What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Windows Vista Internet/Desktop Help

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hi, I'm new here and I'm using a Windows Vista. When I try to start IE, DEP won't let it start. When I'm on Safari and I click on a Google search result, the URL redirects. My desktop themes change to Classic and refuse to change back (I have gone on My Computer/Advanced Settings). Also, my icons on the desktop sometimes go away, and my Instant Messenger settings reset to as if was newly installed.

*Edit: Also, sometimes when I run Internet Explorer, my computer goes to a blue Error screen and shuts down/restarts.

Here is my DDS:



DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 18:22:09.13 on 05/28/2010 Fri
Internet Explorer: 8.0.6001.18904
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.949.82.1033.18.958.264 [GMT -7:00]

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\Dwm.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\system32\AERTSrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Safari\Safari.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Safari\Safari.exe
C:\Program Files\Safari\Safari.exe
C:\Users\Jay\AppData\Local\Temp\93ntrsb2.tmp\HiJackThis.exe
C:\Windows\system32\DllHost.exe
C:\Users\Jay\Desktop\dds.scr
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uSearch Page =
uSearch Bar = Preserve
uWindow Title = Internet Explorer provided by Dell
uStart Page = hxxp://www.google.com/
uDefault_Page_URL = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=2070828
mDefault_Page_URL = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=2070828
uInternet Settings,ProxyOverride = localhost;*.local
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
uRun: [charress] rundll32 "c:\users\jay\appdata\local\temp\dnscPlay.dll",DllEntryPoint
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [fullmusic_info] c:\program files\fullmusicp\fullmusic_info.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

============= SERVICES / DRIVERS ===============

R0 amacpi;Microsoft Away Mode System;c:\windows\system32\drivers\null.sys [2009-10-21 4608]
R2 AERTFilters;Andrea RT Filters Service;c:\windows\system32\AERTSrv.exe [2007-12-5 77824]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-10 135664]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2009-10-21 21504]
S3 U1expskpn_3.0;U1expskpn_3.0; [x]
S4 nvrd32;NVIDIA nForce RAID Driver;c:\windows\system32\drivers\nvrd32.sys [2007-8-27 129832]

=============== Created Last 30 ================

2010-05-28 15:16 173,603,570 a——- c:\windows\MEMORY.DMP
2010-05-27 21:18 12 a——- c:\users\jay\appdata\roaming\bpzmnq.dat
2010-05-24 15:13 –d—– C:\acccore
2010-05-23 12:59 –d—– c:\program files\Steam
2010-05-11 15:53 738,816 a——- c:\windows\system32\inetcomm.dll

==================== Find3M ====================

2010-05-21 14:14 221,568 ——– c:\windows\system32\MpSigStub.exe
2010-05-19 18:54 2,414 a——- c:\users\jay\appdata\roaming\wklnhst.dat
2010-04-08 23:58 65,536 a——- c:\windows\IFinst27.exe
2010-04-08 15:19 73,216 a——- c:\windows\ST6UNST.EXE
2010-04-08 15:19 286,720 ——– c:\windows\Setup1.exe
2010-04-08 13:20 107,808 a——- c:\windows\system32\dns-sd.exe
2010-04-08 13:20 91,424 a——- c:\windows\system32\dnssd.dll
2010-04-02 20:24 143,360 a——- c:\windows\inf\infstrng.dat
2010-04-02 20:24 86,016 a——- c:\windows\inf\infstor.dat
2010-04-02 20:24 51,200 a——- c:\windows\inf\infpub.dat
2010-03-20 20:55 81,920 ——– c:\windows\bwUnin-6.1.4.68-8876480L.exe
2010-03-05 07:01 420,352 a——- c:\windows\system32\vbscript.dll
2010-02-08 01:23 68 a——- c:\users\jay\appdata\roaming\wp4.dat
2010-02-08 01:23 2 a——- c:\users\jay\appdata\roaming\wp3.dat
2010-02-07 23:26 36 a——- c:\users\jay\appdata\roaming\skynet.dat
2009-11-17 15:23 665,600 a——- c:\windows\inf\drvindex.dat
2009-10-24 09:03 174 a–sh— c:\program files\desktop.ini
2009-10-12 17:08 56 a—h— c:\programdata\ezsidmv.dat
2009-10-12 17:08 56 a—h— c:\progra~2\ezsidmv.dat
2006-11-02 05:42 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 05:42 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 05:42 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 05:42 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 02:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 02:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 02:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 02:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat
2009-10-21 16:46 245,760 a–sh— c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat
2007-08-27 22:51 8,192 a–sh— c:\windows\users\default\NTUSER.DAT

============= FINISH: 18:23:50.64 ===============



I have attached the second logfile as directed in the help topic.
Also, here is my HiJackThis logfile I ran minutes earlier:



Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 6:03:57 PM, on 5/28/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18904)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Safari\Safari.exe
C:\Program Files\Safari\Safari.exe
C:\Program Files\Safari\Safari.exe
C:\Users\Jay\AppData\Local\Temp\93ntrsb2.tmp\HiJackThis.exe
C:\Users\Jay\Desktop\HiJackThis.exe

O1 - Hosts: ::1 localhost
O1 - Hosts: 174.142.113.204 defender-for-pc.info
O1 - Hosts: 70.38.11.165 reviews.toptenreviews.com
O1 - Hosts: 70.38.11.165 reviews.reevoo.com
O1 - Hosts: 70.38.11.165 av2010pro.com
O1 - Hosts: 70.38.11.165 review.deutsch.eazel.com
O1 - Hosts: 70.38.11.165 reviews.download.softwareload.de
O1 - Hosts: 70.38.11.165 r1.downloads.phpnuke.org
O1 - Hosts: 70.38.11.165 www.anti.actebis.com
O1 - Hosts: 70.38.11.165 www.antivirus-review.channelpartner.de
O1 - Hosts: 70.38.11.165 www.reviews.chip.de
O1 - Hosts: 70.38.11.165 www.dah5.ppks.net
O1 - Hosts: 70.38.11.165 www.test-reviews.softguide.de
O1 - Hosts: 70.38.11.165 www.review.virenschutz.ch
O1 - Hosts: 70.38.11.165 www.reviews.wave-computer.de
O1 - Hosts: 70.38.11.165 www.about.zdnet.de
O1 - Hosts: 70.38.11.165 www.soft-review.zdnet1.de
O1 - Hosts: 70.38.11.165 reviews.livix.blogspot.com
O1 - Hosts: 70.38.11.165 www.review-antivirus.alegsa.com.ar
O1 - Hosts: 70.38.11.165 www.ra1.analisis-antivirus.com
O1 - Hosts: 70.38.11.165 www.review.antivirusgratis.com.ar
O1 - Hosts: 70.38.11.165 www.soft-review.directoriowarez.com
O1 - Hosts: 70.38.11.165 www.arbest.grupogeek.com
O1 - Hosts: 70.38.11.165 www.best-reviews.pcasalvo.com
O1 - Hosts: 70.38.11.165 www.testing-av.pcdecasa.net
O1 - Hosts: 70.38.11.165 www.rz-x.wei.cl
O1 - Hosts: 70.38.11.165 www.review.yoreparo.com
O1 - Hosts: 70.38.11.165 reviews.coprocessing.be
O1 - Hosts: 70.38.11.165 lab.descary.com
O1 - Hosts: 70.38.11.165 review.fr.brothersoft.com
O1 - Hosts: 70.38.11.165 www.antilab-review.01net.com
O1 - Hosts: 70.38.11.165 www.review-lab.blogeek.ch
O1 - Hosts: 70.38.11.165 www.gr1.clubic.com
O1 - Hosts: 70.38.11.165 www.laboratory.commentcamarche.net
O1 - Hosts: 70.38.11.165 www.review.generation-nt.com
O1 - Hosts: 70.38.11.165 www.top-rev.host.fr
O1 - Hosts: 70.38.11.165 www.expert.infos-du-net.com
O1 - Hosts: 70.38.11.165 www.review.numerama.com
O1 - Hosts: 70.38.11.165 www.lab1-r.starzik.com
O1 - Hosts: 70.38.11.165 review-tests.italian.ircfast.com
O1 - Hosts: 70.38.11.165 www.labs.b2b24.ilsole24ore.com
O1 - Hosts: 70.38.11.165 www.ref1.blogslab.net
O1 - Hosts: 70.38.11.165 www.review.dvdprice.it
O1 - Hosts: 70.38.11.165 www.reviews.ebizitalia.it
O1 - Hosts: 70.38.11.165 www.review-software.hwgadget.com
O1 - Hosts: 70.38.11.165 www.exp-test.hwupgrade.it
O1 - Hosts: 70.38.11.165 www.full-reiew.lolasoft.it
O1 - Hosts: 70.38.11.165 www.dkl23.mondotechblog.com
O1 - Hosts: 70.38.11.165 www.antiviruses.sicurezzainrete.com
O1 - Hosts: 70.38.11.165 www.top.tomshw.it
O1 - Hosts: 70.38.11.165 avangate.com
O1 - Hosts: 70.38.11.165 regnow.com
O1 - Hosts: 70.38.11.165 shareit.com
O1 - Hosts: 70.38.11.165 eSellerate.net
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [fullmusic_info] C:\Program Files\FullMusicP\fullmusic_info.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [charress] rundll32 "C:\Users\Jay\AppData\Local\Temp\dnscPlay.dll",DllEntryPoint
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Andrea RT Filters Service (AERTFilters) - Andrea Electronics Corporation - C:\Windows\system32\AERTSrv.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 7262 bytes



Thank you in advance.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI