Joe, Here's the Minitoolbox report, with the checks you prescribed. MiniToolBox by Farbar Version:10-01-2013 Ran by Owner (administrator) on 14-01-2013 at 22:51:53 Running from "C:\Documents and Settings\Owner\My Documents\Downloads" Microsoft Windows XP Service Pack 3 (X86) Boot Mode: Normal *************************************************************************** ========================= Event log errors: =============================== Application errors: ================== Error: (01/10/2013 07:49:26 PM) (Source: MsiInstaller) (User: JERRYGATEWAY) Description: Product: Microsoft .NET Framework 3.0 Service Pack 2 -- Error 2004. Method GetFontCacheDataFolder failed. HRESULT: 0x80004005. Error: (01/10/2013 07:49:26 PM) (Source: MsiInstaller) (User: JERRYGATEWAY) Description: Product: Microsoft .NET Framework 3.0 Service Pack 2 -- Error 2004. Method SHGetFolderPath failed. HRESULT: 0x80004005. Error: (01/10/2013 07:19:56 PM) (Source: PerfNet) (User: ) Description: Unable to read Server Queue performance data from the Server service. No Server Queue performance data will be returned in this sample. Error code returned is in data DWORD 0, IOSB.Status is DWORD 1 and the IOSB.Information is DWORD 2. Error: (01/10/2013 07:19:56 PM) (Source: PerfNet) (User: ) Description: Unable to read performance data from the Server service. No Server performance data will be returned in this sample. Error code returned is in data DWORD 0, IOSB.Status is DWORD 1 and the IOSB.Information is DWORD 2. Error: (11/20/2012 08:44:35 AM) (Source: ESENT) (User: ) Description: svchost (1344) An attempt to open the file "C:\WINDOWS\system32\CatRoot2\(F750E6C3-38EE-11D1-85E5-00C04FC295EE)\catdb" for read / write access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8). Error: (11/15/2012 05:33:50 PM) (Source: LoadPerf) (User: ) Description: The performance counter name string value in the registry is incorrectly formatted. The bogus string is 18846, the bogus index value is the first DWORD in Data section while the last valid index values are the second and third DWORD in Data section. Error: (11/15/2012 05:33:47 PM) (Source: LoadPerf) (User: ) Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The Error code is the first DWORD in Data section. Error: (11/15/2012 05:33:47 PM) (Source: LoadPerf) (User: ) Description: The performance counter name string value in the registry is incorrectly formatted. The bogus string is 18846, the bogus index value is the first DWORD in Data section while the last valid index values are the second and third DWORD in Data section. Error: (11/04/2012 06:09:27 PM) (Source: MPSampleSubmission) (User: ) Description: EventType mptelemetry, P1 8024402c, P2 endsearch, P3 search, P4 1.1.1593.0, P5 mpsigdwn.dll, P6 1.1.1593.0, P7 windows defender, P8 NIL, P9 mptelemetry0, P10 mptelemetry1. Error: (11/04/2012 05:34:03 PM) (Source: MPSampleSubmission) (User: ) Description: EventType mptelemetry, P1 8024402c, P2 endsearch, P3 search, P4 1.1.1593.0, P5 mpsigdwn.dll, P6 1.1.1593.0, P7 windows defender, P8 NIL, P9 mptelemetry0, P10 mptelemetry1. System errors: ============= Error: (01/13/2013 08:37:24 AM) (Source: Print) (User: NT AUTHORITY) Description: Sharing printer failed + 1722, Printer PageManager PDF Writer share name Printer2. Error: (01/12/2013 07:44:35 PM) (Source: Service Control Manager) (User: ) Description: The Application Management service terminated with the following error: %%2 Error: (01/12/2013 07:44:35 PM) (Source: Service Control Manager) (User: ) Description: The Application Management service terminated with the following error: %%2 Error: (01/12/2013 07:44:35 PM) (Source: Service Control Manager) (User: ) Description: The Application Management service terminated with the following error: %%2 Error: (01/12/2013 07:44:35 PM) (Source: Service Control Manager) (User: ) Description: The Application Management service terminated with the following error: %%2 Error: (01/12/2013 