Active win32/tenga.gen virus - it took over

First, lets get a new log from that computer. Please download DDS and save it to your desktop.

• Disable any script blocking protection
• Double click dds.scr to run the tool.
• When done, DDS will open two (2) logs:
  1. DDS.txt
  2. Attach.txt
• Save both reports to your desktop.

Please include the contents of both logs in your next reply. The scan will instruct you to post the attach log as an attachment. No need for that though ..... just post it as you would any other log.


Side note - to copy an error message, click the message once to make sure it is the active window then press the Ctrl and C keys simultaneously. Open notepad and press Ctrl+V to paste it.

 

DDS (Version 1.1.0) - NTFSx86
Run by TigerDistrict2 at 14:07:35.29 on Fri 01/02/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1918.1373 [GMT -6:00]

AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated)
FW: ActiveArmor Firewall *disabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\DRoster\Firebird\bin\fbguard.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Common Files\Intuit\Entitlement Client\v5\Server\Intuit.Spc.Map.EntitlementClient.Server.Service.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\DOCUMENTS AND SETTINGS\TIGERDISTRICT2\DESKTOP\UPS\WSTD\MSSQL$UPSWSDBSERVER\Binn\sqlservr.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\DRoster\Firebird\bin\fbserver.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdater.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\TigerDistrict2\Desktop\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://smallbusiness.att.net
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: PCTools Site Guard: {5c8b2a36-3db1-42a4-a3cb-d426709bbfeb} - c:\progra~1\spywar~1\tools\iesdsg.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: PCTools Browser Monitor: {b56a7d7d-6927-48c8-a975-17df180c71ac} - c:\progra~1\spywar~1\tools\iesdpb.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [EasyLinkAdvisor] "c:\program files\linksys easylink advisor\LinksysAgent.exe" /startup
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
uRun: [Spyware Doctor] "c:\program files\spyware doctor\swdoctor.exe" /Q
mRun: [ClamWin] "c:\program files\clamwin\bin\ClamTray.exe" --logon
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe "
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [HelpCenter4.1] c:\program files\fastaccessdsl\helpcenter43\bin\sprtcmd.exe /P HelpCenter4.1
mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
mRun: [NA1Messenger] c:\documents and settings\tigerdistrict2\desktop\ups\wstd\UPSNA1Msgr.exe
mRun: [IntuitUpdater] "c:\program files\common files\intuit\update service\IntuitUpdater.exe" /command startup
mRunOnce: [spuninst] c:\windows\$ntservicepackuninstall$\spuninst\spuninst.exe /@@
dRun: [Spyware Doctor] "c:\program files\spyware doctor\swdoctor.exe" /Q
StartupFolder: c:\docume~1\tigerd~1\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ralink~1.lnk - c:\program files\ralink\common\RaUI.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\servic~1.lnk - c:\program files\microsoft sql server\80\tools\binn\sqlmangr.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\upswor~2.lnk - c:\documents and settings\tigerdistrict2\desktop\ups\wstd\WSTDMessaging.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\upswor~1.lnk - c:\documents and settings\tigerdistrict2\desktop\ups\wstd\wstdPldReminder.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - {A1EDC4A1-940F-48E0-8DFD-E38F1D501021} - c:\progra~1\spywar~1\tools\iesdpb.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: qbpos - {662E7FAE-5C17-491C-AD9D-98C1F66CC6A0} - c:\windows\system32\QBPOSProtocol.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
AppInit_DLLs: c:\progra~1\google\google~1\GOEC62~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
LSA: Notification Packages = scecli scecli scecli scecli

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\tigerd~1\applic~1\mozilla\firefox\profiles\bnw0f2xz.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - component: c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

============= SERVICES / DRIVERS ===============

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-12-15 28544]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2007-12-21 33800]
R1 ikhfile;File Security Kernel Anti-Spyware Driver;c:\windows\system32\drivers\ikhfile.sys [2008-12-16 30592]
R1 ikhlayer;Kernel Anti-Spyware Driver;c:\windows\system32\drivers\ikhlayer.sys [2008-12-16 51072]
R1 SASDIFSV;SASDIFSV;\??\c:\program files\superantispyware\SASDIFSV.SYS [2008-5-28 8944]
R1 SASKUTIL;SASKUTIL;\??\c:\program files\superantispyware\SASKUTIL.sys [2008-5-28 55024]
R2 ekrn;Eset Service; "c:\program files\eset\eset nod32 antivirus\ekrn.exe" [2007-12-21 468224]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\droster\firebird\bin\fbguard.exe -s []
R2 Intuit Entitlement Service v5;Intuit Entitlement Service v5; "c:\program files\common files\intuit\entitlement client\v5\server\Intuit.Spc.Map.EntitlementClient.Server.Service.exe" [2007-6-20 20480]
R2 IntuitUpdateService;Intuit Update Service; "c:\program files\common files\intuit\update service\IntuitUpdateService.exe" [2007-8-15 20480]
R2 MSSQL$UPSWSDBSERVER;MSSQL$UPSWSDBSERVER; "c:\documents and settings\tigerdistrict2\desktop\ups\wstd\mssql$upswsdbserver\binn\sqlservr.exe" -sUPSWSDBSERVER [2005-5-4 9154560]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\droster\firebird\bin\fbserver.exe -s []
R3 SASENUM;SASENUM;\??\c:\program files\superantispyware\SASENUM.SYS [2008-5-28 7408]
S2 QBPOSDBServiceV7;QBPOS Database Manager v7; "c:\program files\intuit\quickbooks point of sale 7.0\databaseserver\QBPOSDBServiceV7.exe" [2007-9-13 2613072]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\nos\bin\getPlus_HelperSvc.exe [2008-12-17 33752]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245; "c:\program files\google\google desktop search\GoogleDesktop.exe" [2008-12-1 24064]
S3 SQLAgent$UPSWSDBSERVER;SQLAgent$UPSWSDBSERVER; "c:\documents and settings\tigerdistrict2\desktop\ups\wstd\mssql$upswsdbserver\binn\sqlagent.EXE" -i UPSWSDBSERVER [2005-5-3 323584]

=============== Created Last 30 ================

2009-01-02 13:36 1,200,128 a------- c:\windows\system32\ntbackup.exe
2009-01-02 13:23 <DIR> --d----- c:\windows\ServicePackFiles
2009-01-02 12:33 <DIR> --d----- c:\program files\Intuit
2009-01-02 12:33 <DIR> --d----- c:\program files\common files\Intuit
2008-12-29 12:12 19,569 a------- c:\windows\006696_.tmp
2008-12-29 12:12 19,569 a------- c:\windows\006600_.tmp
2008-12-29 12:12 19,569 a------- c:\windows\003302_.tmp
2008-12-24 15:56 19,569 a------- c:\windows\003401_.tmp
2008-12-24 15:51 <DIR> --d----- C:\a7e98894695ef887a195baff3bce221b
2008-12-24 00:01 <DIR> --d----- c:\program files\Windows Resource Kits
2008-12-23 23:38 <DIR> --d----- c:\windows\system32\scripting
2008-12-23 23:38 <DIR> --d----- c:\windows\l2schemas
2008-12-23 23:38 <DIR> --d----- c:\windows\system32\en
2008-12-23 23:38 <DIR> --d----- c:\windows\system32\bits
2008-12-23 23:25 221,184 a------- c:\windows\system32\wmpns.dll
2008-12-23 23:05 33,656 a------- c:\windows\system32\sprecovr.exe
2008-12-22 10:31 <DIR> --d----- c:\documents and settings\tigerdistrict2\DoctorWeb
2008-12-19 11:41 7,680 a------- c:\windows\system32\spdwnwxp.exe
2008-12-19 11:41 19,569 a------- c:\windows\003400_.tmp
2008-12-19 11:41 19,569 a------- c:\windows\003399_.tmp
2008-12-19 11:41 19,569 a------- c:\windows\003398_.tmp
2008-12-19 11:40 1,689,088 a------- c:\windows\system32\SET1479.tmp
2008-12-19 11:31 410,984 a------- c:\windows\system32\deploytk.dll
2008-12-19 10:22 53,248 a------- c:\documents and settings\tigerdistrict2\Process.exe
2008-12-19 10:21 <DIR> --d----- c:\program files\Trend Micro
2008-12-18 17:32 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Intuit
2008-12-17 16:58 <DIR> --d----- c:\program files\MICROSOFT SQL SERVER
2008-12-17 11:08 582 a------- c:\windows\win.tmp
2008-12-17 11:08 231 a------- c:\windows\system.tmp
2008-12-17 11:07 <DIR> --d----- c:\docume~1\tigerd~1\applic~1\PC Tools
2008-12-16 13:14 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2008-12-16 13:14 <DIR> --d----- c:\program files\SUPERAntiSpyware
2008-12-16 13:14 <DIR> --d----- c:\docume~1\tigerd~1\applic~1\SUPERAntiSpyware.com
2008-12-16 13:13 352 a---h--- c:\windows\nod32fixtemdono.reg
2008-12-16 13:13 <DIR> --d----- c:\program files\ESET
2008-12-16 11:45 <DIR> --d----- C:\SPYWARE
2008-12-16 10:44 51,072 a------- c:\windows\system32\drivers\ikhlayer.sys
2008-12-16 10:44 30,592 a------- c:\windows\system32\drivers\ikhfile.sys
2008-12-16 10:44 <DIR> --d----- c:\program files\Spyware Doctor
2008-12-15 17:39 28,544 a------- c:\windows\system32\drivers\pavboot.sys
2008-12-15 17:38 <DIR> --d----- c:\program files\Panda Security
2008-12-15 17:15 102,664 a------- c:\windows\system32\drivers\tmcomm.sys
2008-12-15 17:10 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2008-12-15 17:10 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2008-12-15 17:03 <DIR> --d----- c:\program files\common files\Wise Installation Wizard
2008-12-15 16:58 <DIR> --d----- C:\nod32
2008-12-15 16:52 15,504 a------- c:\windows\system32\drivers\mbam.sys
2008-12-15 16:52 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-15 16:52 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2008-12-15 16:52 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2008-12-15 15:37 234 a------- c:\documents and settings\tigerdistrict2\dl.exe
2008-12-09 12:33 <DIR> --d----- c:\program files\FastAccessDSL
2008-12-09 12:18 <DIR> --d----- c:\docume~1\alluse~1\applic~1\ATTToolbar
2008-12-09 12:18 <DIR> --d----- c:\program files\ATTToolbar
2008-12-09 12:18 <DIR> --d----- c:\docume~1\tigerd~1\applic~1\ATTToolbar
2008-12-09 12:18 <DIR> --d----- c:\windows\Motive
2008-12-09 12:18 <DIR> --d----- c:\program files\BellSouth Application Management
2008-12-09 12:18 <DIR> --d----- c:\program files\BellSouth
2008-12-09 12:08 <DIR> --d----- c:\program files\att-nap
2008-12-09 12:08 <DIR> --d----- c:\program files\common files\Motive

==================== Find3M ====================

2008-12-23 23:15 86,327 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2008-12-16 12:45 36,352 a------- c:\windows\system32\typeperf.exe
2008-12-16 12:44 33,792 a------- c:\windows\system32\regini.exe
2008-12-16 12:43 123,392 a------- c:\windows\system32\mplay32.exe
2008-12-16 12:42 83,456 a------- c:\windows\system32\dpvsetup.exe
2008-12-16 12:41 57,856 a------- c:\windows\system32\dllcache\spoolsv.exe
2008-12-16 12:40 90,624 a------- c:\windows\system32\dllcache\muisetup.exe
2008-12-16 12:39 539,136 a------- c:\windows\system32\dllcache\dialer.exe
2008-12-16 12:38 27,648 a------- c:\windows\system32\dllcache\conime.exe
2008-12-16 12:33 146,432 a------- c:\windows\system32\dllcache\regedit.exe
2008-12-16 12:33 146,432 a------- c:\windows\regedit.exe
2008-12-16 12:32 35,328 a------- c:\windows\pchealth\helpctr\binaries\notiflag.exe
2008-12-16 12:32 99,840 a------- c:\windows\pchealth\helpctr\binaries\HelpHost.exe
2008-12-16 12:27 315,392 a------- c:\windows\HideWin.exe
2008-12-16 12:27 10,752 a------- c:\windows\system32\dllcache\hh.exe
2008-12-16 12:27 10,752 a------- c:\windows\hh.exe
2008-12-16 12:27 376,832 a------- c:\windows\help\tours\mmtour\tour.exe
2008-12-09 12:18 53,797 a------- c:\program files\INSTALL.LOG
2008-10-24 05:10 453,632 a------- c:\windows\system32\dllcache\mrxsmb.sys
2008-10-23 07:01 283,648 a------- c:\windows\system32\gdi32.dll
2008-10-23 07:01 283,648 a------- c:\windows\system32\dllcache\gdi32.dll
2008-10-16 14:38 826,368 a------- c:\windows\system32\wininet.dll
2008-10-16 14:06 268,648 a------- c:\windows\system32\mucltui.dll
2008-10-16 14:06 208,744 a------- c:\windows\system32\muweb.dll
2008-10-15 10:57 332,800 a------- c:\windows\system32\dllcache\netapi32.dll

============= FINISH: 14:08:07.29 ===============

 

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Version 1.0)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 11/12/2007 4:30:45 PM
System Uptime: 1/2/2009 1:55:36 PM (1 hours ago)

Motherboard: ASUSTek Computer INC. | | NARRA2
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 4400+ | Socket AM2 | 2310/200mhz
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 4400+ | Socket AM2 | 2310/200mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 373 GiB total, 339.511 GiB free.
D: is CDROM ()
E: is Removable
F: is Removable
G: is Removable
H: is Removable

==== Disabled Device Manager Items =============

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: USB Wireless 802.11 b/g Adaptor
Device ID: USB\VID_15A9&PID_0004\5&21383744&0&10
Manufacturer: Lite-On
Name: USB Wireless 802.11 b/g Adaptor
PNP Device ID: USB\VID_15A9&PID_0004\5&21383744&0&10
Service: RT73

==== System Restore Points ===================

RP1: 12/22/2008 7:07:48 PM - System Checkpoint
RP2: 12/23/2008 9:28:49 PM - System Checkpoint
RP3: 12/23/2008 10:15:23 PM - Installed QuickBooks Point of Sale 7.0.
RP4: 12/23/2008 10:59:28 PM - Software Distribution Service 3.0
RP5: 12/23/2008 11:27:28 PM - Software Distribution Service 3.0
RP6: 12/24/2008 12:01:32 AM - Installed Windows Resource Kit Tools - SubInAcl.exe
RP7: 12/24/2008 12:04:30 AM - Software Distribution Service 3.0
RP8: 12/24/2008 3:00:15 AM - Software Distribution Service 3.0
RP9: 12/24/2008 2:10:16 PM - Software Distribution Service 3.0
RP10: 12/24/2008 2:20:20 PM - Software Distribution Service 3.0
RP11: 12/24/2008 2:29:13 PM - Software Distribution Service 3.0
RP12: 12/24/2008 2:30:03 PM - Software Distribution Service 3.0
RP13: 12/24/2008 2:30:19 PM - Software Distribution Service 3.0
RP14: 12/24/2008 3:56:59 PM - Installed Windows XP Service Pack 3.
RP15: 12/25/2008 3:00:14 AM - Software Distribution Service 3.0
RP16: 12/26/2008 3:00:14 AM - Software Distribution Service 3.0
RP17: 12/27/2008 3:00:13 AM - Software Distribution Service 3.0
RP18: 12/28/2008 3:00:14 AM - Software Distribution Service 3.0
RP19: 12/29/2008 3:00:14 AM - Software Distribution Service 3.0
RP20: 12/29/2008 11:52:18 AM - Software Distribution Service 3.0
RP21: 12/29/2008 11:52:50 AM - Software Distribution Service 3.0
RP22: 12/29/2008 11:53:05 AM - Software Distribution Service 3.0
RP23: 12/29/2008 12:13:17 PM - Software Distribution Service 3.0
RP24: 12/29/2008 12:15:33 PM - Software Distribution Service 3.0
RP25: 12/29/2008 1:16:21 PM - Software Distribution Service 3.0
RP26: 12/29/2008 5:54:46 PM - Software Distribution Service 3.0
RP27: 12/30/2008 1:18:48 PM - Removed QuickBooks Point of Sale 7.0.
RP28: 12/30/2008 1:29:10 PM - Installed QuickBooks Point of Sale 7.0.
RP29: 12/31/2008 3:00:25 AM - Software Distribution Service 3.0
RP30: 1/1/2009 3:00:14 AM - Software Distribution Service 3.0
RP31: 1/2/2009 3:00:14 AM - Software Distribution Service 3.0
RP32: 1/2/2009 12:13:58 PM - Installed QuickBooks Point of Sale 5.0
RP33: 1/2/2009 12:16:10 PM - Printer Driver EPSON TM-T88II No cut Installed
RP34: 1/2/2009 12:16:13 PM - Printer Driver EPSON TM-T88II Partial cut Installed
RP35: 1/2/2009 12:16:18 PM - Printer Driver QBPOS Star TSP600 Receipt Printer Installed
RP36: 1/2/2009 12:16:24 PM - Printer Driver Zebra LP2824 Installed
RP37: 1/2/2009 12:20:00 PM - Removed QuickBooks Point of Sale 5.0
RP38: 1/2/2009 12:26:24 PM - Removed QuickBooks Point of Sale 7.0.
RP39: 1/2/2009 12:33:40 PM - Installed QuickBooks Point of Sale 7.0.
RP40: 1/2/2009 1:14:05 PM - Software Distribution Service 3.0
RP41: 1/2/2009 1:30:44 PM - Software Distribution Service 3.0

==== Installed Programs ======================

2007 Microsoft Office Suite Service Pack 1 (SP1)
Acrobat.com
Adobe AIR
Adobe Flash Player 9 ActiveX
Adobe Flash Player Plugin
Adobe Reader 9
Apple Mobile Device Support
Apple Software Update
AT&T Toolbar
BellSouth Application Management
Bonjour
CCC
ClamWin Free Antivirus 0.94.1
Color LaserJet 2600n
CT-S300_x32_157
Data Fax SoftModem with SmartCP
Drivers Install For Linksys Easylink Advisor
DRoster
ESET NOD32 Antivirus
FastAccess® DSL Help Center 4.4
FormsComponent
FOSS
Google Desktop
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hotfix 2050 for SQL Server 2000 ENU (KB948110)
Hotfix for Microsoft .NET Framework 3.0 (KB932471)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB896344)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB935448)
Hotfix for Windows XP (KB952287)
iTunes
Java(TM) 6 Update 11
Java(TM) 6 Update 3
Linksys EasyLink Advisor 1.6 (0032)
Macromedia FreeHand 10
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 3.0 Service Pack 1
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft SQL Server Desktop Engine (UPSWSDBSERVER)
Microsoft User-Mode Driver Framework Feature Pack 1.0
MiniRingtone 1.5
Mozilla Firefox (2.0.0.20)
Mozilla Thunderbird (2.0.0.18)
MSIChecker
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 Parser and SDK
MSXML 6 Service Pack 2 (KB954459)
NA1Messenger
Netflix Movie Viewer
NOD32 v3.x FiX 1.1 by TemDono (Free Updates - Expire in 2050)
NRF
NVIDIA Drivers
NVIDIA ForceWare Network Access Manager
Panda ActiveScan 2.0
PolicyManager
psqlODBC
QuickBooks Point of Sale 7.0
QuickTime
Ralink Wireless LAN
Realtek High Definition Audio Driver
Reconciler
ReportServer
Security Update for 2007 Microsoft Office System (KB951550)
Security Update for 2007 Microsoft Office System (KB951944)
Security Update for 2007 Microsoft Office System (KB958439)
Security Update for Microsoft Office Excel 2007 (KB958437)
Security Update for Microsoft Office OneNote 2007 (KB950130)
Security Update for Microsoft Office PowerPoint 2007 (KB951338)
Security Update for Microsoft Office Publisher 2007 (KB950114)
Security Update for Microsoft Office system 2007 (KB954326)
Security Update for Microsoft Office system 2007 (KB956828)
Security Update for Microsoft Office Word 2007 (KB956358)
Security Update for Visio 2007 (KB947590)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937894)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB939653)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Spybot - Search & Destroy
Spyware Doctor 4.0
Star TSP100 Driver Installer
SUPERAntiSpyware Professional
SupportSoft Assisted Service
SupportUtility
System
System Requirements Lab
Update for Microsoft Office Outlook 2007 (KB952142)
Update for Office 2007 (KB946691)
Update for Outlook 2007 Junk Email Filter (kb958619)
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920342)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB925720)
Update for Windows XP (KB925876)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB932823-v3)
Update for Windows XP (KB933360)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB955839)
UPS WorldShip
UPSDB
UPSICC
UPSlinkHTTP
UPSVCMM
WebFldrs XP
WebHelp
Windows Driver Package - Star Micronics TSP100 (07/26/2006 1.0.4.0)
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 11
Windows Presentation Foundation
Windows Resource Kit Tools - SubInAcl.exe
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Service Pack 3
WinRAR archiver
WinZip 11.2
WorldShip
XML Paper Specification Shared Components Pack 1.0

==== Event Viewer Messages From Past Week ========

12/30/2008 3:59:01 PM, error: SideBySide [58] - Syntax error in manifest or policy file "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\csc.exe" on line 6.
12/30/2008 3:54:01 PM, error: SideBySide [59] - Generate Activation Context failed for c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\csc.exe. Reference error message: The operation completed successfully. .
12/30/2008 11:11:29 AM, error: EventLog [6004] - A driver packet received from the I/O subsystem was invalid. The data is the packet.
12/30/2008 10:47:42 AM, error: SideBySide [59] - Generate Activation Context failed for C:\WINDOWS\system32\wscntfy.exe. Reference error message: The operation completed successfully. .
12/30/2008 10:47:42 AM, error: SideBySide [58] - Syntax error in manifest or policy file "C:\WINDOWS\system32\wscntfy.exe" on line 21.
12/30/2008 10:47:12 AM, error: SideBySide [59] - Generate Activation Context failed for C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe. Reference error message: The operation completed successfully. .
12/30/2008 10:47:12 AM, error: SideBySide [58] - Syntax error in manifest or policy file "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" on line 30.
12/30/2008 10:47:08 AM, error: SideBySide [59] - Generate Activation Context failed for C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe. Reference error message: The operation completed successfully. .
12/30/2008 10:47:08 AM, error: SideBySide [58] - Syntax error in manifest or policy file "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" on line 2.
12/30/2008 10:46:42 AM, error: Service Control Manager [7000] - The Upload Manager service failed to start due to the following error: The account specified for this service is different from the account specified for other services running in the same process.
12/30/2008 10:46:42 AM, error: Service Control Manager [7000] - The Bonjour Service service failed to start due to the following error: This application has failed to start because the application configuration is incorrect. Reinstalling the application may fix this problem.
12/30/2008 10:46:42 AM, error: Service Control Manager [7000] - The Apple Mobile Device service failed to start due to the following error: This application has failed to start because the application configuration is incorrect. Reinstalling the application may fix this problem.
12/30/2008 10:46:36 AM, error: SideBySide [59] - Generate Activation Context failed for C:\Program Files\Bonjour\mDNSResponder.exe. Reference error message: The operation completed successfully. .
12/30/2008 10:46:36 AM, error: SideBySide [58] - Syntax error in manifest or policy file "C:\Program Files\Bonjour\mDNSResponder.exe" on line 6.
12/30/2008 10:46:36 AM, error: SideBySide [59] - Generate Activation Context failed for C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe. Reference error message: The operation completed successfully. .
12/30/2008 10:46:36 AM, error: SideBySide [58] - Syntax error in manifest or policy file "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe" on line 1.
12/29/2008 5:55:01 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x8007f0ed: Security Update for Windows XP (KB946648).
12/29/2008 1:03:07 PM, error: System Error [1003] - Error code 100000d1, parameter1 00630077, parameter2 00000002, parameter3 00000000, parameter4 b5ebdcd6.
12/29/2008 12:47:27 PM, error: NtServicePack [4374] - Windows XP installation failed, leaving Windows XP partially updated.
The installation of the Service Pack did not complete, and a rollback to the pre-installation state has been initiated. A rollback is a two-step process. Step one is complete; to complete step two, click OK. To be reminded at next login to complete step two, click Cancel. After you complete the rollback, your system will reboot and you may retry the installation of the Service Pack.
12/29/2008 11:53:03 AM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80246007: Windows XP Service Pack 3 (KB936929).
12/29/2008 10:08:19 AM, error: System Error [1003] - Error code 1000000a, parameter1 00670070, parameter2 0000001c, parameter3 00000000, parameter4 804faab0.
12/28/2008 9:00:05 AM, error: NtServicePack [4374] - Windows XP installation failed, leaving Windows XP partially updated.
The installation of the Service Pack did not complete, and a rollback to the pre-installation state has been initiated. A rollback is a two-step process. Step one is complete; to complete step two, click OK. To be reminded at next login to complete step two, click Cancel. After you complete the rollback, your system will reboot and you may retry the installation of the Service Pack.
1/2/2009 12:53:01 PM, error: Service Control Manager [7034] - The QBPOS Database Manager v7 service terminated unexpectedly. It has done this 1 time(s).
1/2/2009 12:53:06 PM, error: Service Control Manager [7034] - The Intuit Entitlement Service v5 service terminated unexpectedly. It has done this 1 time(s).
1/2/2009 12:53:10 PM, error: Service Control Manager [7034] - The Intuit Update Service service terminated unexpectedly. It has done this 1 time(s).

==== End Of File ===========================

 

It may be important to let you know that this computer originally came with Windows Vista, but took it off and put Windows XP.

I'm not sure how/if this affects anything, but I thought I'd throw it out there anyway.

 

I know it doesn't sound like much fun, but I think the solution to installing SP3 on this machine is going to be uninstalling the security apps. Nod32, Panda ActiveScan 2.0, Spyware Doctor 4.0 and SUPERAntiSpyware. Then run the SubInACL procedure again, and finally try installing SP3.

 

Thanks for the tip on copying error messages.

Do you see anything in this message that may provide us with an answer of where to look to solve our problem? This happens when I try to reinstall Quickbooks Point of Sale Software. It started giving us problems right around the time of the virus.

---------------------------
Error create firewall rule(s)!
---------------------------
Cannot execute a program. The command being executed was "c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @ "C:\Documents and Settings\TigerDistrict2\Local Settings\Temp\dwy4ij_1.cmdline ".: at System.CodeDom.Compiler.Executor.ExecWaitWithCaptureUnimpersonated(SafeUserTokenHandle userToken, String cmd, String currentDir, TempFileCollection tempFiles, String& outputName, String& errorName, String trueCmdLine)

at System.CodeDom.Compiler.Executor.ExecWaitWithCapture(SafeUserTokenHandle userToken, String cmd, String currentDir, TempFileCollection tempFiles, String& outputName, String& errorName, String trueCmdLine)

at Microsoft.CSharp.CSharpCodeGenerator.Compile(CompilerParameters options, String compilerDirectory, String compilerExe, String arguments, String& outputFile, Int32& nativeReturnValue, String trueArgs)

at Microsoft.CSharp.CSharpCodeGenerator.FromFileBatch(CompilerParameters options, String[] fileNames)

at Microsoft.CSharp.CSharpCodeGenerator.FromSourceBatch(CompilerParameters options, String[] sources)

at Microsoft.CSharp.CSharpCodeGenerator.System.CodeDom.Compiler.ICodeCompiler.CompileAssemblyFromSourceBatch(CompilerParameters options, String[] sources)

at System.CodeDom.Compiler.CodeDomProvider.CompileAssemblyFromSource(CompilerParameters options, String[] sources)

at System.Xml.Serialization.Compiler.Compile(Assembly parent, String ns, XmlSerializerCompilerParameters xmlParameters, Evidence evidence)

at System.Xml.Serialization.TempAssembly.GenerateAssembly(XmlMapping[] xmlMappings, Type[] types, String defaultNamespace, Evidence evidence, XmlSerializerCompilerParameters parameters, Assembly assembly, Hashtable assemblies)

at System.Xml.Serialization.TempAssembly..ctor(XmlMapping[] xmlMappings, Type[] types, String defaultNamespace, String location, Evidence evidence)

at System.Xml.Serialization.XmlSerializer.GenerateTempAssembly(XmlMapping xmlMapping, Type type, String defaultNamespace)

at System.Xml.Serialization.XmlSerializer..ctor(Type type, String defaultNamespace)

at System.Xml.Serialization.XmlSerializer..ctor(Type type)

at Intuit.Spc.Map.WindowsFirewallUtilities.Configuration.WindowsFirewall.CreateInstance(String xmlConfig)

at Intuit.Spc.Map.WindowsFirewallUtilities.Configuration.WindowsFirewall.CreateInstanceFromFile(String filePath)

at Intuit.Spc.Map.WindowsFirewallUtilities.Installer.WindowsFirewallException.InstallFirewall(String configPath, String productName, String productCode, Boolean isInstalling)

at Intuit.Spc.Map.WindowsFirewallUtilities.Installer.WindowsFirewallException.InstallFirewall(MsiUtilities msiUtil, Boolean isInstalling)

at Intuit.Spc.Map.WindowsFirewallUtilities.Installer.WindowsFirewallException.CreateFirewallRules2(MsiUtilities msiUtil)

at Intuit.Spc.Map.WindowsFirewallUtilities.Installer.WindowsFirewallException.CreateFirewallRules(UInt32 installerContext)
---------------------------
OK ---------------------------

 

Is the Windows Firewall enabled on this machine?
Open the Firewall properties (Start>Run and type firewall.cpl) and select the Exceptions tab.
Is QB POS listed? If so, and QB POS is NOT installed, remove it from the Exceptions list then try re-installing.
If QB POS is not listed, and IS installed, Add it to the Exceptions list.


I several uninstall/re-install instances of QB POS. At what point was the SubInACL run again in relation to those?