NEED HELP PLEASE

. . i cant locate HKLM . . .how do i find it where will it be ? ?

Click Start
CLick Run
type in regedit and click Enter.

This will open registry editor.
In the left pane, you will see 5 lines as follows:
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_CURRENT_CONFIG

These are abbreviated to
HKCR
HKCU
HKLM
HKU
HKCC

Makes sense now?

This is the first one Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe"
"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe"
"SoundMan"="SOUNDMAN.EXE"
"AlcWzrd"="ALCWZRD.EXE"
"Alcmtr"="ALCMTR.EXE"
"HP Software Update"="\"C:\\Program Files\\HP\\HP Software Update\\HPWuSchd.exe\""
"HP Component Manager"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\""
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"InCD"="C:\\Program Files\\Ahead\\InCD\\InCD.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"msnappau"="\"C:\\Program Files\\MSN Apps\\Updater\\01.02.3000.1001\\en-us\\msnappau.exe\""
"Universal USB Service"="svchost32.exe"
"MSConfig"="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe /auto"
"gcasServ"="\"C:\\Program Files\\Microsoft AntiSpyware\\gcasServ.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

This is the second one
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"Yahoo! Pager"="C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe -quiet"
"ares"="\"C:\\Program Files\\Ares\\Ares.exe\" -h"
"Windows Registry Repair Pro"="C:\\Program Files\\3B Software\\Windows Registry Repair Pro\\RegistryRepairPro.exe 4"
"Spyware Doctor"="C:\\PROGRA~1\\SPYWAR~1\\swdoctor.exe /Q"
"SpySweeper"="\"C:\\Program Files\\Webroot\\Spy Sweeper\\SpySweeper.exe\" /0"
"MessengerPlus3"="\"\\\" /WinStart"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"