07:44:34 PM) (Source: Service Control Manager) (User: ) Description: The Application Management service terminated with the following error: %%2 Error: (01/12/2013 07:44:34 PM) (Source: Service Control Manager) (User: ) Description: The Application Management service terminated with the following error: %%2 Error: (01/12/2013 07:44:34 PM) (Source: Service Control Manager) (User: ) Description: The Application Management service terminated with the following error: %%2 Error: (01/12/2013 07:44:34 PM) (Source: Service Control Manager) (User: ) Description: The Application Management service terminated with the following error: %%2 Error: (01/12/2013 07:44:34 PM) (Source: Service Control Manager) (User: ) Description: The Application Management service terminated with the following error: %%2 Microsoft Office Sessions: ========================= =========================== Installed Programs ============================ 7-Zip 4.65 Adobe Acrobat 7.0 Professional (Version: 7.1.0) Adobe Acrobat 7.0.9 Professional (Version: 7.0.9) Adobe Flash Player 10 ActiveX (Version: 10.0.45.2) Adobe Flash Player 11 Plugin (Version: 11.5.502.146) Adobe Reader 9.5.2 (Version: 9.5.2) Advanced SystemCare 6 (Version: 6.0) Apple Application Support (Version: 2.3.2) Apple Mobile Device Support (Version: 6.0.1.3) Apple Software Update (Version: 2.1.3.127) ArcSoft PhotoImpression 5 AstroViewer 3.1.5 Audacity 1.2.6 Autostar Suite Autostar Suite Astronomers Edition Avira Free Antivirus (Version: 12.1.9.1236) Blackhawk Striker 2 (Version: WT010647) Blasterball 2 Revolution (Version: WT010648) Bonjour (Version: 3.0.0.10) Broadcom 802.11 Network Adapter (Version: 4.10.47.0) Browser Address Error Redirector Browser MOUSE CCleaner (Version: 2.29) Critical Update for Windows Media Player 11 (KB959772) DiMAGE Viewer DVD Solution EPSON Attach To Email (Version: 1.01.0000) EPSON Perfection V100 Photo Scanner Driver Update EPSON Perfection V100P User's Guide EPSON Printer Software EPSON Scan Eraser Eraser (Version: 5.84) ESET Online Scanner v3 EZ Vinyl Converter 2.0.0 by MixMeister Garmin City Navigator North America NT 2010.20 (Version: 13.20.0.0) Garmin Communicator Plugin (Version: 2.8.3) Garmin USB Drivers (Version: 2.3.0.0) Gateway Game Console Google Chrome (Version: 23.0.1271.97) Google Toolbar for Internet Explorer Google Update Helper (Version: 1.3.21.123) GoToAssist Corporate (Version: 9.0.0.570) gtw_logo High Definition Audio Driver Package - KB888111 (Version: 20040219.000000) ImgBurn (Version: 2.5.0.0) Intel Matrix Storage Manager Intel(R) Graphics Media Accelerator Driver (Version: 6.14.10.4543) IrfanView (remove only) iTunes (Version: 11.0.1.12) Japanese Fonts Support For Adobe Reader 9 (Version: 9.0.0) Lexmark 8300 Series Malwarebytes Anti-Malware version 1.70.0.1100 (Version: 1.70.0.1100) Maxtor Backup (Version: 1.00.0040) Maxtor Encryption (Version: 1.01.0040) Maxtor OneTouch III (Version: 3.02.0040) McAfee Security Scan Plus (Version: 2.1.121.2) Microsoft .NET Framework 1.1 (Version: 1.1.4322) Microsoft .NET Framework 1.1 Security Update (KB2698023) Microsoft .NET Framework 1.1 Security Update (KB2742597) Microsoft .NET Framework 1.1 Security Update (KB979906) Microsoft .NET Framework 2.0 Service Pack 2 (Version: 2.2.30729) Microsoft .NET Framework 3.0 Service Pack 2 (Version: 3.2.30729) Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729) Microsoft Application Error Reporting (Version: 12.0.6012.5000) Microsoft Compression Client Pack 1.0 for Windows XP (Version: 1) Microsoft IntelliPoint 7.1 (Version: 7.10.344.0) Microsoft Internationalized Domain Names Mitigation APIs Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 Microsoft National Language Support Downlevel APIs Microsoft Outlook 2002 (Version: 10.0.6626.0) Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs (Version: 12.0.4518.1014) Microsoft Text-to-Speech Engine 4.0 (English) Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft Works (Version: 08.05.0818) Motorola SM56 Speakerphone Modem Mozilla Firefox 18.0 (x86 en-US) (Version: 18.0) Mozilla Maintenance Service (Version: 18.0) Mozilla Thunderbird (2.0.0.24) (Version: 2.0.0.24 (en-US)) MSXML 4.0 SP2 (KB927978) (Version: 4.20.9841.0) MSXML 4.0 SP2 (KB936181) (Version: 4.20.9848.0) MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0) Napster (Version: 3.0.3.7) Napster Burn Engine (Version: 2.5.0000) OpenOffice.org 3.3 (Version: 3.3.9567) Palm (Version: 4.1.0420) Pdf995 (installed by TaxCut) PdfEdit995 (installed by TaxCut) Penguins! (Version: WT010651) Polar Bowler (Version: WT010660) Polar Golfer (Version: WT010661) Power2Go 4.0 PowerDVD Presto! Forms 3.50.01 Presto! PageManager 7.12.02 Print to Fax (Version: 1.00) QuickTime (Version: 7.73.80.64) RealPlayer Basic Recover My Photos (Version: 3.6.1.60) Recovery Software Suite Gateway (Version: 1.00.0000) Registry Mechanic 6.0 (Version: 6.0) SCRABBLE (Version: WT010654) SigmaTel Audio (Version: 5.10.4803.0) Spelling Dictionaries Support For Adobe Reader 9 (Version: 9.0.0) Spybot - Search & Destroy (Version: 1.6.2) SUPERAntiSpyware (Version: 5.6.1012) Synaptics Pointing Device Driver (Version: 7.12.3.0) TaxACT 2008 TaxACT 2009 TaxACT 2010 TaxACT 2011 - 1040 Edition TaxCut Premium 2007 (Version: 07.03.0000) Texas Instruments PCIxx21/x515/xx12 drivers. (Version: 1.15.0000) TIPCI (Version: 1.15.0000) Tradewinds (Version: WT010655) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1) Update for Windows Internet Explorer 8 (KB968220) (Version: 1) Update for Windows Internet Explorer 8 (KB976662) (Version: 1) Update for Windows Internet Explorer 8 (KB976749) (Version: 1) Update for Windows Internet Explorer 8 (KB980182) (Version: 1) Update for Windows XP (KB2141007) (Version: 1) Update for Windows XP (KB2345886) (Version: 1) Update for Windows XP (KB2467659) (Version: 1) Update for Windows XP (KB2541763) (Version: 1) Update for Windows XP (KB2616676-v2) (Version: 2) Update for Windows XP (KB2616676) (Version: 1) Update for Windows XP (KB2641690) (Version: 1) Update for Windows XP (KB2661254-v2) (Version: 2) Update for Windows XP (KB2718704) (Version: 1) Update for Windows XP (KB2736233) (Version: 1) Update for Windows XP (KB2749655) (Version: 1) Update for Windows XP (KB951072-v2) (Version: 2) Update for Windows XP (KB951978) (Version: 1) Update for Windows XP (KB955759) (Version: 1) Update for Windows XP (KB955839) (Version: 1) Update for Windows XP (KB967715) (Version: 1) Update for Windows XP (KB968389) (Version: 1) Update for Windows XP (KB971029) (Version: 1) Update for Windows XP (KB971737) (Version: 1) Update for Windows XP (KB973687) (Version: 1) Update for Windows XP (KB973815) (Version: 1) ViewMate Desktop Mouse CC2201 Uninstaller Viewpoint Media Player Virtual Account Numbers (Version: 1.0.0.9) Virtual Account Numbers (Version: 3.7.11.0) Virtual Moon Atlas WebFldrs XP (Version: 9.50.7523) Windows Backup Utility (Version: 5.1) Windows Defender (Version: 1.1.1593.21) Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0) (Version: 06/03/2009 2.3.0.0) Windows Genuine Advantage Notifications (KB905474) (Version: 1.7.0017.0) Windows Genuine Advantage Validation Tool (KB892130) Windows Genuine Advantage Validation Tool (KB892130) (Version: 1.7.0069.2) Windows Internet Explorer 7 (Version: 20061107.210142) Windows Internet Explorer 8 (Version: 20090308.140743) Windows Media Format 11 runtime Windows XP Service Pack 3 (Version: 20080414.031525) Yahoo! Install Manager Yahoo! Toolbar ========================= Memory info: =================================== Percentage of memory in use: 76% Total physical RAM: 1014.11 MB Available physical RAM: 240.46 MB Total Pagefile: 1915.69 MB Available Pagefile: 758.2 MB Total Virtual: 2047.88 MB Available Virtual: 1994.31 MB ========================= Partitions: ===================================== 1 Drive c: () (Fixed) (Total:67.68 GB) (Free:24.96 GB) NTFS 2 Drive d: (RECOVERY) (Fixed) (Total:6.83 GB) (Free:4.77 GB) FAT32 ========================= Users: ======================================== User accounts for \\JERRYGATEWAY Administrator ASPNET Guest HelpAssistant Owner SUPPORT_388945a0 **** End of log ****

