1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Windows problems?? [moved, no malware infection]

Discussion in 'Windows XP' started by sfp25143, 2009/05/27.

Page 1 of 6
  1. 2009/05/27
    sfp25143

    sfp25143 Inactive Thread Starter

    Joined:
    2009/05/26
    Messages:
    62
    Likes Received:
    0
    Problems: error on every page; slow as syrup, startup and shutdown takes minutes; page cannot be displayed, freezes when playing games as in cards, board games; much much more happening.
    Was asked to come here by What The Tech. They ran the malware scan and said none ws there. Suggested it probably is in windows.
    Sure do miss my board/card games sites. Can only play without another person. Lots of things showed up on HighJack This that I had uninstalled or deleted. Lots of things I used years ago and won't go away or show up on add/delete to remove. Tried sev virus programs and nothing found.
    Hope someone can figure out how to clean this up.
    I know which site did this to me and about when. Daughter clicked on offer of free money deposit and filled out all the information to apply for loan. Started that day. Seems like it is destroying something every time I use computer.
    Thank you.
     
    sfp25143,
    #1
  2. 2009/05/27
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,890
    Likes Received:
    387
    I suspect your computer is still infected and have moved your thread to the Malware & Virus Removal forum.

    Please read this and post the logs requested in this thread.
     
    PeteC,
    #2
    sfp25143 likes this.


  3. to hide this advert.

  4. 2009/05/27
    sfp25143

    sfp25143 Inactive Thread Starter

    Joined:
    2009/05/26
    Messages:
    62
    Likes Received:
    0
    DDS Requested

    DDS (Ver_09-05-14.01) - NTFSx86
    Run by Shirley at 4:19:24.00 on Wed 05/27/2009
    Internet Explorer: 6.0.2900.5512
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.255.64 [GMT -4:00]

    AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    svchost.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\Program Files\AVG\AVG8\avgcsrvx.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe -k imgsvc
    C:\Program Files\Linksys\WUSB54GSC\WLService.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\Program Files\Linksys\WUSB54GSC\WUSB54GSC.exe
    C:\Program Files\AVG\AVG8\avgcsrvx.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\WgaTray.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\Outlook Express\msimn.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Documents and Settings\Shirley\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.google.com/
    uDefault_Search_URL = hxxp://www.google.com/ie
    uSearchAssistant = hxxp://www.google.com/ie
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL
    TB: {4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} - No File
    EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
    EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
    uRun: [msnmsgr] "c:\program files\msn messenger\msnmsgr.exe" /background
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
    uPolicies-explorer: NoWindowsUpdate = 0 (0x0)
    uPolicies-explorer: NoThemesTab = 0 (0x0)
    uPolicies-system: NoDispAppearancePage = 0 (0x0)
    uPolicies-system: NoColorChoice = 0 (0x0)
    uPolicies-system: NoSizeChoice = 0 (0x0)
    uPolicies-system: NoVisualStyleChoice = 0 (0x0)
    uPolicies-system: NoDispSettingsPage = 0 (0x0)
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    Trusted Zone: facebook.com\www
    Trusted Zone: kmart.com
    Trusted Zone: kmart.com\www
    Trusted Zone: kohls.com\www
    Trusted Zone: sears.com\www
    DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
    DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
    DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab
    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
    DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} - hxxp://download.yahoo.com/dl/installs/yinst0309.cab
    DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37984.9260300926
    DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} - hxxp://www.microsoft.com/security/controls/Sasser/20/SassCln.CAB
    DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
    Notify: avgrsstarter - avgrsstx.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll
    SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