THis is hte third one
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Controls Folder]
"Presentation LCID"=dword:00000409
"Presentation Cache"=hex:c4,00,00,00,01,00,00,00,00,e4,c3,08,9d,2b,c1,01,00,00,\
00,00,00,4a,02,00,64,00,00,00,1f,00,00,00,2c,00,00,00,43,00,3a,00,5c,00,57,\
00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,00,53,00,79,00,73,00,74,00,65,00,\
6d,00,33,00,32,00,5c,00,68,00,64,00,77,00,77,00,69,00,7a,00,2e,00,63,00,70,\
00,6c,00,00,00,41,00,64,00,64,00,20,00,48,00,61,00,72,00,64,00,77,00,61,00,\
72,00,65,00,00,00,49,00,6e,00,73,00,74,00,61,00,6c,00,6c,00,73,00,20,00,61,\
00,6e,00,64,00,20,00,74,00,72,00,6f,00,75,00,62,00,6c,00,65,00,73,00,68,00,\
6f,00,6f,00,74,00,73,00,20,00,68,00,61,00,72,00,64,00,77,00,61,00,72,00,65,\
00,00,00,58,01,00,00,01,00,00,00,00,e4,c3,08,9d,2b,c1,01,00,00,00,00,00,de,\
02,00,64,00,00,00,1d,00,00,00,23,00,00,00,43,00,3a,00,5c,00,57,00,49,00,4e,\
00,44,00,4f,00,57,00,53,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,\
32,00,5c,00,6d,00,61,00,69,00,6e,00,2e,00,63,00,70,00,6c,00,00,00,4d,00,6f,\
00,75,00,73,00,65,00,00,00,43,00,75,00,73,00,74,00,6f,00,6d,00,69,00,7a,00,\
65,00,20,00,79,00,6f,00,75,00,72,00,20,00,6d,00,6f,00,75,00,73,00,65,00,20,\
00,73,00,65,00,74,00,74,00,69,00,6e,00,67,00,73,00,2c,00,20,00,73,00,75,00,\
63,00,68,00,20,00,61,00,73,00,20,00,74,00,68,00,65,00,20,00,62,00,75,00,74,\
00,74,00,6f,00,6e,00,20,00,63,00,6f,00,6e,00,66,00,69,00,67,00,75,00,72,00,\
61,00,74,00,69,00,6f,00,6e,00,2c,00,20,00,64,00,6f,00,75,00,62,00,6c,00,65,\
00,2d,00,63,00,6c,00,69,00,63,00,6b,00,20,00,73,00,70,00,65,00,65,00,64,00,\
2c,00,20,00,6d,00,6f,00,75,00,73,00,65,00,20,00,70,00,6f,00,69,00,6e,00,74,\
00,65,00,72,00,73,00,2c,00,20,00,61,00,6e,00,64,00,20,00,6d,00,6f,00,74,00,\
69,00,6f,00,6e,00,20,00,73,00,70,00,65,00,65,00,64,00,2e,00,00,00,30,01,00,\
00,01,00,00,00,00,e4,c3,08,9d,2b,c1,01,00,00,00,00,00,de,02,00,c8,00,00,00,\
1d,00,00,00,26,00,00,00,43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,\
00,53,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,6d,00,\
61,00,69,00,6e,00,2e,00,63,00,70,00,6c,00,00,00,4b,00,65,00,79,00,62,00,6f,\
00,61,00,72,00,64,00,00,00,43,00,75,00,73,00,74,00,6f,00,6d,00,69,00,7a,00,\
65,00,20,00,79,00,6f,00,75,00,72,00,20,00,6b,00,65,00,79,00,62,00,6f,00,61,\
00,72,00,64,00,20,00,73,00,65,00,74,00,74,00,69,00,6e,00,67,00,73,00,2c,00,\
20,00,73,00,75,00,63,00,68,00,20,00,61,00,73,00,20,00,74,00,68,00,65,00,20,\
00,63,00,75,00,72,00,73,00,6f,00,72,00,20,00,62,00,6c,00,69,00,6e,00,6b,00,\
20,00,72,00,61,00,74,00,65,00,20,00,61,00,6e,00,64,00,20,00,74,00,68,00,65,\
00,20,00,63,00,68,00,61,00,72,00,61,00,63,00,74,00,65,00,72,00,20,00,72,00,\