Unbeknownst to its users, Webshots employed its Webshots Desktop Application (a free program that users can download from their site to manage their online pictures) to install the Kiwee Toolbar as part of a software update for this program. Other than the Wikipedia article (whose references don't appear to have anything to do with the surreptitious installation of Kiwee) and complaints in support forums about problems getting it off a computer, I don't see anything about it being forced on users. Was it one of the many tools bars included with software that installed by default but unchecking a box provided an opt-out? I just don't know. Although several of the search hits I saw included the word "unbeknownst" which leaves me wondering if they were written by the same person or several people parroting the others. In any case, it seems more a case of poorly written code and even poorer judgment on the part of American Greetings than malware. American Greetings does offer instructions on how to remove Kiwee although it sounds like you need to install the latest, greatest version first. I'm not sure I'd be jumping at at offer. Gosh Durn Mike ~ Don't be so rude & judgemental! I didn't get "glitter text" intentionally. Do you have any idea of the number of computers I've looked at with upwards of a half dozen different tools bars installed? Every user claimed they never installed them. Yes they did, when the went click, click, click without bothering to read what was on the screen. Now maybe I got up on my soapbox a little too soon and American Greetings did install poorly written software on their customers' computers without their customers knowledge or consent. If that is the case, I would be writing a nice letter to Mr. Weiss letting him know why he won't be getting any more of my money. Even if it meant giving up a really pretty screen saver.

if it is his regular pc it is windows 2000 I do believe. Shax can you get to safe mode at all? if so you can run malwarebytes in safe mode, it sounds like it could be something from that update that did not agree with your system. I just don't know much about windows 2000. You could try to get a linux live cd and stick it in the cd drive and see if it will boot to the live cd and using it you could at least see your windows partition and save your files. Use Ubuntu Live CD to Backup Files from Your Dead Windows Computer Geek to Live: Rescue files with a boot CD oh yes you were using a registry cleaner??? hum well that could definitely cause some issues, do you happen to know if that one you used created a back up of your registry? Not that it will help very much if you can not get to boot.

Today we cannot simply click to download and install programs because so many companies allow other things to be piggybacked in for a fee. During the install we now need to carefully view each screen where choices are available to ensure we not not have the situation you have found yourself in. AVG itself is good, no problem there. To get rid of the Google toolbar click on an open areas on the top toolbars and in the drop down menu you should be able to remove the check mark beside Google. Regarding the critical files you had listed you could download and install Superantispyware, update the definitions and run a full scan. Be sure to click on the blue button for the free version, not the green free trial version. This is an excellent program. You could/should also do a free online scan at Housecall or a similar site if you have a favourite. If this happened very recently you might consider using the System Restore feature on your computer and go back to a date prior to these events. However you should still seriously consider doing the scans.