Posts by jholland1964

Office Startup is Unchecked not checked, meaning it is NOT starting. Turn off that Find Fast that is not needed for sure. Though neither of those are 16 bit programs.

You're welcome.

I certainly wouldn't recommend doing a wipe and reinstall. That really is a bit more than needed. I don't see a firewall on there, what do you use?
As far as pop ups, do you have a pop up blocker? I am pretty much grasping at straws here as I don't see infection on the scans.
I also see nothing that would be playing music without your knowing it. Of course pop ups sometime contain sound, they are ads of course.
I would advise that you install a firewall if you don't have one, and also install SpywareBlaster. A superb FREE program that will block ActiveX-based spyware, adware, dialers, browser hijackers, and other potentially unwanted programs. It can also block spyware/tracking cookies in IE, Mozilla Firefox and it DOESN'T run in the background. Just download, install Update, Enable ALL protection including Restricted Sites portion and close the program, that's it. Manually check for updates every week or so.
Also make sure your browsers are set to Accept 1st party cookies, and Block 3rd party cookies.
That's all I can think of for the moment, but a wipe and reinstall is certainly NOT necessary.

Don't really see a lot there. You have a few auto starting programs which aren't necessary, all can be run manually if needed:
SunJavaUpdateSched
QuickTime Task
iTunesHelper
Adobe Reader Speed Launcher
Adobe ARM
FlashPlayerUpdate

Not a lot of processes showing there either. One thing you need to remember if you are running the computer with a lot of IE Tabs open at the same time there will be a number of other processes which will run with each tab also. For instance when you ran the scan it appears there were three tabs likely open. So that could increase things AND slow the computer.
Try to remember to close out a tab when you are finished with it. Other than that I don't see much.

That IS a lot of processes running. You need to look at your auto starts and see what is running there.
Give us a HiJackThis log. Please be positive you download the newest version which is 2.0.4 from this link;
http://free.antivirus.com/hijackthis/

Winamp is my player of choice, I have the newest version.

Check to see if the volume slider in the main Winamp window is set at zero.
If so, turn it up to the desired level

Don't know that I have been much help if you are still having these problems. Can't see anything in the logs which would indicate as being the cause of the .wav volume is still resetting to zero.
Still getting pop ups with IE mostly, not so much with Firefox.
Still Hearing ads in background.
Had a similar one a couple weeks ago on another forum and got all the pop ups stopped and the volume corrected but person was still hearing things from background. That one ended up being Real Player being up and running all the time. He hadn't used Real Player in a couple years but suddenly it "activated" itself evidently. He uninstalled it and no problem.
One totally unnecessary Service I see is Bonjour Service which is automatically installed and enabled with the iTunes software. It isn't needed at all. You might go into Administrative Tools, Services and Stop it and then Disable it.
What media player are you using? Have you updated all your Sound & Audio Devices or looked for new drivers?
Also noticed, which would likely have nothing to do with the sounds playing, but CDBurnerXP is running all the time in the background. This shows in nearly all of your logs. This is totally unnecessary and should only be running if you are actually using it.

The search redirecting has stopped.
The .wav volume is still resetting to zero.
Still getting pop ups with IE mostly, not so much with Firefox.
Still Hearing ads in background.

Ok then do the following:

Please download ComboFix by sUBs from HERE
· You must download it to and run it from your Desktop
· Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
· Double click combofix.exe & follow the prompts.
· When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
· Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Run Combofix ONCE only!!

Are you still having the problems noted in your first post? Sounds though, because of the attempt by the trojan to come onto your system there is still "something" there "phoning home",

You need to wait to do the updates until we are certain the computer is clean. That is one of the main requirements.
You are going to need to do those two scans again.
Update MBA-M and run the full scan again, be sure to remove everything found. Reboot and then do the ESET scan again, also remove everything found.
Then do a new HJT scan.
Post back with those three logs.

You didn't answer my question, did you remove all those dangerous sites from the Host file?

Ok, you need to Uninstall Combofix as it will not be needed again and it should never be re-used. To uninstall it do the following:

* Click START then RUN
* Now type ComboFix /Uninstall in the runbox and click OK. The space between the combofix and the /uninstall, it must be there.
When shown the disclaimer, Select "2"

Your Java is also way out of date. You need to go here and download the Offline Install file and save it to the desktop;
http://www.java.com/en/download/manual.jsp

Once it is downloaded then close all browsers. Go to Add/Remove and Uninstall Java(TM) 6 Update 15.
When that is uninstalled then double click the install file on the desktop. Watch the install very closely as very often toolbars are added to the install file. These will be noted by a box with a check mark in it, take the check mark out so you don't get whatever toolbar is offered. Once the install is complete then go back to the download page and click Verify Now on the right side to go to the verification page to check to be certain the install was successful.