65,00,70,00,65,00,61,00,74,00,20,00,72,00,61,00,74,00,65,00,2e,00,00,00,00,\
00,70,01,00,00,01,00,00,00,00,e4,c3,08,9d,2b,c1,01,00,00,00,00,00,8a,08,00,\
bc,0b,00,00,1e,00,00,00,37,00,00,00,43,00,3a,00,5c,00,57,00,49,00,4e,00,44,\
00,4f,00,57,00,53,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,\
5c,00,6d,00,6d,00,73,00,79,00,73,00,2e,00,63,00,70,00,6c,00,00,00,53,00,6f,\
00,75,00,6e,00,64,00,73,00,20,00,61,00,6e,00,64,00,20,00,41,00,75,00,64,00,\
69,00,6f,00,20,00,44,00,65,00,76,00,69,00,63,00,65,00,73,00,00,00,43,00,68,\
00,61,00,6e,00,67,00,65,00,20,00,74,00,68,00,65,00,20,00,73,00,6f,00,75,00,\
6e,00,64,00,20,00,73,00,63,00,68,00,65,00,6d,00,65,00,20,00,66,00,6f,00,72,\
00,20,00,79,00,6f,00,75,00,72,00,20,00,63,00,6f,00,6d,00,70,00,75,00,74,00,\
65,00,72,00,2c,00,20,00,6f,00,72,00,20,00,63,00,6f,00,6e,00,66,00,69,00,67,\
00,75,00,72,00,65,00,20,00,74,00,68,00,65,00,20,00,73,00,65,00,74,00,74,00,\
69,00,6e,00,67,00,73,00,20,00,66,00,6f,00,72,00,20,00,79,00,6f,00,75,00,72,\
00,20,00,73,00,70,00,65,00,61,00,6b,00,65,00,72,00,73,00,20,00,61,00,6e,00,\
64,00,20,00,72,00,65,00,63,00,6f,00,72,00,64,00,69,00,6e,00,67,00,20,00,64,\
00,65,00,76,00,69,00,63,00,65,00,73,00,2e,00,00,00,00,00,20,01,00,00,01,00,\
00,00,00,e4,c3,08,9d,2b,c1,01,00,00,00,00,00,e8,03,00,c8,00,00,00,20,00,00,\
00,2e,00,00,00,43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,\
5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,6e,00,75,00,73,\
00,72,00,6d,00,67,00,72,00,2e,00,63,00,70,00,6c,00,00,00,55,00,73,00,65,00,\
72,00,20,00,41,00,63,00,63,00,6f,00,75,00,6e,00,74,00,73,00,00,00,43,00,68,\
00,61,00,6e,00,67,00,65,00,20,00,75,00,73,00,65,00,72,00,20,00,61,00,63,00,\
63,00,6f,00,75,00,6e,00,74,00,20,00,73,00,65,00,74,00,74,00,69,00,6e,00,67,\
00,73,00,20,00,61,00,6e,00,64,00,20,00,70,00,61,00,73,00,73,00,77,00,6f,00,\
72,00,64,00,73,00,20,00,66,00,6f,00,72,00,20,00,70,00,65,00,6f,00,70,00,6c,\
00,65,00,20,00,77,00,68,00,6f,00,20,00,73,00,68,00,61,00,72,00,65,00,20,00,\
74,00,68,00,69,00,73,00,20,00,63,00,6f,00,6d,00,70,00,75,00,74,00,65,00,72,\
00,2e,00,00,00,00,00,ec,00,00,00,01,00,00,00,00,e4,c3,08,9d,2b,c1,01,00,00,\
00,00,00,aa,01,00,ca,00,00,00,21,00,00,00,2f,00,00,00,43,00,3a,00,5c,00,57,\
00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,00,53,00,79,00,73,00,74,00,65,00,\
6d,00,33,00,32,00,5c,00,70,00,6f,00,77,00,65,00,72,00,63,00,66,00,67,00,2e,\
00,63,00,70,00,6c,00,00,00,50,00,6f,00,77,00,65,00,72,00,20,00,4f,00,70,00,\
74,00,69,00,6f,00,6e,00,73,00,00,00,43,00,6f,00,6e,00,66,00,69,00,67,00,75,\
00,72,00,65,00,20,00,65,00,6e,00,65,00,72,00,67,00,79,00,2d,00,73,00,61,00,\
