)& d:\.(i dont log onto this or use it) Each has a sparate version of windows installed. Its when it starts to scan "d:\program files\internet explorer" that the freeze happens.
My pc is very very slow. my mouse pointer moves very slowly and when i open up my computer and folder explorer it becomes even slower.
I'm suddenly, after having the same email for 3 years approx, getting loads of spam mail, mostly from hotmail.co.uk and hotmail.com users.
here is my hjt log

Logfile of HijackThis v1.99.1
Scan saved at 20:28:32, on 12/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\AOL\1170959009\ee\AOLSoftware.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\VoyagerTest\fts.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AOL 9.0a\aoltray.exe
c:\program files\common files\aol\1170959009\ee\services\antiSpywareApp\ver2_0_12\AOLSP Scheduler.exe
c:\program files\common files\aol\1170959009\ee\aolsoftware.exe
C:\Program Files\AOL 9.0a\waol.exe
C:\Program Files\AOL 9.0a\shellmon.exe
C:\Program Files\Common Files\AOL\aoltpspd.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\hijackthis\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1170959009\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0a\aoltray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI3369~1\Office12\EXCEL.EXE/3000
O17 - HKLM\System\CCS\Services\Tcpip\..\{E58EFF56-5732-4F6C-AC8E-C25CB7B403D7}: NameServer = 205.188.146.145
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

[lauraocal]

I'll start with AdAwear SE Personal 1.06 I'm running.
When I set it to run a full system scan it goes so far then stops just freezes on a file and after running Adawear several times it continues to freeze on the same file.
I have 2 partitions on my pc, c:\ (this one i use)& d:\.(i dont log onto this or use it) Each has a sparate version of windows installed. Its when it starts to scan "d:\program files\internet explorer" that the freeze happens.
My pc is very very slow. my mouse pointer moves very slowly and when i open up my computer and folder explorer it becomes even slower.
I'm suddenly, after having the same email for 3 years approx, getting loads of spam mail, mostly from hotmail.co.uk and hotmail.com users.
my spyware program, aol, has found the following "items" during a scan:
Softomate, alexia, and numerous tracking cookies.
When i look in my partners sons user files in local settings\temp internet files i get the blue screen of death.
i have since deleted everything inside. I have had a service running in taskman called KB885295.exe which i know was an update that was installed but i didnt realise they would run weeks after installation.

here is my hjt log

Logfile of HijackThis v1.99.1
Scan saved at 20:28:32, on 12/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\AOL\1170959009\ee\AOLSoftware.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\VoyagerTest\fts.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AOL 9.0a\aoltray.exe
c:\program files\common files\aol\1170959009\ee\services\antiSpywareApp\ver2_0_12\AOLSP Scheduler.exe
c:\program files\common files\aol\1170959009\ee\aolsoftware.exe
C:\Program Files\AOL 9.0a\waol.exe
C:\Program Files\AOL 9.0a\shellmon.exe
C:\Program Files\Common Files\AOL\aoltpspd.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\hijackthis\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1170959009\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0a\aoltray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI3369~1\Office12\EXCEL.EXE/3000
O17 - HKLM\System\CCS\Services\Tcpip\..\{E58EFF56-5732-4F6C-AC8E-C25CB7B403D7}: NameServer = 205.188.146.145
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

[SWI Support Robot]

Welcome to SWI. We apologize for the delay; our helpers have been very busy.
If you have not received help after 3 days, please CLICK HERE, and post a link to your log and the date it was originally posted.

Thank you for your patience.

[this is an automated reply]

[SWI Support Robot]

Welcome to SWI. We apologize for the delay; our helpers have been very busy.
If you have not received help after 3 days, please CLICK HERE, and post a link to your log and the date it was originally posted.

Thank you for your patience.

[this is an automated reply]

[waterfalls]

Hi -

Your log is not showing anything unusual. However, the file you mentioned, KB885295.exe, seems strange.

Since the file should be deleted when you follow the directions below, before you begin, kindly upload the file to Jotti's Online Virus Scan
- Click the link above to Jotti's Online Virus Scan
- Click "Browse" at the top of the page
- Navigate to C:\Documents and Settings\<<your partner's son's username>>\Local Settings\Temp\ and click KB885295.exe
- Click "Open" and let the scan finish
- Copy/paste the results in your next reply.

One thing, however, that stands out in your log is that you do not have an Anti-Virus program nor a software Firewall program installed. Nowadays, without these, it is very likely that your computer will get infected.

• Install Active Virus Shield which is a good FREE Anti-Virus ("AV") program.
Never install more than one Anti-Virus scanner on your system! Having more than one AV installed will likely cause your system to become unstable and seriously decrease the reliable detection of any malware.
After installing the AV program, have it perform a complete scan, and let it delete everything it finds.

