What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] "55 critical system errors" popup...

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hello,

I am trying to help my mother-in-law clean up her computer. There is so much junk on there I don't even know where to start. I did run the ATF Cleaner and Spybot Programs before running HijackThis. The computer runs really slow and when it is online it just crawls at a painfully slow speed. :pullhair: Here is a baseline HijackThis Log. Thanks

P.S. AVG is usually running on thecomputer, but it was not working properly (which explains why its not showing in the hjt log), so I had to reinstall.

P.S.S. When I went to check the firewall settings in windows, I was unable to access. There was a message saying that that service was not available.

Logfile of HijackThis v1.99.1
Scan saved at 8:05:04 PM, on 4/1/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\System32\CTHELPER.EXE
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us7.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wunderground.com/cgi-bin/findwe…ast?query=39648
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us7.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us7.hpwis.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Freedom Popup Killer - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Zero Knowledge\Freedom\pkR.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Freedom BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\Zero Knowledge\Freedom\FreeBHOR.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O4 - HKLM\..\Run: [BlockTracker] c:\hp\bin\BlockTracker.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [AutoTBar] C:\hp\bin\autotbar.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded
O4 - HKLM\..\Run: [BCNT] C:\PROGRA~1\AWS\WEATHE~1\BCNT.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [Zero Knowledge Freedom] C:\Program Files\Zero Knowledge\Freedom\AutoStarterR.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: officejet 6100.lnk = ?
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{636C9EED-136E-4ABE-9FBC-ECFC341E31BF}: NameServer = 208.137.128.8 208.137.128.6
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
Post #2
Hello

Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner and click Accept

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
    Extended (if available otherwise Standard)
    • Scan Options:
    Scan Archives
    Scan Mail Bases
  • Click OK
  • Now under select a target to scan:Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
    • Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post.


Please download Deckard's System Scanner (DSS) and save it to your Desktop.
  • Close all other windows before proceeding.
  • Double-click on dss.exe and follow the prompts.
  • If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
  • When it has finished, dss will open two Notepads main.txt and extra.txt – please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.
Post #3
Hello, and thank you for your reply. Here is the Kaspersky Log: ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Thursday, April 10, 2008 5:46:57 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 1 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 10/04/2008 Kaspersky Anti-Virus database records: 696282 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ Scan Statistics: Total number of scanned objects: 89154 Number of viruses found: 4 Number of infected objects: 7 Number of suspicious objects: 0 Duration of the scan process: 01:18:15 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\AVG7\Log\emc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped C:\Program Files\MyWebSearchWB\bar\1.bin\NPMYSRWB.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.i skipped C:\Program Files\MyWebSearchWB\bar\1.bin\W6PLUGIN.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.l skipped C:\Program Files\Screensavers.com\SSSInstaller\bin\screensavers.exe Infected: not-a-virus:AdWare.Win32.Comet.bl skipped C:\Program Files\Screensavers.com\SSSInstaller\bin\sinstaller3.exe/data0002 Infected: not-a-virus:AdWare.Win32.Comet.bl skipped C:\Program Files\Screensavers.com\SSSInstaller\bin\sinstaller3.exe NSIS: infected - 1 skipped C:\Program Files\Screensavers.com\SSSInstaller\bin\SSSInstaller.dll Infected: not-a-virus:AdWare.Win32.Comet.bl skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP10\change.log Object is locked skipped C:\System Volume Information\_restore{6CD01810-EFB9-4AF0-A405-DE07EB8CD51D}\RP8\A0000591.EXE Infected: not-a-virus:AdWare.Win32.WeatherBug.a skipped C:\WINDOWS\$NtUninstallKB824141$\user32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB824141$\win32k.sys Object is locked skipped C:\WINDOWS\$NtUninstallKB828035$\msgsvc.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828035$\wkssvc.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\catsrv.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\catsrvut.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\clbcatex.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\clbcatq.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\colbact.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\comadmin.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\comrepl.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\comsvcs.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\comuid.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\es.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\migregdb.exe Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\msdtcprx.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\msdtctm.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\msdtcuiu.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\mtxclu.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\mtxoci.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\ole32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\rpcrt4.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\rpcss.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB828741$\txflog.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\callcont.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\gdi32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\h323.tsp Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\h323msp.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\ipnathlp.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\lsasrv.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\mf3216.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\msasn1.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\msgina.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\mst120.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\nmcom.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\rtcdll.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB835732$\schannel.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\dao360.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\expsrv.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msexch40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msexcl40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msjet40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msjetol1.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msjetoledb40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msjint40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msjter40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msjtes40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msltus40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\mspbde40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msrd2x40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msrd3x40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msrepl40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\mstext40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\mswdat10.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\mswstr10.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\msxbde40.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB837001$\vbajet32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB839645$\fldrclnr.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB839645$\shell32.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB839645$\shlwapi.dll Object is locked skipped C:\WINDOWS\$NtUninstallKB839645$\sxs.dll Object is locked skipped C:\WINDOWS\$NtUninstallQ828026$\msdxm.ocx Object is locked skipped C:\WINDOWS\$NtUninstallQ828026$\wmpcore.dll Object is locked skipped C:\WINDOWS\Debug\oakley.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. ************************************************************** ************************************************************** I tried 4 times to run Deckard's System Scanner. Each time it would appear to be almost finished, then I would get an error message: dss.exe has encountered a problem and needs to close. We are sorry for the inconvenience. Thanks…Will be awaiting further instructions.
Post #4
Do this then

