Posts by dlh6213

I have recently purchased Firefox and Im waiting for delivery. If I install it and use it for a browser do you think that will eliminate this downloading problem?

That would depend on the reason you can't download; if it's a setting in your firewall, another browser probably won't make any difference.

If it does work, however, that will narrow down the problem to an IE issue.

Follow the suggestions in this thread:
http://www.daniweb.com/techtalkforums/thread19959.html

Go to the following locations and delete these files (if found):

C:\WINDOWS\System32\systr.dll
C:\WINDOWS\system32\svrhost.exe

If you can't delete them, try booting into Safe Mode and then delete them.

Download CWShredder 2 from here:
http://www.intermute.com/spysubtract/cwshredder_download.html

Run it and press Fix (not scan) and allow it to clean the infection. Close all windows before hitting the Fix button.

Download Hoster from here:
http://www.funkytoad.com/download/hoster.zip

Run it, and when it opens, click on the Restore Original Hosts button and then exit Hoster.

Reboot, close any open browser windows, scan with hijackthis, and post a new log please.

I split your post into it's own thread, please do not tag onto other threads regardless of how similar they may be.
[edit: I just found you had started two other threads with the same problem so I deleted them, please reply to this thread only (for this particular problem)]

Download CWShredder 2 from here:
http://www.intermute.com/spysubtract/cwshredder_download.html

Run it and press Fix (not scan) and allow it to clean the infection. Close all windows before hitting the Fix button.

You need to move hijackthis from the Temp folder it is in to it's own permanent folder (like c:\HJT\hijackthis.exe).

After running the shredder and moving hijackthis, close any open browser windows, scan with HJT, and post a new log please.

Did you run the Hoster? There should be an R1 entry in that log.

For every User listed under C:\Documents and Settings, delete the entire contents of these folders (not the folders themselves):

Local Settings\Temp
Cookies
History
Local Settings\Temporary Internet Files\Content.IE5

Delete the entire contents of your C:\Windows\Temp folder.

Delete the entire contents of your C:\Temp folder (if you have one).

Do a search for *.tmp and delete all entries found.

(Note: if any of these temporary files cannot be deleted while in ‘normal mode,’ try Safe Mode.

Empty your Recycle Bin.

Scan with HJT and have it fix the following entries (if found):

O2 - BHO: InstaFinderK - {4E7BD74F-2B8D-469E-90F0-F66AB581A933} - C:\PROGRA~1\INSTAF~1\INSTAF~1.DLL (file missing)
O4 - HKLM\..\Run: [Trickler] "c:\documents and settings\owner\local settings\temp\fsg_4203.exe"
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)

Since you say you are not allowed to remove any programs, all I can do is recommend the following be removed:
P2P Networking
Kazaa
InstaFinder
WeatherBug

Reboot, close any open browser windows, scan with HJT, and post a new log please.

Download Hoster from here:
http://www.funkytoad.com/download/hoster.zip

Run it, and when it opens, click on the Restore Original Hosts button and then exit Hoster.

Scan with HJT and have it fix the following entries (if found):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://minisearch.startnow.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://minisearch.startnow.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://minisearch.startnow.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://minisearch.startnow.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimtoday.com/search/aimtoolbar.jsp
R3 - URLSearchHook: HyperSearchHook - {B38BD575-71C5-47F2-901B-ED5150447027} - C:\Program Files\Common Files\Hyperbar\HyperbarSS3.dll
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...b?1107083623257
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binar...nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/M...pDownloader.cab

Be sure all windows, other then hijackthis, are closed before hitting the Fix button.

Go to the following location and delete the highlighted folder:

C:\Program Files\Common Files\Hyperbar

Reboot, close any open browser windows, scan with HJT, and post a new log please.

I'm pretty sure it's safe to download -- I haven't heard of anyone having any problems (yet).

Run the online scans while in normal mode.

Have you tried the suggestions in this thread yet?
http://www.daniweb.com/techtalkforums/showthread.php?t=19959

Also run the free online scans from TrendMicro:
http://housecall.trendmicro.com/

And Panda:
http://www.pandasoftware.com/products/activescan/com/activescan_principal.htm

Before fixing anything with hijackthis, you need to move it from the Temp folder it's in to it's own permanent folder (like c:\HJT\hijackthis.exe).

The cause of the viruses is most likely due to the use of file sharing programs (like P2P Networking & Kazaa); I would strongly recommend removing them. Let us know if you decide to and we can help you with it.

After you move hijackthis into it's own folder, close any open browser windows, scan with HJT, and post a new log please.

