What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Infected PC

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi,

For some unknown reason, My XP SP3 PC takes over 10 mins to load my profile and then has no access to the internet.
I have other profiles on the PC and they take just as long.

Release Renew flushDNS has no effect nor has restarting the Modem or Resetting TCP/IP settings.
Please note that i Have a wireless Router. I connect to the PC wired. I connect wirelessly with my Laptop and am having no issues. I have never had any major issues before.

Checking my Eventvwr shows VSMON.exe Issues which is related to Zone alarm, but i am hesitant to unistall it.

If Task Manager is brought up, it will show a limited number if processes initially without entries in the Username, but then kickes in and seems normal.

I have run CCleaner Avira(Nothing found) and Malware Bytes. Cannot install Spybot as no access to the Internet.

I have managed to get a HJT Log as well as A Malware Bytes Log.

Please assist.

Thanks,

Lotus

********************************************************************************
**********

HJT LOG

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:22:02, on 15/03/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Apps\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Apps\Softex\OmniPass\OPXPApp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://format.packardbell.com/cgi-bin/redi…&key=SEARCH
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\uk.htm
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} - http://tdserver.bitstream.com/tdserver.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1228843724375
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E862C832-3A5F-4CEB-BFAA-167B22010A71} (InfosFinder2.InfosFinder) - http://support.packardbell.com/files/activ…nfosFinder2.CAB
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Softex Inc. - C:\Apps\Softex\OmniPass\Omniserv.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

–
End of file - 7464 bytes


*****************************************************

Malware Bytes Log.

Malwarebytes' Anti-Malware 1.34
Database version: 1749
Windows 5.1.2600 Service Pack 3

15/03/2009 12:04:21
mbam-log-2009-03-15 (12-04-21).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 182910
Time elapsed: 56 minute(s), 0 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3aa42713-5c1e-48e2-b432-d8bf420dd31d} (Rogue.Antivirus2008) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
Post #2
Hi lotus lion,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

Nothing showing. Let's get a couple different looks:

Download Rooter.exe to your desktop

  • Then doubleclick it to start the tool
  • A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt. Post that here