76,00,69,00,6e,00,67,00,20,00,73,00,65,00,74,00,74,00,69,00,6e,00,67,00,73,\
00,20,00,66,00,6f,00,72,00,20,00,79,00,6f,00,75,00,72,00,20,00,63,00,6f,00,\
6d,00,70,00,75,00,74,00,65,00,72,00,2e,00,00,00,00,00,28,01,00,00,01,00,00,\
00,40,57,c4,ee,50,34,c5,01,00,00,00,00,00,2a,03,00,66,00,00,00,1c,00,00,00,\
2d,00,00,00,43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,\
00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,6a,00,6f,00,79,00,\
2e,00,63,00,70,00,6c,00,00,00,47,00,61,00,6d,00,65,00,20,00,43,00,6f,00,6e,\
00,74,00,72,00,6f,00,6c,00,6c,00,65,00,72,00,73,00,00,00,41,00,64,00,64,00,\
2c,00,20,00,72,00,65,00,6d,00,6f,00,76,00,65,00,2c,00,20,00,61,00,6e,00,64,\
00,20,00,63,00,6f,00,6e,00,66,00,69,00,67,00,75,00,72,00,65,00,20,00,67,00,\
61,00,6d,00,65,00,20,00,63,00,6f,00,6e,00,74,00,72,00,6f,00,6c,00,6c,00,65,\
00,72,00,20,00,68,00,61,00,72,00,64,00,77,00,61,00,72,00,65,00,20,00,73,00,\
75,00,63,00,68,00,20,00,61,00,73,00,20,00,6a,00,6f,00,79,00,73,00,74,00,69,\
00,63,00,6b,00,73,00,20,00,61,00,6e,00,64,00,20,00,67,00,61,00,6d,00,65,00,\
70,00,61,00,64,00,73,00,2e,00,00,00,00,00,0c,01,00,00,01,00,00,00,00,e4,c3,\
08,9d,2b,c1,01,00,00,00,00,00,6e,00,00,64,00,00,00,21,00,00,00,39,00,00,00,\
43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,00,53,00,79,\
00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,74,00,65,00,6c,00,65,00,70,00,\
68,00,6f,00,6e,00,2e,00,63,00,70,00,6c,00,00,00,50,00,68,00,6f,00,6e,00,65,\
00,20,00,61,00,6e,00,64,00,20,00,4d,00,6f,00,64,00,65,00,6d,00,20,00,4f,00,\
70,00,74,00,69,00,6f,00,6e,00,73,00,00,00,43,00,6f,00,6e,00,66,00,69,00,67,\
00,75,00,72,00,65,00,20,00,79,00,6f,00,75,00,72,00,20,00,74,00,65,00,6c,00,\
65,00,70,00,68,00,6f,00,6e,00,65,00,20,00,64,00,69,00,61,00,6c,00,69,00,6e,\
00,67,00,20,00,72,00,75,00,6c,00,65,00,73,00,20,00,61,00,6e,00,64,00,20,00,\
6d,00,6f,00,64,00,65,00,6d,00,20,00,73,00,65,00,74,00,74,00,69,00,6e,00,67,\
00,73,00,2e,00,00,00,ec,00,00,00,01,00,00,00,00,e4,c3,08,9d,2b,c1,01,00,00,\
00,00,00,60,01,00,c8,00,00,00,21,00,00,00,2f,00,00,00,43,00,3a,00,5c,00,57,\
00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,00,53,00,79,00,73,00,74,00,65,00,\
6d,00,33,00,32,00,5c,00,74,00,69,00,6d,00,65,00,64,00,61,00,74,00,65,00,2e,\
00,63,00,70,00,6c,00,00,00,44,00,61,00,74,00,65,00,20,00,61,00,6e,00,64,00,\
20,00,54,00,69,00,6d,00,65,00,00,00,53,00,65,00,74,00,20,00,74,00,68,00,65,\
00,20,00,64,00,61,00,74,00,65,00,2c,00,20,00,74,00,69,00,6d,00,65,00,2c,00,\
20,00,61,00,6e,00,64,00,20,00,74,00,69,00,6d,00,65,00,20,00,7a,00,6f,00,6e,\
00,65,00,20,00,66,00,6f,00,72,00,20,00,79,00,6f,00,75,00,72,00,20,00,63,00,\
6f,00,6d,00,70,00,75,00,74,00,65,00,72,00,2e,00,00,00,60,01,00,00,01,00,00,\
00,00,e8,f0,cc,9c,4e,c2,01,00,00,00,00,00,f8,01,00,64,00,00,00,1d,00,00,00,\
25,00,00,00,43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,\
00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,65,00,73,00,\
6b,00,2e,00,63,00,70,00,6c,00,00,00,44,00,69,00,73,00,70,00,6c,00,61,00,79,\
00,00,00,43,00,68,00,61,00,6e,00,67,00,65,00,20,00,74,00,68,00,65,00,20,00,\
61,00,70,00,70,00,65,00,61,00,72,00,61,00,6e,00,63,00,65,00,20,00,6f,00,66,\
00,20,00,79,00,6f,00,75,00,72,00,20,00,64,00,65,00,73,00,6b,00,74,00,6f,00,\
70,00,2c,00,20,00,73,00,75,00,63,00,68,00,20,00,61,00,73,00,20,00,74,00,68,\
00,65,00,20,00,62,00,61,00,63,00,6b,00,67,00,72,00,6f,00,75,00,6e,00,64,00,\
2c,00,20,00,73,00,63,00,72,00,65,00,65,00,6e,00,20,00,73,00,61,00,76,00,65,\
00,72,00,2c,00,20,00,63,00,6f,00,6c,00,6f,00,72,00,73,00,2c,00,20,00,66,00,\
6f,00,6e,00,74,00,20,00,73,00,69,00,7a,00,65,00,73,00,2c,00,20,00,61,00,6e,\
00,64,00,20,00,73,00,63,00,72,00,65,00,65,00,6e,00,20,00,72,00,65,00,73,00,\
6f,00,6c,00,75,00,74,00,69,00,6f,00,6e,00,2e,00,00,00,00,00,f8,00,00,00,01,\
00,00,00,00,e8,f0,cc,9c,4e,c2,01,00,00,00,00,00,d4,08,00,dc,05,00,00,1f,00,\
00,00,36,00,00,00,43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,61,00,70,00,\
70,00,77,00,69,00,7a,00,2e,00,63,00,70,00,6c,00,00,00,41,00,64,00,64,00,20,\
00,6f,00,72,00,20,00,52,00,65,00,6d,00,6f,00,76,00,65,00,20,00,50,00,72,00,\
6f,00,67,00,72,00,61,00,6d,00,73,00,00,00,49,00,6e,00,73,00,74,00,61,00,6c,\
00,6c,00,20,00,6f,00,72,00,20,00,72,00,65,00,6d,00,6f,00,76,00,65,00,20,00,\
70,00,72,00,6f,00,67,00,72,00,61,00,6d,00,73,00,20,00,61,00,6e,00,64,00,20,\
00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,63,00,6f,00,6d,00,70,00,\
6f,00,6e,00,65,00,6e,00,74,00,73,00,2e,00,00,00,00,00,f8,00,00,00,01,00,00,\
00,00,e8,f0,cc,9c,4e,c2,01,00,00,00,00,00,76,04,00,87,11,00,00,20,00,00,00,\
31,00,00,00,43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,\
00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,69,00,6e,00,65,00,\
74,00,63,00,70,00,6c,00,2e,00,63,00,70,00,6c,00,00,00,49,00,6e,00,74,00,65,\
00,72,00,6e,00,65,00,74,00,20,00,4f,00,70,00,74,00,69,00,6f,00,6e,00,73,00,\
00,00,43,00,6f,00,6e,00,66,00,69,00,67,00,75,00,72,00,65,00,20,00,79,00,6f,\
00,75,00,72,00,20,00,49,00,6e,00,74,00,65,00,72,00,6e,00,65,00,74,00,20,00,\
64,00,69,00,73,00,70,00,6c,00,61,00,79,00,20,00,61,00,6e,00,64,00,20,00,63,\
00,6f,00,6e,00,6e,00,65,00,63,00,74,00,69,00,6f,00,6e,00,20,00,73,00,65,00,\
74,00,74,00,69,00,6e,00,67,00,73,00,2e,00,00,00,34,01,00,00,01,00,00,00,00,\
e8,f0,cc,9c,4e,c2,01,00,00,00,00,00,dc,01,00,c8,00,00,00,1d,00,00,00,3b,00,\
00,00,43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,00,53,\
00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,69,00,6e,00,74,00,6c,00,\
2e,00,63,00,70,00,6c,00,00,00,52,00,65,00,67,00,69,00,6f,00,6e,00,61,00,6c,\
00,20,00,61,00,6e,00,64,00,20,00,4c,00,61,00,6e,00,67,00,75,00,61,00,67,00,\
65,00,20,00,4f,00,70,00,74,00,69,00,6f,00,6e,00,73,00,00,00,43,00,75,00,73,\
00,74,00,6f,00,6d,00,69,00,7a,00,65,00,20,00,73,00,65,00,74,00,74,00,69,00,\
6e,00,67,00,73,00,20,00,66,00,6f,00,72,00,20,00,74,00,68,00,65,00,20,00,64,\
00,69,00,73,00,70,00,6c,00,61,00,79,00,20,00,6f,00,66,00,20,00,6c,00,61,00,\
6e,00,67,00,75,00,61,00,67,00,65,00,73,00,2c,00,20,00,6e,00,75,00,6d,00,62,\
00,65,00,72,00,73,00,2c,00,20,00,74,00,69,00,6d,00,65,00,73,00,2c,00,20,00,\
61,00,6e,00,64,00,20,00,64,00,61,00,74,00,65,00,73,00,2e,00,00,00,00,00,54,\
01,00,00,01,00,00,00,00,e8,f0,cc,9c,4e,c2,01,00,00,00,00,00,18,04,00,01,00,\
00,00,1e,00,00,00,25,00,00,00,43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,\
00,57,00,53,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
73,00,79,00,73,00,64,00,6d,00,2e,00,63,00,70,00,6c,00,00,00,53,00,79,00,73,\
00,74,00,65,00,6d,00,00,00,53,00,65,00,65,00,20,00,69,00,6e,00,66,00,6f,00,\
72,00,6d,00,61,00,74,00,69,00,6f,00,6e,00,20,00,61,00,62,00,6f,00,75,00,74,\
00,20,00,79,00,6f,00,75,00,72,00,20,00,63,00,6f,00,6d,00,70,00,75,00,74,00,\
65,00,72,00,20,00,73,00,79,00,73,00,74,00,65,00,6d,00,2c,00,20,00,61,00,6e,\
00,64,00,20,00,63,00,68,00,61,00,6e,00,67,00,65,00,20,00,73,00,65,00,74,00,\
74,00,69,00,6e,00,67,00,73,00,20,00,66,00,6f,00,72,00,20,00,68,00,61,00,72,\
00,64,00,77,00,61,00,72,00,65,00,2c,00,20,00,70,00,65,00,72,00,66,00,6f,00,\
72,00,6d,00,61,00,6e,00,63,00,65,00,2c,00,20,00,61,00,6e,00,64,00,20,00,61,\
00,75,00,74,00,6f,00,6d,00,61,00,74,00,69,00,63,00,20,00,75,00,70,00,64,00,\
61,00,74,00,65,00,73,00,2e,00,00,00,00,00,10,01,00,00,01,00,00,00,60,4e,13,\
f5,48,34,c5,01,00,00,00,00,00,02,01,00,6e,00,00,00,1f,00,00,00,35,00,00,00,\
43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,5c,00,53,00,79,\
00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,61,00,63,00,63,00,65,00,73,00,\
73,00,2e,00,63,00,70,00,6c,00,00,00,41,00,63,00,63,00,65,00,73,00,73,00,69,\
00,62,00,69,00,6c,00,69,00,74,00,79,00,20,00,4f,00,70,00,74,00,69,00,6f,00,\
6e,00,73,00,00,00,41,00,64,00,6a,00,75,00,73,00,74,00,20,00,79,00,6f,00,75,\
00,72,00,20,00,63,00,6f,00,6d,00,70,00,75,00,74,00,65,00,72,00,20,00,73,00,\
65,00,74,00,74,00,69,00,6e,00,67,00,73,00,20,00,66,00,6f,00,72,00,20,00,76,\
00,69,00,73,00,69,00,6f,00,6e,00,2c,00,20,00,68,00,65,00,61,00,72,00,69,00,\
6e,00,67,00,2c,00,20,00,61,00,6e,00,64,00,20,00,6d,00,6f,00,62,00,69,00,6c,\