• Install
Kerio 2.1.5 which is a good FREE software Firewall program.
See, Understanding and Using Firewalls

• Download and scan with CCleaner.
1. Starting with v1.27.260, CCleaner installs the Yahoo Toolbar as an option which IS checkmarked by default during the installation. IF you do NOT want it, REMOVE the checkmark when provided with the option OR download the toolbar-free Basic or Slim versions instead of the Standard Build.
2. Before first use, select Options > Advanced and UNCHECK Only delete files in Windows Temp folder older than 48 hours
3. Then select the items you wish to clean up.

In the Windows Tab:

• Clean all entries in the "Internet Explorer" section except Cookies.
  
• Clean all the entries in the "Windows Explorer" section.
  
• Clean all entries in the "System" section.
  
• Clean all entries in the "Advanced" section.
  
• Clean any others that you choose.

In the Applications Tab:

• Clean all except cookies in the Firefox/Mozilla section if you use it.
  
• Clean all in the Opera section if you use it.
  
• Clean Sun Java in the Internet Section.
  
• Clean any others that you choose.

3. Click the "Run Cleaner" button.
4. A pop-up box will appear advising this process will permanently delete files from your system.
5. Click "OK" and it will scan and clean your system.
6. Click "exit" when done.

• Download and scan with AVG Anti-Spyware v7.5
(This is Ewdio 4.0 renamed. If you already have Ewido installed, please update to this version which has a special "clean driver" for removing persistent malware)
1. After download, double click on the file to launch the install process.
2. Choose a language, click "OK" and then click "Next".
3. Read the "License Agreement" and click "I Agree".
4. Accept default installation path: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5, click "Next", then click "Install".
5. After setup completes, click "Finish" to start the program automatically or launch AVG Anti-Spyware by double-clicking its icon on your desktop or in the system tray.
6. The main "Status" menu will appear. Select "Change state" to inactivate 'Resident Shield' and 'Automatic Updates'.
7. Then right click on AVG Anti-Spyware in the system tray and uncheck "Start with Windows".
8. Go to Start > Run and type: services.msc

• Press "OK".
  
• Click the "Extended tab" and scroll down the list to find AVG Anti-Spyware guard.
  
• When you find the guard service, double-click on it.
  
• In the Properties Window > General Tab that opens, click the "Stop" button.
  
• From the drop-down menu next to "Startup Type", click on "Manual".
  
• Now click "Apply", then "OK" and close the Services window.

9. Select the "Update" button and click "Start update". Wait until you see the "Update succesfull message. If you are having problems with the updater, manually update with the
AVG Anti-Spyware Full database installer from here.

Once the updates are installed do the following:
1. Click on the "Scanner" button and choose the "Settings" tab.

• Under "How to act?", click on "Recommended actions" and choose "Quarantine" to set default action for detected malware.
  
• Under "How to Scan?" check all (default).
  
• Under "Possibly unwanted software" check all (default).
  
• Under "What to Scan?" make sure "Scan every file" is selected (default).
  
• Under "Reports" select "Automatically generate report after every scan" and UNcheck "Only if threats were found".

2. Click the "Scan" tab to return to scanning options.
3. Click "Complete System Scan" to start.
4. When the scan has finished you will be presented with a list of infected objects found. Click "Apply all actions" to place the files in Quarantine.

IMPORTANT! Do not save the report before you have clicked the Apply all actions button. If you do, the log that is created will indicate "No action taken", making it more difficult to interpret the report. So be sure you save it only AFTER clicking the "Apply all actions?" button.

5. Click on "Save Report" to view all completed scans. Click on the most recent scan you just performed and select "Save report as" - the default file name will be in date/time format as follows: Report-Scan-20060620-142816.txt. Save to your desktop. A copy of each report will also be saved in C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Reports\
6. Exit AVG Anti-Spyware when done and submit the log report in your next response.

Note: Close all open windows, programs, and DO NOT USE the computer while AVG Anti-Spyware is scanning. If Explorer or other programs are open during the scan that means certain files will also be in use. Some malware will insert itself and hide in areas that are "protected" by Windows when the files are being used. This can hamper AVG Anti-Spyware's ability to clean properly and may result in reinfection.

• Post back with the results from the Jotti scan, the log from AVG Anti-Spyware and a new HijackThis log.

[lauraocal]

Thank You for posting a reply.
I have a another problem, after reading your message I decided to run hjt again to see what comes up. When I click on the program icon it says "unexpected error" and wont open. I have downloaded it again but it still says the same thing.
After I send this I am going to follow the steps you advised me to do, just thought this is probably important.

[lauraocal]

I went to the web site (jotti) and when i try to upload the file i get an error message saying my firewall or malware is preventing the file to be uploaded