Please download DDS and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.scr to run the tool.
  • When done, DDS.txt will open.
  • Click Yes at the next prompt for Optional Scan.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.
Post #3
Hi Tomk, Thanks for having a look and apologies for the delay in getting back. ***************************** Contents of Rooter: ***************************** Microsoft Windows XP Home Edition (5.1.2600) Service Pack 3 C:\ [Fixed] - NTFS - (Total:30710 Mo/Free:3786 Mo) D:\ [Fixed] - NTFS - (Total:113914 Mo/Free:3302 Mo) E:\ [CD-Rom] (Total:0 Mo/Free:0 Mo) F:\ [Removable] (Total:3816 Mo/Free:3722 Mo) 22/03/2009| 8:17 ———————-\\ Processes.. –Locked– [System Process] ———- System ———- \SystemRoot\System32\smss.exe ———- \??\C:\WINDOWS\system32\csrss.exe ———- \??\C:\WINDOWS\system32\winlogon.exe ———- C:\WINDOWS\system32\services.exe ———- C:\WINDOWS\system32\lsass.exe ———- C:\WINDOWS\system32\svchost.exe ———- C:\WINDOWS\system32\svchost.exe ———- C:\WINDOWS\System32\svchost.exe ———- C:\WINDOWS\system32\svchost.exe ———- C:\WINDOWS\system32\svchost.exe ———- C:\WINDOWS\Explorer.EXE ———- C:\WINDOWS\system32\spoolsv.exe ———- C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe ———- C:\Program Files\AntiVir PersonalEdition Classic\sched.exe ———- C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe ———- c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe ———- c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe ———- C:\WINDOWS\system32\svchost.exe ———- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE ———- C:\WINDOWS\System32\svchost.exe ———- C:\WINDOWS\system32\nvsvc32.exe ———- C:\Apps\Softex\OmniPass\Omniserv.exe ———- C:\WINDOWS\System32\svchost.exe ———- C:\WINDOWS\system32\locator.exe ———- C:\Program Files\Spyware Terminator\sp_rsser.exe ———- C:\WINDOWS\system32\svchost.exe ———- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe ———- C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe ———- c:\APPS\Powercinema\Kernel\TV\CLSched.exe ———- C:\WINDOWS\system32\wuauclt.exe ———- C:\Apps\Softex\OmniPass\OPXPApp.exe ———- C:\WINDOWS\System32\alg.exe ———- C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe ———- C:\Program Files\QuickTime\qttask.exe ———- C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe ———- C:\WINDOWS\system32\ctfmon.exe ———- C:\WINDOWS\system32\ZoneLabs\vsmon.exe ———- C:\WINDOWS\system32\cmd.exe ———- C:\Rooter$\RK.exe ———————-\\ Search.. ———————-\\ ROOTKIT !! 1 - "C:\Rooter$\Rooter_1.txt" - 22/03/2009| 8:18 ———————-\\ Scan completed at 8:18 ***************************** Contents of DDS ***************************** DDS (Ver_09-03-16.01) - NTFSx86 Run by [removed] at 8:19:27.70 on 22/03/2009 Internet Explorer: 7.0.5730.11 Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1022.586 [GMT 0:00] AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Updated) AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Outdated) FW: ZoneAlarm Security Suite Firewall *disabled* ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe C:\WINDOWS\system32\svchost.exe -k hpdevmgmt C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\system32\nvsvc32.exe C:\Apps\Softex\OmniPass\Omniserv.exe C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\Program Files\Spyware Terminator\sp_rsser.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe c:\APPS\Powercinema\Kernel\TV\CLSched.exe C:\Apps\Softex\OmniPass\OPXPApp.exe C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe D:\Documents and Settings\Kamaldeep\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com/ uWindow Title = Packard Bell uSearch Bar = hxxp://format.packardbell.com/cgi-bin/redirect/?country=UK&range=AD&phase=6&key=SEARCH BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll BHO: ZoneAlarm Spy Blocker BHO: {f0d4b231-da4b-4daf-81e4-dfee4931a4aa} - c:\program files\zonealarmsb\bar\1.bin\SPYBLOCK.DLL BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll TB: ZoneAlarm Spy Blocker: {f0d4b239-da4b-4daf-81e4-dfee4931a4aa} - c:\program files\zonealarmsb\bar\1.bin\SPYBLOCK.DLL TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File TB: {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - No File TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [avgnt] "c:\program files\antivir personaledition classic\avgnt.exe" /min mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe" dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} - hxxp://tdserver.bitstream.com/tdserver.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1228843724375 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: {E862C832-3A5F-4CEB-BFAA-167B22010A71} - hxxp://support.packardbell.com/files/activex/InfosFinder2.CAB Notify: OPXPGina - c:\apps\softex\omnipass\opxpgina.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ============= SERVICES / DRIVERS =============== R?2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service –> c:\windows\system32\zonelabs\vsmon.exe -service [?] R1 avgio;avgio;c:\program files\antivir personaledition classic\avgio.sys [2007-5-13 11840] R1 KLIF;KLIF;c:\windows\system32\drivers\klif.sys [2009-2-8 148496] R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2008-3-2 138752] R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2007-5-14 353680] R2 AntiVirScheduler;AntiVir PersonalEdition Classic Scheduler;c:\program files\antivir personaledition classic\sched.exe [2007-5-13 68865] R2 AntiVirService;AntiVir PersonalEdition Classic Guard;c:\program files\antivir personaledition classic\avguard.exe [2007-5-13 151297] R3 avgntflt;avgntflt;c:\program files\antivir personaledition classic\avgntflt.sys [2007-5-13 52032] S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [2008-2-17 16512] S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [2008-3-27 17149] S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [2007-7-28 517632] ============== File Associations =============== regfile=regedit.exe "%1" %* scrfile="%1" %* regfile\shell\edit\command=%SystemRoot%\system32\NOTEPAD.EXE %1 =============== Created Last 30 ================ 2009-03-22 08:17 –d—– C:\Rooter$ 2009-03-15 10:52 –d—– c:\program files\CCleaner ==================== Find3M ==================== 2009-03-22 08:19 247,554,080 a–sh— c:\windows\system32\drivers\fidbox.dat 2009-03-15 13:04 3,315,176 a–sh— c:\windows\system32\drivers\fidbox.idx 2009-02-26 07:27 4,212 a—h— c:\windows\system32\zllictbl.dat 2009-02-11 10:19 38,496 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-02-11 10:19 15,504 a——- c:\windows\system32\drivers\mbam.sys 2009-01-16 21:35 3,594,752 a——- c:\windows\system32\dllcache\mshtml.dll 2008-12-08 19:34 200,846 a——- c:\program files\RuntimeSetup.exe 2008-12-08 19:34 1,068 a——- c:\program files\runtimesetup.ini 2008-02-13 13:50 82 a——- d:\docume~1\alluse~1\applic~1\SUMQU0C1-FE20-APII-YE7M-BEDSDWMY5R6A.dat 2007-02-24 16:04 208 a——- d:\docume~1\kamald~1\applic~1\wklnhst.dat 2002-04-16 10:27 5 a–sh— c:\windows\system32\CdI5T.drv 2008-06-28 10:13 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008062820080629\index.dat ============= FINISH: 8:20:18.98 =============== ****************************************************** Please find attached the attach.txt from DDS also. ****************************************************** Thanks, Lotus

Attachments:

Post #4 last edited
lotus lion,

I'm not seeing the reason you can't connect to the internet. Try this:


We need to repair some of windows' internal registration settings
  • Please download Dial-A-Fix from one of the following mirrors:
  • Extract the zip file to your desktop.
  • Double click Dial-a-Fix.exe to start the program.
  • Press the green double checkmark box (Looks like this: [external image: Posted Image])
  • UNcheck "Empty Temp Folders", as well as "Adjust Time/Date" in the prep section.
  • Press the GO button in the bottom of the window.
  • Exit/Close Dial-A-Fix

If it still doesn't connect, then go into your internet options settings in the control panel, Connection Tab, Lan Settings and make sure "use Proxy server" is UNTICKED.

Let me know if you can connect now.
Post #5
Hi Tomk, Dial-A-Fix did not make a difference i am afraid, but is a good app none-the-less. I do not use a Proxy either, but double checked and can confirm that it is unticked. I have tried to start the PC without any network cables attached and it does not make a difference. Still takes ages to load a profile. If i connect the Network cable directly into the PC it still does not allow me to access the Internet, but the wireless Modem works perfectly. Whilst i can release an IP, I can not renew it. The Speed and Duplex is set to Auto Negotiate. Changing them to 100MB full/Half Duplex etc… make no difference either. I cannot access the PC in Safe mode either, It brings up loads of Lines… and then just hangs. I am beginning to think that the Hard-drive/OS is corrupted so am looking to schedule a disk check to see what happens. I may have a System Restore point somewhere if it will let me go that far, and will see if i can hold of updated NIC Drivers but am not too sure it will help. Any more ideas, please let me know. Thanks, Lotus
Post #7
lotus lion,

I apologize. I thought I posted additional instructions this morning. Apparently I didn't. :blush:

Download WinsockFix

http://downloads.subratam.org/WinsockFix.zip


1.) UnZip WinsockFix.zip (Pay close attention to where the file is extracted to.)
2.) Run WinsockFix.exe.
3.) Click the Fix button.


This program will clean up your TCP/IP connection and rebuild the database. After the program is complete please reboot

If that doesn't work, I have a whole series of questions for you:
  • When did these problems start? Did profiles suddenly take 10 minutes to load? As in, he shut it down thinking all was okay, and on next boot the problem (or all the problems above) appeared? Or did the load times slowly creep past 5, 7, and up to 10 minutes over a period of several days or longer?
  • What line does safe mode last display before it stops? That will be the last device/object to load properly and may provide a clue.
  • Once profiles load, is the computer's performance normal otherwise (except for Internet access and Task Manager population)?
  • Does the router's port LED show you're connected? If it has more than one Ethernet port, try a different one - they do go bad.
  • Can another computer gain Internet access via Ethernet?
Post #8 last edited
Hi Tomk,

I performed an error check (took over 3/4 of an hour) and i could login almost instantaneously and access my files. Unfortunately, no access to the Internet.

I rebooted and when i tried to login again, it took about 10 mins again :(

One thing to note is that when once i have logged in there is only the wallpaper on display, Windows blue sky with Green Hills.
I press ctrl + Alt + del and nothing will happen for about 3 mins perhaps but will then bring up the Task Manager with a limited number of processes.

I began killing them 1-by-1 and noticed that if i killed a particular svchost.exe it would let me get in 'straight away' so to speak. Nothing different about it compared to the other svchosts, similar amount of Memory being taken up.

Once in though, it will not let me access the files nor access to the Internet and just says that it is not responding in task manager. I have to kill explorer.exe and start it up again. sometimes it works, sometimes not.

The only way to access the files (which have now been transfered) is to do another error check, which is quicker now, about 20-30 mins, but not an ideal way to get into the PC.

I also have spyware terminator installed previously, perhaps not up-to-date, and it found nothing unfortunately.

I have run Winsockfix and it did not work i am afraid. the number of packets being sent an recieved are pretty small <200 if that.

<<1)When did these problems start? Did profiles suddenly take 10 minutes to load? As in, he shut it down thinking all was okay, and on next boot the problem (or all the problems above) appeared? Or did the load times slowly creep past 5, 7, and up to 10 minutes over a period of several days or longer?>>

The problem started about 2 weeks ago, only i install software on it, and do my best to be as careful as i can. Keep Window Update up-to-date, as well as Zone Alarm and AntiVirus. Nothing has been installed lately, perhaps some accounting software about a 2 months ago if that.
It happened instantanously, only difference now is that i have to error check to get into the files, but was not like that initially.

<<2) What line does safe mode last display before it stops? That will be the last device/object to load properly and may provide a clue.?>>

Multi(0)disk(0)rdisk(0)partition(2)\windows\system32\drivers\agpcpq.sys

Funnilly enough, i was called away for about 10 mins and once i was i came back it had loaded in safe mode. I could access my files, but not the internet.

<<3) Once profiles load, is the computer's performance normal otherwise (except for Internet access and Task Manager population)?>>

If no error check is performed, then Task Manager is lowly populated, no access to files or the internet.
If an error check is performed, then Task Manager is fully populated, I have access to the files, but no Internet.

<<4) Does the router's port LED show you're connected? If it has more than one Ethernet port, try a different one - they do go bad.
Can another computer gain Internet access via Ethernet?>>

Yes the router does. I have tried another network port as well as another netowork cable without joy. attaching the network cable that comes out of the modem makes no difference either.

Thanks for all of your help and patience, much appreciated,

Lotus
Post #9
lotus lion,

You have two anti-virus programs running. Avira AntiVir and ZoneAlarm Security Suite Antivirus . Please uninstall one of them.

There is some chance that your Zone Alarm firewall is blocking access. Please uninstall it, then be sure to turn your windows firewall on.

After you've got the windows firewall working, try to connect to the internet.

Let me know how it goes.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI