Inactive [InActive] Virus may have created Internet connectivity problem

Last Wednesday, I activated a virus in a .rar file because I failed to scan it before unpacking it. It hijacked my browser among other nasty things like disabling Task Manager, removing my Programs listing from the Start menu, adding "VIRUS ALERT" to my clock and removing access to Control Panel.

Anyway, after several unsuccessful efforts to remove the virus, I was able to get back to a Restore Point from Monday (i.e. 2 days prior). Everything came up fine and I've run a couple of different virus sweeps and they say all is well.

HOWEVER, even though my Network Connections shows me connected to the Internet (and the details even shows a few bits "sent" and "received "), all attempts to load a web page (Firefox & IE) return a "cannot find" error. When I try to "repair" the connection Windows XP tells me it can not complete the repair because it could not flush the DNS cache.

My on-line research says this "failure to flush" can be addressed by using a command line "ipconfig /flushdns ", HOWEVER this returns another "flush failed during execution" error message.

Searching on this error message, the Microsoft Knowledge Base says it happens when the DNS Client services are not running, instructing to run "services.msc ", selecting DNS Client and making sure that the Start mode is set to Automatic and the Status shows the service running.

The MS Knowledge Base asserts that once the DNS Client service is running, one can run the "ipconfig /flushdns" command and all will be well. UNFORTUNATELY, that doesn't work for me.

I've insured the service is running but the cache will not flush (I get the same error message) and I still can't bring up a web page. (Obviously, I'm using a different PC to write this post.)

I posted all this info in another thread in the Internet forum. One member was kind enough to send me a couple of great suggestions on how to fix the DNS flushing problem but unfortunately, nothing has worked. He also suggested I run RSIT and post the logs in a new thread here just in case the virus caused issues in my restore point.

Here they are:

info.txt logfile of random's system information tool 1.04 2008-10-25 14:15:32

======Uninstall list======

-->C:\Program Files\Copy_Clone\Nero 7\\nero\uninstall\UNNERO.exe /UNINSTALL
-->C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
-->C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
-->VTUninst.exe -reg 5 'HKLM\Software\S3\VT\S3Uninst\S3Timer'
5 Spots--> "C:\Program Files\Games_June\5 Spots\ReflexiveArcade\unins000.exe "
Abra Academy--> "C:\Program Files\Games_June\Abra Academy\ReflexiveArcade\unins000.exe "
Ad-Aware SE Professional-->D:\PROGRA~1\Lavasoft\AD-AWA~2\UNWISE.EXE D:\PROGRA~1\Lavasoft\AD-AWA~2\INSTALL.LOG
Adobe Flash Player Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 8.1.2-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
Agatha Christie Death On The Nile--> "C:\Program Files\Games_June\Death On The Nile\ReflexiveArcade\unins000.exe "
Agatha Christie Peril At End House--> "C:\Program Files\Games_June\Agatha Christie Peril At End House\ReflexiveArcade\unins000.exe "
Alice Greenfingers--> "C:\Program Files\Games_June\Alice Greenfingers\ReflexiveArcade\unins000.exe "
Amazing Adventures The Lost Tomb--> "C:\Program Files\Games_June\Amazing Adventures The Lost Tomb\ReflexiveArcade\unins000.exe "
ArcSoft PhotoImpression 5-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D433ABC3-0CD8-4BB0-B6A9-84501B4B47B7}\Setup.exe" -l0x9
Baby Blimp--> "C:\WINDOWS\Baby Blimp\uninstall.exe" "/U:C:\Program Files\Games_June\Baby Blimp\Uninstall\uninstall.xml "
Beach Party Craze--> "C:\WINDOWS\Beach Party Craze\uninstall.exe" "/U:C:\Program Files\Games_June\Beach Party Craze\Uninstall\uninstall.xml "
Big City Adventure San Francisco--> "C:\Program Files\Games_June\Big City Adventure San Francisco\ReflexiveArcade\unins000.exe "
Big City Adventure Sydney Australia--> "C:\Program Files\Games_June\Big City Adventure Sydney Australia\ReflexiveArcade\unins000.exe "
Big Fish Games Client-->C:\Program Files\bfgclient\Uninstall.exe
Big Island Blends--> "C:\Program Files\Games_June\Big Island Blends\ReflexiveArcade\unins000.exe "
Burger Island--> "C:\Program Files\Games_June\Burger Island\ReflexiveArcade\unins000.exe "
Burger Shop--> "C:\WINDOWS\Burger Shop\uninstall.exe" "/U:C:\Program Files\Games_June\Burger Shop\Uninstall\uninstall.xml "
Cake Mania Back to the Bakery (remove only)--> "C:\Program Files\Games_June\Cake Mania Back to the Bakery\Uninstall.exe "
Camp Funshine - Carrie the Caregiver 3--> "C:\WINDOWS\Camp Funshine - Carrie the Caregiver 3\uninstall.exe" "/U:C:\Program Files\Games_June\Carrie the Caregiver 3\Uninstall\uninstall.xml "
Carrie The Caregiver 2 Preschool--> "C:\WINDOWS\Carrie The Caregiver 2 Preschool\uninstall.exe" "/U:C:\Program Files\Games_June\Carrie The Caregiver 2 Preschool\Uninstall\uninstall.xml "
Cate West The Vanishing Files--> "C:\Program Files\Games_June\Cate West The Vanishing Files\ReflexiveArcade\unins000.exe "
Christmasville--> "C:\Program Files\Games_June\Christmasville\ReflexiveArcade\unins000.exe "
Coffee House Chaos--> "C:\WINDOWS\Coffee House Chaos\uninstall.exe" "/U:C:\Program Files\Games_June\Coffee House Chaos\Uninstall\uninstall.xml "
Cooking Dash--> "C:\WINDOWS\Cooking Dash\uninstall.exe" "/U:C:\Program Files\Games_June\Cooking Dash\Uninstall\uninstall.xml "
CPL All-in-One-->rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\CPLBonus.inf,uninstall
Delicious 2 Deluxe--> "C:\Program Files\Games_June\Delicious 2 Deluxe\ReflexiveArcade\unins000.exe "
Diner Dash Hometown Hero--> "C:\Program Files\Games_June\Diner Dash Hometown Hero\ReflexiveArcade\unins000.exe "
Doggie Dash--> "C:\Program Files\Games_June\Doggie Dash\ReflexiveArcade\unins000.exe "
Dr Daisy Pet Vet--> "C:\Program Files\Games_June\Dr Daisy Pet Vet\ReflexiveArcade\unins000.exe "
Dr. Daisy Pet Vet--> "C:\WINDOWS\Dr. Daisy Pet Vet\uninstall.exe" "/U:C:\Program Files\Games_June\Dr. Daisy Pet Vet\Uninstall\uninstall.xml "
Dream Chronicles 2--> "C:\Program Files\Games_June\Dream Chronicles 2\ReflexiveArcade\unins000.exe "
Dream Chronicles--> "C:\Program Files\Games_June\Dream Chronicles\ReflexiveArcade\unins000.exe "
Dream Day - First Home--> "C:\WINDOWS\Dream Day - First Home\uninstall.exe" "/U:C:\Program Files\Games_June\Dream Day - First Home\Uninstall\uninstall.xml "
Dream Day Honeymoon--> "C:\Program Files\Games_June\Dream Day Honeymoon\ReflexiveArcade\unins000.exe "
Dream Day Wedding--> "C:\Program Files\Games_June\Dream Day Wedding\ReflexiveArcade\unins000.exe "
DVD Decrypter (Remove Only)--> "C:\Program Files\Copy_Clone\DVD Decrypter\uninstall.exe "
DVD Shrink 3.2--> "C:\Program Files\Copy_Clone\DVD Shrink\unins000.exe "
DVDFab Platinum 3.1.3.2 Ghosthunter release--> "C:\Program Files\Copy_Clone\DVDFab Platinum 3132\unins000.exe "
EPSON Print CD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FF477885-5EA8-40D0-ADF3-D4C1B86FAEA4}\Setup.exe" -l0x9 -SYSTEM
EPSON Printer Software-->C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R
EPSON Stylus Photo R260 User's Guide-->C:\Program Files\epson\guide\spr260_e\uninstall.exe
Escape The Museum--> "C:\Program Files\Games_June\Escape The Museum\ReflexiveArcade\unins000.exe "
Fab Fashion--> "C:\Program Files\Games_June\Fab Fashion\ReflexiveArcade\unins000.exe "
Farm Frenzy 2--> "C:\WINDOWS\Farm Frenzy 2\uninstall.exe" "/U:C:\Program Files\Games_June\Farm Frenzy 2\Uninstall\uninstall.xml "
Farm Frenzy--> "C:\Program Files\Games_June\Farm Frenzy\ReflexiveArcade\unins000.exe "
Feelers--> "C:\Program Files\Games_June\Feelers\ReflexiveArcade\unins000.exe "
First Class Flurry--> "C:\WINDOWS\First Class Flurry\uninstall.exe" "/U:C:\Program Files\Games_June\First Class Flurry\Uninstall\uninstall.xml "
Flower Shop Big City Break--> "C:\Program Files\Games_June\Flower Shop Big City Break\ReflexiveArcade\unins000.exe "
Forgotten Riddles The Mayan Princess--> "C:\Program Files\Games_June\Forgotten Riddles The Mayan Princess\ReflexiveArcade\unins000.exe "
Garden Dreams--> "C:\Program Files\Games_June\Garden Dreams\ReflexiveArcade\unins000.exe "
GHOST Hunters The Haunting Of Majesty Manor--> "C:\Program Files\Games_June\GHOST Hunters The Haunting Of Majesty Manor\ReflexiveArcade\unins000.exe "
GMail Drive Shell Extension-->rundll32.exe C:\WINDOWS\system32\ShellExt\GMailFS.dll,Uninstall C:\WINDOWS\system32\ShellExt\GMailFS.inf
Google Desktop Plugin - Calendar-->MsiExec.exe /X{CE55B9C0-D0E6-42F5-8CCA-9A6B90359FAC}
Google Desktop-->C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstall
Harvest Mania To Go--> "C:\Program Files\Games_June\Harvest Mania To Go\ReflexiveArcade\unins000.exe "
Hell's Kitchen--> "C:\WINDOWS\Hell's Kitchen\uninstall.exe" "/U:C:\Program Files\Games_June\Hell's Kitchen\Uninstall\uninstall.xml "
Hidden Expedition Amazon--> "C:\WINDOWS\Hidden Expedition Amazon\uninstall.exe" "/U:C:\Program Files\Games_June\Hidden Expedition Amazon\Uninstall\uninstall.xml "
Hidden Secrets The Nightmare--> "C:\Program Files\Games_June\Hidden Secrets The Nightmare\ReflexiveArcade\unins000.exe "
Hide And Secret--> "C:\Program Files\Games_June\Hide And Secret\ReflexiveArcade\unins000.exe "
Holly: A Christmas Tale (remove only)--> "C:\Program Files\Holly - A Christmas Tale\Uninstall.exe "
Hotfix for Windows Internet Explorer 7 (KB947864)--> "C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe "
Hotfix for Windows Media Format 11 SDK (KB929399)--> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe "
Hotfix for Windows Media Player 11 (KB939683)--> "C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe "
Hotfix for Windows XP (KB952287)--> "C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe "
HP Photo and Imaging 2.0 - All-in-One Drivers-->MsiExec.exe /X{6ECB39BD-73C2-44DD-B1A0-898207C58D8B}
HP Photo and Imaging 2.0 - All-in-One-->MsiExec.exe /X{9867A917-5D17-40DE-83BA-BEA5293194B1}