Download OTScanIt.exe to your Desktop and double-click on it to extract the files. It will create a folder named OTScanIt on your desktop.
  • Open the OTScanIt folder and double-click on OTScanIt.exe to start the program.
  • Under Additional Scans check the boxes beside Reg - App Paths, Reg - Bot Check, Reg - Desktop Components, Reg - Disabled MS Config Items, Reg - File Additional Folder Scans, File - Lop Check, and File - Purity Scan.
  • Under Drivers change it to Non-Microsoft.
  • Check the box beside Scan All User Accounts at the top
  • Under Files Created Within and Files Modified Within change it to 90 days.
  • Now click the Run Scan button on the toolbar.
  • When the scan is complete Notepad will open with the report file loaded in it.
  • Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.
Use the Add Reply button and post the information back here in an attachment. I will review it when it comes in. The last line is < End of Report >, so make sure that is the last line in the attached report.


Make sure you attach the report in your reply. If it is too big to upload, then zip the text file and upload it that way
Post #7
Deckard's System Scanner v20071014.68
Run by [removed] on 2008-04-15 17:52:38
Computer is in Safe Mode.
——————————————————————————–

– System Restore ————————————————————–

Failed to create restore point; computer is in safe mode.


– Last 5 Restore Point(s) –
13: 2008-04-15 19:47:27 UTC - RP13 - System Checkpoint
12: 2008-04-12 01:07:30 UTC - RP12 - System Checkpoint
11: 2008-04-10 22:53:59 UTC - RP11 - Deckard's System Scanner Restore Point
10: 2008-04-10 19:42:07 UTC - RP10 - System Checkpoint
9: 2008-04-06 00:53:43 UTC - RP9 - System Checkpoint


– First Restore Point –
1: 2008-03-30 01:55:42 UTC - RP1 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.



– HijackThis (run as Owner.exe) ———————————————–

Unable to find log (file not found); running clone.
– HijackThis Clone ————————————————————


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-04-15 17:53:11
Platform: Windows XP Service Pack 1 (5.01.2600)
MSIE: Internet Explorer (6.00.2800.1106)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Owner\Desktop\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us7.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wunderground.com/cgi-bin/findwe…ast?query=39648
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us7.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us7.hpwis.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: My Web Search Bar BHO - {8EAB99C1-F9EC-4b64-A4BA-D9BCAE8779C2} - C:\Program Files\MyWebSearchWB\bar\1.bin\W6BAR.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\hp\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: WeatherBug Browser Bar - powered by MyWebSearch - {8EAB99C9-F9EC-4b64-A4BA-D9BCAE8779C2} - C:\Program Files\MyWebSearchWB\bar\1.bin\W6BAR.DLL
O4 - HKLM\..\Run: [BlockTracker] c:\hp\bin\BlockTracker.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [AutoTBar] C:\hp\bin\autotbar.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [SetDefaultMidi] MIDIDEF.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [PlayCenter2] "C:\Program Files\Creative\SBLive\PlayCenter2\MDEntry.EXE" "C:\Program Files\Creative\SBLive\PlayCenter2" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [SetDefaultMidi] MIDIDEF.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [PlayCenter2] "C:\Program Files\Creative\SBLive\PlayCenter2\MDEntry.EXE" "C:\Program Files\Creative\SBLive\PlayCenter2" (User 'Default user')
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: officejet 6100.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\Web\related.htm
O9 - Extra 'Tools' menuitem: @shdoclc.dll,-864 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\Web\related.htm
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/minibug/tr…Transporter.cab?
O16 - DPF: {33564D57-9980-0010-8000-00AA00389B71} () - http://download.microsoft.com/download/D/0…D0C/wmv9dmo.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSVCCDA.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe


–
End of file - 5737 bytes

– File Associations ———————————————————–

All associations okay.


– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————

R0 drvmcdb - c:\windows\system32\drivers\drvmcdb.sys
Post #8
Hello

Start OTScanIt. Copy/Paste the information in the quotebox below into the panel where it says "Paste fix here" and then click the Run Fix button.

[Kill Explorer]
[Unregister Dlls]
[Registry - Non-Microsoft Only]
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> AutoTBar -> %SystemDrive%\hp\bin\autotbar.exe [C:\hp\bin\autotbar.exe]
YN -> BlockTracker -> %SystemDrive%\hp\bin\BlockTracker.exe [c:\hp\bin\BlockTracker.exe]
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
YY -> {8EAB99C1-F9EC-4b64-A4BA-D9BCAE8779C2} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\MyWebSearchWB\bar\1.bin\W6BAR.DLL [My Web Search Bar BHO]
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar
YY -> {8EAB99C9-F9EC-4b64-A4BA-D9BCAE8779C2} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\MyWebSearchWB\bar\1.bin\W6BAR.DLL [WeatherBug Browser Bar - powered by MyWebSearch]
< Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\
YY -> {17A27031-71FC-11d4-815C-005004D0F1FA}:Exec -> %ProgramFiles%\MarketBrowser\lmt\MarketBrowser_Launch.xpy [MktBrowser]
YN -> {c95fe080-8f5d-11d2-a20b-00aa003c157a}: [HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or could not be opened. [@shdoclc.dll,-866]
< Internet Explorer Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\
YY -> CmdMapping\\{17A27031-71FC-11d4-815C-005004D0F1FA} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\MarketBrowser\lmt\MarketBrowser_Launch.xpy [MktBrowser]
YN -> CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} [HKEY_LOCAL_MACHINE] -> [@shdoclc.dll,-866]
YN -> CmdMapping\\{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} [HKEY_LOCAL_MACHINE] -> [Reg Error: Key does not exist or could not be opened.]
< Internet Explorer Extensions [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Extensions\
YY -> CmdMapping\\{17A27031-71FC-11d4-815C-005004D0F1FA} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\MarketBrowser\lmt\MarketBrowser_Launch.xpy [MktBrowser]
< Internet Explorer Extensions [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Extensions\
YY -> CmdMapping\\{17A27031-71FC-11d4-815C-005004D0F1FA} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\MarketBrowser\lmt\MarketBrowser_Launch.xpy [MktBrowser]
< Internet Explorer Extensions [HKEY_USERS\S-1-5-21-2908572736-99931356-3806881469-1003\] > -> HKEY_USERS\S-1-5-21-2908572736-99931356-3806881469-1003\Software\Microsoft\Internet Explorer\Extensions\
YY -> CmdMapping\\{17A27031-71FC-11d4-815C-005004D0F1FA} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\MarketBrowser\lmt\MarketBrowser_Launch.xpy [MktBrowser]
[Files/Folders - Created Within 90 days]
NY -> 1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp
[Empty Temp Folders]
[Start Explorer]
[Reboot]


The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here

I will review the information when it comes back in.



Then post a new DSS log
Post #9
Hi, Sorry it has taken so long…Ran OTS Fix…I'm still getting the same adware popup. Also, something is preventing me from activating windows firewall. Here is the text of the OTS Fix and another dss log. Thanks!

Explorer killed successfully
[Registry - Non-Microsoft Only]
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\AutoTBar deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\BlockTracker deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8EAB99C1-F9EC-4b64-A4BA-D9BCAE8779C2}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8EAB99C1-F9EC-4b64-A4BA-D9BCAE8779C2}\ deleted successfully.
C:\Program Files\MyWebSearchWB\bar\1.bin\W6BAR.DLL unregistered successfully.
C:\Program Files\MyWebSearchWB\bar\1.bin\W6BAR.DLL moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar\\{8EAB99C9-F9EC-4b64-A4BA-D9BCAE8779C2} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8EAB99C9-F9EC-4b64-A4BA-D9BCAE8779C2}\ not found.
File C:\Program Files\MyWebSearchWB\bar\1.bin\W6BAR.DLL not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{17A27031-71FC-11d4-815C-005004D0F1FA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{17A27031-71FC-11d4-815C-005004D0F1FA}\ not found.
C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c95fe080-8f5d-11d2-a20b-00aa003c157a}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{17A27031-71FC-11d4-815C-005004D0F1FA} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{17A27031-71FC-11d4-815C-005004D0F1FA}\ not found.
File C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c95fe080-8f5d-11d2-a20b-00aa003c157a}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}\ not found.
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{17A27031-71FC-11d4-815C-005004D0F1FA} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{17A27031-71FC-11d4-815C-005004D0F1FA}\ not found.
File C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy not found.
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{17A27031-71FC-11d4-815C-005004D0F1FA} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{17A27031-71FC-11d4-815C-005004D0F1FA}\ not found.
File C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy not found.
Registry value HKEY_USERS\S-1-5-21-2908572736-99931356-3806881469-1003\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{17A27031-71FC-11d4-815C-005004D0F1FA} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{17A27031-71FC-11d4-815C-005004D0F1FA}\ not found.
File C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy not found.
[Files/Folders - Created Within 90 days]
[Empty Temp Folders]
File delete failed. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.
User temp folders emptied.
SystemRoot temp folder emptied.
IE temp folders emptied
RecycleBin -> emptied.
Explorer started successfully
< End of fix log >
OTScanIt by OldTimer - Version 1.0.9.0 fix logfile created on 04212008_181305


Deckard's System Scanner v20071014.68
Run by [removed] on 2008-04-21 18:28:41
Computer is in Normal Mode.
——————————————————————————–



– HijackThis (run as Owner.exe) ———————————————–

Logfile of HijackThis v1.99.1
Scan saved at 6:28:44 PM, on 4/21/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\HP\KBD\KBD.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\System32\winamp.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Owner\Desktop\Computer Cleaning Stuff\dss.exe
C:\PROGRA~1\HIJACK~1\Owner.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us7.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wunderground.com/cgi-bin/findwe…ast?query=39648
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us7.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us7.hpwis.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Winamp Agent] C:\WINDOWS\System32\winamp.exe
O4 - HKLM\..\Run: [Windows Logon Application] C:\WINDOWS\System32\winIogon.exe
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: officejet 6100.lnk = ?
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/minibug/tr…Transporter.cab?
O17 - HKLM\System\CCS\Services\Tcpip\..\{636C9EED-136E-4ABE-9FBC-ECFC341E31BF}: NameServer = 208.137.128.8 208.137.128.6
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe


– Files created between 2008-03-21 and 2008-04-21 —————————–

2008-04-21 18:04:07 0 d——– C:\Documents and Settings\Owner\Application Data\Google
2008-04-19 11:56:00 0 d——– C:\Documents and Settings\All Users\Application Data\Google
2008-04-19 11:55:55 0 d——– C:\Program Files\Google
2008-04-18 21:03:58 63963 –a—— C:\WINDOWS\System32\egvur.exe
2008-04-15 17:47:53 0 d——– C:\Documents and Settings\Administrator\Application Data\AVG7
2008-04-15 17:47:53 0 d——– C:\Documents and Settings\Administrator\Application Data\ArcSoft
2008-04-15 17:47:53 0 d——– C:\Documents and Settings\Administrator\Application Data\AdobeUM
2008-04-15 17:47:53 0 d——– C:\Documents and Settings\Administrator\Application Data\Adobe
2008-04-15 17:47:52 0 d——– C:\Documents and Settings\Administrator\Application Data\Macromedia
2008-04-15 17:47:52 0 d——– C:\Documents and Settings\Administrator\Application Data\Lavasoft
2008-04-15 17:47:52 0 d——– C:\Documents and Settings\Administrator\Application Data\InterTrust
2008-04-15 17:47:52 0 d——– C:\Documents and Settings\Administrator\Application Data\Identities
2008-04-15 17:47:52 0 d——– C:\Documents and Settings\Administrator\Application Data\Help
2008-04-15 17:47:52 0 d——– C:\Documents and Settings\Administrator\Application Data\Freedom
2008-04-15 17:47:52 0 d——– C:\Documents and Settings\Administrator\Application Data\Corel
2008-04-15 17:47:51 0 dra—— C:\Documents and Settings\Administrator\Favorites
2008-04-15 17:47:51 0 d——– C:\Documents and Settings\Administrator\Desktop
2008-04-15 17:47:51 0 d—s—- C:\Documents and Settings\Administrator\Cookies
2008-04-15 17:47:51 0 drah—– C:\Documents and Settings\Administrator\Application Data
2008-04-15 17:47:51 0 d——– C:\Documents and Settings\Administrator\Application Data\VERITAS
2008-04-15 17:47:51 0 d——– C:\Documents and Settings\Administrator\Application Data\Share-to-Web Upload Folder
2008-04-15 17:47:51 0 d——– C:\Documents and Settings\Administrator\Application Data\SampleView
2008-04-15 17:47:51 0 d——– C:\Documents and Settings\Administrator\Application Data\MSN6
2008-04-15 17:47:51 0 d——– C:\Documents and Settings\Administrator\Application Data\Mozilla
2008-04-15 17:47:51 0 d——– C:\Documents and Settings\Administrator\Application Data\Motive
2008-04-15 17:47:51 0 d—s—- C:\Documents and Settings\Administrator\Application Data\Microsoft
2008-04-15 17:47:48 0 d——– C:\Documents and Settings\Administrator\WINDOWS
2008-04-15 17:47:48 0 d—s—- C:\Documents and Settings\Administrator\UserData
2008-04-15 17:47:48 0 d–h—– C:\Documents and Settings\Administrator\Templates
2008-04-15 17:47:48 0 dra—— C:\Documents and Settings\Administrator\Start Menu
2008-04-15 17:47:48 0 drah—– C:\Documents and Settings\Administrator\SendTo
2008-04-15 17:47:48 0 drah—– C:\Documents and Settings\Administrator\Recent
2008-04-15 17:47:48 0 d–h—– C:\Documents and Settings\Administrator\PrintHood
2008-04-15 17:47:48 0 d–h—– C:\Documents and Settings\Administrator\NetHood
2008-04-15 17:47:48 0 dra—— C:\Documents and Settings\Administrator\My Documents
2008-04-15 17:47:48 0 d–h—– C:\Documents and Settings\Administrator\Local Settings
2008-04-15 17:47:47 786432 –ah—– C:\Documents and Settings\Administrator\NTUSER.DAT
2008-04-10 13:53:38 0 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-04-10 13:53:36 0 d——– C:\WINDOWS\System32\Kaspersky Lab
2008-04-03 20:19:48 0 d——– C:\Documents and Settings\Owner\Application Data\WeatherBug
2008-04-03 20:19:23 0 d——– C:\Program Files\MyWebSearchWB
2008-04-01 20:22:51 0 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-29 20:57:29 0 dr-h—– C:\Documents and Settings\Owner\Recent
2008-03-29 20:55:51 288 –a—— C:\WINDOWS\System32\DVCStateBkp-{00000002-00000000-00000009-00001102-00000002-80691102}.dat
2008-03-29 20:55:51 288 –a—— C:\WINDOWS\System32\DVCState-{00000002-00000000-00000009-00001102-00000002-80691102}.dat
2008-03-29 20:51:49 26768 —–n— C:\WINDOWS\System32\CTL3D.DLL
Post #10
Hello

Please download the OTMoveIt2 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt2.exe to run it.
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    [kill explorer]
C:\WINDOWS\System32\egvur.exe
C:\Program Files\MyWebSearchWB
purity 
[start explorer]
  • Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the light Yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
  • Close OTMoveIt2
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.



Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner and click Accept

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
    Extended (if available otherwise Standard)
    • Scan Options:
    Scan Archives
    Scan Mail Bases
  • Click OK
  • Now under select a target to scan:Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
    • Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post.


Reboot and post a new DSS log and tell me how your PC is running
Post #11
Explorer killed successfully
File/Folder C:\WINDOWS\System32\egvur.exe not found.
C:\Program Files\MyWebSearchWB\bar\Settings moved successfully.
C:\Program Files\MyWebSearchWB\bar\History moved successfully.
C:\Program Files\MyWebSearchWB\bar\Cache moved successfully.
C:\Program Files\MyWebSearchWB\bar\1.bin moved successfully.
C:\Program Files\MyWebSearchWB\bar moved successfully.
C:\Program Files\MyWebSearchWB moved successfully.
< purity >
Explorer started successfully

OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 04242008_173455

**********************************
**********************************
I tried several times to run Kaspersky, but it would not succesfully update, so it would not scan.

**********************************
**********************************

Deckard's System Scanner v20071014.68
Run by [removed] on 2008-04-24 17:43:05
Computer is in Normal Mode.
——————————————————————————–



– HijackThis (run as Owner.exe) ———————————————–

Logfile of HijackThis v1.99.1
Scan saved at 5:43:11 PM, on 4/24/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\VERITAS Software\Update Manager\sgtray.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\System32\winamp.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\spooIsv.exe
C:\WINDOWS\System32\aufhzbnz.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Documents and Settings\Owner\Desktop\Computer Cleaning Stuff\dss.exe
C:\PROGRA~1\HIJACK~1\Owner.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us7.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wunderground.com/cgi-bin/findwe…ast?query=39648
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us7.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us7.hpwis.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Winamp Agent] C:\WINDOWS\System32\winamp.exe
O4 - HKLM\..\Run: [Windows Logon Application] C:\WINDOWS\System32\winIogon.exe
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\System32\spooIsv.exe
O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\WINDOWS\System32\aufhzbnz.exe
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: officejet 6100.lnk = ?
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/minibug/tr…Transporter.cab?
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe


– Files created between 2008-03-24 and 2008-04-24 —————————–

2008-04-24 12:16:48 9353 –a—— C:\WINDOWS\System32\ftpupd.exe
2008-04-24 09:44:25 34788 –a—— C:\WINDOWS\System32\uqhpd.exe
2008-04-23 18:28:16 34788 –a—— C:\WINDOWS\System32\xipv.exe
2008-04-23 18:28:15 23040 –a—— C:\WINDOWS\System32\aufhzbnz.exe
2008-04-23 18:26:11 53248 –a—— C:\WINDOWS\System32\xssbjkzl.exe
2008-04-23 18:26:08 34788 –a—— C:\WINDOWS\System32\ohhncqpz.exe
2008-04-21 18:04:07 0 d——– C:\Documents and Settings\Owner\Application Data\Google
2008-04-19 11:56:00 0 d——– C:\Documents and Settings\All Users\Application Data\Google
2008-04-19 11:55:55 0 d——– C:\Program Files\Google
2008-04-15 17:47:53 0 d——– C:\Documents and Settings\Administrator\Application Data\AVG7
2008-04-15 17:47:53 0 d——– C:\Documents and Settings\Administrator\Application Data\ArcSoft
2008-04-15 17:47:53 0 d——– C:\Documents and Settings\Administrator\Application Data\AdobeUM
2008-04-15 17:47:53 0 d——– C:\Documents and Settings\Administrator\Application Data\Adobe
2008-04-15 17:47:52 0 d——– C:\Documents and Settings\Administrator\Application Data\Macromedia
2008-04-15 17:47:52 0 d——– C:\Documents and Settings\Administrator\Application Data\Lavasoft
2008-04-15 17:47:52 0 d——– C:\Documents and Settings\Administrator\Application Data\InterTrust
2008-04-15 17:47:52 0 d——– C:\Documents and Settings\Administrator\Application Data\Identities
2008-04-15 17:47:52 0 d——– C:\Documents and Settings\Administrator\Application Data\Help
2008-04-15 17:47:52 0 d——– C:\Documents and Settings\Administrator\Application Data\Freedom
2008-04-15 17:47:52 0 d——– C:\Documents and Settings\Administrator\Application Data\Corel
2008-04-15 17:47:51 0 dra—— C:\Documents and Settings\Administrator\Favorites
2008-04-15 17:47:51 0 d——– C:\Documents and Settings\Administrator\Desktop
2008-04-15 17:47:51 0 d—s—- C:\Documents and Settings\Administrator\Cookies
2008-04-15 17:47:51 0 drah—– C:\Documents and Settings\Administrator\Application Data
2008-04-15 17:47:51 0 d——– C:\Documents and Settings\Administrator\Application Data\VERITAS
2008-04-15 17:47:51 0 d——– C:\Documents and Settings\Administrator\Application Data\Share-to-Web Upload Folder
2008-04-15 17:47:51 0 d——– C:\Documents and Settings\Administrator\Application Data\SampleView
2008-04-15 17:47:51 0 d——– C:\Documents and Settings\Administrator\Application Data\MSN6
2008-04-15 17:47:51 0 d——– C:\Documents and Settings\Administrator\Application Data\Mozilla
2008-04-15 17:47:51 0 d——– C:\Documents and Settings\Administrator\Application Data\Motive
2008-04-15 17:47:51 0 d—s—- C:\Documents and Settings\Administrator\Application Data\Microsoft
2008-04-15 17:47:48 0 d——– C:\Documents and Settings\Administrator\WINDOWS
2008-04-15 17:47:48 0 d—s—- C:\Documents and Settings\Administrator\UserData
2008-04-15 17:47:48 0 d–h—– C:\Documents and Settings\Administrator\Templates
2008-04-15 17:47:48 0 dra—— C:\Documents and Settings\Administrator\Start Menu
2008-04-15 17:47:48 0 drah—– C:\Documents and Settings\Administrator\SendTo
2008-04-15 17:47:48 0 drah—– C:\Documents and Settings\Administrator\Recent
2008-04-15 17:47:48 0 d–h—– C:\Documents and Settings\Administrator\PrintHood
2008-04-15 17:47:48 0 d–h—– C:\Documents and Settings\Administrator\NetHood
2008-04-15 17:47:48 0 dra—— C:\Documents and Settings\Administrator\My Documents
2008-04-15 17:47:48 0 d–h—– C:\Documents and Settings\Administrator\Local Settings
2008-04-15 17:47:47 786432 –ah—– C:\Documents and Settings\Administrator\NTUSER.DAT
2008-04-10 13:53:38 0 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-04-10 13:53:36 0 d——– C:\WINDOWS\System32\Kaspersky Lab
2008-04-03 20:19:48 0 d——– C:\Documents and Settings\Owner\Application Data\WeatherBug
2008-04-01 20:22:51 0 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-29 20:57:29 0 dr-h—– C:\Documents and Settings\Owner\Recent
2008-03-29 20:55:51 288 –a—— C:\WINDOWS\System32\DVCStateBkp-{00000002-00000000-00000009-00001102-00000002-80691102}.dat
2008-03-29 20:55:51 288 –a—— C:\WINDOWS\System32\DVCState-{00000002-00000000-00000009-00001102-00000002-80691102}.dat
2008-03-29 20:51:49 26768 —–n— C:\WINDOWS\System32\CTL3D.DLL
Post #12
Hello

1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

O4 - HKLM\..\Run: [Windows Logon Application] C:\WINDOWS\System32\winIogon.exe
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\System32\spooIsv.exe
O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\WINDOWS\System32\aufhzbnz.exe


2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.



Please download the OTMoveIt2 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt2.exe to run it.
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    [kill explorer]
C:\WINDOWS\System32\ftpupd.exe
C:\WINDOWS\System32\uqhpd.exe
C:\WINDOWS\System32\xipv.exe
C:\WINDOWS\System32\aufhzbnz.exe
C:\WINDOWS\System32\xssbjkzl.exe
C:\WINDOWS\System32\ohhncqpz.exe
C:\WINDOWS\System32\spooIsv.exe
C:\WINDOWS\System32\winIogon.exe
purity 
[start explorer]
  • Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the light Yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
  • Close OTMoveIt2
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.


Reboot and post a new DSS log
Post #13
I apologize for taking so long with this…it's difficult with the computer being at my mother-in-law's house…I will get back to this on Thursday…I appreciate your patience. Thanks!
Post #15 last edited
Hello, still getting the "Critical system errors" popup and AVG is still catching around 20 virus threats every 10 minutes or so while online. I have been clicking on the Move to Virus Vault Option. Could this have to do with the firewall not working properly?
Thanks!

