Inactive [InActive] IE popups and many programs won't run

Hi,

I'm having an issue and it appears after all these years I've caught my first virus or malware. As soon as I boot up and before Norton Virus protection starts I get a message about the "No disk in Drive" error. I then get multiple IE popups for spam. I use Firefox as my browser and don't ever use IE. I cannot run QuickBooks anymore since this started.

I ran a full Norton scan which found nothing. I downloaded & installed AVG which found 3 threats and supposedly "healed" them. After a reboot I'm still seeing the popups and can't run my applications.

I tried running AVG in Safe Mode (since it appears that the virus/malware is running prior to Symantec Firewall (when the "no disk in drive" error happens), but it didn't find anything else useful. I finally ran hijackthis as recommended and I'm posting the results below. Please help me as I'm getting desperate. I need to use this computer for work...

Thanks!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:53:00 PM, on 2/18/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Asi\AsiServer\AsiServer.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bacula\bin\bacula-fd.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINDOWS\system32\Hummbird\inetd32.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec_Desktop_Firewall\NISSERV.EXE
C:\Program Files\NavNT\rtvscan.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Roxio\MyDVD\MyDVD\USBDeviceService.exe
C:\Program Files\VMware\VMware Server\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\VMware\VMware Server\vmserverdWin32.exe
C:\Program Files\Symantec_Desktop_Firewall\NISUM.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec_Desktop_Firewall\IAMAPP.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\Logi_MwX.Exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Roxio\MyDVD\MyDVD\DetectorApp.exe
C:\WINDOWS\system32\x85xbgnd.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\NavNT\vptray.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\xerox\Phaser 8510_8560\x85xzpui.exe
C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Verizon\CallAssistant\VZVidgetEngine.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe
C:\Program Files\DynDNS Updater\DynUpPs.exe
C:\WINDOWS\system32\xrxbeacn.exe
C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\system32\xnetsrvc.exe
C:\Program Files\DynDNS Updater\DynTray.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\Verizon\CallAssistant\VZVidgetEngineMonitor.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Verizon\CallAssistant\VZCallAssistant.exe
C:\PROGRA~1\Webshots\Webshots.scr
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\bk\Desktop\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.galaxy.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = webcache.east.sun.com:8080
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\twext.exe,
O1 - Hosts: 129.154.66.186 t2000-nyc
O4 - HKLM\..\Run: [iamapp] "C:\Program Files\Symantec_Desktop_Firewall\IAMAPP.EXE "
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe "
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE "
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DetectorApp] C:\Program Files\Roxio\MyDVD\MyDVD\DetectorApp.exe
O4 - HKLM\..\Run: [XeroxBackgroundTask] C:\WINDOWS\system32\x85xbgnd.exe 1
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [e491238f] rundll32.exe "C:\WINDOWS\system32\ahlduiua.dll ",b
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [RIMDeviceManager] "C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe" -RunServer
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [VZVidgets] C:\Program Files\Verizon\CallAssistant\VZVidgetEngine.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Desktop Manager.lnk = C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe
O4 - Global Startup: DynDNS Updater.lnk = C:\Program Files\DynDNS Updater\DynUpPs.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: office.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1234968060203
O17 - HKLM\System\CCS\Services\Tcpip\..\{0DBB00E3-BA2F-419A-B83C-6455CEE3588B}: Domain = sun.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{0DBB00E3-BA2F-419A-B83C-6455CEE3588B}: NameServer = 129.152.194.33,129.148.13.40
O17 - HKLM\System\CCS\Services\Tcpip\..\{D84246DF-322B-4CFF-BB4B-942787B0DC15}: NameServer = 198.144.239.9,198.144.230.11
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: uovnrh.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bacula File Service (Bacula-fd) - Unknown owner - C:\Program Files\Bacula\bin\bacula-fd.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Hummingbird Inetd (HCLInetd) - Hummingbird Communications Ltd. - C:\WINDOWS\system32\Hummbird\inetd32.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec Desktop Firewall Service (NISSERV) - Symantec Corporation - C:\Program Files\Symantec_Desktop_Firewall\NISSERV.EXE
O23 - Service: NISUM - Symantec Corporation - C:\Program Files\Symantec_Desktop_Firewall\NISUM.EXE
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: QuickBooks Database Manager Service (QBCFMonitorService) - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Roxio\MyDVD\MyDVD\USBDeviceService.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Server\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware Registration Service (vmserverdWin32) - VMware, Inc. - C:\Program Files\VMware\VMware Server\vmserverdWin32.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

--
End of file - 12338 bytes

 

Oops, sorry posted wrong logs...

Things took awhile, ran out of resources after it launched 48 IE windows.
I noticed there's a file called xrxbeacn.exe which may be the culprit.
But Norton & AVG didn't find or remove either. I also found there was
a program office.exe in the All Users startup folder. I disabled that and
it disappeared....


DDS (Ver_09-02-01.01) - FAT32x86
Run by bk at 12:56:53.17 on Thu 02/19/2009
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_07

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.galaxy.net/
uDefault_Page_URL = hxxp://www.dell.com
mDefault_Page_URL = hxxp://www.dell.com
mStart Page = hxxp://www.dell.com
uInternet Settings,ProxyServer = webcache.east.sun.com:8080
mWinlogon: Userinit=c:\windows\system32\userinit.exe,c:\windows\system32\twext.exe,
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: {b1d921d9-f48b-8d1a-a534-92e4d1874c05}: {50c4781d-4e29-435a-a1d8-b84f9d129d1b} - c:\windows\system32\rbblhv.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: {6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} - c:\windows\system32\wvUkICSK.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
BHO: {7cc7247a-2ea9-4d56-a488-f1fa9fc3e887} - c:\windows\system32\wvUkJbcY.dll
TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [googletalk] "c:\program files\google\google talk\googletalk.exe" /autostart
uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
uRun: [RIMDeviceManager] "c:\program files\common files\research in motion\rimdevicemanager\RIMDeviceManager.exe" -RunServer
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [VZVidgets] c:\program files\verizon\callassistant\VZVidgetEngine.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [iamapp] "c:\program files\symantec_desktop_firewall\IAMAPP.EXE "
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_07\bin\jusched.exe "
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [Logitech Utility] Logi_MwX.Exe
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe "
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe
mRun: [Logitech Hardware Abstraction Layer] "c:\program files\common files\logitech\khalshared\KHALMNPR.EXE "
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [DetectorApp] c:\program files\roxio\mydvd\mydvd\DetectorApp.exe
mRun: [XeroxBackgroundTask] c:\windows\system32\x85xbgnd.exe 1
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRun: [vptray] c:\program files\navnt\vptray.exe
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
dRunOnce: [RunNarrator] Narrator.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1234968060203
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: {0DBB00E3-BA2F-419A-B83C-6455CEE3588B} = 129.152.194.33,129.148.13.40
TCP: {D84246DF-322B-4CFF-BB4B-942787B0DC15} = 198.144.239.9,198.144.230.11
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: NavLogon - c:\windows\system32\NavLogon.dll
Notify: wvUkICSK - wvUkICSK.dll
AppInit_DLLs: rbblhv.dll
SEH: {6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} - c:\windows\system32\wvUkICSK.dll
LSA: Authentication Packages = msv1_0 c:\windows\system32\wvUkJbcY

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\bk\applic~1\mozilla\firefox\profiles\vmt60bbd.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.galaxy.net/
FF - component: c:\documents and settings\bk\application

data\mozilla\firefox\profiles\vmt60bbd.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\winnt_x86-msvc\components\ipc.dll
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npatgpc.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPcol305.dll
FF - plugin: c:\program files\mozilla firefox\plugins\nphclx.dll

============= SERVICES / DRIVERS ===============


=============== Created Last 30 ================


==================== Find3M ====================


============= FINISH: 12:58:37.68 ===============




UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-02-01.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 9/20/2005 12:01:09 AM
System Uptime: 2/19/2009 12:01:36 PM (0 hours ago)

Motherboard: Dell Inc. | | 0HH807
Processor: Intel(R) Pentium(R) D CPU 2.80GHz | Microprocessor | 2793/800mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 149 GiB total, 31.239 GiB free.
D: is CDROM ()
G: is NetworkDisk (NTFS) - 1070 GiB total, 1038.222 GiB free.
H: is NetworkDisk (NTFS) - 1319 GiB total, 1038.222 GiB free.
T: is NetworkDisk (NTFS) - 1368 GiB total, 1200.997 GiB free.
U: is NetworkDisk (NTFS) - 1370 GiB total, 316.338 GiB free.
V: is NetworkDisk (NTFS) - 1319 GiB total, 1038.222 GiB free.
W: is NetworkDisk (NTFS) - 1370 GiB total, 366.593 GiB free.
X: is NetworkDisk (NTFS) - 1370 GiB total, 749.394 GiB free.
Y: is NetworkDisk (NTFS) - 1370 GiB total, 3.947 GiB free.
Z: is NetworkDisk (NTFS) - 1319 GiB total, 1038.222 GiB free.

==== Disabled Device Manager Items =============

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: 3Com EtherLink XL 10/100 PCI TX NIC (3C905B-TX)
Device ID: PCI\VEN_10B7&DEV_9055&SUBSYS_905510B7&REV_34\4&5855BE9&0&10F0
Manufacturer: 3Com
Name: 3Com EtherLink XL 10/100 PCI TX NIC (3C905B-TX)
PNP Device ID: PCI\VEN_10B7&DEV_9055&SUBSYS_905510B7&REV_34\4&5855BE9&0&10F0
Service: EL90XBC

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Cisco Systems VPN Adapter
Device ID: ROOT\NET\0000
Manufacturer: Cisco Systems
Name: Cisco Systems VPN Adapter
PNP Device ID: ROOT\NET\0000
Service: CVirtA

==== System Restore Points ===================

RP1194: 1/23/2009 6:50:59 PM - System Checkpoint
RP1195: 1/24/2009 7:26:52 PM - System Checkpoint
RP1196: 1/25/2009 8:04:10 PM - System Checkpoint
RP1197: 1/26/2009 10:44:47 PM - System Checkpoint
RP1198: 1/27/2009 11:41:36 PM - System Checkpoint
RP1199: 1/29/2009 12:02:57 AM - System Checkpoint
RP1200: 1/30/2009 1:30:33 AM - System Checkpoint
RP1201: 1/31/2009 3:13:02 AM - System Checkpoint
RP1202: 2/1/2009 3:30:50 AM - System Checkpoint
RP1203: 2/2/2009 5:14:38 AM - System Checkpoint
RP1204: 2/3/2009 6:02:46 AM - System Checkpoint
RP1205: 2/4/2009 6:50:19 AM - System Checkpoint
RP1206: 2/5/2009 7:38:43 AM - System Checkpoint
RP1207: 2/6/2009 9:14:09 AM - System Checkpoint
RP1208: 2/7/2009 10:28:45 AM - System Checkpoint
RP1209: 2/8/2009 11:03:56 AM - System Checkpoint
RP1210: 2/9/2009 2:31:41 PM - System Checkpoint
RP1211: 2/10/2009 3:03:20 PM - System Checkpoint
RP1212: 2/11/2009 3:27:56 PM - System Checkpoint
RP1213: 2/12/2009 4:03:19 PM - System Checkpoint
RP1214: 2/13/2009 7:22:50 PM - System Checkpoint
RP1215: 2/14/2009 8:17:16 PM - System Checkpoint
RP1216: 2/15/2009 9:47:17 PM - Last known good configuration
RP1217: 2/17/2009 12:42:09 AM - System Checkpoint
RP1218: 2/18/2009 12:57:47 AM - Removed Norton AntiVirus Corporate Edition
RP1219: 2/18/2009 1:09:16 AM - Installed Norton AntiVirus Corporate Edition
RP1220: 2/18/2009 10:05:58 AM - Removed Microsoft SQL Server Desktop Engine
RP1221: 2/18/2009 10:10:59 AM - Removed SupportSoft Assisted Service
RP1222: 2/18/2009 10:25:58 AM - Removed Microsoft Visual C++ 2005 Redistributable
RP1223: 2/18/2009 10:26:41 AM - Installed AVG 8.0
RP1224: 2/19/2009 8:44:48 AM - Software Distribution Service 3.0
RP1225: 2/19/2009 8:57:32 AM - Software Distribution Service 3.0

==== Installed Programs ======================

Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe Flash Player ActiveX
Adobe Reader 7.0.9
Adobe Shockwave Player
Apple Mobile Device Support
Apple Software Update
ArcSoft PhotoStudio 5.5
ATI - Software Uninstall Utility
ATI Control Panel
ATI Display Driver
Audacity 1.2.4
Automated Software Installer Server
Avery® Wizard 2.1 forMicrosoft® Word 2000
AVG 8.0
AviSynth 2.5
BitPim 1.0.7.20080908
BlackBerry Desktop Software 4.5
BlackBerry Device Software v4.5.0 for the BlackBerry 8310 smartphone
Broadcom Advanced Control Suite
Bugster 2.7.0.05 [Production]
Bugster 2.9.0.04 [Production]
Canon Camera Access Library
Canon Camera Support Core Library
Canon Camera WIA Driver
Canon Camera Window DC_DV 5 for ZoomBrowser EX
Canon Camera Window DC_DV 6 for ZoomBrowser EX
Canon Camera Window MC 6 for ZoomBrowser EX
Canon EOS Kiss_N REBEL_XT 350D WIA Driver
Canon G.726 WMP-Decoder
Canon MovieEdit Task for ZoomBrowser EX
Canon PhotoRecord
Canon RAW Image Task for ZoomBrowser EX
Canon RemoteCapture Task for ZoomBrowser EX
Canon Utilities Digital Photo Professional 2.0
Canon Utilities EOS Capture 1.5
Canon Utilities EOS Utility
Canon Utilities PhotoStitch
Canon Utilities ZoomBrowser EX
Chief Architect X1 Viewer
City Navigator North America v7
Click'N Design 3D for AfterBurner(tm) (V5)
Dell Resource CD
Driver Detective
DVD Decrypter (Remove Only)
DVD Shrink 3.2
DVDFab (Platinum/Gold/HD Decrypter) (Option: Mobile) 5.0.2.5
DVDFab Decrypter 2.9.7.6
DVDFab HD Decrypter 4.1.2.0
DynDNS Updater
EASEUS Partition Manager Personal 1.6.4
EOS Capture 1.5
Exact Audio Copy 0.95b3
Exceed for Windows NT
GIMP 2.4.1
GlassFish V2 UR1
Google Earth
Google Talk (remove only)
Handbrake 0.9.2
Hard Disk Low Level Format Tool 2.36 build 1181
HijackThis 2.0.2
Hoyle Poker
HP Software Update
IM
iPod for Windows 2005-09-06
iPod for Windows 2006-01-10
ISPWizard
ISPWizard Dialer
iTunes
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 4
J2SE Runtime Environment 5.0 Update 6
Java 2 Runtime Environment, SE v1.4.2_03
Java DB 10.3.1.4
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) 6 Update 7
Java(TM) SE Development Kit 6 Update 5
Java(TM) SE Runtime Environment 6 Update 1
JavaRConsole
KhalSetup
Lexmark Printer Software Uninstall
LiveReg (Symantec Corporation)
LiveUpdate 1.90 (Symantec Corporation)
Logitech MouseWare 9.79.1
Logitech SetPoint
MapSource
MapSource - North American City Navigator v5
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB886903)
Microsoft .NET Framework 2.0
Microsoft Document Explorer 2005
Microsoft FrontPage 2000
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft MSDN 2005 Express Edition - ENU
Microsoft Office 2000 Disc 2
Microsoft Office Professional Edition 2003
Microsoft Platform SDK (R2) (3790.2075)
Microsoft Project Standard 2002
Microsoft Visual C++ 2005 Express Edition - ENU
Microsoft Visual C++ 2005 Redistributable
Microsoft Windows Driver Kit 5600
mobile PhoneTools
MobileMe Control Panel
Motorola Driver Installation 3.7.0
Move Networks Media Player for Internet Explorer
Mozilla Firefox (3.0.6)
Mozilla Thunderbird (2.0.0.19)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 Parser and SDK
MSXML 6.0 Parser
MyDSC2
Nero 6 Enterprise Edition
NetBeans IDE 6.0.1
Norton AntiVirus Corporate Edition
OLYMPUS CAMEDIA Master 2.5
Orb
PARTNER Messaging Release 1.0 System Administration\Uninstaller
Photo Viewer
Photosmart 140,240,7200,7600,7700,7900 Series
PowerDVD 5.5
PS7700
PSShortcutsP
PSUsage
QFolder
QuickBooks Pro 2007
QuickBooks Product Listing Service
QuickTime
RealPlayer
Roxio Media Manager
Roxio MyDVD
Roxio UDF Reader
Roxio Update Manager
Security Update for Microsoft .NET Framework 2.0 (KB917283)
Security Update for Microsoft .NET Framework 2.0 (KB922770)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB923689)
Sonic Copy Module
Sonic Express Labeler
Sonic RecordNow Audio
Sonic RecordNow Data
Spybot - Search & Destroy
StarOffice 8
Sun Download Manager 2.0 (web)
Sun xVM VirtualBox
Symantec Desktop Firewall
The Print Shop® 6.0 Deluxe
uSirius 1.0RC7
Verizon Call Assistant - Version 2.7.55
VMware Server
VNC Free Edition 4.1.1
VPN Client
WebEx
WebFldrs XP
Webshots Desktop
Windows Backup Utility
Windows Driver Package - (mr7910) Image (08/08/2006 1.4.0.0)
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Media Format Runtime
Windows Media Player 10
Windows XP Service Pack 3
Winmail Opener 1.1
WinRAR archiver
WinZip
WinZip Self-Extractor
WRQ Reflection Manuals 10.0
WRQ Reflection Security Components 10.0.4
WRQ Reflection Suite for X 10.0.3
Xerox Phaser 8510_8560 Scan Driver
Xerox Support Centre

==== Event Viewer Messages From Past Week ========

2/18/2009 12:59:51 AM, error: Service Control Manager [7023] - The Application Management service terminated with the following error:

The specified module could not be found.
2/18/2009 12:41:35 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Roxio Hard Drive Watcher 9

service to connect.
2/12/2009 4:33:38 AM, error: PlugPlayManager [11] - The device Root\LEGACY_NAVEX15\0000 disappeared from the system without first

being prepared for removal.
2/18/2009 9:39:36 AM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service wuauserv with arguments " " in order

to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
2/18/2009 3:48:58 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments " " in

order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
2/18/2009 3:49:16 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments " " in order

to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
2/18/2009 3:49:29 PM, error: Service Control Manager [7001] - The NISDRV service depends on the TCP/IP Protocol Driver service which

failed to start because of the following error: A device attached to the system is not functioning.
2/18/2009 3:49:29 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NISDRV service which failed to

start because of the following error: The dependency service or group failed to start.
2/18/2009 3:49:29 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service

which failed to start because of the following error: A device attached to the system is not functioning.
2/18/2009 3:49:29 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which

failed to start because of the following error: A device attached to the system is not functioning.
2/18/2009 3:49:29 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver

service which failed to start because of the following error: A device attached to the system is not functioning.
2/18/2009 3:49:29 PM, error: Service Control Manager [7001] - The Bacula File Service service depends on the AFD service which failed

to start because of the following error: A device attached to the system is not functioning.
2/18/2009 3:49:29 PM, error: Service Control Manager [7001] - The Cisco Systems, Inc. VPN Service service depends on the TCP/IP

Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
2/18/2009 3:49:29 PM, error: Service Control Manager [7001] - The Hummingbird Inetd service depends on the AFD service which failed to

start because of the following error: A device attached to the system is not functioning.
2/18/2009 3:49:29 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which

failed to start because of the following error: A device attached to the system is not functioning.
2/18/2009 3:49:29 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD

AvgLdx86 AvgMfx86 AvgTdiX Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip VBoxDrv VBoxUSBMon
2/18/2009 9:33:09 PM, error: System Error [1003] - Error code 1000000a, parameter1 c0000000, parameter2 00000002, parameter3 00000000,

parameter4 80505c1f.
2/19/2009 11:00:09 AM, error: Service Control Manager [7016] - The Symantec Desktop Firewall Service service has reported an invalid

current state 0.
2/19/2009 11:04:24 AM, error: Service Control Manager [7034] - The Bacula File Service service terminated unexpectedly. It has done

this 1 time(s).

==== End Of File ===========================

 

Hi galaxy
Welcome to WindowsBBS

Please do the following in the order given.

1. Go to Start > Control Panel double-click on the Java Icon (coffee cup) in the Control Panel.
2. It will say "Java Plug-in" under the icon.
   Please find the update button or tab in the Java Control Panel. Update your Java then reboot.
3. If you are unable to update you can manually update by going here:
   • 
     http://java.sun.com/javase/downloads/index.jsp
4. After the reboot, go back into the Control Panel and double-click the Java Icon.
5. On the general tab, at the bottom it has "temporary internet files "
6. Click the settings button. Then the Delete files button.
7. There are two options in the window to clear the cache - Leave both Checked
   • 
     Applications and Applets
     Trace and Log files
8. Click OK
   Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
9. Click OK to leave the Java Control Panel.
10. Delete older versions from Add/Remove list.

Please go to Start > Control Panel > Add/Remove Programs (Windows Vista it’s Programs and Features) and remove the following (if present):


J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 4
J2SE Runtime Environment 5.0 Update 6
Java 2 Runtime Environment, SE v1.4.2_03
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) 6 Update 7
Java(TM) SE Runtime Environment 6 Update 1

Please note any other programs that you dont recognize in that list and post them in your next response

Now do this.

Download ComboFix from Here to your Desktop.

It's best to disable realtime protection applications as they sometimes interfere with the tool.
Check this link for any applicable programs you may have.

• Close all open programs and windows
• Double click combofix.exe and follow the prompts.
• Vista users right click Combofix.exe and select Run As Administrator.
• When finished, it shall produce a log for you. Post the Combofix log

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

**NOTE - Allow ComboFix to update if prompted.

Thanks
maranatha

 

I've decided that since this computer is so critical to me, I'm going to have to reformat and reinstall windows. Even if we get it working, I just don't trust it. I've backed everything up to my Solaris server that I need. I've also bought 2 macbook pro's, and I'll get an iMac next month when the quad-cores come out. I'm done with windows. I'll reformat this PC and put opensolaris on it and give it to the kids after I've moved everything over to the mac.

Thanks for your help though...

 

Way off topic..


Why not Ubuntu ?

Much more user friendly & well supported unlike OpenSolaris.

On Ubuntu you can install Ebuntu as addon & it becomes an excellent educational package.

 

Mainly because its the kernel. I run a few dozen servers, many linux, many solaris. Typically the solaris ones have uptimes in years, whereas I get freezes on the redhats, fedora, centos, virtuozzo & openvz. (Yea, I know, mostly all RH derivatives, but the problem I find is in the linux kernel...)

Now with solaris zones, zfs, dtrace, resource controls, etc. its pretty powerful. Thats what I like about mac os too, it has dtrace & zfs. One of my jobs is to teach DTrace as a consultant for Sun. If I had DTrace for the PC I'd nail down the virus in minutes or seconds...

But solaris is mainly for servers... They're working on the newer install & consumer based stuff in opensolaris, which is why I'd rather put my old hardware there. Its coming a long way in a short amount of time. As you probably know, Ian Murdock (debian creator) has started shaping opensolaris bringing all the things linux folks like over to sun (gnome, gnu, etc.) but retains its enterprise kernel and scalability.

And for the consumer stuff, macs are better than most other *nix. I've learned that my kids are going to be issued macbooks next year (so I guess now's a good time to learn, but I think issuing any kind of laptop to the kids is a waste of tax dollars). They're a real unix so I don't need the cygwin or even vmware to do my work. I may need vmware or parallels to run my quickbooks now though...

 

Hi galaxy
Ok thanks for letting me know.

Geri