HP Photo and Imaging 2.0 - hp psc 1200 series-->C:\Program Files\HP Photo 2.0\Digital Imaging\{7C8BB31C-E09E-4c7d-BBF1-45E33B467FE1}\Setup\hpzscr01.exe -datfile hposcr02.dat -forcereboot
hp psc 1200 series-->MsiExec.exe /X{C900EF06-2E76-49C7-8DB0-41F629B21DC5}
I Spy Spooky Mansion-->C:\Program Files\Games_June\I Spy Spooky Mansion\Uninstal.exe
Ice Cream Tycoon--> "C:\Program Files\Games_June\Ice Cream Tycoon\ReflexiveArcade\unins000.exe "
Interpol - The Trail of Dr. Chaos--> "C:\WINDOWS\Interpol - The Trail of Dr. Chaos\uninstall.exe" "/U:C:\Program Files\Games_June\Dr. Chaos\Uninstall\uninstall.xml "
Janes Hotel Family Hero--> "C:\Program Files\Games_June\Janes Hotel Family Hero\ReflexiveArcade\unins000.exe "
Janes Hotel--> "C:\Program Files\Games_June\Janes Hotel\ReflexiveArcade\unins000.exe "
Java(TM) SE Runtime Environment 6 Update 1-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
Jenny's Fish Shop--> "C:\WINDOWS\Jenny's Fish Shop\uninstall.exe" "/U:C:\Program Files\Games_June\Jenny's Fish Shop\Uninstall\uninstall.xml "
Jig Art Quest--> "C:\Program Files\Games_June\Jig Art Quest\ReflexiveArcade\unins000.exe "
Jigsaw World--> "C:\WINDOWS\Jigsaw World\uninstall.exe" "/U:C:\Program Files\Games_June\Jigsaw World\Uninstall\uninstall.xml "
K-Lite Codec Pack 3.1.0 Full--> "C:\Program Files\K-Lite Codec Pack\unins000.exe "
Laura Jones and the Gates of Good and Evil--> "C:\WINDOWS\Laura Jones and the Gates of Good and Evil\uninstall.exe" "/U:C:\Program Files\Games_June\Laura Jones\Uninstall\uninstall.xml "
Little Farm--> "C:\Program Files\Games_June\Little Farm\ReflexiveArcade\unins000.exe "
Little Shop Of Treasures 2--> "C:\Program Files\Games_June\Little Shop Of Treasures 2\ReflexiveArcade\unins000.exe "
Little Shop Of Treasures--> "C:\Program Files\Games_June\Little Shop Of Treasures\ReflexiveArcade\unins000.exe "
LiveUpdate 3.0 (Symantec Corporation)--> "C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
Lizardtech DjVu Control-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{105CFC7C-6992-11D5-BD9D-000102C10FD8}\Setup.exe" -l0x9
Luxor 2--> "C:\Program Files\Games_June\Luxor 2\ReflexiveArcade\unins000.exe "
Luxor 3--> "C:\Program Files\Games_June\Luxor 3\ReflexiveArcade\unins000.exe "
Luxor Amun Rising--> "C:\Program Files\Games_June\Luxor Amun Rising\ReflexiveArcade\unins000.exe "
Luxor--> "C:\Program Files\Games_June\Luxor\ReflexiveArcade\unins000.exe "
Macromedia Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
Magic Farm--> "C:\Program Files\Games_June\Magic Farm\ReflexiveArcade\unins000.exe "
Medal of Honor Allied Assault-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0DEA94ED-915A-4834-A87E-388D012C8E02}\Setup.exe" -l0x9
Microsoft .NET Framework 1.1 Hotfix (KB928366)--> "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp "
Microsoft .NET Framework 1.1 SP1 with KB886903 Hotfix-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft Internationalized Domain Names Mitigation APIs--> "C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe "
Microsoft National Language Support Downlevel APIs--> "C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe "
Microsoft Office XP Professional with FrontPage-->MsiExec.exe /I{90280409-6000-11D3-8CFE-0050048383C9}
Miriel The Magical Merchant--> "C:\Program Files\Games_June\Miriel The Magical Merchant\ReflexiveArcade\unins000.exe "
Miss Teri Tale--> "C:\Program Files\Games_June\Miss Teri Tale\ReflexiveArcade\unins000.exe "
Money Tree--> "C:\WINDOWS\Money Tree\uninstall.exe" "/U:C:\Program Files\Games_June\Money Tree\Uninstall\uninstall.xml "
Mortimer Beckett And The Secrets Of Spooky Manor--> "C:\Program Files\Games_June\Mortimer Beckett And The Secrets Of Spooky Manor\ReflexiveArcade\unins000.exe "
Mozilla Firefox (2.0.0.17)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Mp3 Tag Tools v1.2--> "C:\Program Files\Utilities\MP3TagTool12\uninstall.exe "
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
Mystery Case Files Huntsville--> "C:\Program Files\Games_June\Mystery Case Files Huntsville\ReflexiveArcade\unins000.exe "
Mystery Case Files Prime Suspects--> "C:\Program Files\Games_June\Mystery Case Files Prime Suspects\ReflexiveArcade\unins000.exe "
Mystery in London--> "C:\WINDOWS\Mystery in London\uninstall.exe" "/U:C:\Program Files\Games_June\Mystery in London\Uninstall\uninstall.xml "
Mystery PI The Lottery Ticket--> "C:\Program Files\Games_June\Mystery PI The Lottery Ticket\ReflexiveArcade\unins000.exe "
Mystery PI The Vegas Heist--> "C:\Program Files\Games_June\Mystery PI The Vegas Heist\ReflexiveArcade\unins000.exe "
Mystery Stories-Island of Hope--> "C:\WINDOWS\Mystery Stories-Island of Hope\uninstall.exe" "/U:C:\Program Files\Games_June\Mystery Stories - Island of Hope\Uninstall\uninstall.xml "
Mysteryville 2--> "C:\Program Files\Games_June\Mysteryville 2\ReflexiveArcade\unins000.exe "
Nancy Drew: Secrets Can Kill-->C:\WINDOWS\IsUninst.exe -f "c:\program files\games_june\Nancy Drew\Secrets Can Kill 1\Uninst.isu "
Nancy Drew: Stay Tuned For Danger-->C:\WINDOWS\IsUninst.exe -f "c:\program files\games_june\nancy drew\Stay Tuned For Danger 2\Uninst.isu "
Nancy Drew: Treasure in the Royal Tower-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\Games_June\Nancy Drew\Treasure in the Royal Tower 4\setup.exe"
Nanny Mania--> "C:\Program Files\Games_June\Nanny Mania\ReflexiveArcade\unins000.exe "
Natalie Brooks Secrets Of Treasure House--> "C:\Program Files\Games_June\Natalie Brooks Secrets Of Treasure House\ReflexiveArcade\unins000.exe "
Neptunes Secret--> "C:\Program Files\Games_June\Neptunes Secret\ReflexiveArcade\unins000.exe "
Nero 7 Ultra Edition-->MsiExec.exe /I{43FFE159-3199-4188-A1CD-629166AD1033}
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
NVIDIA Drivers-->C:\WINDOWS\system32\nvudisp.exe UninstallGUI
Paparazzi--> "C:\Program Files\Games_June\Paparazzi\ReflexiveArcade\unins000.exe "
Paradise Pet Salon--> "C:\Program Files\Games_June\Paradise Pet Salon\ReflexiveArcade\unins000.exe "
PerfectDisk-->MsiExec.exe /I{212F5777-1190-4DEF-8E4D-6B2F313B45E7}
Pet Shop Hop--> "C:\Program Files\Games_June\Pet Shop Hop\ReflexiveArcade\unins000.exe "
Pirates Plunder--> "C:\Program Files\Games_June\Pirates Plunder\ReflexiveArcade\unins000.exe "
Plant Tycoon--> "C:\Program Files\Games_June\Plant Tycoon\ReflexiveArcade\unins000.exe "
Plantasia (remove only)-->C:\Program Files\Games_June\Plantasia\Uninstall.exe
Profitville--> "C:\WINDOWS\Profitville\uninstall.exe" "/U:C:\Program Files\Games_June\Profitville\Uninstall\uninstall.xml "
Purrfect Pet Shop--> "C:\Program Files\Games_June\Purrfect Pet Shop\ReflexiveArcade\unins000.exe "
Puzzle Mania--> "C:\Program Files\Games_June\Puzzle Mania\ReflexiveArcade\unins000.exe "
QuickTime Alternative 1.81--> "C:\Program Files\QuickTime Alternative\unins000.exe "
Ranch Rush--> "C:\WINDOWS\Ranch Rush\uninstall.exe" "/U:C:\Program Files\Games_June\Ranch Rush\Uninstall\uninstall.xml "
Real Alternative 1.52--> "C:\Program Files\Real Alternative\unins000.exe "
Realtek AC'97 Audio-->Alcrmv.exe -r -m
Return to Mysterious Island (remove only)--> "C:\Program Files\Return to Mysterious Island\Uninstall.exe "
S3 S3Display-->vtuninst.exe -reg 5 'HKLM\Software\S3\VT\S3Uninst\S3Display'
S3 S3Gamma2-->vtuninst.exe -reg 5 'HKLM\Software\S3\VT\S3Uninst\S3Gamma2'
S3 S3Info2-->vtuninst.exe -reg 5 'HKLM\Software\S3\VT\S3Uninst\S3Info2'
S3 S3Overlay-->vtuninst.exe -reg 5 'HKLM\Software\S3\VT\S3Uninst\S3Overlay'
Sallys Salon--> "C:\Program Files\Games_June\Sallys Salon\ReflexiveArcade\unins000.exe "
Sandlot Games Client Services 1.2.2--> "C:\Program Files\Common Files\Sandlot Shared\unins000.exe "
Secrets Of Great Art--> "C:\Program Files\Games_June\Secrets Of Great Art\ReflexiveArcade\unins000.exe "