    ============= SERVICES / DRIVERS ===============

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-5-10 325896]
    R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-5-10 27784]
    R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-5-10 108552]
    R1 Cinemsup;Cinemsup;c:\windows\system32\drivers\cinemsup.sys [2002-7-19 6656]
    R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-5-10 908568]
    R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-5-10 298776]
    R2 SocketLock;Raw Socket Lock Driver;c:\windows\system32\socketlock.sys [2004-1-24 3712]
    R3 tbcspud;Santa Cruz Driver;c:\windows\system32\drivers\tbcspud.sys [2005-12-28 144768]
    R3 tbcwdm;Santa Cruz WDM Driver;c:\windows\system32\drivers\tbcwdm.sys [2005-12-28 545088]
    S3 Ad-Watch Connect Filter;Ad-Watch Connect Kernel Filter;c:\windows\system32\drivers\NSDriver.sys [2007-8-7 9344]
    S3 Ad-Watch Real-Time Scanner;AW Real-Time Scanner;c:\windows\system32\drivers\AWRTPD.sys [2007-7-11 6272]
    S3 Ad-Watch Registry Filter;Ad-Watch Registry Kernel Filter;c:\windows\system32\drivers\AWRTRD.sys [2007-8-7 8320]
    S3 vtdg46xx;vtdg46xx;c:\progra~1\turtle~1\santac~1\contro~1\vtdg46xx.sys [2005-12-28 19232]
    S4 aawservice;Ad-Aware 2007 Service;c:\program files\lavasoft\ad-aware 2007\aawservice.exe [2007-8-27 587096]

    =============== Created Last 30 ================


    ==================== Find3M ====================

    2009-05-22 02:11 1,492,723 a------- c:\windows\java\packages\6AF1BXFN.ZIP
    2009-05-21 22:46 69,120 a------- c:\windows\system32\notepad.exe
    2009-05-21 22:46 69,120 a------- c:\windows\notepad.exe
    2009-03-09 05:19 410,984 a------- c:\windows\system32\deploytk.dll
    2009-03-06 10:22 284,160 a------- c:\windows\system32\pdh.dll
    2008-01-17 15:41 66,469 ac------ c:\program files\INSTALL.LOG
    2004-09-23 19:58 24,832 ac------ c:\docume~1\shirley\applic~1\GDIPFONTCACHEV1.DAT
    2004-08-04 03:56 73,728 ac-sh--- c:\windows\registeredpackages\{dd90d410-1823-43eb-9a16-a2331bf08799}$backup$\system\wmplayer.exe

    ============= FINISH: 4:20:38.20 ===============
     
    sfp25143,
    #3
  5. 2009/05/27
    sfp25143

    sfp25143 Inactive Thread Starter

    Joined:
    2009/05/26
    Messages:
    62
    Likes Received:
    0
    Attch Text DDS

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_09-05-14.01)

    Microsoft Windows XP Home Edition
    Boot Device: \Device\HarddiskVolume1
    Install Date: 12/30/2003 2:04:04 AM
    System Uptime: 5/26/2009 9:06:33 PM (7 hours ago)

    Motherboard: Dell Computer Corp. | | 06U214
    Processor: Intel(R) Pentium(R) 4 CPU 2.00GHz | Microprocessor | 1993/400mhz

    ==== Disk Partitions =========================

    A: is Removable
    C: is FIXED (NTFS) - 28 GiB total, 19.917 GiB free.
    D: is CDROM (CDFS)
    E: is CDROM (CDFS)

