Ebay/Paypal Problem

Hello.

Good work, were winning, last bit to take out, that HelpAssistant account. Follow my instructions in the order they are written.

Please create a folder on your Desktop called SWReg.

1. Download SWReg.exe from here.
   
2. Save SWReg.exe inside the SWReg folder you just created.
   
   Do not run SWReg.exe.
   
   Now open a new Notepad file, and input this into the Notepad file:
   

   
   @echo off
   swreg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /s >>log.txt
   swreg query "HKLM\SYSTEM\CurrentControlSet\Services\TermService\Parameters" /s >>log.txt
   start notepad log.txt
   

   
   
   Save this as SWReg.bat, save it inside the SWReg folder as well.
   Double click SWReg.bat and the black cmd window will open and close, this is normal.
   
   
3. Make sure both SWReg.exe and SWReg.bat as located next to each other for this to work.
   
4. Now, double click on SWReg.bat to run the script.
   
5. Once done, a Notepad log file will open, copy and paste that log back here.
   

Next,

Now open a new Notepad file, and input this into the Notepad file:

@echo off
net user HelpAssistant>"%userprofile%\desktop\log.txt"
start notepad "%userprofile%\desktop\log.txt"
exit

Save this as fix.bat, save it to your desktop.
Double click fix.bat and the black cmd window will open and close, this is normal.

---

Copy and paste the 2 logs back here.

SteelWerX Registry Console Tool 3.0
Written by Bobbi Flekman 2006 (C)

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\profilelist
ProfilesDirectory REG_EXPAND_SZ %SystemDrive%\Documents and Settings
DefaultUserProfile REG_SZ Default User
AllUsersProfile REG_SZ All Users

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\profilelist\S-1-5-18
Flags REG_DWORD 12 (0xc)
State REG_DWORD 0 (0x0)
RefCount REG_DWORD 1 (0x1)
Sid REG_BINARY 010100000000000512000000
ProfileImagePath REG_EXPAND_SZ %systemroot%\system32\config\systemprofile

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\profilelist\S-1-5-19
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\LocalService
Sid REG_BINARY 010100000000000513000000
Flags REG_DWORD 9 (0x9)
State REG_DWORD 0 (0x0)
CentralProfile REG_SZ
ProfileLoadTimeLow REG_DWORD 858229908 (0x33278c94)
ProfileLoadTimeHigh REG_DWORD 30063002 (0x1cab99a)
RefCount REG_DWORD 3 (0x3)

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\profilelist\S-1-5-20
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\NetworkService
Sid REG_BINARY 010100000000000514000000
Flags REG_DWORD 9 (0x9)
State REG_DWORD 0 (0x0)
CentralProfile REG_SZ
ProfileLoadTimeLow REG_DWORD 848386158 (0x3291586e)
ProfileLoadTimeHigh REG_DWORD 30063002 (0x1cab99a)
RefCount REG_DWORD 2 (0x2)

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\profilelist\S-1-5-21-1214440339-602609370-682003330-1000
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\HelpAssistant.JENSENS
Sid REG_BINARY 01050000000000051500000093e36248da16eb23828ba628e8030000
Flags REG_DWORD 1 (0x1)
State REG_DWORD 256 (0x100)
CentralProfile REG_SZ
ProfileLoadTimeLow REG_DWORD 1429914964 (0x553ac554)
ProfileLoadTimeHigh REG_DWORD 30061066 (0x1cab20a)
RefCount REG_DWORD 0 (0x0)

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\profilelist\S-1-5-21-1214440339-602609370-682003330-1003
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\Owner
Sid REG_BINARY 01050000000000051500000093e36248da16eb23828ba628eb030000
Flags REG_DWORD 0 (0x0)
State REG_DWORD 256 (0x100)
CentralProfile REG_SZ
ProfileLoadTimeLow REG_DWORD 1528698658 (0x5b1e1722)
ProfileLoadTimeHigh REG_DWORD 30063002 (0x1cab99a)
RefCount REG_DWORD 1 (0x1)
RunLogonScriptSync REG_DWORD 0 (0x0)
OptimizedLogonStatus REG_DWORD 11 (0xb)

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\profilelist\S-1-5-21-1214440339-602609370-682003330-1006
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\QBDataServiceUser
Sid REG_BINARY 01050000000000051500000093e36248da16eb23828ba628ee030000
Flags REG_DWORD 1 (0x1)
State REG_DWORD 0 (0x0)
CentralProfile REG_SZ
ProfileLoadTimeLow REG_DWORD 998229908 (0x3b7fc794)
ProfileLoadTimeHigh REG_DWORD 30063002 (0x1cab99a)
RefCount REG_DWORD 1 (0x1)