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Windows Internet Explorer 7 (KB938127)--> "C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe "
Security Update for Windows Internet Explorer 7 (KB939653)--> "C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe "
Security Update for Windows Internet Explorer 7 (KB950759)--> "C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe "
Security Update for Windows Internet Explorer 7 (KB953838)--> "C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe "
Security Update for Windows Media Player 11 (KB936782)--> "C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe "
Security Update for Windows Media Player 11 (KB954154)--> "C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe "
Security Update for Windows XP (KB921503)--> "C:\WINDOWS\$NtUninstallKB921503$\spuninst\spuninst.exe "
Security Update for Windows XP (KB929123)--> "C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe "
Security Update for Windows XP (KB933729)--> "C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe "
Security Update for Windows XP (KB935839)--> "C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe "
Security Update for Windows XP (KB935840)--> "C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe "
Security Update for Windows XP (KB936021)--> "C:\WINDOWS\$NtUninstallKB936021$\spuninst\spuninst.exe "
Security Update for Windows XP (KB937143)--> "C:\WINDOWS\$NtUninstallKB937143$\spuninst\spuninst.exe "
Security Update for Windows XP (KB938127)--> "C:\WINDOWS\$NtUninstallKB938127$\spuninst\spuninst.exe "
Security Update for Windows XP (KB938464)--> "C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe "
Security Update for Windows XP (KB938829)--> "C:\WINDOWS\$NtUninstallKB938829$\spuninst\spuninst.exe "
Security Update for Windows XP (KB939653)--> "C:\WINDOWS\$NtUninstallKB939653$\spuninst\spuninst.exe "
Security Update for Windows XP (KB941202)--> "C:\WINDOWS\$NtUninstallKB941202$\spuninst\spuninst.exe "
Security Update for Windows XP (KB941693)--> "C:\WINDOWS\$NtUninstallKB941693$\spuninst\spuninst.exe "
Security Update for Windows XP (KB943055)--> "C:\WINDOWS\$NtUninstallKB943055$\spuninst\spuninst.exe "
Security Update for Windows XP (KB943460)--> "C:\WINDOWS\$NtUninstallKB943460$\spuninst\spuninst.exe "
Security Update for Windows XP (KB945553)--> "C:\WINDOWS\$NtUninstallKB945553$\spuninst\spuninst.exe "
Security Update for Windows XP (KB946026)--> "C:\WINDOWS\$NtUninstallKB946026$\spuninst\spuninst.exe "
Security Update for Windows XP (KB946648)--> "C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe "
Security Update for Windows XP (KB948590)--> "C:\WINDOWS\$NtUninstallKB948590$\spuninst\spuninst.exe "
Security Update for Windows XP (KB948881)--> "C:\WINDOWS\$NtUninstallKB948881$\spuninst\spuninst.exe "
Security Update for Windows XP (KB950760)--> "C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe "
Security Update for Windows XP (KB950762)--> "C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe "
Security Update for Windows XP (KB950974)--> "C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe "
Security Update for Windows XP (KB951066)--> "C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe "
Security Update for Windows XP (KB951376)--> "C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe "
Security Update for Windows XP (KB951376-v2)--> "C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe "
Security Update for Windows XP (KB951698)--> "C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe "
Security Update for Windows XP (KB951748)--> "C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe "
Security Update for Windows XP (KB952954)--> "C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe "
Security Update for Windows XP (KB953839)--> "C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe "
Sherlock Holmes - The Mystery of the Persian Carpet--> "C:\WINDOWS\Sherlock Holmes - The Mystery of the Persian Carpet\uninstall.exe" "/U:C:\Program Files\Games_June\Sherlock Holmes - Mystery of the Persian Carpet\Uninstall\uninstall.xml "
SnagIt 8-->MsiExec.exe /I{DA0BF7AB-88EB-4675-8FA1-531EAD938821}
Sprill The Mystery Of The Bermuda Triangle--> "C:\Program Files\Games_June\Sprill The Mystery Of The Bermuda Triangle\ReflexiveArcade\unins000.exe "
Spy Sweeper-->C:\WINDOWS\unSpySweeper.exe
Stone Of Destiny--> "C:\Program Files\Games_June\Stone Of Destiny\ReflexiveArcade\unins000.exe "
StoneLoops Of Jurassica--> "C:\Program Files\Games_June\StoneLoops Of Jurassica\ReflexiveArcade\unins000.exe "
Sunset Studio Deluxe--> "C:\WINDOWS\Sunset Studio Deluxe\uninstall.exe" "/U:C:\Program Files\Games_June\Sunset Studio Deluxe\Uninstall\uninstall.xml "
Sunshine Acres--> "C:\WINDOWS\Sunshine Acres\uninstall.exe" "/U:C:\Program Files\Games_June\Sunshine Acres\Uninstall\uninstall.xml "
Supermarket Mania--> "C:\WINDOWS\Supermarket Mania\uninstall.exe" "/U:C:\Program Files\Games_June\Supermarket Mania\Uninstall\uninstall.xml "
Sushi Frenzy--> "C:\Program Files\Games_June\Sushi Frenzy\ReflexiveArcade\unins000.exe "
Symantec Client Security-->MsiExec.exe /I{C20729A4-C8C2-4DE3-94BE-5E3A2E9EFB63}
The Clumsys--> "C:\Program Files\Games_June\The Clumsys\ReflexiveArcade\unins000.exe "
The Magicians Handbook Cursed Valley--> "C:\Program Files\Games_June\The Magicians Handbook Cursed Valley\ReflexiveArcade\unins000.exe "
The Princess Bride Game--> "C:\WINDOWS\The Princess Bride Game\uninstall.exe" "/U:C:\Program Files\Games_June\The Princess Bride\Uninstall\uninstall.xml "
The Sultan's Labyrinth--> "C:\Program Files\The Sultan's Labyrinth\Uninstall.exe "
Travelogue 360 Paris--> "C:\Program Files\Games_June\Travelogue 360 Paris\ReflexiveArcade\unins000.exe "
Tumble Bugs--> "C:\Program Files\Games_June\Tumble Bugs\ReflexiveArcade\unins000.exe "
Turbo Pizza--> "C:\Program Files\Games_June\Turbo Pizza\ReflexiveArcade\unins000.exe "
Turbo Subs--> "C:\Program Files\Games_June\Turbo Subs\ReflexiveArcade\unins000.exe "
Unicorn Castle--> "C:\WINDOWS\Unicorn Castle\uninstall.exe" "/U:C:\Program Files\Games_June\Unicorn Castle\Uninstall\uninstall.xml "
Update for Windows XP (KB933360)--> "C:\WINDOWS\$NtUninstallKB933360$\spuninst\spuninst.exe "
Update for Windows XP (KB938828)--> "C:\WINDOWS\$NtUninstallKB938828$\spuninst\spuninst.exe "
Update for Windows XP (KB951072-v2)--> "C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe "
Val Gor--> "C:\WINDOWS\Val Gor\uninstall.exe" "/U:C:\Program Files\Games_June\Val Gor\Uninstall\uninstall.xml "
VIA Rhine-Family Fast-Ethernet Adapter-->Rundll32.exe vuins32.dll,vuins32Ex $Rhine $VIA
VIA/S3G Display Driver-->VTsetvga.exe -s -rRundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\system32\hg201hp.inf
Virtual Villagers The Secret City--> "C:\Program Files\Games_June\Virtual Villagers The Secret City\ReflexiveArcade\unins000.exe "
Wedding Dash 2--> "C:\Program Files\Games_June\Wedding Dash 2\ReflexiveArcade\unins000.exe "
Window Washer-->C:\WINDOWS\Unwash6.exe
Windows Imaging Component--> "C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe "
Windows Installer 3.1 (KB893803)--> "C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe "
Windows Internet Explorer 7--> "C:\WINDOWS\ie7\spuninst\spuninst.exe "
Windows XP Hotfix - KB885884-->C:\WINDOWS\$NtUninstallKB885884$\spuninst\spuninst.exe
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
WinRAR Themes Addon-->C:\PROGRA~1\WinRAR\Themes\UNWISE.EXE C:\PROGRA~1\WinRAR\Themes\INSTALL.LOG
Women's Murder Club - Death in Scarlet--> "C:\WINDOWS\Women's Murder Club - Death in Scarlet\uninstall.exe" "/U:C:\Program Files\Games_June\Women's Murder Club - Death in Scarlet\Uninstall\uninstall.xml "
Yard Sale Junkie--> "C:\Program Files\Games_June\Yard Sale Junkie\ReflexiveArcade\unins000.exe "
©Ãº¬P³Ã‚±N123-->MsiExec.exe /I{D8A19F2F-37A7-46F1-84A6-CBC3DA8653E0}