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    RP55: 3/19/2009 3:06:58 PM - System Checkpoint
    RP56: 3/20/2009 3:48:45 AM - Ace Utilities : Before Registry Cleanup
    RP57: 3/20/2009 3:50:55 AM - Ace Utilities : Before Registry Cleanup
    RP58: 3/20/2009 4:40:49 AM - Software Distribution Service 3.0
    RP59: 3/21/2009 6:55:34 PM - System Checkpoint
    RP60: 3/23/2009 1:25:59 AM - System Checkpoint
    RP61: 3/23/2009 12:04:36 PM - Software Distribution Service 3.0
    RP62: 3/24/2009 9:55:01 PM - System Checkpoint
    RP63: 3/25/2009 11:07:49 PM - Avg8 Update
    RP64: 3/25/2009 11:11:28 PM - Avg8 Update
    RP65: 3/27/2009 4:03:51 PM - Avg8 Update
    RP66: 3/30/2009 6:08:09 PM - System Checkpoint
    RP67: 4/1/2009 12:16:06 AM - System Checkpoint
    RP68: 4/3/2009 2:00:55 AM - System Checkpoint
    RP69: 4/3/2009 12:01:11 PM - Software Distribution Service 3.0
    RP70: 4/4/2009 7:53:59 PM - System Checkpoint
    RP71: 4/6/2009 12:02:07 PM - Software Distribution Service 3.0
    RP72: 4/7/2009 5:40:38 PM - Avg8 Update
    RP73: 4/8/2009 8:29:40 PM - Avg8 Update
    RP74: 4/11/2009 1:04:29 PM - System Checkpoint
    RP75: 4/13/2009 8:52:31 PM - Software Distribution Service 3.0
    RP76: 4/14/2009 3:20:30 AM - Ace Utilities : Before Registry Cleanup
    RP77: 4/16/2009 1:16:44 PM - System Checkpoint
    RP78: 4/19/2009 1:07:48 AM - System Checkpoint
    RP79: 4/21/2009 9:20:15 PM - System Checkpoint
    RP80: 4/26/2009 12:34:22 AM - System Checkpoint
    RP81: 4/26/2009 10:39:16 PM - Avg8 Update
    RP82: 4/26/2009 10:42:22 PM - Avg8 Update
    RP83: 4/29/2009 12:13:31 AM - System Checkpoint
    RP84: 5/6/2009 6:34:16 PM - System Checkpoint
    RP85: 5/8/2009 12:29:42 AM - Ace Utilities : Before Registry Cleanup
    RP86: 5/8/2009 12:50:03 AM - Software Distribution Service 3.0
    RP87: 5/8/2009 1:03:36 AM - Removed AVG 8.5
    RP88: 5/8/2009 2:38:59 AM - Installed ErrorFix
    RP89: 5/8/2009 3:08:21 AM - My Restore Point
    RP90: 5/8/2009 3:48:26 AM - Software Distribution Service 3.0
    RP91: 5/9/2009 1:25:52 AM - Removed ErrorFix
    RP92: 5/9/2009 2:21:42 AM - Installed Antispyware
    RP93: 5/10/2009 12:03:39 AM - Installed Java(TM) 6 Update 13
    RP94: 5/10/2009 6:58:50 PM - Installed AVG Free 8.5
    RP95: 5/11/2009 2:01:53 PM - Avg8 Update
    RP96: 5/12/2009 3:24:20 AM - Removed Antispyware
    RP97: 5/12/2009 4:01:48 AM - Installed ErrorFix
    RP98: 5/12/2009 4:18:05 AM - Removed Adobe Reader 7.1.0
    RP99: 5/12/2009 4:19:26 AM - Installed Adobe Reader 9.
    RP100: 5/12/2009 4:36:53 AM - Software Distribution Service 3.0
    RP101: 5/13/2009 4:32:31 AM - Ad-Aware Checkpoint
    RP102: 5/14/2009 2:55:26 AM - Ace Utilities : Before Registry Cleanup
    RP103: 5/14/2009 3:26:03 AM - Avg8 Update
    RP104: 5/15/2009 5:13:16 PM - System Checkpoint
    RP105: 5/15/2009 9:15:14 PM - Restore Operation
    RP106: 5/15/2009 9:40:14 PM - Restore Operation
    RP107: 5/15/2009 9:55:24 PM - Avg8 Update
    RP108: 5/15/2009 10:07:19 PM - Restore Operation
    RP109: 5/16/2009 3:59:08 AM - Software Distribution Service 3.0
    RP110: 5/16/2009 4:08:25 AM - Software Distribution Service 3.0
    RP111: 5/17/2009 7:48:13 PM - System Checkpoint
    RP112: 5/18/2009 12:47:50 PM - Avg8 Update
    RP113: 5/18/2009 12:49:35 PM - Avg8 Update
    RP114: 5/20/2009 7:42:16 PM - Removed ErrorFix
    RP115: 5/20/2009 11:48:33 PM - Software Distribution Service 3.0
    RP116: 5/22/2009 11:24:21 PM - System Checkpoint
    RP117: 5/26/2009 1:33:55 AM - System Checkpoint

    ==== Installed Programs ======================

    Acrobat.com
    Adobe Photoshop Elements 2.0
    Adobe Reader 9
    Adobe Shockwave Player 11.5
    AVG Free 8.5
    BCM V.92 56K Modem
    Belarc Advisor 6.1
    Compact Wireless-G USB Network Adapter with SpeedBooster
    Critical Update for Windows Media Player 11 (KB959772)
    Dell ResourceCD
    EPSON Copy Utility
    EPSON PERF 2400 Guide
    EPSON Photo Print
    EPSON Printer Software
    EPSON Scan
    EPSON Smart Panel
    HijackThis 2.0.2
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB952287)
    Java(TM) 6 Update 13
    Malwarebytes' Anti-Malware
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 2.0
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Data Access Components KB870669
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Word 2000 SR-1
    Microsoft Works 2001 Setup Launcher
    Microsoft Works 6.0
    Microsoft Works Suite Add-in for Microsoft Word
    MSN Gaming Zone
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    Notepad++
    NVIDIA Display Driver
    NVIDIA Windows 2000/XP Display Drivers
    Picasa 3
    Pop-Up Stopper Free Edition
    Remove-it
    Security Update for CAPICOM (KB931906)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player 10 (KB911565)
    Security Update for Windows Media Player 10 (KB917734)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956390)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958215)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960714)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB963027)
    Turtle Beach Santa Cruz Driver
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB967715)
    Visual C++ 2008 x86 Runtime - (v9.0.30729)
    Visual C++ 2008 x86 Runtime - v9.0.30729.01
    WebFldrs XP
    WebIQ Technology Engine
    Windows Defender
    Windows Genuine Advantage v1.3.0254.0
    Windows Live Messenger
    Windows Live OneCare safety scanner
    Windows Live Sign-in Assistant
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows XP Service Pack 3
    WinZip
    Works Suite OS Pack
    Works Synchronization

    ==== Event Viewer Messages From Past Week ========

    5/24/2009 3:06:01 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the WUSB54GSC service to connect.
    5/24/2009 3:06:01 PM, error: Service Control Manager [7000] - The WUSB54GSC service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    5/22/2009 6:28:23 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service upnphost with arguments " " in order to run the server: {204810B9-73B2-11D4-BF42-00B0D0118B56}
    5/22/2009 5:00:10 PM, error: DCOM [10005] - DCOM got error "%1055" attempting to start the service netman with arguments " " in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
    5/21/2009 11:34:00 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The system cannot find the file specified.
    5/21/2009 11:29:38 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the NVSvc service.
    5/21/2009 11:29:38 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.
    5/21/2009 11:29:38 PM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    5/21/2009 11:29:23 PM, error: Service Control Manager [7023] - The HID Input Service service terminated with the following error: The system cannot find the file specified.
    5/20/2009 11:41:05 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: IntelIde
    5/20/2009 11:39:34 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.

    ==== End Of File ===========================
     
    sfp25143,
    #4
  6. 2009/05/27
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,890
    Likes Received:
    387
    Thanks :)

    One of our trained malware analysts will take a look at your logs ASAP, but it may be a day or so before you get a response as they are always very busy. All logs are dealt with in the order received.

    Thank you for your patience.
     
    PeteC,
    #5
  7. 2009/05/27
    sfp25143

    sfp25143 Inactive Thread Starter

    Joined:
    2009/05/26
    Messages:
    62
    Likes Received:
    0
    Thank you for such a timely response. I will wait patiently for answer. I see a lot of programs that aren't installed on my computer, i.e. works, adware, avg or google toolbar, and if netframework is for multiple office like computers, I would never need this.
    Again, thank you so much for your help. It has been one month since I hve had this problem. No programs I tried showed any problems.
     
    sfp25143,
    #6
  8. 2009/05/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Couple of things...
    1. Can you post a link to your thread at WhatTheTech, so we don't have to go through the same steps twice?
    2. How much RAM is installed?
     
    broni,
    #7
  9. 2009/05/27
    sfp25143

    sfp25143 Inactive Thread Starter

    Joined:
    2009/05/26
    Messages:
    62
    Likes Received:
    0
    Link & Ram

    I know how to send links to another website, but not sure how to send my thread in what the tech. please send me info on how to do that.
    And where in my computer do I see how much ram I have? thank you
     
    sfp25143,
    #8
  10. 2009/05/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Go to your thread at WhatTheTech, copy the web page address from your browser address bar, and paste it here.
    As for RAM....hold Windows logo key, hit Pause/Break key.
     
    broni,
    #9
  11. 2009/05/27
    sfp25143

    sfp25143 Inactive Thread Starter

    Joined:
    2009/05/26
    Messages:
    62
    Likes Received:
    0
    sfp25143,
    #10
  12. 2009/05/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Thank you :)
    You definitely need to get more RAM. XP with 256MB of RAM will be always sluggish.

    Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.
     
    broni,
    #11
  13. 2009/05/28
    sfp25143

    sfp25143 Inactive Thread Starter

    Joined:
    2009/05/26
    Messages:
    62
    Likes Received:
    0
    Went to link to see how to disable anitvirus, etc. But could not find Malbytes'Anti-malware listed. when bringing it up it says it is running. search via tabbing and could not find a way to disable it.
    will wait for reply before downloading combo. thanks
    severe weather here and is causing delay in responding, sorry...
     
    sfp25143,
    #12
  14. 2009/05/28
    sfp25143

    sfp25143 Inactive Thread Starter

    Joined:
    2009/05/26
    Messages:
    62
    Likes Received:
    0
    never mind, I uninstalled Malware'AntiMalware program.
    will now do what you asked with combo. sorry...
     
    sfp25143,
    #13
  15. 2009/05/28
    sfp25143

    sfp25143 Inactive Thread Starter

    Joined:
    2009/05/26
    Messages:
    62
    Likes Received:
    0
    Combo

    ComboFix 09-05-26.05 - Shirley 05/28/2009 4:34.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.255.127 [GMT -4:00]
    Running from: c:\documents and settings\Shirley\Desktop\ComboFix.exe
    AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\program files\INSTALL.LOG
    c:\windows\patch.exe

    .
    ((((((((((((((((((((((((( Files Created from 2009-04-28 to 2009-05-28 )))))))))))))))))))))))))))))))
    .

    2009-05-27 10:23 . 2009-05-06 18:06 4784464 ----a-w c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{59ED5624-3B35-48F4-91EC-B5F5B5AE0BDA}\mpengine.dll
    2009-05-27 09:47 . 2009-05-27 09:47 -------- d-----w c:\program files\Common Files\Windows Live
    2009-05-27 09:41 . 2009-05-27 09:41 -------- d-sh--w c:\documents and settings\Shirley\PrivacIE
    2009-05-27 09:37 . 2009-05-27 09:37 -------- d-sh--w c:\documents and settings\Shirley\IETldCache
    2009-05-27 09:36 . 2009-05-27 09:36 -------- d-sh--w c:\documents and settings\LocalService\IETldCache
    2009-05-27 09:28 . 2009-05-27 10:37 -------- d-----w c:\windows\ie8updates
    2009-05-27 09:22 . 2009-02-20 08:10 81920 ----a-w c:\windows\system32\ieencode.dll
    2009-05-27 09:22 . 2009-02-20 08:10 81920 ----a-w c:\windows\system32\dllcache\ieencode.dll
    2009-05-27 09:17 . 2009-05-12 05:11 102912 -c----w c:\windows\system32\dllcache\iecompat.dll
    2009-05-26 09:19 . 2009-05-26 09:19 -------- d-----w c:\windows\system32\Adobe
    2009-05-26 06:25 . 2009-05-26 06:25 -------- d-----w c:\program files\Trend Micro
    2009-05-22 06:18 . 2009-05-22 08:24 -------- d-----w c:\program files\Notepad++
    2009-05-22 06:18 . 2009-05-22 06:19 -------- d-----w c:\documents and settings\Shirley\Application Data\Notepad++
    2009-05-18 16:49 . 2009-05-10 22:59 2051864 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
    2009-05-18 16:49 . 2009-05-10 22:59 424472 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgwdwsc.dll
    2009-05-18 16:49 . 2009-05-10 22:59 177432 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgmail.dll
    2009-05-18 16:49 . 2009-05-10 22:58 312088 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avglngx.dll
    2009-05-18 16:49 . 2009-05-10 22:59 486168 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgrsx.exe
    2009-05-18 16:47 . 2009-05-10 22:59 755992 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avginet.dll
    2009-05-18 16:47 . 2009-05-10 22:59 1437464 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.dll
    2009-05-18 07:36 . 2009-05-18 07:36 -------- d-----w c:\documents and settings\Shirley\Application Data\Malwarebytes
    2009-05-18 07:36 . 2009-05-18 07:36 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-05-16 10:09 . 2009-05-16 10:09 -------- d-----w c:\documents and settings\Shirley\Application Data\WinPatrol
    2009-05-16 10:09 . 2004-01-14 00:30 55 ----a-w c:\documents and settings\Shirley\Application Data\WinPatrol\Autoexec.bat
    2009-05-16 10:09 . 2003-12-30 07:01 0 ----a-w c:\documents and settings\Shirley\Application Data\WinPatrol\Config.sys
    2009-05-16 10:08 . 2009-05-16 10:08 -------- d-----w c:\program files\BillP Studios
    2009-05-16 06:02 . 2009-05-16 06:41 -------- d-----w c:\program files\Remove-it
    2009-05-14 07:26 . 2009-05-10 22:59 2302232 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avguiadv.dll
    2009-05-14 07:26 . 2009-05-10 22:59 3399960 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgui.exe
    2009-05-10 22:59 . 2009-05-10 22:59 11952 ----a-w c:\windows\system32\avgrsstx.dll
    2009-05-10 22:59 . 2009-05-10 22:59 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
    2009-05-10 22:59 . 2009-05-10 22:59 325896 ----a-w c:\windows\system32\drivers\avgldx86.sys
    2009-05-10 22:59 . 2009-05-10 22:59 27784 ----a-w c:\windows\system32\drivers\avgmfx86.sys
    2009-05-10 22:59 . 2009-05-27 22:39 -------- d-----w c:\windows\system32\drivers\Avg
    2009-05-10 22:59 . 2009-05-16 02:36 -------- d-----w c:\documents and settings\Shirley\Application Data\AVGTOOLBAR
    2009-05-10 04:34 . 2009-05-28 08:27 -------- d-----w c:\program files\Windows Live Safety Center
    2009-05-10 03:59 . 2009-05-10 04:02 152576 ----a-w c:\documents and settings\Shirley\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
    2009-05-10 03:52 . 2009-05-10 06:41 -------- d-----w c:\documents and settings\All Users\Application Data\PCPitstop
    2009-05-08 07:46 . 2009-03-06 14:22 284160 -c----w c:\windows\system32\dllcache\pdh.dll
    2009-05-08 07:46 . 2009-02-09 12:10 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
    2009-05-08 07:46 . 2009-02-09 12:10 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
    2009-05-08 07:46 . 2009-02-09 12:10 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
    2009-05-08 07:46 . 2009-02-06 11:11 110592 -c----w c:\windows\system32\dllcache\services.exe
    2009-05-08 07:46 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
    2009-05-08 07:46 . 2009-02-09 12:10 729088 -c----w c:\windows\system32\dllcache\lsasrv.dll
    2009-05-08 07:46 . 2009-02-09 12:10 714752 -c----w c:\windows\system32\dllcache\ntdll.dll
    2009-05-08 07:46 . 2009-02-09 12:10 617472 -c----w c:\windows\system32\dllcache\advapi32.dll
    2009-05-08 07:46 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
    2009-05-08 07:46 . 2008-04-21 12:08 215552 -c----w c:\windows\system32\dllcache\wordpad.exe
    2009-05-08 05:07 . 2009-05-08 05:07 -------- d-----w c:\documents and settings\Shirley\Application Data\AVG8
    2009-05-01 18:30 . 2009-05-01 18:30 3366912 ----a-w c:\windows\system32\GPhotos.scr

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-05-22 06:11 . 2004-11-15 21:16 1492723 ----a-w c:\windows\java\Packages\6AF1BXFN.ZIP
    2009-05-22 02:46 . 2004-08-25 17:44 69120 ----a-w c:\windows\system32\notepad.exe
    2009-05-22 02:46 . 2004-08-25 17:44 69120 ----a-w c:\windows\notepad.exe
    2009-05-15 09:07 . 2007-01-11 17:08 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
    2009-05-14 06:50 . 2003-12-31 22:34 -------- d-----w c:\program files\Lavasoft
    2009-05-14 06:50 . 2007-10-10 21:36 -------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
    2009-05-11 01:13 . 2006-02-23 18:28 -------- d-----w c:\program files\PCPitstop
    2009-05-10 22:58 . 2008-08-25 23:14 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
    2009-05-10 04:04 . 2004-11-18 08:21 -------- d-----w c:\program files\Java
    2009-04-14 00:39 . 2008-11-13 18:06 4656976 ----a-w c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
    2009-03-09 09:19 . 2009-01-17 12:50 410984 ----a-w c:\windows\system32\deploytk.dll
    2009-03-06 14:22 . 2004-08-25 17:44 284160 ----a-w c:\windows\system32\pdh.dll
    2004-08-04 07:56 . 2004-12-25 20:41 73728 -csha-w c:\windows\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\wmplayer.exe
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "msnmsgr "= "c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
    "ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2003-10-06 5058560]
    "AVG8_TRAY "= "c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-10 1947928]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
    2009-05-10 22:59 11952 ----a-w c:\windows\system32\avgrsstx.dll

    HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
    "wave "= serwvdrv.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
    @= "Service "

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
    backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
    backup=c:\windows\pss\Microsoft Works Calendar Reminders.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
    backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gcasServ
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LifeScape Media Detector
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tgcmd

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "aawservice "=2 (0x2)

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
    "msnmsgr "= "c:\program files\MSN Messenger\msnmsgr.exe" /background
    "ErrorFix "=c:\program files\ErrorFix\ErrorFix.exe -boot

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe "
    "Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe "

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall "= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "c:\\WINDOWS\\system32\\sessmgr.exe "=
    "c:\\unzipped\\HFO26\\HFO26.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "%windir%\\system32\\sessmgr.exe "=
    "c:\\Program Files\\MSN Messenger\\msnmsgr.exe "=
    "c:\\Program Files\\MSN Messenger\\livecall.exe "=
    "c:\\Program Files\\AVG\\AVG8\\avgemc.exe "=
    "c:\\Program Files\\AVG\\AVG8\\avgupd.exe "=
    "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe "=
    "c:\\Program Files\\Java\\jre6\\bin\\java.exe "=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "6900:TCP "= 6900:TCP:HFOv26

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [5/10/2009 6:59 PM 325896]
    R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [5/10/2009 6:59 PM 108552]
    R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [5/10/2009 6:59 PM 908568]
    R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [5/10/2009 6:59 PM 298776]
    R2 SocketLock;Raw Socket Lock Driver;c:\windows\system32\socketlock.sys [1/24/2004 8:19 PM 3712]
    R2 WUSB54GSC;WUSB54GSC;c:\program files\Linksys\WUSB54GSC\WLService.exe [2/8/2008 7:40 PM 53307]
    R3 tbcspud;Santa Cruz Driver;c:\windows\system32\drivers\tbcspud.sys [12/28/2005 1:07 AM 144768]
    R3 tbcwdm;Santa Cruz WDM Driver;c:\windows\system32\drivers\tbcwdm.sys [12/28/2005 1:07 AM 545088]
    S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 8:19 PM 13592]
    S3 vtdg46xx;vtdg46xx;c:\progra~1\TURTLE~1\SANTAC~1\CONTRO~1\vtdg46xx.sys [12/28/2005 1:08 AM 19232]

    --- Other Services/Drivers In Memory ---

    *NewlyCreated* - GTNDIS5
    .
    Contents of the 'Scheduled Tasks' folder
    .
    - - - - ORPHANS REMOVED - - - -

    SafeBoot-procexp90.Sys


    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    uDefault_Search_URL = hxxp://www.google.com/ie
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    Trusted Zone: facebook.com\www
    Trusted Zone: kmart.com
    Trusted Zone: kmart.com\www
    Trusted Zone: kohls.com\www
    Trusted Zone: sears.com\www
    DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
    DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-05-28 04:36
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\S-1-5-21-1606980848-2111687655-725345543-1004\Software\Microsoft\SystemCertificates\AddressBook*]
    @Allowed: (Read) (RestrictedCode)
    @Allowed: (Read) (RestrictedCode)
    .
    Completion time: 2009-05-28 4:39
    ComboFix-quarantined-files.txt 2009-05-28 08:38

    Pre-Run: 21,275,267,072 bytes free
    Post-Run: 21,381,996,544 bytes free

    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

    199
     
    sfp25143,
    #14
  16. 2009/05/28
    sfp25143

    sfp25143 Inactive Thread Starter

    Joined:
    2009/05/26
    Messages:
    62
    Likes Received:
    0
    Hjt

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 5:05:40 AM, on 5/28/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\Program Files\AVG\AVG8\avgcsrvx.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Linksys\WUSB54GSC\WLService.exe
    C:\Program Files\Linksys\WUSB54GSC\WUSB54GSC.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\Program Files\AVG\AVG8\avgcsrvx.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\notepad.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Outlook Express\msimn.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://www.facebook.com
    O15 - Trusted Zone: www.kmart.com
    O15 - Trusted Zone: http://*.kmart.com
    O15 - Trusted Zone: http://www.kohls.com
    O15 - Trusted Zone: www.sears.com
    O15 - Trusted Zone: http://www.sears.com
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1243419511890
    O16 - DPF: {95B5D20C-BD31-4489-8ABF-F8C8BE748463} (MSN Games "“ Hearts) - http://zone.msn.com/bingame/zpagames/zpa_hrtz.cab99160.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZPAFramework.cab102118.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
    O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: WUSB54GSC - GEMTEKS - C:\Program Files\Linksys\WUSB54GSC\WLService.exe

    --
    End of file - 5307 bytes
     
    sfp25143,
    #15
  17. 2009/05/28
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Malware-wise, all look clean.
    You have just 3 startups, very limited number of services are running, so this is not the issue, either.

    From Combofix log, I can see, you had ErrorFix program installed at some point, and if you played with it, it was very bad idea, because some system files could have gotten messed up.

    256MB of RAM is definitely part of the problem.
    AVG running on a computer with low RAM can be another problem.

    For now...
    1. Uninstall Combofix:

    Go Start > Run
    Type in:
    combofix /u
    Note the space between the "combofix" and the "/u "
    Restart computer.

    2. Download ATF Cleaner by Atribune.

    Double-click ATF-Cleaner.exe to run the program.
    Under Main choose: Select All
    Unselect Cookies.
    Click the Empty Selected button.

    If you use Firefox browser
    Click Firefox at the top and choose: Select All
    NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    Unselect Cookies.
    Click the Empty Selected button.

    If you use Opera browser
    Click Opera at the top and choose: Select All
    NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    Unselect Cookies.
    Click the Empty Selected button.

    Click Exit on the Main menu to close the program.

    3. Download, and install SpeedFan: http://www.almico.com/sfdownload.php
    Post your computer temperatures:

    [​IMG]

    4. Go Start>Run ( "Start Search" in Vista), type in:
    sfc /scannow
    Click OK (hold CTRL, and SHIFT, hit Enter in Vista).
    Have Windows CD/DVD handy.
    If System File Checker (sfc) will find any errors, it may ask you for the CD/DVD (rarely in Vista case).
    If sfc won't find any errors in Windows XP, it'll simply quit, without any message.
     
    broni,
    #16
  18. 2009/05/28
    sfp25143

    sfp25143 Inactive Thread Starter

    Joined:
    2009/05/26
    Messages:
    62
    Likes Received:
    0
    went to the post your temp website. don't know how to get it to here. it shows that info.
    Also, went to sfc and it keeps asking for CD. I fought with Dell over not having delivered one with this pc. They said I did not need one but do not remember why. I do have the reinstall CD with sp1 and cd with sp2. But dialog says wrong ones. It says they have to check to see if my programs are all there and in proper place. Well, I know there is a lot missing. i.e. Works and other items that shows in program files. Any thing I can do now?
    and will send the temps with info on how to. Thxs...
     
    sfp25143,
    #17
  19. 2009/05/28
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    3. Look at my image of SpeedFan. Simply write down temps indicated in red rectangle, and post the info in your next reply.

    As for sfc...
    Since it asks for CD, that means some system files ARE corrupted.
    Reinstall CD won't do.
    Three options regarding Windows CD:
    - call Dell, and insist on getting one; there is a good chance, they'll send you one for free
    - buy one
    - borrow one
     
    broni,
    #18
  20. 2009/05/28
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Did you complete 1, and 2?
     
    broni,
    #19
  21. 2009/05/28
    sfp25143

    sfp25143 Inactive Thread Starter

    Joined:
    2009/05/26
    Messages:
    62
    Likes Received:
    0
    yes, did 1 and 2.
    http://209.85.48.8/228/109/upload/p4151509.gif
    remembered...
    hope you can read it, so faint.
    went back to speedfan and could not get this info to come up again.
    Is there a way we can chat privately w/o members reading my post? Need to explain privately, about issues I have and how you can further help with my computer problems.
    And please tell me where to find hidden files check box to turn show off. Way back I was asked to show them for a scan and now can't remember where I did this. Thank you...
     
    sfp25143,
    #20
Page 1 of 6

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...