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\profilelist\S-1-5-21-1214440339-602609370-682003330-1007
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\HelpAssistant.JENSENS.000
Sid REG_BINARY 01050000000000051500000093e36248da16eb23828ba628ef030000
Flags REG_DWORD 1 (0x1)
State REG_DWORD 256 (0x100)
CentralProfile REG_SZ
ProfileLoadTimeLow REG_DWORD -1266069296 (0xb48950d0)
ProfileLoadTimeHigh REG_DWORD 30062000 (0x1cab5b0)
RefCount REG_DWORD 0 (0x0)

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\profilelist\S-1-5-21-1214440339-602609370-682003330-500
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\Administrator
Sid REG_BINARY 01050000000000051500000093e36248da16eb23828ba628f4010000
Flags REG_DWORD 0 (0x0)
State REG_DWORD 260 (0x104)
CentralProfile REG_SZ
ProfileLoadTimeLow REG_DWORD 666469788 (0x27b9859c)
ProfileLoadTimeHigh REG_DWORD 29996347 (0x1c9b53b)
RefCount REG_DWORD 0 (0x0)
RunLogonScriptSync REG_DWORD 0 (0x0)

SteelWerX Registry Console Tool 3.0
Written by Bobbi Flekman 2006 (C)

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\termservice\parameters
ServiceDll REG_EXPAND_SZ %SystemRoot%\System32\termsrv.dll
Certificate REG_BINARY 01000000010000000100000006005c005253413148000000000200003f0000000100010089c288264ae933f4519421ce4634af44ffe6c4c5c23b5d448970d0e5f0cc10bb46e2915f8eaf15e973900f302492ae95d67cdf7943160331d2e1769c973138d600000000000000000800480000d4fb42b4a710b7a4cc933bbaae8589927b38cad56058d3c7493d2fad47e0ffe42fdbe87f01406aacdc44c01061e26c37c727ccf6fc79fdc0e3ea005f5c34410000000000000000

SteelWerX Registry Console Tool 3.0
Written by Bobbi Flekman 2006 (C)

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\profilelist
ProfilesDirectory REG_EXPAND_SZ %SystemDrive%\Documents and Settings
DefaultUserProfile REG_SZ Default User
AllUsersProfile REG_SZ All Users

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\profilelist\S-1-5-18
Flags REG_DWORD 12 (0xc)
State REG_DWORD 0 (0x0)
RefCount REG_DWORD 1 (0x1)
Sid REG_BINARY 010100000000000512000000
ProfileImagePath REG_EXPAND_SZ %systemroot%\system32\config\systemprofile

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\profilelist\S-1-5-19
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\LocalService
Sid REG_BINARY 010100000000000513000000
Flags REG_DWORD 9 (0x9)
State REG_DWORD 0 (0x0)
CentralProfile REG_SZ
ProfileLoadTimeLow REG_DWORD 858229908 (0x33278c94)
ProfileLoadTimeHigh REG_DWORD 30063002 (0x1cab99a)
RefCount REG_DWORD 3 (0x3)

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\profilelist\S-1-5-20
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\NetworkService
Sid REG_BINARY 010100000000000514000000
Flags REG_DWORD 9 (0x9)
State REG_DWORD 0 (0x0)
CentralProfile REG_SZ
ProfileLoadTimeLow REG_DWORD 848386158 (0x3291586e)
ProfileLoadTimeHigh REG_DWORD 30063002 (0x1cab99a)
RefCount REG_DWORD 2 (0x2)

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\profilelist\S-1-5-21-1214440339-602609370-682003330-1000
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\HelpAssistant.JENSENS
Sid REG_BINARY 01050000000000051500000093e36248da16eb23828ba628e8030000
Flags REG_DWORD 1 (0x1)
State REG_DWORD 256 (0x100)
CentralProfile REG_SZ
ProfileLoadTimeLow REG_DWORD 1429914964 (0x553ac554)
ProfileLoadTimeHigh REG_DWORD 30061066 (0x1cab20a)
RefCount REG_DWORD 0 (0x0)

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\profilelist\S-1-5-21-1214440339-602609370-682003330-1003
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\Owner
Sid REG_BINARY 01050000000000051500000093e36248da16eb23828ba628eb030000
Flags REG_DWORD 0 (0x0)
State REG_DWORD 256 (0x100)
CentralProfile REG_SZ
ProfileLoadTimeLow REG_DWORD 1528698658 (0x5b1e1722)
ProfileLoadTimeHigh REG_DWORD 30063002 (0x1cab99a)
RefCount REG_DWORD 1 (0x1)
RunLogonScriptSync REG_DWORD 0 (0x0)
OptimizedLogonStatus REG_DWORD 11 (0xb)