Sorry for the delay, I've been trying to find what's causing the problem to return. Try this:

Download Hoster from here:
http://www.funkytoad.com/download/hoster.zip

Run it, and when it opens, click on the Restore Original Hosts button and then exit Hoster.

Scan with HJT and have it fix the following entries (if found):

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://rl.webtracer.cc/-/?bayzm
O1 - Hosts: 1159680172 auto.search.msn.com

Remember to close any open windows before hitting the Fix button.

Reboot, close any open browser windows, scan with HJT, and post another new log please. You may need to reset your start page to telia.

It'll come pre-installed, but it will be on the hard drive, not on the motherboard :)

They used to include a recovery CD; hopefully they still do that.

Crunchie, I think these threads are for different computers...

Follow the suggestions in this thread to get rid of HotOffers:
http://www.daniweb.com/techtalkforums/showthread.php?t=19959-hotoffers

Go to Add/Remove Programs in your Control Panel and remove (if found):
MyWebSearch

Scan with hijackthis and have it fix the following entries:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotoffers.info/ad0058/
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Arquivos de programas\MyWebSearch\bar\2.bin\MWSOEMON.EXE
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binar...kr.cab31267.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocach...up1.0.0.8-2.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com/PhotoUpload/M....cab?10,0,910,0
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binar...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/m...pdownloader.cab

Be sure all windows are closed, other then hijackthis, before hitting the Fix button.

Go to C:\Arquivos de programas and delete the MyWebSearch folder.

Reboot, close any open browser windows, scan with HJT, and post a new log please.

Thanks, i definately will, it's been on my list of things to do for a while, i'm a procrastinator me! But should i not get my system clean before installing anything new on it? I've heard that hotoffers supplies an uninstall file, i'm loathe to use that, but have heard that it works. Please advise me if you can, as i'm totally done with the t*ts & *ss! ;)

It should be safe for you to get all the updates except SP2.

I don't care for the idea of using the uninstall file from an adware company either, but in this case it appears to work. Follow the suggestions in that thread, get your updates, then post a new log.

Go to Add/Remove Programs in your Control Panel and remove (if found):

Virtual Maid

Scan with hijackthis and have it fix the following entries:

O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O3 - Toolbar: Virtual Maid - {77B2F8DE-CB3F-4b6b-839B-807DD1ADBA1C} - C:\PROGRA~1\VIRTUA~1\VIRTUA~1.DLL

Be sure all windows, other then hijackthis, are closed before hitting the Fix button.

Go to C:\PROGRAM FILES and delete the Virtual Maid Folder.

Reboot, see if the problem still exists, and then close all browser windows, scan with hijackthis and post a new log.

You need to go to Windows Update to get the Critical Updates for your system. Hold off on SP2, however, at least until your system gets cleaned up.

Check this thread for suggestions on removing HotOffers:
http://www.daniweb.com/techtalkforums/showthread.php?t=19959-hotoffers

After you've done that, close all browser windows, scan with HJT, and post a new log as there are a few other things that should be cleaned up.

When you maximize the window, as Zeroth suggested, instead of using the X to exit, go to File, and select Close; the next time you open IE, it should come up full-screen.

What is the exact error message? Do you get the same message regardless of the browser?

See if anything here helps:
http://www.shr.fiberpipe.net/faq.htm#6a

First you need to move hijackthis into it's own permanent folder instead of the Temp folder it's in now. Something like c:\HJT\hijackthis.exe

After you move it, close all browser windows, 'Scan and Save Log' with hijackthis, and then copy and past the entire log here (including the header which indicates the hijackthis version, your operating system, etc.).

Is this problem just with IE or with your other browser as well (Netscape/Mozilla)?

Well, first of all, I did a Google search for Traylon Explorer and nothing came up; if this were a legit browser, I would think there would be some info on it (assuming you spelled it correctly :) ). Secondly, since it just 'showed up' on your computer, that would be another hint to me that it doesn't belong.

Try booting into Safe Mode, go to Add/Remove Programs in your Control Panel, and look for Traylon Explorer -- remove it if it is. Then, go to C:\Program Files and look for a folder named Traylon Explorer and remove it if found.

My guess would be that the most likely cause for you being unable to download is a setting in your firewall. Have you tried to disable it then download anything?

Can you post a recent HJT log so we can see if there are any more clues?

Just to clarify, you can access the web, right? It's just the inability to download anything isn't it?

