Inactive No internet but have connectivity

[Inactive] No internet but have connectivity

Hi, I am hoping to get some help here.

My 93 year old father in law got some kind of malware while on the internet (prob a p*rn site... at 93!!). Anyway, it is an XP desktop with IE8 and OE6. He is using a wireless connection and it is working fine. However, I cannot get anything to connect. So, I decided it was an XP issue, not an IE, OE or networking issue. I ran Malwarebytes (manually updated), Avira & SD Fix. I used WinsockXPFix, too. Malwarebytes and Aviva found some stuff and cleaned it up but that did not help. SD Fix was clean. I went back to a restore point 2 days back but still I cannot get IE or OE to work. However, the wireless connection still seems very happy and unaffected.

Per and MS Support page I pinged 127.0.0.1 and my IP address and both worked well. Nothing else works though.

I did ck IE Properties and made sure that the proxy boxes weren't checked. They were and I cleared them.

Then having read some other threads in the forum I ran some of the recommended programs, just not sure how to read them. The computer is not actually with me as he lives about a mile from my home. So, I ran an ipconfig test (that Arie suggested), OTL, ComboFix, Security Checker, TFC, HijackThis and Malwarebytes (again). I have all of the logs. Should I post them?

The ipconfig test showed this:

Windows IP Configuration
Host Name . . . . . . . . . . . . : Miller
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : lan

Ethernet adapter Wireless Network Connection:
Connection-specific DNS Suffix . : lan
Description . . . . . . . . . . . : U.S. Robotics Wireless MAXg USB Adapter
Physical Address. . . . . . . . . : 00-14-C1-1A-EB-DA
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.0.29
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.1
DHCP Server . . . . . . . . . . . : 192.168.0.1
DNS Servers . . . . . . . . . . . : 192.168.0.1
Lease Obtained. . . . . . . . . . : Saturday, June 04, 2011 9:41:36 AM
Lease Expires . . . . . . . . . . : Sunday, June 05, 2011 9:41:36 AM

Oh, I used Avira yesterday (could not update it, though) and it found 2 things that it quarantined. Today, it will not run because of dll problem. Malwarebytes found 3 instances of something called "POM..." in the the Security Center registry, which it removed. Also, whatever it was turned on the Wired Network Connection which had been disabled. My father in law could not get online and kept getting messages that the network was unplugged. That is turned back off again.

Thanks for any and all guidance.

 

MiniToolBox by Farbar
Ran by The Spectors (administrator) on 05-06-2011 at 13:06:59
Microsoft Windows XP Service Pack 3 (X86)

**********************************************************

========================= IE Proxy Settings: ==========

Proxy is not enabled.
No Proxy Server is set.

========================= End of IE Proxy Settings =========
=============== Hosts content: ============================

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

=============== End of Hosts ===========================

================= IP Configuration: ======================

# ----------------------------------
# Interface IP Configuration
# ----------------------------------
pushd interface ip


# Interface IP Configuration for "Wireless Network Connection "

set address name= "Wireless Network Connection" source=dhcp
set dns name= "Wireless Network Connection" source=dhcp register=PRIMARY
set wins name= "Wireless Network Connection" source=dhcp


popd
# End of interface IP configuration




Windows IP Configuration



Host Name . . . . . . . . . . . . : Spector

Primary Dns Suffix . . . . . . . :

Node Type . . . . . . . . . . . . : Unknown

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No

DNS Suffix Search List. . . . . . : lan



Ethernet adapter Wireless Network Connection:



Connection-specific DNS Suffix . : lan

Description . . . . . . . . . . . : U.S. Robotics Wireless MAXg USB Adapter

Physical Address. . . . . . . . . : 00-14-C1-1A-EB-DA

Dhcp Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

IP Address. . . . . . . . . . . . : 192.168.0.29

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 192.168.0.1

DHCP Server . . . . . . . . . . . : 192.168.0.1

DNS Servers . . . . . . . . . . . : 192.168.0.1

Lease Obtained. . . . . . . . . . : Sunday, June 05, 2011 1:02:25 PM

Lease Expires . . . . . . . . . . : Monday, June 06, 2011 1:02:25 PM

Server: Overdrive-CE8.lan
Address: 192.168.0.1

Ping request could not find host google.com. Please check the name and try again.

Server: Overdrive-CE8.lan
Address: 192.168.0.1

Ping request could not find host yahoo.com. Please check the name and try again.



Pinging 127.0.0.1 with 32 bytes of data:



Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128



Ping statistics for 127.0.0.1:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 0ms, Average = 0ms

======================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x10003 ...00 14 c1 1a eb da ...... U.S. Robotics Wireless MAXg USB Adapter - Packet Scheduler Miniport
=================================================
=================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.29 25
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.0.0 255.255.255.0 192.168.0.29 192.168.0.29 25
192.168.0.29 255.255.255.255 127.0.0.1 127.0.0.1 25
192.168.0.255 255.255.255.255 192.168.0.29 192.168.0.29 25
224.0.0.0 240.0.0.0 192.168.0.29 192.168.0.29 25
255.255.255.255 255.255.255.255 192.168.0.29 192.168.0.29 1
Default Gateway: 192.168.0.1
=====================================================
Persistent Routes:
None

================= End of IP Configuration ===========
========================= Event log errors: ==========
Application errors:
==================
Error: (06/05/2011 01:02:19 PM) (Source: Avira AntiVir) (User: SYSTEM)SYSTEM
Description: An unknown error occurred during init of the engine!
Returned error code: 0x35

Error: (06/05/2011 09:46:31 AM) (Source: Avira AntiVir) (User: SYSTEM)SYSTEM
Description: An unknown error occurred during init of the engine!
Returned error code: 0x35

Error: (06/05/2011 09:27:32 AM) (Source: Avira AntiVir) (User: SYSTEM)SYSTEM
Description: An unknown error occurred during init of the engine!
Returned error code: 0x35

Error: (06/04/2011 11:02:59 AM) (Source: Avira AntiVir) (User: SYSTEM)SYSTEM
Description: An unknown error occurred during init of the engine!
Returned error code: 0x35

Error: (06/04/2011 10:39:00 AM) (Source: Avira AntiVir) (User: SYSTEM)SYSTEM
Description: An unknown error occurred during init of the engine!
Returned error code: 0x35

Error: (06/04/2011 10:33:42 AM) (Source: Avira AntiVir) (User: SYSTEM)SYSTEM
Description: An unknown error occurred during init of the engine!
Returned error code: 0x35

Error: (06/04/2011 10:31:06 AM) (Source: Avira AntiVir) (User: SYSTEM)SYSTEM
Description: An unknown error occurred during init of the engine!
Returned error code: 0x35

Error: (06/04/2011 10:27:16 AM) (Source: Avira AntiVir) (User: SYSTEM)SYSTEM
Description: An unknown error occurred during init of the engine!
Returned error code: 0x35

Error: (06/04/2011 10:17:05 AM) (Source: Avira AntiVir) (User: SYSTEM)SYSTEM
Description: An unknown error occurred during init of the engine!
Returned error code: 0x35

Error: (06/04/2011 10:16:28 AM) (Source: Avira AntiVir) (User: SYSTEM)SYSTEM
Description: An unknown error occurred during init of the engine!
Returned error code: 0x35


System errors:
=============
Error: (06/05/2011 01:02:28 PM) (Source: W32Time) (User: )
Description: The time provider NtpClient is configured to acquire time from one or more
time sources, however none of the sources are currently accessible.
No attempt to contact a source will be made for 14 minutes.
NtpClient has no source of accurate time.

Error: (06/05/2011 01:02:28 PM) (Source: W32Time) (User: )
Description: Time Provider NtpClient: An error occurred during DNS lookup of the manually
configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15
minutes.
The error was: A socket operation was attempted to an unreachable host. (0x80072751)

Error: (06/05/2011 09:46:40 AM) (Source: W32Time) (User: )
Description: The time provider NtpClient is configured to acquire time from one or more
time sources, however none of the sources are currently accessible.
No attempt to contact a source will be made for 14 minutes.
NtpClient has no source of accurate time.

Error: (06/05/2011 09:46:40 AM) (Source: W32Time) (User: )
Description: Time Provider NtpClient: An error occurred during DNS lookup of the manually
configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15
minutes.
The error was: A socket operation was attempted to an unreachable host. (0x80072751)

Error: (06/05/2011 09:27:41 AM) (Source: W32Time) (User: )
Description: The time provider NtpClient is configured to acquire time from one or more
time sources, however none of the sources are currently accessible.
No attempt to contact a source will be made for 14 minutes.
NtpClient has no source of accurate time.

Error: (06/05/2011 09:27:41 AM) (Source: W32Time) (User: )
Description: Time Provider NtpClient: An error occurred during DNS lookup of the manually
configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15
minutes.
The error was: A socket operation was attempted to an unreachable host. (0x80072751)

Error: (06/04/2011 06:27:34 AM) (Source: W32Time) (User: )
Description: The time provider NtpClient is configured to acquire time from one or more
time sources, however none of the sources are currently accessible.
No attempt to contact a source will be made for 14 minutes.
NtpClient has no source of accurate time.

Error: (06/04/2011 06:27:34 AM) (Source: W32Time) (User: )
Description: Time Provider NtpClient: An error occurred during DNS lookup of the manually
configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15
minutes.
The error was: A socket operation was attempted to an unreachable host. (0x80072751)

Error: (05/28/2011 09:09:34 PM) (Source: 0) (User: )
Description: {D11769E3-DAC2-4F52-8E44-E5528FDA6912}

Error: (05/28/2011 09:09:34 PM) (Source: 0) (User: )
Description: {D11769E3-DAC2-4F52-8E44-E5528FDA6912}


Microsoft Office Sessions:
=========================
Error: (06/05/2011 01:02:19 PM) (Source: Avira AntiVir)(User: SYSTEM)SYSTEM
Description: 0x35

Error: (06/05/2011 09:46:31 AM) (Source: Avira AntiVir)(User: SYSTEM)SYSTEM
Description: 0x35

Error: (06/05/2011 09:27:32 AM) (Source: Avira AntiVir)(User: SYSTEM)SYSTEM
Description: 0x35

Error: (06/04/2011 11:02:59 AM) (Source: Avira AntiVir)(User: SYSTEM)SYSTEM
Description: 0x35

Error: (06/04/2011 10:39:00 AM) (Source: Avira AntiVir)(User: SYSTEM)SYSTEM
Description: 0x35

Error: (06/04/2011 10:33:42 AM) (Source: Avira AntiVir)(User: SYSTEM)SYSTEM
Description: 0x35

Error: (06/04/2011 10:31:06 AM) (Source: Avira AntiVir)(User: SYSTEM)SYSTEM
Description: 0x35

Error: (06/04/2011 10:27:16 AM) (Source: Avira AntiVir)(User: SYSTEM)SYSTEM
Description: 0x35

Error: (06/04/2011 10:17:05 AM) (Source: Avira AntiVir)(User: SYSTEM)SYSTEM
Description: 0x35

Error: (06/04/2011 10:16:28 AM) (Source: Avira AntiVir)(User: SYSTEM)SYSTEM
Description: 0x35


========================= End of Event log errors ===========

========================= Memory info: =====================

Percentage of memory in use: 11%
Total physical RAM: 3317.1 MB
Available physical RAM: 2919.62 MB
Total Pagefile: 5200.63 MB
Available Pagefile: 4979.68 MB
Total Virtual: 2047.88 MB
Available Virtual: 1995.5 MB

======================= Partitions: ====================

1 Drive c: () (Fixed) (Total:294.73 GB) (Free:279.53 GB) NTFS
7 Drive i: () (Removable) (Total:3.74 GB) (Free:2.65 GB) FAT32

================= Users: ==========================

User accounts for \\SPECTOR

-------------------------------------------------------------------------------
Administrator Guest HelpAssistant
SUPPORT_388945a0 The Spectors
The command completed successfully.

================= End of Users ============

 

I had to leave while GMER was running (30 minutes +) but I have the other 3 for now. The Malwarebytes log is from the day I first tried to resolve the issue when I did find something. Since then, it has been clean.

Malwarebytes Log:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5825

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

6/3/2011 3:14:29 PM
mbam-log-2011-06-03 (15-14-29).txt

Scan type: Quick scan
Objects scanned: 152314
Time elapsed: 5 minute(s), 11 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


MBR Log:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x000001fc

Kernel Drivers (total 118):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E5000 \WINDOWS\system32\hal.dll
0xBA5A8000 \WINDOWS\system32\KDCOM.DLL
0xBA4B8000 \WINDOWS\system32\BOOTVID.dll
0xB9F79000 ACPI.sys
0xBA5AA000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xB9F68000 pci.sys
0xBA0A8000 isapnp.sys
0xBA670000 pciide.sys
0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xBA0B8000 MountMgr.sys
0xB9F49000 ftdisk.sys
0xBA5AC000 dmload.sys
0xB9F23000 dmio.sys
0xBA330000 PartMgr.sys
0xBA0C8000 VolSnap.sys
0xB9F0B000 atapi.sys
0xB9E44000 iaStor.sys
0xBA0D8000 disk.sys
0xBA0E8000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xB9E24000 fltmgr.sys
0xB9E12000 sr.sys
0xBA0F8000 PxHelp20.sys
0xB9DFB000 KSecDD.sys
0xB9D6E000 Ntfs.sys
0xB9D41000 NDIS.sys
0xB9D27000 Mup.sys
0xBA218000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xB9760000 \SystemRoot\system32\DRIVERS\igxpmp32.sys
0xB974C000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xBA3C8000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xB9728000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xBA3D0000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xB9700000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xBA3D8000 \SystemRoot\system32\DRIVERS\fdc.sys
0xBA228000 \SystemRoot\system32\DRIVERS\imapi.sys
0xBA238000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xBA248000 \SystemRoot\system32\DRIVERS\redbook.sys
0xB96DD000 \SystemRoot\system32\DRIVERS\ks.sys
0xBA7F5000 \SystemRoot\system32\DRIVERS\audstub.sys
0xBA258000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xBA560000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xB96C6000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xBA268000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xBA278000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xBA3E0000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xB96B5000 \SystemRoot\system32\DRIVERS\psched.sys
0xBA288000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xBA3E8000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xBA3F0000 \SystemRoot\system32\DRIVERS\raspti.sys
0xB9685000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xBA298000 \SystemRoot\system32\DRIVERS\termdd.sys
0xBA3F8000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xBA400000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xBA5C4000 \SystemRoot\system32\DRIVERS\swenum.sys
0xB95FF000 \SystemRoot\system32\DRIVERS\update.sys
0xBA580000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xBA2B8000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xBA2D8000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xBA5C8000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xA8FA7000 \SystemRoot\system32\drivers\RtkHDAud.sys
0xA8F83000 \SystemRoot\system32\drivers\portcls.sys
0xBA2F8000 \SystemRoot\system32\drivers\drmk.sys
0xB967D000 \SystemRoot\System32\Drivers\i2omgmt.SYS
0xBA5CC000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xBA79B000 \SystemRoot\System32\Drivers\Null.SYS
0xBA5CE000 \SystemRoot\System32\Drivers\Beep.SYS
0xBA410000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xBA418000 \SystemRoot\System32\drivers\vga.sys
0xBA5D0000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xBA5D2000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xBA420000 \SystemRoot\System32\Drivers\Msfs.SYS
0xBA428000 \SystemRoot\System32\Drivers\Npfs.SYS
0xB9675000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xA8F00000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xA8EA7000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xA8E7F000 \SystemRoot\system32\DRIVERS\netbt.sys
0xA8E59000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xBA318000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xA8E37000 \SystemRoot\System32\drivers\afd.sys
0xBA128000 \SystemRoot\system32\DRIVERS\netbios.sys
0xBA430000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0xA8E0C000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xA8D9C000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xBA148000 \SystemRoot\System32\Drivers\Fips.SYS
0xBA168000 \SystemRoot\System32\Drivers\LHidUsb.Sys
0xBA178000 \SystemRoot\System32\Drivers\HIDCLASS.SYS
0xB965D000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xA80C0000 \SystemRoot\system32\DRIVERS\avipbb.sys
0xBA5DE000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
0xBA450000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0xBA460000 \SystemRoot\system32\DRIVERS\LHidFlt2.Sys
0xB95D7000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xBA1E8000 \SystemRoot\system32\DRIVERS\LMouFlt2.Sys
0xA8F77000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xBA1F8000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xA8080000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xBA5FA000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xA8F53000 \SystemRoot\System32\drivers\Dxapi.sys
0xBA478000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xBA78E000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF024000 \SystemRoot\System32\igxpgd32.dll
0xBF012000 \SystemRoot\System32\igxprd32.dll
0xBF04E000 \SystemRoot\System32\igxpdv32.DLL
0xBF1F2000 \SystemRoot\System32\igxpdx32.DLL
0xA7F2C000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0xA7F1C000 \SystemRoot\system32\DRIVERS\AegisP.sys
0xA7F10000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xA7C07000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xA7BA2000 \SystemRoot\system32\drivers\wdmaud.sys
0xA7E74000 \SystemRoot\system32\drivers\sysaudio.sys
0xA77DA000 \SystemRoot\system32\DRIVERS\srv.sys
0xA7311000 \SystemRoot\System32\Drivers\HTTP.sys
0xA71B3000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xA716F000 \??\C:\DOCUME~1\THESPE~1\LOCALS~1\Temp\fxrdypob.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 33):
0 System Idle Process
4 System
440 C:\WINDOWS\system32\smss.exe
652 csrss.exe
676 C:\WINDOWS\system32\winlogon.exe
720 C:\WINDOWS\system32\services.exe
732 C:\WINDOWS\system32\lsass.exe
916 C:\WINDOWS\system32\svchost.exe
964 svchost.exe
1004 C:\WINDOWS\system32\svchost.exe
1096 svchost.exe
1132 svchost.exe
1364 C:\WINDOWS\system32\WLTRYSVC.EXE
1380 C:\WINDOWS\system32\BCMWLTRY.EXE
1496 C:\WINDOWS\system32\spoolsv.exe
1584 C:\Program Files\Avira\AntiVir Desktop\sched.exe
1624 svchost.exe
1908 C:\WINDOWS\explorer.exe
276 C:\Program Files\Java\jre6\bin\jqs.exe
400 C:\WINDOWS\RTHDCPL.EXE
408 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
480 C:\Program Files\Common Files\Java\Java Update\jusched.exe
492 C:\WINDOWS\system32\wltray.exe
504 C:\Program Files\IE New Window Maximizer\iemaximizer.exe
536 C:\WINDOWS\system32\ctfmon.exe
604 C:\WINDOWS\system32\svchost.exe
1116 C:\Program Files\Logitech\MouseWare\system\EM_EXEC.EXE
1216 C:\Program Files\Quick ShutDown\qsd.exe
2552 alg.exe
2980 C:\WINDOWS\system32\wscntfy.exe
2428 C:\WINDOWS\system32\notepad.exe
2788 C:\Documents and Settings\The Spectors\Desktop\Gmer\yggmbxos.exe
3232 C:\Documents and Settings\The Spectors\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`02f10c00 (NTFS)

PhysicalDrive0 Model Number: SAMSUNGHD321KJ, Rev: CP100-13

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0 Dell MBR code detected
SHA1: 57BDF501CE769EF2720C705B6C71C893DA31574E


Done!


DDS Log #1- DDS.TXT:

.
DDS (Ver_2011-06-03.01) - NTFSx86
Internet Explorer: 7.0.5730.13
Run by The Spectors at 17:50:12 on 2011-06-05
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3317.2873 [GMT -7:00]
.
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\IE New Window Maximizer\iemaximizer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Quick ShutDown\qsd.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\The Spectors\Desktop\Gmer\yggmbxos.exe
.
============== Pseudo HJT Report ===============
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = <local>
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [IE New Window Maximizer] c:\program files\ie new window maximizer\iemaximizer.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [Logitech Utility] Logi_MwX.Exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
mRun: [U.S. Robotics Wireless Manager UI] c:\windows\system32\WLTRAY
StartupFolder: c:\docume~1\thespe~1\startm~1\programs\startup\quicks~1.lnk - c:\program files\quick shutdown\qsd.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Notify: GoToAssist - c:\program files\citrix\gotoassist\514\G2AWinLogon.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
============= SERVICES / DRIVERS ===============
.
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-3-3 11608]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-3-3 108289]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-3-3 56816]
S2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-3-3 185089]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-11-26 136176]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-11-26 136176]
S3 pmxmouse;PMXMOUSE;c:\windows\system32\drivers\pmxmouse.sys [2008-5-24 18432]
S3 pmxusblf;PMXUSBLF;c:\windows\system32\drivers\pmxusblf.sys [2008-5-24 14336]
S3 USB-100;Linksys EtherFast 10/100 Compact USB Network Adapter;c:\windows\system32\drivers\USB100M.SYS [2011-5-28 27519]
.
=============== Created Last 30 ================
.
2011-06-04 17:33:45 0 ---ha-w- c:\documents and settings\the spectors\local settings\application data\BIT3.tmp
2011-06-04 16:51:12 98816 ----a-w- c:\windows\sed.exe
2011-06-04 16:51:12 518144 ----a-w- c:\windows\SWREG.exe
2011-06-04 16:51:12 256512 ----a-w- c:\windows\PEV.exe
2011-06-04 16:51:12 208896 ----a-w- c:\windows\MBR.exe
2011-06-04 16:51:06 -------- d-----w- C:\ComboFix
2011-06-04 01:56:26 -------- d-----w- c:\windows\system32\wbem\repository\FS
2011-06-04 01:56:26 -------- d-----w- c:\windows\system32\wbem\Repository
2011-06-04 01:33:27 23584 ----a-w- c:\temp\ERDNT.EXE
2011-06-04 01:32:44 -------- d-----w- C:\Temp
2011-05-29 03:49:19 36864 ------w- c:\windows\system32\pnpchk.exe
2011-05-28 22:50:28 27519 ----a-r- c:\windows\system32\drivers\USB100M.SYS
.
==================== Find3M ====================
.
2011-05-29 03:42:43 17801 ----a-w- c:\windows\system32\drivers\AegisP.sys
.
============= FINISH: 17:51:02.54 ===============


DDS Log #2- Attach.txt:

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-06-03.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 5/24/2008 12:07:57 PM
System Uptime: 6/5/2011 5:22:51 PM (0 hours ago)
.
Motherboard: Dell Inc. | | 0RY007
Processor: Intel Pentium III Xeon processor | Socket 775 | 2660/333mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 295 GiB total, 279.519 GiB free.
D: is CDROM ()
E: is Removable
F: is Removable
G: is Removable
H: is Removable
I: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Intel(R) 82562V-2 10/100 Network Connection
Device ID: PCI\VEN_8086&DEV_10C0&SUBSYS_020D1028&REV_02\3&2411E6FE&0&C8
Manufacturer: Intel
Name: Intel(R) 82562V-2 10/100 Network Connection
PNP Device ID: PCI\VEN_8086&DEV_10C0&SUBSYS_020D1028&REV_02\3&2411E6FE&0&C8
Service: e1express
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: U.S. Robotics Wireless MAXg USB Adapter
Device ID: USB\VID_0BAF&PID_011B\000000000001
Manufacturer: U.S. Robotics Corporation
Name: U.S. Robotics Wireless MAXg USB Adapter
PNP Device ID: USB\VID_0BAF&PID_011B\000000000001
Service: USB_RNDIS
.
==== System Restore Points ===================
.
RP322: 3/6/2011 12:25:59 PM - System Checkpoint
RP323: 3/8/2011 1:55:19 PM - System Checkpoint
RP324: 3/9/2011 8:09:40 AM - Software Distribution Service 3.0
RP325: 3/12/2011 9:20:07 AM - System Checkpoint
RP326: 3/15/2011 12:21:24 PM - System Checkpoint
RP327: 3/16/2011 9:13:50 AM - Software Distribution Service 3.0
RP328: 3/17/2011 7:43:07 PM - System Checkpoint
RP329: 3/19/2011 10:58:54 AM - System Checkpoint
RP330: 3/22/2011 8:13:28 AM - System Checkpoint
RP331: 3/23/2011 12:27:21 PM - System Checkpoint
RP332: 3/24/2011 10:43:06 AM - Software Distribution Service 3.0
RP333: 3/26/2011 5:41:36 PM - System Checkpoint
RP334: 3/28/2011 2:44:33 PM - System Checkpoint
RP335: 3/30/2011 1:45:03 PM - System Checkpoint
RP336: 4/4/2011 12:29:32 PM - System Checkpoint
RP337: 4/6/2011 1:35:20 PM - System Checkpoint
RP338: 4/12/2011 2:42:30 PM - System Checkpoint
RP339: 4/15/2011 2:38:06 PM - System Checkpoint
RP340: 4/16/2011 5:18:19 PM - System Checkpoint
RP341: 4/19/2011 4:19:22 PM - System Checkpoint
RP342: 4/22/2011 3:24:32 PM - System Checkpoint
RP343: 4/24/2011 4:21:48 PM - System Checkpoint
RP344: 4/26/2011 9:50:00 AM - System Checkpoint
RP345: 4/28/2011 1:42:44 PM - System Checkpoint
RP346: 5/1/2011 2:45:00 PM - System Checkpoint
RP347: 5/2/2011 3:00:45 PM - System Checkpoint
RP348: 5/3/2011 3:15:56 PM - System Checkpoint
RP349: 5/4/2011 5:54:27 PM - System Checkpoint
RP350: 5/6/2011 12:00:24 PM - System Checkpoint
RP351: 5/8/2011 9:33:22 AM - System Checkpoint
RP352: 5/9/2011 4:20:05 PM - System Checkpoint
RP353: 5/11/2011 5:02:42 PM - System Checkpoint
RP354: 5/12/2011 5:12:45 PM - System Checkpoint
RP355: 5/14/2011 7:26:17 PM - System Checkpoint
RP356: 5/16/2011 1:05:47 PM - System Checkpoint
RP357: 5/17/2011 5:37:39 PM - System Checkpoint
RP358: 5/19/2011 7:30:12 AM - System Checkpoint
RP359: 5/20/2011 10:05:34 AM - System Checkpoint
RP360: 5/22/2011 11:38:22 AM - System Checkpoint
RP361: 5/23/2011 1:36:18 PM - System Checkpoint
RP362: 5/26/2011 9:25:49 AM - System Checkpoint
RP363: 5/28/2011 3:50:27 PM - Unsigned driver install
RP364: 5/29/2011 3:58:40 PM - System Checkpoint
RP365: 6/1/2011 6:07:38 AM - System Checkpoint
RP366: 6/3/2011 7:41:16 AM - System Checkpoint
RP367: 6/3/2011 6:55:47 PM - Restore Operation
RP368: 6/4/2011 10:02:50 AM - OTL Restore Point
.
==== Installed Programs ======================
.
Adobe Flash Player 10 ActiveX
Adobe Reader 8.1.6
Apple Software Update
Auslogics Disk Defrag
Avira AntiVir Personal - Free Antivirus
Browser Address Error Redirector
CCleaner
CCScore
Compatibility Pack for the 2007 Office system
Critical Update for Windows Media Player 11 (KB959772)
Dell DataSafe Online
Dell Driver Reset Tool
Dell Support Center
Dell System Restore
Documentation & Support Launcher
EPSON Printer Software
ESSPDock
Fogware e-mail Back-up and Relocator
Games, Music, & Photos Launcher
Google Earth Plug-in
Google Update Helper
GoToAssist 8.0.0.514
High Definition Audio Driver Package - KB835221
HijackThis 1.99.1
HLPPDOCK
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
IE New Window Maximizer 2.4
Intel(R) Graphics Media Accelerator Driver
Intel(R) PRO Network Connections Drivers
Internet Service Offers Launcher
Java Auto Updater
Java(TM) 6 Update 24
jv16 PowerTools 1.3
Kodak EasyShare software
Logitech MouseWare 9.79.1
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft PowerPoint Viewer 97
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Works
Mouse Suite for Desktop Computers
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser (KB933579)
Musicmatch for Windows Media Player
OGA Notifier 2.0.0048.0
PC Inspector File Recovery
PowerDVD
Quick ShutDown
QuickTime
Realtek High Definition Audio Driver
Roxio Creator Audio
Roxio Creator Copy
Roxio Creator Data
Roxio Creator DE
Roxio Creator Tools
Roxio Express Labeler 3
Roxio Update Manager
SearchAssist
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB2183461)
Security Update for Windows Internet Explorer 7 (KB2360131)
Security Update for Windows Internet Explorer 7 (KB2416400)
Security Update for Windows Internet Explorer 7 (KB2482017)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Internet Explorer 7 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
SFR
Spelling Dictionaries Support For Adobe Reader 8
Spybot - Search & Destroy
U.S. Robotics Wireless MAXg Adapter
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows Internet Explorer 7 (KB980182)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 10
Windows Media Player 11
Windows XP Service Pack 3
.
==== Event Viewer Messages From Past Week ========
.
6/4/2011 6:27:34 AM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
.
==== End Of File ===========================



Thanks!! I will get the GMER log later today.

 

I got it, I got it!!!

Gmer log:

GMER 1.0.15.15640 - http://www.gmer.net
Rootkit scan 2011-06-05 19:17:34
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 SAMSUNG_HD321KJ rev.CP100-13
Running: yggmbxos.exe; Driver: C:\DOCUME~1\THESPE~1\LOCALS~1\Temp\fxrdypob.sys


---- System - GMER 1.0.15 ----

SSDT BA6B71FE ZwCreateKey
SSDT BA6B71F4 ZwCreateThread
SSDT BA6B7203 ZwDeleteKey
SSDT BA6B720D ZwDeleteValueKey
SSDT BA6B7212 ZwLoadKey
SSDT BA6B71E0 ZwOpenProcess
SSDT BA6B71E5 ZwOpenThread
SSDT BA6B721C ZwReplaceKey
SSDT BA6B7217 ZwRestoreKey
SSDT BA6B7208 ZwSetValueKey
SSDT BA6B71EF ZwTerminateProcess

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----


Thanks!!

 

ComboFix 11-06-04.02 - The Spectors 06/04/2011 9:52.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3317.2925 [GMT -7:00]
Running from: c:\documents and settings\The Spectors\Desktop\ComboFix\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((( Files Created from 2011-05-04 to 2011-06-04 )))))))))))))))))))))))))))))))
.
.
2011-06-04 01:56 . 2011-06-04 01:56 -------- d-----w- c:\windows\system32\wbem\Repository
2011-06-04 01:33 . 2011-06-04 01:32 23584 ----a-w- c:\temp\ERDNT.EXE
2011-06-04 01:32 . 2011-06-04 01:33 -------- d-----w- C:\Temp
2011-06-04 00:39 . 2011-06-04 00:39 -------- d-----w- c:\documents and settings\The Spectors\Application Data\Roxio
2011-05-29 03:49 . 2005-04-27 17:56 36864 ------w- c:\windows\system32\pnpchk.exe
2011-05-28 22:50 . 2001-09-14 02:35 27519 ----a-r- c:\windows\system32\drivers\USB100M.SYS
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IE New Window Maximizer "= "c:\program files\IE New Window Maximizer\iemaximizer.exe" [2005-02-09 356352]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"U.S. Robotics Wireless Manager UI "= "c:\windows\system32\WLTRAY" [X]
"Logitech Utility "= "Logi_MwX.Exe" [2003-12-17 19968]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2008-05-27 413696]
"RTHDCPL "= "RTHDCPL.EXE" [2007-07-16 16132608]
"avgnt "= "c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
.
c:\documents and settings\The Spectors\Start Menu\Programs\Startup\
Quick ShutDown.lnk - c:\program files\Quick ShutDown\qsd.exe [2003-2-18 294400]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-05-13 03:36 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 09:04 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2007-07-16 23:48 69632 ----a-w- c:\windows\ALCMTR.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2007-07-16 23:45 162584 ----a-w- c:\windows\system32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2007-07-16 23:45 142104 ----a-w- c:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv]
2007-09-17 15:56 124200 ------w- c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2007-07-16 23:45 138008 ----a-w- c:\windows\system32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PMX Daemon]
2006-11-08 19:01 49152 ----a-w- c:\windows\system32\ico.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS "= "c:\program files\Messenger\msmsgs.exe" /background
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ECenter "=c:\dell\E-Center\EULALauncher.exe
"dscactivate "= "c:\program files\Dell Support Center\gs_agent\custom\dsca.exe "
"BuildBU "=c:\dell\bldbubg.exe
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" -atboottime
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)
"DisableNotifications "= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PowerDVD.exe "=
"c:\\Program Files\\CyberLink\\PowerDVD DX\\PDVDDXSrv.exe "=
.
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [3/3/2010 7:57 PM 108289]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [11/26/2010 4:24 PM 136176]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [11/26/2010 4:24 PM 136176]
S3 pmxmouse;PMXMOUSE;c:\windows\system32\drivers\pmxmouse.sys [5/24/2008 12:02 PM 18432]
S3 pmxusblf;PMXUSBLF;c:\windows\system32\drivers\pmxusblf.sys [5/24/2008 12:02 PM 14336]
S3 USB-100;Linksys EtherFast 10/100 Compact USB Network Adapter;c:\windows\system32\drivers\USB100M.SYS [5/28/2011 3:50 PM 27519]
.
Contents of the 'Scheduled Tasks' folder
.
2011-06-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-26 23:24]
.
2011-06-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-26 23:24]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://my.earthlink.net/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = <local>
TCP: DhcpNameServer = 192.168.0.1
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
MSConfigStartUp-Microsoft Default Manager - c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe
AddRemove-HijackThis - D:\HijackThis.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-04 09:55
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(496)
c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll
c:\windows\System32\BCMLogon.dll
.
- - - - - - - > 'explorer.exe'(2508)
c:\windows\system32\WININET.dll
c:\program files\Logitech\MouseWare\System\LgWndHk.dll
c:\program files\Common Files\Logitech\Scrolling\LgMsgHk.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2011-06-04 09:56:47
ComboFix-quarantined-files.txt 2011-06-04 16:56
.
Pre-Run: 299,683,696,640 bytes free
Post-Run: 300,144,340,992 bytes free
.
- - End Of File - - 3CE326E8AFF9D7B5CA14A81935D10FAB

 

BTW, here is OTL (what h*ll!)

OTL Log: Using parameters on this post:
Post #7

OTL Extras logfile created on: 6/4/2011 10:02:34 AM - Run 1
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\The Spectors\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.24 Gb Total Physical Memory | 2.76 Gb Available Physical Memory | 85.33% Memory free
5.08 Gb Paging File | 4.86 Gb Available in Paging File | 95.71% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 294.73 Gb Total Space | 279.56 Gb Free Space | 94.85% Space Free | Partition Type: NTFS
Drive I: | 3.74 Gb Total Space | 2.65 Gb Free Space | 71.02% Space Free | Partition Type: FAT32

Computer Name: SPECTOR | User Name: The Spectors | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-3792849028-2717149064-130673143-1005\SOFTWARE\Classes\<extension>]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNetisabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNetisabledxpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\CyberLink\PowerDVD DX\PowerDVD.exe" = C:\Program Files\CyberLink\PowerDVD DX\PowerDVD.exe:*:Enabled:CyberLink PowerDVD DX -- (CyberLink Corp.)
"C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" = C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe:*:Enabled:CyberLink PowerDVD DX Resident Program -- (CyberLink Corp.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\CyberLink\PowerDVD DX\PowerDVD.exe" = C:\Program Files\CyberLink\PowerDVD DX\PowerDVD.exe:*isabled:CyberLink PowerDVD DX -- (CyberLink Corp.)
"C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" = C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe:*isabled:CyberLink PowerDVD DX Resident Program -- (CyberLink Corp.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{02DFF6B1-1654-411C-8D7B-FD6052EF016F}" = Apple Software Update
"{08CA9554-B5FE-4313-938F-D4A417B81175}" = QuickTime
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data
"{09760D42-E223-42AD-8C3E-55B47D0DDAC3}" = Roxio Creator DE
"{0DD140D3-9563-481E-AA75-BA457CBDAEF2}" = PC Inspector File Recovery
"{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE
"{154508C0-07C5-4659-A7A0-E49968750D21}" = HLPPDOCK
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{171E6C1E-B5FC-11DF-B115-005056C00008}" = Google Earth Plug-in
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 24
"{2B4CF74B-AA96-49AF-87FA-A8FBCC3C9574}" = Fogware e-mail Back-up and Relocator
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{448E2D77-E504-4221-B2C2-93646B344729}" = Mouse Suite for Desktop Computers
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D3C9F4B-4B7D-4E5D-99B9-0123AB0D51ED}" = Dell DataSafe Online
"{5809E7CF-4DCF-11D4-9875-00105ACE7734}" = Logitech MouseWare 9.79.1
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.6
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{B0DF58A2-40DF-4465-AA56-38623EC9938C}" = Documentation & Support Launcher
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}" = CCScore
"{B6884A07-0305-47AE-9969-8F26FADC17DE}" = Games, Music, & Photos Launcher
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D32470A1-B10C-4059-BA53-CF0486F68EBC}" = Kodak EasyShare software
"{DB02F716-6275-42E9-B8D2-83BA2BF5100B}" = SFR
"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics Disk Defrag
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center
"{E42BD75A-FC23-4E3F-9F91-2658334C644F}" = Internet Service Offers Launcher
"{E93E5EF6-D361-481E-849D-F16EF5C78EBC}" = Musicmatch for Windows Media Player
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator DE
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FCDB1C92-03C6-4C76-8625-371224256091}" = ESSPDock
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CCleaner" = CCleaner
"EPSON Printer and Utilities" = EPSON Printer Software
"GoToAssist" = GoToAssist 8.0.0.514
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"IE New Window Maximizer_is1" = IE New Window Maximizer 2.4
"ie7" = Windows Internet Explorer 7
"jv16 PowerTools_is1" = jv16 PowerTools 1.3
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PPTView97" = Microsoft PowerPoint Viewer 97
"PROSet" = Intel(R) PRO Network Connections Drivers
"Quick ShutDown" = Quick ShutDown
"SearchAssist" = SearchAssist
"U.S. Robotics Wireless MAXg Adapter" = U.S. Robotics Wireless MAXg Adapter
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1/4/2011 12:17:39 PM | Computer Name = SPECTOR | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6000.17093, faulting
module sdhelper.dll, version 1.6.2.14, fault address 0x000051a0.

Error - 2/6/2011 2:53:04 PM | Computer Name = SPECTOR | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.17093, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 2/6/2011 2:53:20 PM | Computer Name = SPECTOR | Source = Application Hang | ID = 1001
Description = Fault bucket -2087263879.

Error - 3/31/2011 3:00:17 PM | Computer Name = SPECTOR | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.17095, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 5/28/2011 7:19:07 PM | Computer Name = SPECTOR | Source = Application Hang | ID = 1002
Description = Hanging application SpybotSD.exe, version 1.6.2.46, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 6/3/2011 9:59:03 PM | Computer Name = SPECTOR | Source = Avira AntiVir | ID = 4110
Description = An unknown error occurred during init of the engine! Returned error
code: 0x35

Error - 6/3/2011 10:06:55 PM | Computer Name = SPECTOR | Source = Avira AntiVir | ID = 4110
Description = An unknown error occurred during init of the engine! Returned error
code: 0x35

Error - 6/4/2011 9:27:25 AM | Computer Name = SPECTOR | Source = Avira AntiVir | ID = 4110
Description = An unknown error occurred during init of the engine! Returned error
code: 0x35

Error - 6/4/2011 12:41:26 PM | Computer Name = SPECTOR | Source = Avira AntiVir | ID = 4110
Description = An unknown error occurred during init of the engine! Returned error
code: 0x35

Error - 6/4/2011 1:00:57 PM | Computer Name = SPECTOR | Source = Application Hang | ID = 1002
Description = Hanging application OTL.exe, version 3.2.23.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 5/29/2011 12:09:34 AM | Computer Name = SPECTOR | Source = PSched | ID = 14103
Description = QoS [Adapter {D11769E3-DAC2-4F52-8E44-E5528FDA6912}]: The netcard driver
failed the query for OID_GEN_LINK_SPEED.

Error - 5/29/2011 12:09:34 AM | Computer Name = SPECTOR | Source = PSched | ID = 14103
Description = QoS [Adapter {D11769E3-DAC2-4F52-8E44-E5528FDA6912}]: The netcard driver
failed the query for OID_GEN_LINK_SPEED.

Error - 5/29/2011 12:09:34 AM | Computer Name = SPECTOR | Source = PSched | ID = 14103
Description = QoS [Adapter {D11769E3-DAC2-4F52-8E44-E5528FDA6912}]: The netcard driver
failed the query for OID_GEN_LINK_SPEED.

Error - 5/29/2011 12:09:34 AM | Computer Name = SPECTOR | Source = PSched | ID = 14103
Description = QoS [Adapter {D11769E3-DAC2-4F52-8E44-E5528FDA6912}]: The netcard driver
failed the query for OID_GEN_LINK_SPEED.

Error - 5/29/2011 12:09:34 AM | Computer Name = SPECTOR | Source = PSched | ID = 14103
Description = QoS [Adapter {D11769E3-DAC2-4F52-8E44-E5528FDA6912}]: The netcard driver
failed the query for OID_GEN_LINK_SPEED.

Error - 5/29/2011 12:09:34 AM | Computer Name = SPECTOR | Source = PSched | ID = 14103
Description = QoS [Adapter {D11769E3-DAC2-4F52-8E44-E5528FDA6912}]: The netcard driver
failed the query for OID_GEN_LINK_SPEED.

Error - 5/29/2011 12:09:34 AM | Computer Name = SPECTOR | Source = PSched | ID = 14103
Description = QoS [Adapter {D11769E3-DAC2-4F52-8E44-E5528FDA6912}]: The netcard driver
failed the query for OID_GEN_LINK_SPEED.

Error - 5/29/2011 12:09:34 AM | Computer Name = SPECTOR | Source = PSched | ID = 14103
Description = QoS [Adapter {D11769E3-DAC2-4F52-8E44-E5528FDA6912}]: The netcard driver
failed the query for OID_GEN_LINK_SPEED.

Error - 6/4/2011 9:27:34 AM | Computer Name = SPECTOR | Source = W32Time | ID = 39452689
Description = Time Provider NtpClient: An error occurred during DNS lookup of the
manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup
again in 15 minutes. The error was: A socket operation was attempted to an unreachable
host. (0x80072751)

Error - 6/4/2011 9:27:34 AM | Computer Name = SPECTOR | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 14 minutes. NtpClient has no source of accurate
time.


< End of report >

 

Wired connection looks great. Very good signal strength. Still think I should reinstall the drivers?? I can do that. I have them.

No wired connection available.

I'll ck Device Manager tomorrow.

Could it be a Registry issue of some kind?

Avira is broken, too. Cannot load a module of a file that is where it is supposed to be. (aecore.dll). I cannot really fix that until I get connected and can perform updates.

 

Yes, Wireless, oops.

Retirement Hotel- wireless only.

Assuming that Device Mgr is clear and reinstalling the usb adapter drivers is for naught, what would you suggest we do next?

Thanks, Lar

 

I'll do these tomorrow.

DAF looks a little scary. Is that really an ok piece of software?

Larry

 

Sadly, things have gone badly. Once I removed the driver and reinstalled it, I could not get connected to the internet at all. Kept "acquiring ". So, I carried on to the rest. All went without a hitch. Now, the computer won't recognize the insertion of new hardware (USB wireless), the Add/Remove function will not populate and the computer will not fully shut down (just says "shutting down" forever). Maybe I should do a System Restore next time I am there and hope for the best. I ran out of time tonight.

Thanks.

 

Ok. Thanks for your help. Movin' on!!