Active Userinit.exe Application error

[Active] Userinit.exe Application error

here is the problem....XP almost starts fine, but then a message pops up:
"userinit.exe- Application error "
"The application failed to initialize properly (0xc0000005) Click on OK to terminate the application "

so i googled the problem a few people recommended this:

Restore Winlogon\Userinit
Line #263 right side
http://www.kellys-korner-xp.com/xp_tweaks.htm

so when i went into the regedit the userinit already read C:\Windows\System32\Userinit.exe,

i went into system32 and found no wsaupdater.exe so this next step did not work

Place your XP CD in and navigate to the Recovery Console.
Change the C:\Windows prompt to: C:\Windows\System32 and copy userinit.exe to wsaupdater.exe

Reboot into Safe Mode and modify:

change userinit in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon from wsaupdater.exe, to userinit.exe,

so i downloaded hijack this and these are my logs:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1147 AM, on 12/16/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ATKKBService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID}
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {8375FA3F-751F-40FC-AFE4-C6315D6B5798} - C:\WINDOWS\system32\geBuRLFu.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: {bd2fcec5-ff14-8ae8-1a34-53a6fb15881e} - {e18851bf-6a35-43a1-8ea8-41ff5cecf2db} - C:\WINDOWS\system32\ubysug.dll (file missing)
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: (no name) - {5d4831e0-5a7c-4a46-afd5-a79ab8ce36c2} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [MediaFace Integration] C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [zzz_ImInstaller_IncrediMail] "C:\Documents and Settings\life is great\Local Settings\Temp\ImInstaller\IncrediMail\incredimail_install.exe" -startup -product IncrediMail
O4 - HKLM\..\Run: [34ab544e] rundll32.exe "C:\WINDOWS\system32\rtfpndot.dll ",b
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Photo Downloader] "G:\3.0\Apps\apdproxy.exe "
O4 - HKLM\..\RunOnce: [*Restore] C:\WINDOWS\system32\restore\rstrui.exe -i
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [PowerBar] "\PowerBar.exe" /AtBootTime
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\Program Files\IncrediMail\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1155675828546
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c00D53F6.dat
O22 - SharedTaskScheduler: flammei - {9d635a36-6b3c-4146-8625-f3aaf507bbf8} - (no file)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 9376 bytes

no idea what to do now all i know is its from a virus, i downloaded AVG it did a full scan them updated then asked for a restart thats when the error started to happen, i went into msconfig to do a system restore but their is nothing at all to restore to not even before i installed AVG

Just finished virus scan this is the result: (Bold the infected file which i think is stoping the computer to fully boot)

Scan "Scan whole computer" was finished.
Infections found:; "19 "
Infected objects removed or healed:; "15 "
Not removed or healed:; "4 "
Spyware found:; "1 "
Spyware removed:; "1 "
Not removed:; "0 "
Warnings count:; "198 "
Information count:; "0 "
Scan started:; "Tuesday, December 16, 2008, 12:55:27 PM "
Scan finished:; "Tuesday, December 16, 2008, 3:52:54 PM (2 hour(s) 57 minute(s) 26 second(s)) "
Total object scanned:; "1210444 "
User who launched the scan:; "life is great "

Infections
File; "Infection "; "Result "
C:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Recycle Bin\kdja.exe; "Trojan horse BackDoor.Agent.TJA "; "Moved to Virus Vault "

C:\Documents and Settings\life is great\Desktop\Phone Pics\New Folder\New Folder (2)\New Folder\avg_avwt_stf_all_8_81a1271.EXE; "Trojan horse BackDoor.Agent.TJA "; "Infected "

C:\Documents and Settings\life is great\Desktop\Phone Pics\New Folder\New Folder (2)\New Folder\avg_avwt_stf_all_8_81a1271.EXE:\server.exe; "Trojan horse BackDoor.Agent.TJA "; "Infected "

C:\Documents and Settings\life is great\Desktop\Phone Pics\New Folder\New Folder (2)\Ultra Iso.EXE; "Trojan horse SHeur2.CWB "; "Moved to Virus Vault "

C:\Documents and Settings\life is great\Desktop\Phone Pics\New Folder\New Folder (2)\Ultra Iso.EXE:\is170086.exe; "Trojan horse SHeur2.CWB "; "Moved to Virus Vault "

C:\WINDOWS\system32\__c00D53F6.dat; "Trojan horse Generic10.AIEO "; "Reboot is required to finish the action "

C:\WINDOWS\system32\__c00D53F6.dat; "Trojan horse Generic10.AIEO "; "Moved to Virus Vault "
C:\WINDOWS\system32\mlJCVoPH.dll; "Trojan horse Vundo.AT "; "Moved to Virus Vault "
C:\WINDOWS\system32\qnvhsblf.dll; "Trojan horse Generic10.AIEO "; "Moved to Virus Vault "
C:\WINDOWS\system32\rfmwuyff.dll; "Trojan horse Vundo.CK "; "Moved to Virus Vault "
C:\WINDOWS\system32\rtfpndot.dll; "Trojan horse Vundo.CK "; "Moved to Virus Vault "
C:\WINDOWS\system32\ssqRKAtu.dll; "Trojan horse Vundo.CI "; "Moved to Virus Vault "
[SIZE= "3"]C:\WINDOWS\system32\winlogon.exe (804); "Trojan horse Generic10.AIEO "; "Reboot is required to finish the action "[/SIZE]


Spyware
File; "Infection "; "Result "
F:\Paint.Shop.Pro.Photo.XI\PATCH\corel.paint.shop.pro.photo.XI.++-patch.exe; "Potentially harmful program HackTool.crack "; "Moved to Virus Vault "

 

Welcome to WindowsBBS AzzBr0

Download ComboFix by sUBs from here, saving the file to your desktop.


Please disable realtime protection applications as they sometimes interfere with the tool. Check this link for your applicable programs.

• Close all open programs and windows
• Double click ComboFix.exe and follow the prompts.
• It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log in your next reply.

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

**NOTE - I recommend you allow the Recovery Console to be downloaded and installed if or when prompted.

 

Hello noahdfear, thank you for your welcome

When i go to run ComboFix i get run32.dll error (i think) and other errors i have got previously but not from combo fix are Find.exe and CMD.exe failed to initialize when combo fix tries to download recovery console it says no active internet connection yet i know the internet works I'm using it at the moment. But with that is mind this is what i managed to get. (i just got the desktop back for the first time in a week thank you so much)

ComboFix 08-12-17.01 - life is great 2008-12-18 16:43:48.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2047.1675 [GMT 10:00]
Running from: c:\documents and settings\life is great\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\__c00D53F6.dat
c:\windows\system32\AutoRun.inf
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll
c:\windows\Tasks\cqshrsff.job
F:\WinRAR.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Service_NPF


((((((((((((((((((((((((( Files Created from 2008-11-18 to 2008-12-18 )))))))))))))))))))))))))))))))
.

2008-12-16 16:46 . 2008-12-16 17:16 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2008-12-16 10:21 . 2004-08-04 00:56 116,224 --a--c--- c:\windows\system32\dllcache\xrxwiadr.dll
2008-12-16 10:21 . 2001-08-17 22:37 99,865 --a--c--- c:\windows\system32\dllcache\xlog.exe
2008-12-16 10:21 . 2001-08-17 22:37 27,648 --a--c--- c:\windows\system32\dllcache\xrxftplt.exe
2008-12-16 10:21 . 2001-08-17 22:36 23,040 --a--c--- c:\windows\system32\dllcache\xrxwbtmp.dll
2008-12-16 10:21 . 2004-08-03 22:29 19,455 --a--c--- c:\windows\system32\dllcache\wvchntxx.sys
2008-12-16 10:21 . 2001-08-17 22:36 17,408 --a--c--- c:\windows\system32\dllcache\xrxscnui.dll
2008-12-16 10:21 . 2001-08-17 12:11 16,970 --a--c--- c:\windows\system32\dllcache\xem336n5.sys
2008-12-16 10:21 . 2004-08-03 22:29 12,063 --a--c--- c:\windows\system32\dllcache\wsiintxx.sys
2008-12-16 10:21 . 2001-08-17 22:37 4,608 --a--c--- c:\windows\system32\dllcache\xrxflnch.exe
2008-12-16 10:19 . 2001-08-17 13:28 765,884 --a--c--- c:\windows\system32\dllcache\usrti.sys
2008-12-16 10:18 . 2001-08-17 13:28 794,654 --a--c--- c:\windows\system32\dllcache\usr1801.sys
2008-12-16 10:17 . 2001-08-17 22:36 525,568 --a--c--- c:\windows\system32\dllcache\tridxp.dll
2008-12-16 10:16 . 2001-08-17 14:56 172,768 --a--c--- c:\windows\system32\dllcache\t2r4disp.dll
2008-12-16 10:15 . 2001-08-17 12:18 285,760 --a--c--- c:\windows\system32\dllcache\stlnata.sys
2008-12-16 10:14 . 2001-08-17 14:56 147,200 --a--c--- c:\windows\system32\dllcache\smidispb.dll
2008-12-16 10:13 . 2004-08-03 22:41 404,990 --a--c--- c:\windows\system32\dllcache\slntamr.sys
2008-12-16 10:12 . 2001-08-17 22:36 495,616 --a--c--- c:\windows\system32\dllcache\sblfx.dll
2008-12-16 10:11 . 2004-08-04 00:56 397,056 --a--c--- c:\windows\system32\dllcache\s3gnb.dll
2008-12-16 10:10 . 2001-08-17 13:28 899,146 --a--c--- c:\windows\system32\dllcache\r2mdkxga.sys
2008-12-16 10:09 . 2001-08-17 14:04 173,696 --a--c--- c:\windows\system32\dllcache\philcam2.sys
2008-12-16 10:08 . 2001-08-17 14:05 351,616 --a--c--- c:\windows\system32\dllcache\ovcodek2.sys
2008-12-16 10:07 . 2004-08-04 00:56 4,274,816 --a--c--- c:\windows\system32\dllcache\nv4_disp.dll
2008-12-16 10:06 . 2004-08-03 22:31 132,695 --a--c--- c:\windows\system32\dllcache\netwlan5.sys
2008-12-16 10:05 . 2004-08-04 00:56 1,737,856 --a--c--- c:\windows\system32\dllcache\mtxparhd.dll
2008-12-16 10:04 . 2001-08-17 13:28 802,683 --a--c--- c:\windows\system32\dllcache\ltsm.sys
2008-12-16 10:03 . 2001-08-17 22:36 242,176 --a--c--- c:\windows\system32\dllcache\kdsusd.dll
2008-12-16 10:02 . 2001-08-17 22:36 372,824 --a--c--- c:\windows\system32\dllcache\iconf32.dll
2008-12-16 10:01 . 2004-08-04 00:56 702,845 --a--c--- c:\windows\system32\dllcache\i81xdnt5.dll
2008-12-16 10:00 . 2001-08-17 13:28 907,456 --a--c--- c:\windows\system32\dllcache\hcf_msft.sys
2008-12-16 09:59 . 2001-08-17 14:56 1,733,120 --a--c--- c:\windows\system32\dllcache\g400d.dll
2008-12-16 09:58 . 2001-08-17 13:28 634,134 --a--c--- c:\windows\system32\dllcache\el656ct5.sys
2008-12-16 09:57 . 2001-08-17 12:14 952,007 --a--c--- c:\windows\system32\dllcache\diwan.sys
2008-12-16 09:56 . 2001-08-17 22:36 419,357 --a--c--- c:\windows\system32\dllcache\dgconfig.dll
2008-12-16 09:55 . 2001-08-17 12:13 980,034 --a--c--- c:\windows\system32\dllcache\cicap.sys
2008-12-16 09:54 . 2001-08-17 13:28 871,388 --a--c--- c:\windows\system32\dllcache\bcmdm.sys
2008-12-16 09:53 . 2001-08-17 13:28 762,780 --a--c--- c:\windows\system32\dllcache\3cwmcru.sys
2008-12-15 21:47 . 2008-12-17 12:00 <DIR> d--h----- C:\$AVG8.VAULT$
2008-12-15 21:42 . 2008-12-15 21:42 410,984 --a------ c:\windows\system32\deploytk.dll
2008-12-15 21:27 . 2008-12-18 16:32 <DIR> d-------- c:\windows\system32\drivers\Avg
2008-12-15 21:27 . 2008-12-15 21:27 <DIR> d-------- c:\program files\AVG
2008-12-15 21:27 . 2008-12-15 21:27 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
2008-12-15 21:27 . 2008-12-15 21:55 98,440 --a------ c:\windows\system32\drivers\avgldx86.sys
2008-12-15 21:27 . 2008-12-15 21:55 90,632 --a------ c:\windows\system32\drivers\avgtdix.sys
2008-12-15 21:27 . 2008-12-15 21:55 12,936 --a------ c:\windows\system32\drivers\avgrkx86.sys
2008-12-15 21:27 . 2008-12-15 21:55 10,520 --a------ c:\windows\system32\avgrsstx.dll
2008-12-15 21:08 . 2008-12-15 21:08 <DIR> d-------- c:\program files\Rocket Division Software
2008-12-15 21:08 . 2008-12-15 21:08 717,296 --a------ c:\windows\system32\drivers\sptd.sys
2008-12-15 21:08 . 2007-12-27 16:45 85,760 --a------ c:\windows\system32\drivers\StarPortLite.sys
2008-12-15 20:46 . 2008-12-15 22:29 <DIR> d-------- c:\documents and settings\life is great\Application Data\Thinstall
2008-12-15 19:33 . 2008-12-15 19:33 <DIR> d-------- c:\program files\EZB Systems
2008-12-15 19:33 . 2008-12-15 19:33 <DIR> d-------- C:\EasyBoot

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-16 07:15 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-12-16 01:06 --------- d-----w c:\program files\Trend Micro
2008-12-16 00:58 --------- d-----w c:\documents and settings\life is great\Application Data\HPAppData
2008-12-15 11:42 --------- d-----w c:\program files\Java
2008-12-12 09:29 --------- d-----w c:\documents and settings\life is great\Application Data\AdobeUM
2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 13:01 283,648 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 20:38 826,368 ----a-w c:\windows\system32\wininet.dll
2008-10-16 04:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 04:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 04:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 04:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 04:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 04:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 04:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 04:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 04:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 04:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-03 10:15 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-09-30 06:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-29 07:09 17,134 ----a-w c:\windows\system32\PCANDIS5.SYS
2008-07-29 12:49 490 ----a-w c:\documents and settings\life is great\Application Data\wklnhst.dat
2007-10-24 04:12 81,920 ----a-w c:\documents and settings\life is great\Application Data\ezpinst.exe
2007-10-24 04:12 47,360 ----a-w c:\documents and settings\life is great\Application Data\pcouffin.sys
2007-03-10 16:22 2,821,119 ----a-w c:\program files\Wld_Photo_Effcts.rar
2007-03-09 23:03 493,160 ----a-w c:\program files\incredimail_install.exe
2008-12-03 22:39 67,696 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2008-12-03 22:39 54,376 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2008-12-03 22:39 34,952 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2008-12-03 22:39 46,720 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2008-12-03 22:39 172,144 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
2006-08-31 20:03 56 --sh--r c:\windows\system32\62C0E6D527.sys
2008-07-12 14:01 4,704 --sha-w c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"MSMSGS "= "c:\program files\Messenger\msmsgs.exe" [2004-10-14 1694208]
"msnmsgr "= "c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"SpybotSD TeaTimer "= "c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KernelFaultCheck "= "c:\windows\system32\dumprep 0 -k" [X]
"ATIPTA "= "c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-09-22 344064]
"PCSuiteTrayApplication "= "c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 227328]
"MediaFace Integration "= "c:\program files\Fellowes\MediaFACE 4.0\SetHook.exe" [2002-09-17 53248]
"NeroFilterCheck "= "c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"HP Software Update "= "c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2008-12-15 136600]
"Easy-PrintToolBox "= "c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600]
"AVG8_TRAY "= "c:\progra~1\AVG\AVG8\avgtray.exe" [2008-12-15 1261336]
"Corel Photo Downloader "= "c:\program files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2007-08-16 531272]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2006-07-19 282624]
"SoundMan "= "SOUNDMAN.EXE" [2006-03-03 c:\windows\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync "= "c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.JDCT "= jl_jdct.drv

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe "=
"c:\\Program Files\\IncrediMail\\bin\\IMApp.exe "=
"c:\\Program Files\\LimeWire\\LimeWire.exe "=
"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"c:\\Program Files\\IncrediMail\\bin\\ImLc.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\IncrediMail\\bin\\ImPackr.exe "=
"c:\\Program Files\\IncrediMail\\bin\\IncrediMail_Install.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe "=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe "=

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\Drivers\avgrkx86.sys [2008-12-15 12936]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-12-15 98440]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-12-15 90632]
R1 StarPortLite;StarPort Storage Controller (Lite);c:\windows\system32\DRIVERS\StarPortLite.sys [2008-12-15 85760]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-12-15 874776]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-12-15 231704]
R3 BT4501G;SpeedTouch 121g Wireless USB Adapter Driver;c:\windows\system32\DRIVERS\BT4501G.sys [2007-12-04 357568]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\setup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F8B9E5C0-4DCC-CFCF-ABA5-00401D608516}]
c:\documents and settings\All Users\Start Menu\Programs\Administrative Tools\Recycle Bin\kdja.exe
.
Contents of the 'Scheduled Tasks' folder

2008-12-17 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
.
- - - - ORPHANS REMOVED - - - -

BHO-{8375FA3F-751F-40FC-AFE4-C6315D6B5798} - c:\windows\system32\geBuRLFu.dll
BHO-{e18851bf-6a35-43a1-8ea8-41ff5cecf2db} - c:\windows\system32\ubysug.dll
WebBrowser-{F3DF2532-A2CC-48D8-8643-A033AE4FC313} - (no file)
HKCU-Run-PowerBar - \PowerBar.exe
HKLM-Run-zzz_ImInstaller_IncrediMail - c:\documents and settings\life is great\Local Settings\Temp\ImInstaller\IncrediMail\incredimail_install.exe
HKLM-Run-Adobe Photo Downloader - g:\3.0\Apps\apdproxy.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: &Add animation to IncrediMail Style Box - c:\program files\IncrediMail\bin\resources\WebMenuImg.htm
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
FF - ProfilePath - c:\documents and settings\life is great\Application Data\Mozilla\Firefox\Profiles\mxvzfvwo.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - MyStart Search
FF - prefs.js: browser.startup.homepage - www.google.com
FF - prefs.js: keyword.URL - hxxp://mystart.incredimail.com/?loc=ff_address_bar&search=
FF - component: c:\documents and settings\life is great\Application Data\Mozilla\Firefox\Profiles\mxvzfvwo.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
FF - component: c:\documents and settings\life is great\Application Data\Mozilla\Firefox\Profiles\mxvzfvwo.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metricsloader.dll
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-18 16:46:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(728)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\savedump.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\windows\ATKKBService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\PSIService.exe
c:\windows\system32\wscntfy.exe
c:\progra~1\AVG\AVG8\avgam.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
.
**************************************************************************
.
Completion time: 2008-12-18 16:49:27 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-18 06:49:23

Pre-Run: 2,902,056,960 bytes free
Post-Run: 2,861,510,656 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Professional" /noexecute=optin /fastdetect

256 --- E O F --- 2008-12-12 14:56:12

 

Did you install some modem drivers on the 16th?

One registry entry to be removed. Highlight and copy the contents of the code box below.

Code:

reg delete  "HKLM\software\microsoft\active setup\installed components\{F8B9E5C0-4DCC-CFCF-ABA5-00401D608516}" /f
exit
cls

Click Start>Run and type cmd then hit enter to open a command window. Right click in the command window and select paste. The command window will close on it's own.

Right click the Start button and select Open All Users
Navigate to Programs\Administrative Tools and remove the Recycle Bin shortcut if present.

 

Not sure about the 16th but i did reinstall the modem a SpeedTouch4D4DDF and wen i type or click or do anything in command window it exits. their is some code error or some type of code but it exits way to fast to see

 

Lets get an online scan now. Do an online scan with Kaspersky Online Scanner

Click Accept, when prompted to download and install the program files and database of malware definitions.

• Click Run at the Security prompt.
• The program will then begin downloading and installing and will also update the database.
• Please be patient as this can take several minutes.
• Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Click View scan report at the bottom.
• Click the Save Report As... button.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

To optimize scanning time and produce a more sensible report for review:

• Close any open programs.
• Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Post the Kaspersky log here.

 

Sorry it is taking so long, the scanner is at 11% now so it will probably take another hour or 2. so i will be back shortly with the results. it has already found 2 infected files.

 

well its been over 5 hours and its finally finished, i hope this is what you needed

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Friday, December 19, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Friday, December 19, 2008 02:39:07
Records in database: 1478945
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\

Scan statistics:
Files scanned: 219378
Threat name: 8
Infected objects: 13
Suspicious objects: 0
Duration of the scan: 03:28:06


File name / Threat name / Threats count
C:\Documents and Settings\life is great\Desktop\incredimail_install.exe Infected: not-a-virusownloader.Win32.ImLoader.n 1
C:\Documents and Settings\life is great\Desktop\Phone Pics\New Folder\New Folder (2)\New Folder\avg_avwt_stf_all_8_81a1271.EXE Infected: Backdoor.Win32.Agent.lcw 1
C:\Program Files\incredimail_install.exe Infected: not-a-virusownloader.Win32.ImLoader.f 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\___c00D53F6_.dat.zip Infected: Trojan.Win32.Monder.gen 1
F:\IncrediMail\bin\IncrediMail_Install.exe Infected: not-a-virusownloader.Win32.ImLoader.d 1
F:\incredimail_install.exe Infected: not-a-virusownloader.Win32.ImLoader.d 1
F:\limewire downloads\albatross peter green.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1
F:\limewire downloads\Bolero (Serbian).wma Infected: Trojan-Downloader.WMA.GetCodec.a 1
F:\limewire downloads\Gorillaz - Rock da house.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1
F:\limewire downloads\power of love jennifer rush.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1
F:\limewire downloads\Sting - We Work The Black Seam.mp3 Infected: Trojan-Downloader.WMA.GetCodec.a 1
F:\My PSP Files\christina\fo-fl203\fo-fl203.exe Infected: not-a-virus:AdWare.Win32.Rabio.gn 1
F:\My PSP Files\christina\fo-fl203.zip Infected: not-a-virus:AdWare.Win32.Rabio.gn 1

The selected area was scanned.

 

Remove the following infected files then empty the recycle bin.

C:\Documents and Settings\life is great\Desktop\Phone Pics\New Folder\New Folder (2)\New Folder\avg_avwt_stf_all_8_81a1271.EXE
F:\limewire downloads\albatross peter green.mp3
F:\limewire downloads\Bolero (Serbian).wma
F:\limewire downloads\Gorillaz - Rock da house.mp3
F:\limewire downloads\power of love jennifer rush.mp3
F:\limewire downloads\Sting - We Work The Black Seam.mp3
F:\My PSP Files\christina\fo-fl203\fo-fl203.exe
F:\My PSP Files\christina\fo-fl203.zip

Click Start>Run and type ComboFix /u then hit Enter to uninstall ComboFix and remove the files it has quarantined. This action will also reset the System Restore points, removing any infected files there as well.
Verify the C:\Qoobox and C:\ComboFix folders were removed, as well as the C:\ComboFix.txt file.
You can delete any other logs that were created/saved too.


Needless to say, you really should stay away from P2P apps like Limewire. I'm not passing judgment on file-sharing as a concept. However, I will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

References for the risk of these programs are here,
here and here.

I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.


That should wrap things up. How's the computer behaving?