00,69,00,74,00,79,00,2e,00,00,00,4c,01,00,00,01,00,00,00,e0,34,b5,1a,48,34,\
c5,01,00,00,00,00,00,40,02,00,8a,00,00,00,3f,00,00,00,46,00,00,00,43,00,3a,\
00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,\
65,00,73,00,5c,00,43,00,6f,00,6d,00,6d,00,6f,00,6e,00,20,00,46,00,69,00,6c,\
00,65,00,73,00,5c,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,\
20,00,53,00,68,00,61,00,72,00,65,00,64,00,5c,00,53,00,70,00,65,00,65,00,63,\
00,68,00,5c,00,73,00,61,00,70,00,69,00,2e,00,63,00,70,00,6c,00,00,00,53,00,\
70,00,65,00,65,00,63,00,68,00,00,00,43,00,68,00,61,00,6e,00,67,00,65,00,20,\
00,73,00,65,00,74,00,74,00,69,00,6e,00,67,00,73,00,20,00,66,00,6f,00,72,00,\
20,00,74,00,65,00,78,00,74,00,2d,00,74,00,6f,00,2d,00,73,00,70,00,65,00,65,\
00,63,00,68,00,20,00,61,00,6e,00,64,00,20,00,66,00,6f,00,72,00,20,00,73,00,\
70,00,65,00,65,00,63,00,68,00,20,00,72,00,65,00,63,00,6f,00,67,00,6e,00,69,\
00,74,00,69,00,6f,00,6e,00,20,00,28,00,69,00,66,00,20,00,69,00,6e,00,73,00,\
74,00,61,00,6c,00,6c,00,65,00,64,00,29,00,2e,00,00,00,dc,00,00,00,01,00,00,\
00,00,25,61,3a,2b,4a,c3,01,00,00,00,00,38,90,01,00,81,00,00,00,34,00,00,00,\
39,00,00,00,43,00,3a,00,5c,00,50,00,52,00,4f,00,47,00,52,00,41,00,7e,00,31,\
00,5c,00,43,00,4f,00,4d,00,4d,00,4f,00,4e,00,7e,00,31,00,5c,00,53,00,59,00,\
53,00,54,00,45,00,4d,00,5c,00,4d,00,53,00,4d,00,41,00,50,00,49,00,5c,00,31,\
00,30,00,33,00,33,00,5c,00,4d,00,4c,00,43,00,46,00,47,00,33,00,32,00,2e,00,\
43,00,50,00,4c,00,00,00,4d,00,61,00,69,00,6c,00,00,00,4d,00,69,00,63,00,72,\
00,6f,00,73,00,6f,00,66,00,74,00,20,00,4f,00,66,00,66,00,69,00,63,00,65,00,\
20,00,4f,00,75,00,74,00,6c,00,6f,00,6f,00,6b,00,20,00,50,00,72,00,6f,00,66,\
00,69,00,6c,00,65,00,73,00,00,00,00,00,34,01,00,00,01,00,00,00,00,cd,ac,80,\
55,34,c5,01,00,00,00,00,00,10,04,00,89,00,00,00,40,00,00,00,4c,00,00,00,43,\
00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,\
6c,00,65,00,73,00,5c,00,43,00,6f,00,6d,00,6d,00,6f,00,6e,00,20,00,46,00,69,\
00,6c,00,65,00,73,00,5c,00,41,00,64,00,6f,00,62,00,65,00,5c,00,43,00,61,00,\
6c,00,69,00,62,00,72,00,61,00,74,00,69,00,6f,00,6e,00,5c,00,41,00,64,00,6f,\
00,62,00,65,00,20,00,47,00,61,00,6d,00,6d,00,61,00,2e,00,63,00,70,00,6c,00,\
00,00,41,00,64,00,6f,00,62,00,65,00,20,00,47,00,61,00,6d,00,6d,00,61,00,00,\
00,43,00,61,00,6c,00,69,00,62,00,72,00,61,00,74,00,65,00,20,00,6d,00,6f,00,\
6e,00,69,00,74,00,6f,00,72,00,20,00,66,00,6f,00,72,00,20,00,63,00,6f,00,6e,\
00,73,00,69,00,73,00,74,00,65,00,6e,00,74,00,20,00,63,00,6f,00,6c,00,6f,00,\
72,00,2c,00,20,00,63,00,72,00,65,00,61,00,74,00,65,00,20,00,49,00,43,00,43,\
00,20,00,70,00,72,00,6f,00,66,00,69,00,6c,00,65,00,2e,00,00,00

