Is this a virus?

[Cricket]

We want to know what processor you're using (make, model, speed), what motherboard, what video card, what brand speed and amount of RAM, etc...not what programs you're using. We want to know what kind of hardware you've got in your PC...and is it a home built or name brand store bought computer?

Cricket

[glc]

Also, is this the HJT in your mom's account? If that's the account you are having issues with, that's what we need to see.

With all that stuff loading at startup, I hope you have a powerful computer - 2 GHz and a gig of ram, for example. None of that stuff looks *harmful* but it's a LOT.

[mrhowdeedoo]

Um...how would I find all that stuff out, Cricket? glc, when my brother built this computer, (he learned how on this site) it was one of the best at the time. About 2 years ago. No, the HJT was in my account, just one second...

Logfile of HijackThis v1.97.7
Scan saved at 9:42:04 AM, on 12/10/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\AppServ\Apache\Apache.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\AppServ\Apache\Apache.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
C:\WINDOWS\System32\GEARSec.exe
C:\AppServ\mysql\bin\mysqld-nt.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\Program Files\Creative\ShareDLL\MediaDet.Exe
C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\GhostTray.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Creative\ShareDLL\MediaDet.Exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\GhostTray.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Verizon Online\SupportCenter\bin\mpbtn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Symantec Shared\AdBlocking\NSMdtr.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Dave\Desktop\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Logitech\iTouch\kbdtray.exe
C:\Documents and Settings\Dave\Desktop\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/cust...//my.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://red.clientapps.yahoo.com/cust...//my.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
O1 - Hosts: 127.0.1.11 mclcitrix.mfldclin.edu
O1 - Hosts: 127.0.1.10 mclcitrix03.mfldclin.edu
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\SBAudigy\Program\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [Jet Detection] C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Norton Ghost 9.0] C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\GhostTray.exe
O4 - HKLM\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~3\Ad-Watch.exe"
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\SupportCenter\bin\matcli.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Control Pad (HKLM)
O9 - Extra 'Tools' menuitem: Control Pad (HKLM)
O9 - Extra button: Encarta Encyclopedia (HKLM)
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia (HKLM)
O9 - Extra button: Define (HKLM)
O9 - Extra 'Tools' menuitem: Define (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {01CA75F1-054B-4A63-9221-C6926369EC52} (HS_live Control) - http://install.homestead.com/~site/I...ve/HS_live.cab
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://us.creative.com/support/downl...19/CTSUEng.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...ctor/swdir.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?link...38&clcid=0x409
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/mini...ansporter.cab?
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0309.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/downlo...22/wmv9VCM.CAB
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeup...ntent/opuc.cab
O16 - DPF: {52A5CD24-64C6-4BAF-A4EC-4D13F451763F} (CU LiveUpdate Control) - http://204.119.246.35:8080/ctmexpres...liveupdate.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/08aa5cf9df05159...p/RdxIE601.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...tatsClient.cab
O16 - DPF: {93CEA8A4-6059-4E0B-ADDD-73848153DD5E} (CWebLaunchCtl Object) - http://gateway.cf1live.com/eSupport/.../weblaunch.cab
O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn.com/controls/FileUC/MsnUpld.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://zone.msn.com/binGame/ZAxRcMgr.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...287.4118634259
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/sof...iveXPlugin.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/p...ll/install.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole...rcadeRdxIE.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/act...a/SymAData.cab
O16 - DPF: {D17EEDBC-9852-4E40-8E44-1ED1BDFC7684} (MC.WebInst) - https://willow.marshfieldclinic.org/...clweb,CT=java+
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/tech...ActiveData.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by14fd.bay14.hotmail.msn.com/...x/HMAtchmt.ocx
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://us.creative.com/support/downl...2119/CTPID.cab

There you go.

[mrhowdeedoo]

I just logged in, and timed it. I was extremely fast this time. It took only 2 minutes, 31 seconds.

[glc]

Same comment applies - what is the processor speed and amount of ram on that thing? WAY too much stuff running at startup, nothing harmful but the sheer amount adds up.

[Yuanji]

i find the zork thingies kinda wierd. you may wanna go into MSConfig and uncheck a lot of the things you don't wanna run at startup. also, how much RAM are you using? winxp can be a real big memory hog and 512 usually recommended at least.

[glc]

Yuanji, he's already been asked several times for specs, no reply yet, just more logs.

[mrhowdeedoo]

How would I find those questions out though, glc? I also asked this question several times.

mrhowdeedoo

[pam123]

Download and run this : http://www.belarc.com/free_download.html
Then you can tell us what we need to know.
How did getting rid of trickler go ?

[mrhowdeedoo]

Sorry for the mess, I just wanted to get this in here as soon as possible. I'll be revising it for my signature in a second.

pam123, the solution didn't work. I don't know why, but I'm still getting trickler messages.

Windows XP Home Edition Service Pack 2 (build 2600)

Processor
1.15 gigahertz AMD Athlon XP128 kilobyte primary memory cache256 kilobyte secondary memory cache

Drives
80.02 Gigabytes Usable Hard Drive Capacity 18.87 Gigabytes Hard Drive Free Space
PLEXTOR CD-R PX-W5224A [CD-ROM drive]
TOSHIBA DVD-ROM SD-M1712 [CD-ROM drive]
3.5" format removeable media [Floppy drive]
Disk drive -- drive 3Generic
STORAGE DEVICE USB Device [Hard drive] -- drive
1 Generic STORAGE DEVICE USB Device [Hard drive]
2 Generic STORAGE DEVICE USB Device [Hard drive]
4ST380021A [Hard drive] (80.03 GB)
0BROKER0, rev 3.02, SMART Status: Healthy

MSI MS-6380 2.0Asset Tag: 0123ABC

Main Circuit Board
Board: MSI MS-6380 2.0Bus Clock: 100 megahertzBIOS: American Megatrends Inc. 07.00T 11/02/2001

Memory Modules
512 Megabytes Installed
MemorySlot '0' has 512
MBSlot '1' is Empty
EmptySlot '2' is Empty

Controllers
Standard floppy disk controller
Primary IDE Channel [Controller]
Secondary IDE Channel [Controller]
VIA Bus Master IDE Controller

Bus Adapters
VIA Rev 5 or later USB Universal Host Controller
VIA Rev 5 or later USB Universal Host Controller
VIA Rev 5 or later USB Universal Host Controller

Comunications
U.S. Robotics 56K Fax PCI [Modem]1394 Net
AdapterLinksys LNE100TX(v5) Fast Ethernet
AdapterLinksys LNE100TX(v5) Fast Ethernet Adapter - Firewall and HTTP Proxy Server TunnelingWestell WireSpeed Dual Connect Modem - Firewall and HTTP Proxy Server TunnelingNetwork Card MAC Address: 00:0C:41:1F:A1:1D
Network IP Address: 192.168.1.100 / 24[/list]
Other Devices[list]
OHCI Compliant IEEE 1394 Host Controller
Dell AIO Printer A920
Easy Internet Keyboard
LEGO USB Tower
Logitech-compatible Mouse PS/2Generic USB
HubUSB Mass Storage Device
USB Printing Support
USB Root Hub
USB Root Hub
USB Root Hub

MultiMedia
ATI WDM Rage Theater Video (Microsoft Corporation)ATI WDM Specialized MVD Codec (Microsoft Corporation)Creative Game PortCreative SB AudigyStandard Game Port

Display
RADEON 7200 SERIES [Display adapter]ViewSonic PF775 [Monitor] (15.7"vis, s/n DZ13600152, September 2001)[/SIZE]

[glc]

Not a whole lot of power for supporting that huge list of startups, and your hard drive is also over 75% full. This is what happens when you install stuff without watching what you are doing - a lot of software defaults to running at startup which is NOT necessary - and it looks like you have the entire Symantec suite doing just that, for example (antivirus, firewall, Ghost, Goback). You should NOT have 2 antivirus packages both running in the background - pick Norton or AVG and shut the other one down - just use it for manual scans if necessary. Do you have both a HP and a Dell printer installed? I see 2 instances of an Apache webserver running.

Bottom line? Time for some serious housecleaning.

[mrhowdeedoo]

So...what should I do? I got all symantec stuff off of the PC.

Also, how do I start XP in safe mode?

[rjfvillarosa]

Repeatedly tapping the F8 key when booting will get you to the safe mode prompt.

[mrhowdeedoo]

Ok. I've gone in safe mode and scanned with Ad-Aware SE Personal, Webroot Spy Sweeper, The Cleaner, AVG Personal, Norton Antivirus. They all found nothing. Now what? I keep having problems with various browsers, emulators, etc. These problems go away for a while, then come back, then leave, then come back..etc.

What should I do? It's getting really annoying.
Mr.Howdeedoo

[Marke522]

If it were my computer, I would back up all my files: music, photos, documents, addresses, emails, anything of value, maybe downloaded programs also, if you don't want to find them again, maybe your favorite web sites; then reformat the hard drive, or Restore to factory settings.

If it's a company made computer, you will have a set of restore cd's or a recovery partition, you can use those to take it back to day one like it out of the box brand new.

If it was built then you should have a cd somewhere for your operating system. If you can't find it then you can use any MS OS disc to reinstall. Just be sure to enter the correct key. Hopefully someone put the key sticker on your computer for you.

If this is the route you would like to take, please think about it before you start, because it will erase everything, and it might take a few hours to complete. Could take you a few days to get your computer back to where you liked it. But you've allready spent more time than that trying to get it to work correctly.

[kev7555]

Are all of your anti-spyware programs up to date? Are you running multiple anti-spyware programs? I would suggest Adaware SE, Spybot Search and Destroy and Spywareblaster, along with AVG anti-virus.

I would dump the Norton stuff and stick with AVG (just my opinion). An overloaded hard drive and all of those programs on start-up are sure to slow things down. Some trojans will cause the behavior noted. Is your AVG ant-virus program version 7.0 and is it up to date? The latest version of AVG has been very successful for me in healing trojan-infected files in the past few weeks. Try running all of the ant-spyware and anti-virus from safe mode and make sure you are NOT connected to the internet until you are certain you are trojan-free.

I would also start un-installing any unneccesary programs and backing up data so you can clean up that hard drive and get it down to a manageable amount of space.


-Kev

[mrhowdeedoo]

Yeah, that's probably what I'm going to do, Marke522, it's just that I don't have a DVD burner, so It's going to take a lot of cd-roms to put all my stuff on.

If I backed up my entire hard drive with norton ghost, would I back up trojans and viruses as well?

[glc]

(How's that for size?)

Too big. 400x125 is the limit, and that's 450 wide.

If I backed up my entire hard drive with norton ghost, would I back up trojans and viruses as well?

Yep, but I don't think you have any. You simply have way too many processes running at startup. Each and every O4 item is a startup process.

[Marke522]

Try this just for grins,

Start / Run / msconfig

Click the Selective Startup button:
Check Process SYSTEM.INI
Check Process WIN.INI
Check Load System Services
Uncheck Load Startup Items

Make sure the button for Use Original BOOT.INI is selected.

The click on the Startup tab on top, should be the last one.

Select Disable All. Then run down the list and look for the anti virus that you are currently using, and also look for the firewall.

Click Apply, OK, and restart the computer. Then see what happens. You can always change it back, and any program you run will turn on when it is started, rather than starting on boot.

If a program enables itself after you Apply, it might be spyware, I would try to research it here. http://www.kephyr.com/filedb/index.php see if this site has info on any file that runs itself and if anything should be done about it.