I don't have time to do a thorough review right now (like you said, work sucks :) ), but you can start with this:

Go to Add/Remove Programs in your Control Panel and remove (if found):
istsvc
SideFind

Scan with HJT and have it fix the following entries:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus8.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus8.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-qus8.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://qus8.hpwis.com/
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem220.dll (file missing)
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - C:\Program Files\SideFind\sfbho.dll (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: ISTbar - {FAA356E4-D317-42a6-AB41-A3021C6E7D52} - C:\Program Files\ISTbar\istbarcm.dll
O4 - HKLM\..\Run: [73084CBA] C:\WINDOWS\System32\ktfkfswdnkxkk.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [WaqcA50] C:\WINDOWS\obbpbjk.exe
O4 - HKLM\..\Run: [secure] C:\WINDOWS\System32\Jcdebp.exe
O4 - HKLM\..\Run: [l6lofn8b] C:\WINDOWS\System32\l6lofn8b.exe
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Program Files\SideFind\sidefind.dll (file missing)
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_f...dabb9ec24c7b353
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://us.chat1.yimg.com/us.yimg.co...v45/yacscom.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.

Why is this titled "XP & Cleaning Temp files" if it's about Win98?

It's been awhile since I've used 98, but I think these are the folders to look for:
C:Temp
C:Windows\Temp
C:Windows\Temporary Internet Files

You can also do a search for *.tmp

Here is a thread with some comments on Microsoft's Anti-spyware:
http://www.daniweb.com/techtalkforums/showthread.php?t=20187-counterspy

Nod32 (http://www.nod32.com/home/home.htm) always gets excellent reviews among antivirus programs.

As DMR said, Viewpoint gets installed without the users knowledge -- one sign that it's up to no good.

This should help you work your way through Remote Assistance:
http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/remoteassist/intro.mspx

Assuming this is XP (if not, please let us know the OS), try a 'repair' installation, instructions here (Method 2):
http://support.microsoft.com/default.aspx?scid=kb;en-us;315341&Product=winxp

Other things to try:
Winsockfix -- http://www.softpedia.com/get/Tweak/Network-Tweak/WinSockFix.shtml
IEfix -- http://windowsxp.mvps.org/IEFIX.htm

If your speaker volume is still not up to par, try reinstalling the sound card drivers and/or the motherboard drivers, they could have become corrupted.

Well, this question seems rather obvious, but since you didn't mention it, I'll ask; does this system meet the minimum requirements of the ISP and this particular modem?

Try downloading and running Winsockfix from here:
http://www.softpedia.com/get/Tweak/Network-Tweak/WinSockFix.shtml

good idea, but then how would i instruct him to them? i mean, if its all in scrably language he cant read it, also lend to the fact, that its very hard for him (he has a debilitating disease, which means he has to look at his hands as he clicks on things to make sure that he actually clicks the mouse) also, he said his email and some things are still in english, but most are not.

Can you use Remote Assistance and attempt to navigate yourself? (I actually thought you were already doing this since you said he was in AZ, implying you were somewhere else.)

Go ahead and follow all of Crunchie's instructions in post #2.

Do you use Viewpoint Mananger? It is spyware related and I would recommend removing it. Here is one opinion:
http://www.2-spyware.com/file-viewmgr-exe.html
You can use Google to search for more inofrmation before you decide whether to keep it or not.

Remember to reboot and post a new log after following Crunchie's instructions.

Go to:
http://www.silentrunners.org/
Download and run Silent Runners.vbs. It generates a log, please post the information back in this thread.

Great! Glad to hear it!

Hey Janine, if you want to add or change something to your post, within about 15 minutes of posting it, just hit the Edit button instead of creating a new post :)

Do you have this set as your start page? http://login1.telia.com

Scan with HJT and have it fix the following entries:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://rl.webtracer.cc/-/?bayzm
O1 - Hosts: 1159680172 auto.search.msn.com
O19 - User stylesheet: C:\WINDOWS\stsheets.dat

Be sure all windows, other then hijackthis, are closed before hitting the Fix button.

Go to C:\WINDOWS and delete stsheets.dat

Reboot, scan with HJT, and post a new log please.

Well, I hadn't rebooted, but now that I have, I still only have 3.05 which is less then I had before removing anything.

Okay, I'm really confused now :confused: Before I removed any programs, I had 3.11 GB of free space, after removing several programs (via Add/Remove Programs), ranging in size from 50 MB to 1000 MB, I now have only 2.82 GB of free space! How can removing programs leave me with less space?! I used Disk Cleanup and that didn't change anything.

Thanks for the link Catweazle; I had actually already done method 2, but it didn't seem to be working -- I didn't realize I had to wait 15 minutes!

I guess I'll move my utilities to another partition... and I think I'll reduce the sizes of my Page File and System Restore as well.

Perhaps later today I'll get around to trying to burn again. Do you still think I need to uninstall my burners and reboot?

Hey folks. Thanks for the comments. We are now using Arial and I think it's good to go. Anyone have a problem / qualm with this font? Minor things on the new style are still being tweaked. I may put a box around the forum signatures, but if I do, it will be extraordinarily subtle. The idea of the new design was to look more professional (corporate, actually) while be much cleaner and much easier to navigate. I'm not so sure I'm entirely happy with the results yet, but I'm working on yet! But those are the goals ;)

The new font is fine by me, thanks for the change :)

I still feel a background for the signatures would be good, but at least a box. Here's one example of why (posts 2-5):
http://www.daniweb.com/techtalkforums/thread21849.html

Here's what I have:

Drive--GB---------PF-------------SysRestore
C-------10-----750-1500------Suspended (was 1200 MB before trying to burn)
E-------10-----500-1000------Suspended (was 1200 MB)
F-------10-----100- 200------Turned off
G-------20-----500-1000------Suspended (was 2400 MB)
H-------25.6-----None--------Suspended (was 3156 MB)

So, if I understand this correctly, with what is reserved for the Page File and System Restore, I don't really have any free space on the 'C' drive.

Why then was I able to burn the first CD of 678 MB, but can't do the other of only 353?

Now that System Restore is Suspended, how do I turn it back on? I've never run across 'suspended' before.

How is uninstalling the burners going to help?

This thread is being closed as it was solved last year and people continue to add posts with the same problem. If you have the same, or a similar, problem, please start a new thread.

It's not taking 3Gb of space to do that. How big is the drive in total?

There is a percentage of it reserved for System restore, there needs to be enough space for the page file. you simply can't use the entire drive for storage if Windows is installed on it also.

See post #3; the total drive size is 80 GB, the 'C' partition is 10 GB.

Can your grandfather just learn this new language?

Short of a format, I'm not sure what else can be done.

You might have him try running HijackThis from a floppy disk and, if it works, post the log in the virus forum to see if there's any indication of the problem there.

Hopefully someone else here will have some better ideas. Good luck!

Have you used a CD-RW disk, and ejected the disk before writing the files to CD perhaps? Try this and see if it fixes things up:

* Pop a blank CD into the drive. Cancel from the dialogue box asking what you want to do, or close the writable folder.
* Open Windows Explorer. Right-click on the CD-burner drive, and choose 'write these files to CD. Complete the wizard.

Eject the CD only after the burn process has completed.

* In device manager, right-click on each burner and choose 'Uninstall'.
* Reboot and allow the drives to be redetected.

No, I didn't eject before burning was completed (I'm using CD-R's).

Before I got these instructions, I retried to burn my CD. At this point I had 3.12 GB of free hard drive space (on 'C'), and attempting to burn a CD of approximately 300 MB.

It made it to about 95% this time before problems started arising; first, balloons would pop up saying something about low disk space on Drive C, then, at about 98%, I got the same message I got before about the file I was trying to copy being too big, delete some files. Then, when I closed all the open windows, I got a message saying System Restore had been disabled due to insuffient drive space, at least 200 MB is needed.

I'll try your suggestions later when I get home, but I don't understand why it's taking 3 GB of …

Here are instructions from Winferno on removing SecureIE:

"Removal of SecureIE

Please follow these instructions to fully uninstall the program completely.

To uninstall Secure IE, please follow these steps:

1. Open the CONTROL PANEL. To do this, click START, then SETTINGS, then CONTROL PANEL.
2. Double-click on the icon labeled ADD/REMOVE PROGRAMS.
3. Find SECURE IE in the list of programs. Click on it. You'll also see information such as
size, how often it's used, and a link to support.
4. Click on REMOVE. You will see a pop-up window that reads "Are you sure you want to completely
remove Secure IE and all of its components?"
5. Click YES. Secure IE, Private IE, and all associated files and folders will then be removed from your computer.
6. Make sure you complete these steps for both Secure IE 2003 and Secure IE 2004.

Next, make sure that your browser is closed and go to start/run, type in regedit. You will then have the registry editor. Proceed to back up your registry by clicking on file and export, at which time you will be prompted to save the file. Save it to your desktop by the name of "backup".

Once you are done, look for the Secure IE folder entitled "Secure IE 2004" and remove it. If you still see a folder entitled "Secure IE", remove that also.

If you have any further questions, please do not …

So have you tried System Restore yet?

What are you using to burn CDs with? Are you only using the Windows XP feature which enables you to pop in a blank disk, drag and drop or copy/paste files to a 'Writable CD folder', and then burn them to CD with the use of a Wizard?