And MOST important, you don't appear to be running an antivirus program. This is EXTREMELY important. I strongly recommend that you download, install and update AND use a good anti-virus program. A very good FREE program is Avira Free. I have used it for years and am very pleased with …

None of those removals should have caused this error but it can be caused by out of date software or hardware. Your computer is way out of date. SP3 has been out for well over two years and support for XP SP2 ended yesterday. Microsoft .NET Framework is now up to version 3.5 SP1, your Java is out of date it is currently at version 6 update 21.
You might try this:
To start your computer by using the Last Known Good Configuration feature, follow these steps:

1. Start your computer.
2. tap the "F8 key" continuously until you get the startup menu.
3. When the Windows Advanced Options menu appears, use the ARROW keys to select Last Known Good Configuration (your most recent settings that worked), and then press ENTER.
4. If you are running other operating systems on your computer, use the ARROW keys to select Microsoft Windows XP, and then press ENTER.
See if this allows you to boot up.

Still having problems seeing webpages or logging onto messenger programs?

This thread is closed Josh and over 4 years old. You need to begin your own new thread in order to obtain assistance.

Please do the following:
Please download ComboFix by sUBs from HERE
· You must download it to and run it from your Desktop
· Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
· Double click combofix.exe & follow the prompts.
· When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
· Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Run Combofix ONCE only!!
Judy

Run HiJackThis again, place check marks next to the following entries.
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5577
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: LimeWire Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKCU\..\Run: [UpdateMyDrivers] C:\Program Files\SmartTweak Software\UpdateMyDrivers\UpdateMyDrivers.exe -t
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [ieabwrho] C:\Documents and Settings\LocalService\Local Settings\Application Data\sjnqmxnnr\nadcenatssd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ieabwrho] C:\Documents and Settings\LocalService\Local Settings\Application Data\sjnqmxnnr\nadcenatssd.exe (User 'Default user')

Once all the check marks are placed then click the Fix Checked button. Exit HJT, reboot and run a new system scan with HiJackThis and post back here with the new log. …

Hi Bob, what you need to do is follow the steps given in our Read Me sticky.
Post back with all the requested logs and we will take a look.

http://www.daniweb.com/forums/thread134865.html

Judy

Yes do the msconfig operation. Let me know what happens there. Very strange.

Are you still getting that 16 bit error notification?
Update MBA-M and run a new Full Scan with it.
Have it remove all items found.
Reboot and post back here with the log.
Judy

Question, on your original OTL log you showed a multitude of extremely dangerous Host file listings, they do not show on other logs, did you manually remove them?
Then on the DDS log you also show a disreputable host file,spywareinfo.com did you remove this one also?

You have run a lot of scans but not the one that we always recommend, as it is really the top of the line, Malwarebytes'Anti-Malware (MBA-M)
I would like you to please first turn OFF the following programs as they may interfere with any fixes attempted:
Windows Defender and the AdAware Service.
Then do the following:
Please download Malwarebytes' Anti-Malware (MBA-M) to your Desktop.

* DoubleClick mbam-setup.exe and follow the prompts to install MBA-M.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When MBA-M finishes, Notepad will open with the log. Please save it where you can find it easily. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt.

Reboot …

Just went back through all of your logs and found an entry I had overlooked in all your HJT logs I am very sorry to say:
O4 - HKLM\..\Run: [ToolCar] C:\WINDOWS\system32\cttfmon.exe Note the two "t's" there.

There is normal file with a similar name which is on the computer, ctfmon.exe (note just 1 "t".
but the one noted in red is a trojan. This "might" be your error message trigger, I cannot say for sure. But it ISN'T supposed to be there regardless.

Please do the following:
Please download ComboFix by sUBs from HERE
· You must download it to and run it from your Desktop
· Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
· Double click combofix.exe & follow the prompts.
· When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
· Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Run Combofix ONCE only!!

Ok then it obviously is one of your auto starting programs or services.
Begin by going to start, run, msconfig.
First thing I want you to do is click the Start Up tab. Make a note of all items noted there with check marks in them. Then take the check marks out and reboot the computer. See if you get the pop up error message. If you do not then you will know it is one of those auto starting programs. But if you DO still receive that message then you will know it wasn't one of those but a service that is causing this.
If you DON'T get the message however here is what you will have to do to narrow it down:
You will then have to go back into msconfig and add the check marks back, one at a time, restart after each one. When you finally get the pop up message then you will know which one is causing it and be sure to come back here and let me know what it was.
If you still got the message when removing those check marks come back here and report that.
Judy

Please do the following:
Download HiJackThis.
Run a system scan with it, save the log and post back here with it.

This happens randomly not when you have attempted to run a specific program?

Have all the logs come up clean and is Windows Explorer working as it should?