and this is the fourth one

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveTypeAutoRun"=dword:00000091
"NoActiveDesktopChanges"=dword:00000001

thanx . . a lot . . .

Sorry to be a pain, but you gave me
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Controls Folder]
What I need is
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Control Panel]

im sorry . . .to bother u soo much . . but theres no control panel . . .
.. under current version there is
applets
control folder
device installer
explorer
extensions
group policy
grvconv
internet
internet settings
policies
run
run once
settings
shell extensions
syncmgr
telephony
theme manager
themes
unread mail
webcheck
wintrust
wat should i do ?

Not a bother. Like I said this is a new infection we're dealing with.

It's OK that Control Panel wasn't there

OK, copy contents of code box below to notepad, save it as FixReg2.reg filetype .*.allfiles

REGEDIT4



[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 

"NoDriveTypeAutoRun"=dword:00000091 

"NoActiveDesktopChanges"=dword:00000000

Right click FixReg2.reg and click Merge. Allow it to add/merge with registry.

Now manually delete this file:
C:\Windows\Web\desktop.html if it is there.

Then right click anywhere on an open area of desktop and click Properties.
Click the desktop tab
Click customise desktop
Click Web tab
Checkmark and delete anything in the white 'Wep Pages' space except My Current Homepage
OK...OK...OK out of those windows.

Reboot...and see if that sorts it out.

okay all done
but its STILL not cleared !
its still there
i have control of my wallpaper now but there are still those unwanted icons on my desktop
and there is the big red cross on my tray which syas virus !
. . .and plus my browser keeps opening the site sayin wearning u have a virus !!

i jus got more alerts sayign your computer hads been attacked by a stealth virus click here to remove
and wen i clicked it it opened some site which said doenload anti spyware to remove virus
plus there r these really VULGAR icons on my desktop im dying to get rid off but everytime i delet them they come back

Sorry...got bumped offline for a few.
I'm not sure why those items keep returning other than that we must have another hidden starting point in registry.

I don't see any AV on your machine, I would suggest downloading AVG free from here

Install it, and run a complete system scan allowing it to remove all items found.
Then post another hijackthis log please.
We still have lots of other tools to use to find this infection and fix it.

jus got more alerts sayign your computer hads been attacked by a stealth virus click here to remove
and wen i clicked it it opened some site

DO NOT CLICK THOSE POPUPS!

even if i dont click them . . .the browsswer which i am using automatically changes to that site . . . .
again and again

I understand your frustration, please be patient

Let's get a new hijackthis log please.

heheh . . . thanx . . .
that aVG scan is downloading meanwhile heres my current hijack this log
Logfile of HijackThis v1.99.1
Scan saved at 11:42:55 PM, on 4/23/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Ares\Ares.exe
C:\PROGRA~1\SPYWAR~1\swdoctor.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\LightSurf\Common\IconMgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\LightSurf\Colorific\hgcctl95.exe
C:\Program Files\LightSurf\Color Indicator\TICIcon.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\hijack this\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotoffers.info/ad0179/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com
R3 - Default URLSearchHook is missing
F3 - REG:win.ini: load=C:\Program Files\KEVIN\kevin.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\TOOLS\IESDSG.DLL
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\TOOLS\IESDPB.DLL
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe"
O4 - HKLM\..\Run: [Universal USB Service] svchost32.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\RunServices: [Universal USB Service] svchost32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Windows Registry Repair Pro] C:\Program Files\3B Software\Windows Registry Repair Pro\RegistryRepairPro.exe 4
O4 - HKCU\..\Run: [Spyware Doctor] C:\PROGRA~1\SPYWAR~1\swdoctor.exe /Q
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [MessengerPlus3] "\" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: LightSurf.lnk = C:\Program Files\LightSurf\Common\IconMgr.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\TOOLS\IESDPB.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by103fd.bay103.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{748F67B5-54B6-45E8-88AB-E32FEA956BA5}: NameServer = 202.88.138.15,202.88.130.67,202.88.130.5
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

There is a specific file for this infection we need to look for:
Look in C:\windows\system32... do you see a file named systr.dll there?

If so, rename it to systr.old

Instructions of renaming a file:

Right-click on this file systr.dll and hit Rename and rename the file to systr.old

If you can't rename the file then try this:
Enable the 'Show Hidden Folders' option, like this:
Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading select Show hidden files and folders.
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.

Reboot, into safe mode, this way:
Turn on the computer
Immediately begin tapping the <F8> key.
Use the arrow keys to highlight Safe Mode and press the <Enter> key.

Go to the location of this file systr.dll and rename it using the same instructions above.

Reboot to normal mode and post another log please.

nope no file like systr.dll
there is a file called syssetup.dll
thats all