Yes, this is all I've ever used (with this system); never had any problem before.

If so, there should not be image files retained.

Apparently there seems to be; there are files being stored in the CD Burning folder on the 'C' drive.

What OS? Can you use System Restore?

Internally, I have five partitions on one 80 GB drive (I have a 160 GB installed but not connected yet).

The 'C' partition is 10 GB and is only for the OS, utilities, and programs that do not give the option of where to install them. (In another thread, Caperjack gave instructions on how to change the default installation drive, so next time I reinstall, I'll do that). After deleting the items in the CD Burning folder, I now have over 3 GB available.

Now, where do I go to change options or settings in the default burning program? I've tried searching my system for Roxio and Nero, but nothing comes up -- I thought one of these was the default. If I right-click on my CD-RW drive, and go to Properties, under the Recording tab, there is an option to select the drive where the image will be written; this is already set to 'F' but the files still seem to be going to the CD Burning folder on the 'C' drive.

Another question I have related to this: I have two burners (one also does DVD's), but if I select to enable recording on one, the other is disabled -- how can I have them both enabled to record?

On the Prefetch issue, I've seen several websites (such as this one: http://www.pcworld.com/howto/article/0,aid,114164,00.asp) that recommend purging the folder if it becomes bloated to speed up the system. But I haven't seen what an …

I am running Windows XP Home on this computer, and using the default CD burning software that came with it (I think it's Roxio?)

I wanted to back up some files from the 'F' drive; about 900 MB, so I was going to use two CD's.

Before I started, there was over 2 GB of free space on my 'C' drive.

The first CD burned with no problems; the second one got about 10% through and then popped up a message that there wasn't enough disk space, delete some files.

I rechecked the size of what I was trying to burn and it was only 300 MB. I then checked the size of my 'C' drive and there is now only 974 MB of free space left! I knew XP used a 'staging area' when burning CD's, but I thought it got emptied automatically when you finished. I tried searching MS's site, but couldn't find any info on this particular problem.

So, I did a search for everything modified today and I think I found the problem. In C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Windows, the CD Burning folder has 2.1 GB of files that look like what I was burning. I just want to make sure it is safe to delete everything in this folder before doing so.

I would also like to know it it is possible to relocate this CD Burning folder?

While I've got a thread going, is it also safe …

Some of these should help a little:

http://home.no.net/tkos/info/fat.html

http://home.freeuk.net/foxy2k/disk/disk9.htm

http://home.no.net/tkos/info/fat32.html

http://users.iafrica.com/c/cq/cquirke/fat.htm#EntryStructure

http://www.seas.ucla.edu/classes/mkampe/cs111.sq05/docs/dos.html

See post #19

HijackThis is still being run directly from your desktop (C:\Documents and Settings\a\Desktop\HijackThis.exe); please right-clicking in an open area of your desktop, select New, Folder; give the new folder a name (something like HJT or HijackThis would be good), and then drag the hijackthis.exe icon that is on your desktop into this new folder. After you've moved it, your log should show it as "C:\Documents and Settings\a\Desktop\HJT\HijackThis.exe" (HJT being whatever name you gave the folder).

You can go ahead and have HJT fix these entries, but you shouldn't go any further until we have established that HJT is in it's own folder:

O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.telia.se/sdccommon/download/tgctlcm.cab
O16 - DPF: {11111111-1111-1111-1111-111111113457} - file://c:\explorer.cab
O16 - DPF: {11111111-1111-1111-1111-511111113457} - file://c:\x.cab
O16 - DPF: {11111111-1111-1111-1111-511111113458} - file://c:\x.cab
O16 - DPF: {3B02AAA2-327C-40ED-A849-4BE819AE5385} (ImgSizer Control) - file://C:\Documents and Settings\test\Local Settings\Temp\~DlfnTmp0\imgSizer.ocx
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by10fd.bay10.hotmail.msn.com...es/MsnPUpld.cab
O16 - DPF: {6A7B6E02-D39C-411C-80DE-487888881584} (OpenOffice.OpenOfficeDocument) - http://w03.signform.com/Viewers/OpenOffice.CAB
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/...all/xscan53.cab
O16 - DPF: {75D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin.SecureControl) - http://secure2.comned.com/signuptem...iveSecurity.cab
O16 - DPF: {99B6E512-3893-4155-9964-8EB8E06099CB} (WebSpyWareKiller Class) - http://download.zonelabs.com/bin/pr...ctor/WebSWK.cab

Be sure all windows are closed, other then hijackthis, before hitting the Fix button.

Scan with HJt and post a new log please.