Now download HiJackThis

First I would like you to do a system scan, save the log and post it here.
Also do an Uninstall list with Hijackthis also.
To do this follow these steps:
Start HijackThis
Click on the Misc Tools button
Click on the Open Uninstall Manager button.
Click on the Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad into a reply also.
Judy

Yes it most certainly can be happening because of spyware. Try following the steps given in our Read Me sticky and post the logs here.
If you cannot access them in normal mode then try Safe Mode with Networking.
http://www.daniweb.com/forums/thread134865.html

Ok, there may be more infection on there so lets check all that out first then work on missing devices, ok?
Please Run the ESET Online Scanner and attach the ScanLog with your post for assistance.

* You will need to use Internet Explorer to to complete this scan.
* You will need to temporarily Disable your current Anti-virus program.
* Be sure the option to Remove found threats is checked and the option to Scan unwanted applications is Checked.
* When you have completed that scan, a scanlog ought to have been created and located at C:\Program Files\EsetOnlineScanner\log.txt. Please post that log for us as directed below.

Looks pretty good. Do you feel that your problems are solved or is there anything else you have questions about?

n0pz, if rkill IS needed I will give instructions for it, for the moment let us wait and see what ssj4tim is able to accomplish.

ssj4tim please attempt the step as I have given it. If you are unable to complete the instructions then please post back and I will give you an alternate method of accessing the program.

Sounds good.

Please download Malwarebytes' Anti-Malware (MBA-M) to your Desktop.

* DoubleClick mbam-setup.exe and follow the prompts to install MBA-M.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When MBA-M finishes, Notepad will open with the log. Please save it where you can find it easily. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt.

Reboot the computer->VERY IMPORTANT.
Come back here and post the MBA-M log.
Judy

Can I ask why you uninstalled Norton?
Run HiJackThis again and put check marks next to the following entries:
O15 - Trusted IP range: http://192.168.1.1
O15 - ESC Trusted IP range: http://192.168.1.1

Once you have placed the check marks then click the Fix Checked button.
Exit HJT.
Next try this:
Try using rkill. Follow these instructions to the letter.
RKill only terminates processes, after running it you should not reboot your computer as any malware processes that are set to start automatically, will just start up again. Instead, after running RKill you should scan your computer using your malware removal tool of choice. If there is a problem after running RKill, just reboot your computer and you will be back to where you started before running the program.

When RKill is run it will display a console screen. That console screen will continue to run until it RKill has finished. Once finished, the box will close and a log will be displayed showing all of the processes that were terminated by RKill and while RKill was running.

Depending on the malware that is installed on the computer, when you run RKill you may see a message from the malware stating that the program could not be run because it is a virus or is infected.

These warnings are just fake alerts by the malware that has hijacked your computer trying to protect itself. Two methods …

Just give us a print screen of the error and attach it to a reply. We don't give assistance via email.

Please follow the steps given in our Read Me sticky. It appears you have malware on the system. Run all the scans, following the instructions to the letter, and post back here with requested logs and we will go from there.
http://www.daniweb.com/forums/thread134865.html

Yes, finito you are correct. conime.exe can possibly be infection. But it may be one of several, we have to determine first if the poster knows what these Trusted Sites are and if he added them himself. If not then I will provide other steps which will need to be taken.
Judy

bpeck, please for the moment, hold off on the running of sfc. There are likely other clean up steps which will be needed.
Judy

Is Magentic wallpaper or screensaver or Incredimail installed?

If so uninstall it and that should take care of it.

"so I copied the installer over on a thumb drive, but when I try to install it on my computer, it says the Administrator has made it so I can't install it. How do I fix this."
The installer for what? What you would need to use is Malwarebytes' Anti-Malware.
But first you will need to stop the processes that are blocking your work. To do this you need to use rkill.
RKill only terminates processes, after running it you should not reboot your computer as any malware processes that are set to start automatically, will just start up again. Instead, after running RKill you should scan your computer using your malware removal tool of choice. If there is a problem after running RKill, just reboot your computer and you will be back to where you started before running the program.
When RKill is run it will display a console screen. That console screen will continue to run until it RKill has finished. Once finished, the box will close and a log will be displayed showing all of the processes that were terminated by RKill and while RKill was running.
Depending on the malware that is installed on the computer, when you run RKill you may see a message from the malware stating that the program could not be run because it is a virus or is infected.
These warnings are just fake alerts by the malware that has hijacked your computer trying …

Do you have access to another computer and a flash drive?

Did you add these trusted sites? They say Private Network
O15 - Trusted IP range: http://192.168.1.1
O15 - ESC Trusted IP range: http://192.168.1.1

Your log shows your ISP as Sify is that correct?