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\profilelist\S-1-5-21-1214440339-602609370-682003330-1006
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\QBDataServiceUser
Sid REG_BINARY 01050000000000051500000093e36248da16eb23828ba628ee030000
Flags REG_DWORD 1 (0x1)
State REG_DWORD 0 (0x0)
CentralProfile REG_SZ
ProfileLoadTimeLow REG_DWORD 998229908 (0x3b7fc794)
ProfileLoadTimeHigh REG_DWORD 30063002 (0x1cab99a)
RefCount REG_DWORD 1 (0x1)

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\profilelist\S-1-5-21-1214440339-602609370-682003330-1007
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\HelpAssistant.JENSENS.000
Sid REG_BINARY 01050000000000051500000093e36248da16eb23828ba628ef030000
Flags REG_DWORD 1 (0x1)
State REG_DWORD 256 (0x100)
CentralProfile REG_SZ
ProfileLoadTimeLow REG_DWORD -1266069296 (0xb48950d0)
ProfileLoadTimeHigh REG_DWORD 30062000 (0x1cab5b0)
RefCount REG_DWORD 0 (0x0)

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\profilelist\S-1-5-21-1214440339-602609370-682003330-500
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\Administrator
Sid REG_BINARY 01050000000000051500000093e36248da16eb23828ba628f4010000
Flags REG_DWORD 0 (0x0)
State REG_DWORD 260 (0x104)
CentralProfile REG_SZ
ProfileLoadTimeLow REG_DWORD 666469788 (0x27b9859c)
ProfileLoadTimeHigh REG_DWORD 29996347 (0x1c9b53b)
RefCount REG_DWORD 0 (0x0)
RunLogonScriptSync REG_DWORD 0 (0x0)

SteelWerX Registry Console Tool 3.0
Written by Bobbi Flekman 2006 (C)

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\termservice\parameters
ServiceDll REG_EXPAND_SZ %SystemRoot%\System32\termsrv.dll
Certificate REG_BINARY 01000000010000000100000006005c005253413148000000000200003f0000000100010089c288264ae933f4519421ce4634af44ffe6c4c5c23b5d448970d0e5f0cc10bb46e2915f8eaf15e973900f302492ae95d67cdf7943160331d2e1769c973138d600000000000000000800480000d4fb42b4a710b7a4cc933bbaae8589927b38cad56058d3c7493d2fad47e0ffe42fdbe87f01406aacdc44c01061e26c37c727ccf6fc79fdc0e3ea005f5c34410000000000000000

When I double clicked on the fix.bat, it opened & closed like normal & opened a notepad file but it's blank...I have nothing to post from that.

Try this instead.

Now open a new Notepad file, and input this into the Notepad file:

@echo off
net user HelpAssistant.JENSENS>"%userprofile%\desktop\log.txt"
net user HelpAssistant.JENSENS.000>"%userprofile%\desktop\log.txt"
start notepad "%userprofile%\desktop\log.txt"
exit

Save this as fix.bat, save it to your desktop.
Double click fix.bat and the black cmd window will open and close, this is normal.

Still a blank notepad.

I tried your last instructions but it still comes up with a blank notepad........

Hello.

1. Please download The Avenger by Swandog46 to your Desktop
Link: HERE

• Click on Avenger.zip to open the file
  
• Extract avenger.exe to your desktop
  

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Folders to delete:
C:\Documents and Settings\HelpAssistant.JENSENS
C:\Documents and Settings\HelpAssistant.JENSENS.000

Registry keys to delete:
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\profilelist\S-1-5-21-1214440339-602609370-682003330-1000
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\profilelist\S-1-5-21-1214440339-602609370-682003330-1007

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

4. Please copy/paste the content of c:\avenger.txt into your reply.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Folder "C:\Documents and Settings\HelpAssistant.JENSENS" deleted successfully.
Folder "C:\Documents and Settings\HelpAssistant.JENSENS.000" deleted successfully.
Registry key "HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\profilelist\S-1-5-21-1214440339-602609370-682003330-1000" deleted successfully.
Registry key "HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\profilelist\S-1-5-21-1214440339-602609370-682003330-1007" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Well that worked.

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /uninstall

This will also reset your restore points.

How is the machine running now?

It is doing much better! Thank you! One problem I have & have had for a long time...just haven't done anything about it is my monitor switches colors...it rarely has color...it's like a green or grey hugh. Is there anything to fix it or do I just need a new monitor?

Probably a new monitor, the cable on it is dying.