======Security center information======

AV: Symantec AntiVirus Corporate Edition
FW: Symantec Client Firewall

======Environment variables======

"ComSpec "=%SystemRoot%\system32\cmd.exe
"Path "=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir "=%SystemRoot%
"FP_NO_HOST_CHECK "=NO
"OS "=Windows_NT
"PROCESSOR_ARCHITECTURE "=x86
"PROCESSOR_LEVEL "=6
"PROCESSOR_IDENTIFIER "=x86 Family 6 Model 10 Stepping 0, AuthenticAMD
"PROCESSOR_REVISION "=0a00
"NUMBER_OF_PROCESSORS "=1
"PATHEXT "=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP "=%SystemRoot%\TEMP
"TMP "=%SystemRoot%\TEMP

-----------------EOF-----------------


LOG------------LOG--------------LOG--------------LOG
Logfile of random's system information tool 1.04 (written by random/random)
Run by Administrator at 2008-10-25 14:15:24
Microsoft Windows XP Professional Service Pack 2
System drive C: has 192 GB (81%) free of 238 GB
Total RAM: 959 MB (50% free)

HijackThis download failed

======Scheduled tasks folder======

C:\WINDOWS\tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1190319290.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C350DFC-885F-4296-82E3-6428DD982099}]
C:\WINDOWS\system32\pmnLCSkK.dll [2008-10-20 34304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 501400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B3E0BC5C-C672-4AB7-8A03-9B1F52A9ECDF}]
C:\WINDOWS\system32\awttqQJY.dll [2008-10-20 243712]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMan "=C:\WINDOWS\SOUNDMAN.EXE [2007-04-16 577536]
"NvCplDaemon "=C:\WINDOWS\system32\NvCpl.dll [2006-10-22 7700480]
"nwiz "=nwiz.exe /install []
"NvMediaCenter "=C:\WINDOWS\system32\NvMcTray.dll [2006-10-22 86016]
"VTTimer "=C:\WINDOWS\system32\VTTimer.exe [2006-08-15 53248]
"UnlockerAssistant "=C:\Program Files\Unlocker\UnlockerAssistant.exe [2006-09-07 15872]
"ccApp "=C:\Program Files\Common Files\Symantec Shared\ccApp.exe [2006-03-24 53408]
"vptray "=C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe [2006-06-15 124656]
"EPSON Stylus Photo R220 Series "=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE [2005-03-09 98304]
"IMJPMIG8.1 "=C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2002-12-31 208952]
"MSPY2002 "=C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe [2004-08-04 59392]
"PHIME2002ASync "=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-04 455168]
"PHIME2002A "=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-04 455168]
"NeroFilterCheck "=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-09 153136]
"Google Desktop Search "=C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-09-03 29744]
"Adobe Reader Speed Launcher "=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe "=C:\WINDOWS\system32\ctfmon.exe [2002-12-31 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} "=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-03-12 153136]
"MSMSGS "=C:\Program Files\Messenger\msmsgs.exe [2004-10-14 1694208]
"Window Washer "=C:\Program Files\Window Washer 6.0\wwDisp.exe [2005-04-20 894464]
"SpySweeper "=C:\Program Files\Spy Sweeper\SpySweeper.exe [2003-07-10 654848]
"EPSON Stylus Photo R260 Series "=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBNA.EXE [2006-10-17 143360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
hp psc 1000 series.lnk - C:\Program Files\HP Photo 2.0\Digital Imaging\bin\hpohmr08.exe
hpoddt01.exe.lnk - C:\Program Files\HP Photo 2.0\Digital Imaging\bin\hpotdd01.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS "= "C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
C:\WINDOWS\system32\NavLogon.dll [2006-06-15 43760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pmnLCSkK]
C:\WINDOWS\system32\pmnLCSkK.dll [2008-10-20 34304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll [2002-12-31 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{6C350DFC-885F-4296-82E3-6428DD982099} "=C:\WINDOWS\system32\pmnLCSkK.dll [2008-10-20 34304]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages "=msv1_0
C:\WINDOWS\system32\awttqQJY

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername "=0
"legalnoticecaption "=
"legalnoticetext "=
"shutdownwithoutlogon "=1
"undockwithoutlogon "=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun "=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000 "
"%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019 "
"C:\Program Files\uTorrent\uTorrent.exe "= "C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:£gTorrent "
"D:\Program Files\uTorrent\utorrent.exe "= "D:\Program Files\uTorrent\utorrent.exe:*:Enabled:£gTorrent "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000 "
"%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019 "

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{79f997e6-1f87-11dc-b555-806d6172696f}]
shell\AutoRun\command - "E:\Install FreeAgent Tools.exe" /run


======List of files/folders created in the last 3 months======

2008-10-25 14:15:26 ----D---- C:\Program Files\trend micro
2008-10-25 14:15:24 ----D---- C:\rsit
2008-10-22 16:12:32 ----A---- C:\VundoFix.txt
2008-10-22 16:08:06 ----D---- C:\fixwareout
2008-10-22 14:52:51 ----D---- C:\WINDOWS\BDOSCAN8
2008-10-21 22:26:23 ----A---- C:\WINDOWS\Enchanted Fairy Friends Secret of the Fairy Queen Setup Log.txt
2008-10-20 22:50:09 ----D---- C:\Documents and Settings\All Users\Application Data\Alawar Stargaze
2008-10-20 22:43:04 ----A---- C:\WINDOWS\Super Jigsaw Safari Setup Log.txt
2008-10-20 22:35:06 ----A---- C:\WINDOWS\Bloom Busters Setup Log.txt
2008-10-20 22:32:54 ----A---- C:\WINDOWS\system32\a77a22e4-.txt
2008-10-20 22:32:27 ----ASH---- C:\WINDOWS\system32\YJQqttwa.ini2
2008-10-20 22:32:27 ----ASH---- C:\WINDOWS\system32\YJQqttwa.ini
2008-10-20 22:32:19 ----A---- C:\WINDOWS\system32\awttqQJY.dll
2008-10-20 22:29:29 ----D---- C:\WINDOWS\Jigsaw World
2008-10-20 22:28:09 ----A---- C:\WINDOWS\Jigsaw World Setup Log.txt
2008-10-20 22:27:14 ----A---- C:\WINDOWS\system32\mlJDtSMc.dll
2008-10-20 22:27:13 ----A---- C:\WINDOWS\system32\pmnLCSkK.dll
2008-10-01 07:59:08 ----D---- C:\Documents and Settings\All Users\Application Data\MythPeople
2008-10-01 00:08:00 ----D---- C:\Documents and Settings\All Users\Application Data\PBGsavesDirectory
2008-09-30 23:30:32 ----D---- C:\Documents and Settings\All Users\Application Data\HiddenSecretsNightmare
2008-09-30 23:16:45 ----D---- C:\WINDOWS\The Princess Bride Game
2008-09-30 23:15:32 ----A---- C:\WINDOWS\The Princess Bride Game Setup Log.txt
2008-09-19 00:07:16 ----D---- C:\Documents and Settings\Administrator\Application Data\BeachPartyCraze
2008-09-18 23:10:50 ----D---- C:\WINDOWS\Baby Blimp
2008-09-18 23:09:48 ----A---- C:\WINDOWS\Baby Blimp Setup Log.txt
2008-09-18 23:07:47 ----D---- C:\WINDOWS\Sunshine Acres
2008-09-18 23:06:43 ----A---- C:\WINDOWS\Sunshine Acres Setup Log.txt
2008-09-18 23:04:01 ----D---- C:\WINDOWS\Beach Party Craze
2008-09-18 23:02:21 ----A---- C:\WINDOWS\Beach Party Craze Setup Log.txt
2008-09-17 12:38:44 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2008-09-17 12:38:16 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
2008-08-26 13:42:08 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2008-08-26 13:42:02 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2008-08-26 13:41:56 ----HDC---- C:\WINDOWS\$NtUninstallKB953839$
2008-08-26 13:41:15 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2008-08-26 13:38:51 ----HDC---- C:\WINDOWS\$NtUninstallKB951072-v2$
2008-08-26 13:38:42 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2008-08-26 13:37:45 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2008-08-05 22:14:38 ----D---- C:\Program Files\Common Files\Adobe
2008-08-05 22:14:38 ----D---- C:\Program Files\Adobe
2008-08-03 22:54:13 ----D---- C:\Documents and Settings\Administrator\Application Data\Games
2008-08-02 22:31:25 ----D---- C:\Documents and Settings\Administrator\Application Data\Alawar
2008-08-02 21:41:55 ----D---- C:\Documents and Settings\All Users\Application Data\FarmFrenzy2
2008-08-02 21:40:41 ----D---- C:\WINDOWS\Sherlock Holmes - The Mystery of the Persian Carpet
2008-08-02 21:39:17 ----A---- C:\WINDOWS\Sherlock Holmes - The Mystery of the Persian Carpet Setup Log.txt
2008-08-02 21:36:10 ----D---- C:\WINDOWS\Jenny's Fish Shop
2008-08-02 21:34:37 ----A---- C:\WINDOWS\Jenny's Fish Shop Setup Log.txt
2008-08-02 21:33:36 ----D---- C:\WINDOWS\Farm Frenzy 2
2008-08-02 21:32:32 ----A---- C:\WINDOWS\Farm Frenzy 2 Setup Log.txt
2008-08-01 15:58:25 ----A---- C:\WINDOWS\Little Shop - Big City Setup Log.txt

======List of files/folders modified in the last 3 months======

2008-10-25 14:15:26 ----RD---- C:\Program Files
2008-10-25 14:14:22 ----D---- C:\WINDOWS\Prefetch
2008-10-25 14:04:36 ----D---- C:\WINDOWS\system32\CatRoot2
2008-10-25 14:01:12 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-10-24 16:31:18 ----D---- C:\WINDOWS\Temp
2008-10-22 22:24:06 ----D---- C:\WINDOWS\security
2008-10-22 21:48:35 ----D---- C:\Program Files\Mozilla Firefox
2008-10-22 20:42:51 ----D---- C:\WINDOWS\system32
2008-10-22 20:42:50 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-10-22 19:40:33 ----A---- C:\WINDOWS\system.ini
2008-10-22 18:18:18 ----D---- C:\WINDOWS\system32\config
2008-10-22 18:18:02 ----D---- C:\WINDOWS\system32\wbem
2008-10-22 18:18:02 ----D---- C:\WINDOWS\Registration
2008-10-22 18:17:30 ----D---- C:\WINDOWS
2008-10-22 18:16:11 ----D---- C:\WINDOWS\system32\Restore
2008-10-22 15:03:56 ----D---- C:\Program Files\Common Files\Symantec Shared
2008-10-22 14:52:54 ----SD---- C:\WINDOWS\Downloaded Program Files
2008-10-22 14:49:42 ----D---- C:\WINDOWS\Network Diagnostic
2008-10-22 12:52:32 ----D---- C:\WINDOWS\system32\drivers
2008-10-21 22:27:29 ----D---- C:\Program Files\Games_June
2008-10-20 16:49:54 ----A---- C:\WINDOWS\NeroDigital.ini
2008-09-19 23:20:58 ----HD---- C:\WINDOWS\inf
2008-09-17 12:39:05 ----SHD---- C:\WINDOWS\Installer
2008-09-17 12:38:44 ----D---- C:\WINDOWS\WinSxS
2008-09-17 12:38:36 ----HD---- C:\WINDOWS\$hf_mig$
2008-09-17 12:38:25 ----A---- C:\WINDOWS\imsins.BAK
2008-08-27 03:16:48 ----D---- C:\WINDOWS\Help
2008-08-26 15:28:12 ----A---- C:\WINDOWS\system32\MRT.exe
2008-08-26 13:42:10 ----RSHDC---- C:\WINDOWS\system32\dllcache
2008-08-26 13:42:03 ----D---- C:\Program Files\Messenger
2008-08-26 13:38:31 ----D---- C:\Program Files\Internet Explorer
2008-08-16 15:52:37 ----D---- C:\Documents and Settings\Administrator\Application Data\Vso
2008-08-05 22:14:45 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2008-08-05 22:14:38 ----D---- C:\Program Files\Common Files
2008-08-03 22:48:19 ----D---- C:\Documents and Settings\All Users\Application Data\SpinTop Games

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK7;AMD K7 Processor Driver; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2002-12-31 37376]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys []
R1 FsVga;FsVga; C:\WINDOWS\system32\DRIVERS\fsvga.sys [2002-12-31 12160]
R1 SAVRT;SAVRT; \??\C:\Program Files\Symantec Client Security\Symantec AntiVirus\savrt.sys []
R1 SAVRTPEL;SAVRTPEL; \??\C:\Program Files\Symantec Client Security\Symantec AntiVirus\Savrtpel.sys []
R1 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys []
R1 SYMTDI;SYMTDI; C:\WINDOWS\System32\Drivers\SYMTDI.SYS [2006-01-24 195776]
R1 Tcpip6;Microsoft IPv6 Protocol Driver; C:\WINDOWS\system32\DRIVERS\tcpip6.sys [2008-06-20 225920]
R2 Aspi32;Aspi32; C:\WINDOWS\system32\drivers\Aspi32.sys [2002-12-31 16877]
R2 rspndr;Link-Layer Topology Discovery Responder; C:\WINDOWS\system32\DRIVERS\rspndr.sys [2002-12-31 62336]
R3 Afc;PPdus ASPI Shell; C:\WINDOWS\system32\drivers\Afc.sys [2005-02-23 11776]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2007-04-25 4030144]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2002-12-31 60800]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys []
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service; C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2007-02-27 42496]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 NAVENG;NAVENG; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20081020.003\naveng.sys []
R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20081020.003\navex15.sys []
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2002-12-31 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-10-22 3994624]
R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2007-06-21 47360]
R3 SYMDNS;SYMDNS; C:\WINDOWS\System32\Drivers\SYMDNS.SYS [2006-01-24 12992]
R3 SymEvent;SymEvent; \??\C:\Program Files\Symantec\SYMEVENT.SYS []
R3 SYMFW;SYMFW; C:\WINDOWS\System32\Drivers\SYMFW.SYS [2006-01-24 110784]
R3 SYMIDS;SYMIDS; C:\WINDOWS\System32\Drivers\SYMIDS.SYS [2006-01-24 31936]
R3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\SCFIDS~1\20081014.001\symidsco.sys []
R3 SYMNDIS;SYMNDIS; C:\WINDOWS\System32\Drivers\SYMNDIS.SYS [2006-01-24 28352]
R3 SYMREDRV;SYMREDRV; C:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2006-01-24 24768]
R3 tunmp;Microsoft Tun Miniport Adapter Driver; C:\WINDOWS\system32\DRIVERS\tunmp.sys [2002-12-31 12416]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2002-12-31 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2002-12-31 59392]
R3 usbstor;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2002-12-31 26496]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2002-12-31 20608]
R3 viagfx;viagfx; C:\WINDOWS\system32\DRIVERS\vtmini.sys [2004-12-07 172672]
S3 abgtg7uw;abgtg7uw; C:\WINDOWS\system32\drivers\abgtg7uw.sys []
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2003-03-09 51024]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2003-03-09 16080]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2003-03-09 21456]
S3 SONYPVU1;Sony USB Filter Driver (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2002-12-31 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2002-12-31 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ccEvtMgr;Symantec Event Manager; C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe [2006-03-24 192160]
R2 ccProxy;Symantec Network Proxy; C:\Program Files\Common Files\Symantec Shared\ccProxy.exe [2006-03-24 202400]
R2 ccSetMgr;Symantec Settings Manager; C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe [2006-03-24 169632]
R2 DefWatch;Symantec AntiVirus Definition Watcher; C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe [2006-06-15 31472]
R2 ISSVC;IS Service; C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe [2006-06-07 87728]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-10-22 159810]
R2 PDAgent;PDAgent; C:\Program Files\Perfect Disk 8.0\PDAgent.exe [2006-10-10 402960]
R2 SNDSrvc;Symantec Network Drivers Service; C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe [2006-01-24 214720]
R2 SPBBCSvc;Symantec SPBBCSvc; C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe [2006-04-11 1160848]
R2 Symantec AntiVirus;Symantec AntiVirus; C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe [2006-06-15 1805552]
R2 SymSecurePort;Symantec SecurePort; C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe [2006-06-07 173744]
R2 wwSecSvc;Washer AutoComplete; C:\WINDOWS\system32\wwSecure.exe [2005-04-20 487936]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-03-12 271920]
R3 PDEngine;PDEngine; C:\Program Files\Perfect Disk 8.0\PDEngine.exe [2006-10-10 603664]
S2 6to4;IPv6 Helper Service; C:\WINDOWS\system32\svchost.exe [2002-12-31 14336]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-09-03 29744]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-02-23 2045632]
S3 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2003-03-09 65795]
S3 SavRoam;SAVRoam; C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe [2006-06-15 115952]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2002-12-31 14336]

-----------------EOF-----------------

ANY SUGGESTIONS WILL BE MOST APPRECIATED!

Thank you in advance...........

 

I have the same problem researching it just like you, i have a automatic ip faliure and i used to have the dns failiure but thats fixed just the Internet still does not work

 

Hi elsone
Welcome to WindowsBBS

Please do the following.

Download ComboFix from Here to your Desktop.

It's best to disable realtime protection applications as they sometimes interfere with the tool.
Check this link for any applicable programs you may have.

• Close all open programs and windows
• Double click combofix.exe and follow the prompts.
• Vista users right click Combofix.exe and select Run As Administrator.
• When finished, it shall produce a log for you. Post the Combofix log

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Note - ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.

Note - Combofix makes some changes when run to prevent autorun/autoplay of ALL CDs, floppies and USB devices, to assist with malware removal & increase security. If this is an issue or makes it difficult for you to use those devices, please ask how to reset it.

Thanks
Geri

 

Thanks! Next Steps?

Thanks for the suggestion......and my apologies for the long delay. I was called out of town on a family emergency and just returned yesterday.

I downloaded ComboFix to this machine and transferred to the problem machine. I ran it, rebooted my PC but am still unable to navigate to any webpage.

Here is the log:
omboFix 08-11-07.01 - Administrator 2008-11-08 16:37:17.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.477 [GMT -6:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\documents and settings\Administrator\Application Data\inst.exe
c:\documents and settings\All Users\Start Menu\Programs\Internet Explorer.lnk
c:\windows\system32\awttqQJY.dll
c:\windows\system32\mlJDtSMc.dll
c:\windows\system32\pmnLCSkK.dll
c:\windows\system32\YJQqttwa.ini
c:\windows\system32\YJQqttwa.ini2

.
((((((((((((((((((((((((( Files Created from 2008-10-08 to 2008-11-08 )))))))))))))))))))))))))))))))
.

2008-10-28 17:22 . 2008-10-28 17:22 <DIR> d-------- c:\documents and settings\Administrator\Application Data\FarmerJane
2008-10-27 14:29 . 2008-10-27 14:29 <DIR> d-------- c:\windows\Farmer Jane
2008-10-27 14:27 . 2008-10-27 14:27 <DIR> d-------- c:\windows\Cake Mania 3
2008-10-27 14:25 . 2008-10-27 14:25 <DIR> d-------- c:\windows\Rooms - The Main Building
2008-10-27 14:11 . 2008-10-27 14:11 <DIR> d-------- c:\windows\The Secret of Margrave Manor
2008-10-27 14:09 . 2008-10-27 14:09 <DIR> d-------- c:\windows\Miriel The Magical Merchant
2008-10-27 13:43 . 2008-10-27 13:43 <DIR> d-------- c:\windows\Bloom Busters
2008-10-25 13:15 . 2008-10-25 13:16 <DIR> d-------- C:\rsit
2008-10-25 13:15 . 2008-10-25 13:15 <DIR> d-------- c:\program files\trend micro
2008-10-22 15:08 . 2008-10-22 17:17 <DIR> d-------- C:\fixwareout
2008-10-22 13:52 . 2008-10-22 17:17 <DIR> d-------- c:\windows\BDOSCAN8
2008-10-20 21:50 . 2008-10-20 21:50 <DIR> d-------- c:\documents and settings\All Users\Application Data\Alawar Stargaze
2008-10-20 21:29 . 2008-10-20 21:29 <DIR> d-------- c:\windows\Jigsaw World

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-29 01:50 --------- d-----w c:\documents and settings\Administrator\Application Data\PlayFirst
2008-10-27 20:29 --------- d-----w c:\program files\Games_June
2008-10-22 20:03 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-10-01 12:59 --------- d-----w c:\documents and settings\All Users\Application Data\MythPeople
2008-10-01 05:08 --------- d-----w c:\documents and settings\All Users\Application Data\PBGsavesDirectory
2008-10-01 04:30 --------- d-----w c:\documents and settings\All Users\Application Data\HiddenSecretsNightmare
2008-09-19 05:09 --------- d-----w c:\documents and settings\Administrator\Application Data\BeachPartyCraze
2007-06-21 17:19 47,360 ----a-w c:\documents and settings\Administrator\Application Data\pcouffin.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2002-12-31 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} "= "c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 153136]
"MSMSGS "= "c:\program files\Messenger\msmsgs.exe" [2004-10-14 1694208]
"Window Washer "= "c:\program files\Window Washer 6.0\wwDisp.exe" [2005-04-20 894464]
"SpySweeper "= "c:\program files\Spy Sweeper\SpySweeper.exe" [2003-07-10 654848]
"EPSON Stylus Photo R260 Series "= "c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIBNA.EXE" [2006-10-17 143360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"UnlockerAssistant "= "c:\program files\Unlocker\UnlockerAssistant.exe" [2006-09-07 15872]
"ccApp "= "c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-03-24 53408]
"vptray "= "c:\progra~1\SYMANT~1\SYMANT~2\VPTray.exe" [2006-06-15 124656]
"EPSON Stylus Photo R220 Series "= "c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE" [2005-03-09 98304]
"IMJPMIG8.1 "= "c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2002-12-31 208952]
"MSPY2002 "= "c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"PHIME2002ASync "= "c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A "= "c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"NeroFilterCheck "= "c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 153136]
"Google Desktop Search "= "c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-09-03 29744]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SoundMan "= "SOUNDMAN.EXE" [2007-04-16 c:\windows\SOUNDMAN.EXE]
"nwiz "= "nwiz.exe" [2006-10-22 c:\windows\system32\nwiz.exe]
"VTTimer "= "VTTimer.exe" [2006-08-15 c:\windows\system32\VTTimer.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
hp psc 1000 series.lnk - c:\program files\HP Photo 2.0\Digital Imaging\bin\hpohmr08.exe [2003-04-09 147456]
hpoddt01.exe.lnk - c:\program files\HP Photo 2.0\Digital Imaging\bin\hpotdd01.exe [2003-04-09 28672]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codec "= l3codecp.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify "=dword:00000001
"UpdatesDisableNotify "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\uTorrent\\uTorrent.exe "=

R0 videX32;videX32;c:\windows\system32\DRIVERS\videX32.sys [2006-10-17 9216]
R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\DRIVERS\xfilt.sys [2006-10-18 17920]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;c:\windows\system32\DRIVERS\fetnd5bv.sys [2007-02-27 42496]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2008-09-03 29744]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{79f997e6-1f87-11dc-b555-806d6172696f}]
\Shell\AutoRun\command - "E:\Install FreeAgent Tools.exe" /run

*Newly Created Service* - ASPI32
.
Contents of the 'Scheduled Tasks' folder

2007-12-21 c:\windows\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1190319290.job
- c:\program files\HP Photo 2.0\Digital Imaging\Bin\hpqfrucl.exe [2003-04-09 16:56]
.
- - - - ORPHANS REMOVED - - - -

BHO-{6C350DFC-885F-4296-82E3-6428DD982099} - c:\windows\system32\pmnLCSkK.dll
BHO-{7AE7E2EB-941D-40F7-94F1-D481E47D5493} - c:\windows\system32\awttqQJY.dll
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
ShellExecuteHooks-{6C350DFC-885F-4296-82E3-6428DD982099} - c:\windows\system32\pmnLCSkK.dll


.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\554r5ayc.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - http:\\\\www.google.com|http:\\\\mail.yahoo....://news.bbc.co.uk/chinese/simp/hi/default.stm
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-08 16:39:12
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
Completion time: 2008-11-08 16:40:59
ComboFix-quarantined-files.txt 2008-11-08 22:39:55

Pre-Run: 200,569,032,704 bytes free
Post-Run: 200,559,669,248 bytes free

130 --- E O F --- 2008-09-17 17:40:51


Any further advice will be appreciated! Thank you in advance.........

 

Hi
OK please see if you can download Hijackthis and post the log. If not please transfer the Hijackthis installer to the troubled machine and run it and post the log.

Download a copy of HijackThis installer from here and save it to your Desktop.

1. Save HJTInstall.exe to your desktop.
2. Double-click on the HJTintall.exe icon on your desktop.
   (Let it install to the default location C:\Program Files\Hijackthis)
3. Continue to click Next in the setup dialogue boxes until you get to the Select Additional Tasks dialogue.
4. Put a check by Create a desktop icon and then click Next again.
5. Continue to follow the rest of the prompts from there.
6. At the final dialogue box click Finish and it will launch HijackThis.
7. Click on the Do a system scan and save a log file button.
   (It will scan and the log should open in Notepad.)
8. Click on "Edit" > "Select All" to highlight the entire Notepad contents.
9. Then click on "Edit" > "Copy ".
10. Come back here to this thread and Paste the log in your next reply.
    (Right-click in the message body field and select "Paste ".)

CAUTION: DO NOT have HijackThis "fix" anything without carefully following expert guidance. Otherwise, you might render your computer unstable or even unbootable. Most of what HijackThis finds will be harmless or even required.

Thanks
Geri

 

HJT Log

Thanks for your continuing help........

I did as you suggested by downloading and copying the HJT file to the problem PC. It appears to have installed fine - though there were no prompts or choice about creating a desktop icon, etc. I did run the scan and here's the log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:06:58 PM, on 11/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Perfect Disk 8.0\PDAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
C:\WINDOWS\system32\wwSecure.exe
C:\Program Files\Perfect Disk 8.0\PDEngine.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Window Washer 6.0\wwDisp.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Spy Sweeper\SpySweeper.exe
C:\Program Files\HP Photo 2.0\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\HP Photo 2.0\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe -H
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R220 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE /P30 "EPSON Stylus Photo R220 Series" /O6 "USB001" /M "Stylus Photo R220 "
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe "
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Window Washer] C:\Program Files\Window Washer 6.0\wwDisp.exe
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [EPSON Stylus Photo R260 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBNA.EXE /FU "C:\WINDOWS\TEMP\E_S1D9.tmp" /EF "HKCU "
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Perfect Disk 8.0\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Perfect Disk 8.0\PDEngine.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
O23 - Service: Washer AutoComplete (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe

--
End of file - 7991 bytes

I appreciate your time and effort.......

 

Hi
OK not seeing anything in there either.

Can you tell me what this is?
©Ãº¬P³Ã‚±N123
It's in your Add and Remove Programs list.

Lets try this and see if it helps, then we'll go from there.

Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 only

• 
  Double-click ATF-Cleaner.exe to run the program.
  Under Main choose: Select All
  Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
  Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
  Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

Make sure to run Firefox instructions also.

Also do this in Firefox.

Open Firefox
Click on Tools > Options > click on the Privacy Tab.
Click on the Show Cookies button
Click on Remove All Cookies.

Please clear your Firefox cache.
Open Firefox
Click on Tools.
Click on Clear Private Data
Put a check in the Cache box
Click Clear Private Data Now.
OK any prompts.

Now this,

Open a command window and type the following commands, hitting enter after each. Make sure there is a space between the g /

ipconfig /release

ipconfig /flushdns

ipconfig /renew

Now let me know if you can get to any web sites.

Thanks

 

Steps completed. Next?

Followed the instructions without issue, including those for Firefox.

The high note is that this time when I ran the "ipconfig /flushdns ", it returned "Successfully flushed the DNS Resolver Cache" whereas as before it always returned a message indicating that the operation failed during execution.

Unfortunately, even after the "ipconfig /renew ", I'm still getting "Server not found ", "Firefox is unable to locate the server at www.google.com"

When I check Network Connections, it shows I'm connected at 100 Mbps with 1,147 Bytes Sent and 2,014 Bytes Received (though this doesn't change after repeated attempts to load Google or another other web page).

By the way, the ©Ãº¬P³Ã‚±N123 entry in the Add Remove Programs is a Mah Jong game from Taiwan that has been installed on that machine for at least 6 months. The characters look weird in the log but they are actually Chinese characters on-screen.

Any additional ideas? Thank you in advance.

 

Hi
OK lets try to reset your Host file, If you use a custom host file you will have to replace it after running this.

Download the HostsXpert 4.3 - Hosts File Manager.

• Unzip HostsXpert - Hosts File Manager to a convenient folder such as C:\HostsXpert
• Click HostsXpert.exe to Run HostsXpert - Hosts File Manager from its new home
• Click "Make Hosts Writable?" in the upper left corner (If available).
• Click Backup / Restore then Create Backup
• Click Restore Microsoft's Hosts file and then click OK.
• Click the X to exit the program.
• Note: If you were using a custom Hosts file you will need to replace any of those entries yourself.

Let me know.

Thanks
Geri

 

Done. Next?

Downloaded. Transferred. Unzipped. Ran. Backed Up. Replaced with MS Hosts file. Closed app.

Opened Firefox. "Server not found ", "Firefox is unable to locate the server at www.google.com ".

Shutdown. Turned on. Opened Firefox. Same as above.

Next?

p.s. Thanks for your patience in walking me through all this!

 

Hi
Try each of the following commands from a command window.

ping www.google.com
ping 64.233.187.99

Please let me know how many packets. sent > Received > Lost.

Thanks

 

Good?

First I apologize for the long delay.....my mother passed away and I have been out of town for weeks.

I did as requested. On the www.google.com ping, I got "Ping request could not find the host www.google.com. Please check the name and try again. "

The other ping produced:
Pinging 64.233.187.99 with 32 bytes of data:
Reply from 64.233.187.99: bytes=32 time=42ms T=243
Reply from 64.233.187.99: bytes=32 time=44ms T=243
Reply from 64.233.187.99: bytes=32 time=40ms T=243
Reply from 64.233.187.99: bytes=32 time=40ms T=243

Ping statistics for 64.233.187.99:
Packets Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip time in milli-seconds:
Minimum = 40ms, Maximum = 44ms, Average = 41ms

Thanks again for your patience and continued guidance.........

 

Hi
Is it just Firefox that has the problem? Try deleting Firefox and re-downloading it.

Geri

 

Reinstalled Firefox without success

As suggested, I uninstalled Firefox. I then downloaded the most current version and reinstalled that on the problem PC. After the re-install, I opened Firefox and received: "Address Not Found Firefox can't find the server at en-us.www.mozilla.com "

I suspected that Firefox isn't the problem as Microsoft Internet Explorer also produces "Internet Explorer cannot display the webpage" when attempting to load www.microsoft.com.

Your thoughts? Thanks in advance.

 

Hi
Are you using a wirelees connection or are you wired, it may be a router problem if you are using a wireless connection.

 

Wired vs. Wireless

I'm hardwired from the from the router to the PC.

A real stumper, huh?

 

Hi
I'll see if I can't get one of our Internet people to look in here.

Geri

 

What do you get if you enter:

Code:

nslookup www.google.com

at the command prompt?

Also can you ping the address set as your DNS server?

 

Progress???

OK, when I directly pinged my DNS servers* (24.93.41.127 and 24.93.41.128) both addresses responded to the ping, with 0% loss on all 4 attempts to each.

Address 24.93.41.127 responded in an average of 17 ms.
Address 24.93.41.128 responded in an average of 26 ms.

(*I got the DNS addresses from running "ipconfig /all" at the command line.)


HOWEVER, when I tried running "nslookup www.google.com" at the command line and got:

DNS request timed out.
timeout was 2 seconds.
*** Can't find server for address 24.93.41.127: Timed out
DNS request timed out.
timeout was 2 seconds.
*** Can't find server for address 24.93.41.128: Timed out
*** Default servers are not available
Server: Unknown
Address: 24.93.41.127

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
*** Request to unknown timed-out

Interestingly, those "timeouts" ARE MY DNS SERVER ADDRESSES!! Soooooooo, I guess that means something ......but I really have not idea what!

Thanks for your continuing guidance. I appreciate it.

 

Hi
Please go here.
http://www.freeproxyserver.net/#

Type in
www.google.com and click Go

Does it take you to Googles home page?