Have you tried Safe Mode with networking? This should get you online without the trojan interfering. If you can do that stay in safe mode and run the tools, mainly MBA-M. Forget about GMER for now. Do the MBA-M in safe mode, reboot, update it again and run a full scan again. In both safe and normal have it remove everything found, reboot and do another HiJackThis scan, save the log.
Post back here with all three logs.
Judy

The MAIN requirement when installing a service pack is that the computer must be 100% up to date and it must be running 100% correctly. I feel this was a mistake installing SP3 on a computer suffering major errors. All problems must be corrected BEFORE installing the service pack.
At this point we don't know what is causing those problems, but since you ran no malware scans we don't know but that could be a contributing factor. I would strongly advise that you rule this out. Begin by running the steps given in our sticky and posting back with the required logs.
http://www.daniweb.com/forums/thread134865.html

Run HiJackThis again only this time place check marks next to the following entries;
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - .DEFAULT User Startup: Corel Print Office Registration.lnk = C:\Program Files\Corel\Print Office 2000\Register\Remind32.exe (User 'Default user')
O4 - .DEFAULT User Startup: HP Organize.lnk = ? (User 'Default user')
O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} (WildTangent Active Launcher) - http://install.wildtangent.com/Activ...veLauncher.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) -
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_02) -

Once you have placed the check marks click the Fix Checked button. Exit HiJackThis and reboot.

Next you need to uninstall Combofix as it will not be needed again and should not be reused:
* Click START then RUN
* Now type ComboFix /Uninstall in the runbox and click OK. The space between the combofix and the /uninstall, it must be there.
When shown the disclaimer, Select "2"

Next do the following:
It appears that your Java may be out of date so you need to update that by going to
http://www.java.com/en/download/manual.jsp

Download the Offline Install file and save it to your desktop. Then close all browsers.
Double click the install file to install. Watch the install carefully, this will only take a …

You need to run the rest of the scans recommended and post back with those logs.

Have you done a general clean up of the computer, removing all temp files, and the like? Have you done a defrag lately?
Your Java is way out of date. Go here, http://www.java.com/en/download/manual.jsp
Download the Offline install and save it to the desktop.
Then close all browsers. Go to Add/Remove and Uninstall all old versions of Java that you find there. Once all are uninstalled then go to the install file on your desktop and double click to install the new version. Pay close attention to the install process, it will only take a few moments, as very often extra tool bars are offered and you don't need those. If you see one on the install file just remove the check mark and you won't get that.
Once the install is complete go back to the download page and click Verify Now to assure the install was successful.
After you have done that and recommended clean ups let me know if things have speeded up any.
Judy

You have some unneeded auto starting programs on there, meaning they run all the time even if you don't use them all the time. All of these below can be run manually if needed:
Donwload and install this small, FREE program Mike Lin's Startup Control Panel

Once installed it will be found in the Control Panel with a little computer icon labeled Startup.
Open the program and go through the various tabs and look for the following listings. If you find on, remove the check mark. You should find most of them in there on one tab or another. If you cannot find something don't worry, just make a note of it and let me know when you are finished. Once you have removed all the check marks then close the program, reboot and run a New HiJackThis scan.
Here are the ones you need to look for, none are needed to run the computer or need to run all the time, all can be run manually if needed:
hpsysdrv
HPHmon05
NvCplDaemon
nwiz
Sunkist2k
AlcxMonitor
IgfxTray
Microsoft Works Update Detection
SunJavaUpdateSched
BackupNotify
NVIEW
Corel Print Office Registration
HP Organize

Judy

One problem with running a Repair Install will replace the system files with the files on the XP CD used for the Repair Install. It will leave your applications and settings intact, but all Windows updates will need to be reapplied.
Now if your CD was XP SP2 then that wouldn't be too much of a problem but if it was just a straight XP CD then you should have reinstalled SP 1, SP 2 and all the other updates and then install SP 3. This may have been the problem with installing SP 3 immediately after the Repair. Do you know absolutely what you had on that CD?

Your printer loads the software? A printer is just that, a printer it shouldn't be loading anything. I don't believe it has the capability to load software. Are you certain this is what is actually loading the software?
IF the software IS loading again this means it is still on the computer and not uninstalled.
How did you uninstall it?

Ok, that log at least showed me something. Want you to do the following:
Please Download ATF-Cleaner.exe by Atribune
You can put ATF-Cleaner on your Desktop for easy access.
RUN ATF-Cleaner.exe.

• Click on ATF-Cleaner to run it
• Where it says Select Files To Delete, Check the Select All Option
• Click Empty Selected > OK

Please download Malwarebytes' Anti-Malware (MBA-M) to your Desktop.

* DoubleClick mbam-setup.exe and follow the prompts to install MBA-M.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When MBA-M finishes, Notepad will open with the log. Please save it where you can find it easily. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt.

REBOOT after running MBA-M! This is VERY important.

After the reboot run and new HiJackThis scan and save the log. Post back here with the MBA-M log and the new HiJackThis log.