Explorer killed successfully
File/Folder C:\WINDOWS\System32\ftpupd.exe not found.
File/Folder C:\WINDOWS\System32\uqhpd.exe not found.
File/Folder C:\WINDOWS\System32\xipv.exe not found.
C:\WINDOWS\System32\aufhzbnz.exe moved successfully.
File/Folder C:\WINDOWS\System32\xssbjkzl.exe not found.
File/Folder C:\WINDOWS\System32\ohhncqpz.exe not found.
File/Folder C:\WINDOWS\System32\spooIsv.exe not found.
File/Folder C:\WINDOWS\System32\winIogon.exe not found.
< purity >
Explorer started successfully

OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 05012008_184910


Deckard's System Scanner v20071014.68
Run by [removed] on 2008-05-01 18:54:13
Computer is in Normal Mode.
——————————————————————————–



– HijackThis (run as Owner.exe) ———————————————–

Logfile of HijackThis v1.99.1
Scan saved at 6:54:17 PM, on 5/1/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\VERITAS Software\Update Manager\sgtray.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\System32\winamp.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Documents and Settings\Owner\Desktop\Computer Cleaning Stuff\dss.exe
C:\PROGRA~1\HIJACK~1\Owner.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us7.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wunderground.com/cgi-bin/findwe…ast?query=39648
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us7.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us7.hpwis.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Winamp Agent] C:\WINDOWS\System32\winamp.exe
O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\WINDOWS\System32\icjvv.exe
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: officejet 6100.lnk = ?
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/minibug/tr…Transporter.cab?
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe


– Files created between 2008-04-01 and 2008-05-01 —————————–

2008-04-30 06:08:40 53248 –a—— C:\WINDOWS\System32\onuayeqd.exe
2008-04-30 06:08:39 27409 –a—— C:\WINDOWS\System32\wpsw.exe
2008-04-29 21:08:41 53248 –a—— C:\WINDOWS\System32\zweex.exe
2008-04-27 21:48:48 27409 –a—— C:\WINDOWS\System32\mzdymhy.exe
2008-04-27 21:48:48 53248 –a—— C:\WINDOWS\System32\diwdwdw.exe
2008-04-27 21:48:47 64840 –a—— C:\WINDOWS\System32\ousvxdc.exe
2008-04-27 20:02:58 104 –a—— C:\WINDOWS\System32\o
2008-04-27 19:29:11 27409 –a—— C:\WINDOWS\System32\zjmvb.exe
2008-04-27 19:29:08 53248 –a—— C:\WINDOWS\System32\ovhtzxz.exe
2008-04-27 19:29:05 27409 –a—— C:\WINDOWS\System32\wcxocjzc.exe
2008-04-27 19:29:05 64840 –a—— C:\WINDOWS\System32\hzlnqn.exe
2008-04-26 20:57:32 27409 –a—— C:\WINDOWS\System32\vlckt.exe
2008-04-26 20:57:23 64840 –a—— C:\WINDOWS\System32\wbjbdmh.exe
2008-04-26 20:57:21 23040 –a—— C:\WINDOWS\System32\xjyq.exe
2008-04-26 15:51:25 23040 –a—— C:\WINDOWS\System32\vncjepge.exe
2008-04-26 15:51:22 64840 –a—— C:\WINDOWS\System32\tmlprt.exe
2008-04-26 15:40:16 0 -ra—— C:\WINDOWS\System32\TFTP876
2008-04-26 14:25:11 27409 –a—— C:\WINDOWS\System32\wtapm.exe
2008-04-26 14:25:04 23040 –a—— C:\WINDOWS\System32\zbmy.exe
2008-04-26 14:25:04 27409 –a—— C:\WINDOWS\System32\qixjub.exe
2008-04-26 08:31:33 53248 –a—— C:\WINDOWS\System32\nxse.exe
2008-04-26 08:31:32 34788 –a—— C:\WINDOWS\System32\ubrppg.exe
2008-04-21 18:04:07 0 d——– C:\Documents and Settings\Owner\Application Data\Google
2008-04-19 11:56:00 0 d——– C:\Documents and Settings\All Users\Application Data\Google
2008-04-19 11:55:55 0 d——– C:\Program Files\Google
2008-04-15 17:47:53 0 d——– C:\Documents and Settings\Administrator\Application Data\AVG7
2008-04-15 17:47:53 0 d——– C:\Documents and Settings\Administrator\Application Data\ArcSoft
2008-04-15 17:47:53 0 d——– C:\Documents and Settings\Administrator\Application Data\AdobeUM
2008-04-15 17:47:53 0 d——– C:\Documents and Settings\Administrator\Application Data\Adobe
2008-04-15 17:47:52 0 d——– C:\Documents and Settings\Administrator\Application Data\Macromedia
2008-04-15 17:47:52 0 d——– C:\Documents and Settings\Administrator\Application Data\Lavasoft
2008-04-15 17:47:52 0 d——– C:\Documents and Settings\Administrator\Application Data\InterTrust
2008-04-15 17:47:52 0 d——– C:\Documents and Settings\Administrator\Application Data\Identities
2008-04-15 17:47:52 0 d——– C:\Documents and Settings\Administrator\Application Data\Help
2008-04-15 17:47:52 0 d——– C:\Documents and Settings\Administrator\Application Data\Freedom
2008-04-15 17:47:52 0 d——– C:\Documents and Settings\Administrator\Application Data\Corel
2008-04-15 17:47:51 0 dra—— C:\Documents and Settings\Administrator\Favorites
2008-04-15 17:47:51 0 d——– C:\Documents and Settings\Administrator\Desktop
2008-04-15 17:47:51 0 d—s—- C:\Documents and Settings\Administrator\Cookies
2008-04-15 17:47:51 0 drah—– C:\Documents and Settings\Administrator\Application Data
2008-04-15 17:47:51 0 d——– C:\Documents and Settings\Administrator\Application Data\VERITAS
2008-04-15 17:47:51 0 d——– C:\Documents and Settings\Administrator\Application Data\Share-to-Web Upload Folder
2008-04-15 17:47:51 0 d——– C:\Documents and Settings\Administrator\Application Data\SampleView
2008-04-15 17:47:51 0 d——– C:\Documents and Settings\Administrator\Application Data\MSN6
2008-04-15 17:47:51 0 d——– C:\Documents and Settings\Administrator\Application Data\Mozilla
2008-04-15 17:47:51 0 d——– C:\Documents and Settings\Administrator\Application Data\Motive
2008-04-15 17:47:51 0 d—s—- C:\Documents and Settings\Administrator\Application Data\Microsoft
2008-04-15 17:47:48 0 d——– C:\Documents and Settings\Administrator\WINDOWS
2008-04-15 17:47:48 0 d—s—- C:\Documents and Settings\Administrator\UserData
2008-04-15 17:47:48 0 d–h—– C:\Documents and Settings\Administrator\Templates
2008-04-15 17:47:48 0 dra—— C:\Documents and Settings\Administrator\Start Menu
2008-04-15 17:47:48 0 drah—– C:\Documents and Settings\Administrator\SendTo
2008-04-15 17:47:48 0 drah—– C:\Documents and Settings\Administrator\Recent
2008-04-15 17:47:48 0 d–h—– C:\Documents and Settings\Administrator\PrintHood
2008-04-15 17:47:48 0 d–h—– C:\Documents and Settings\Administrator\NetHood
2008-04-15 17:47:48 0 dra—— C:\Documents and Settings\Administrator\My Documents
2008-04-15 17:47:48 0 d–h—– C:\Documents and Settings\Administrator\Local Settings
2008-04-15 17:47:47 786432 –ah—– C:\Documents and Settings\Administrator\NTUSER.DAT
2008-04-10 13:53:38 0 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-04-10 13:53:36 0 d——– C:\WINDOWS\System32\Kaspersky Lab
2008-04-03 20:19:48 0 d——– C:\Documents and Settings\Owner\Application Data\WeatherBug
2008-04-01 20:22:51 0 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy


– Find3M Report —————————————————————

2008-05-01 18:50:15 288 –a—— C:\WINDOWS\System32\DVCStateBkp-{00000002-00000000-00000009-00001102-00000002-80691102}.dat
2008-05-01 18:50:15 288 –a—— C:\WINDOWS\System32\DVCState-{00000002-00000000-00000009-00001102-00000002-80691102}.dat
2008-04-20 20:16:20 0 d——– C:\Documents and Settings\Owner\Application Data\Adobe
2008-04-03 20:19:22 0 d——– C:\Program Files\AWS
2008-04-03 20:17:02 0 d——– C:\Documents and Settings\Owner\Application Data\AVG7
2008-04-03 19:01:16 0 d——– C:\Program Files\Common Files
2008-03-31 11:32:52 0 d–h—– C:\Program Files\WindowsUpdate
2008-03-29 20:51:15 0 d——– C:\Program Files\Creative
2008-03-29 19:31:21 0 d——– C:\Program Files\Windows NT
2008-03-29 19:31:16 0 d——– C:\Program Files\Movie Maker
2008-03-29 19:31:16 0 d——– C:\Program Files\Messenger
2008-03-29 19:29:56 0 d——– C:\Program Files\ReadIris
2008-03-29 19:29:37 0 d–h—– C:\Program Files\InstallShield Installation Information
2008-03-29 18:22:10 0 d——– C:\Program Files\Common Files\Hewlett-Packard
2008-03-29 18:16:55 0 d——– C:\Program Files\Microsoft AntiSpyware
2008-03-28 19:20:54 0 d——– C:\Documents and Settings\Owner\Application Data\Lavasoft


– Registry Dump —————————————————————

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [05/07/1998 07:04 PM]
"Share-to-Web Namespace Daemon"="c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [04/17/2002 08:42 PM]
"CamMonitor"="c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe" [06/18/2002 02:11 AM]
"KBD"="C:\HP\KBD\KBD.EXE" [07/07/2001 12:56 AM]
"StorageGuard"="C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" [06/18/2002 11:01 AM]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [09/14/2002 12:42 AM]
"PS2"="C:\WINDOWS\system32\ps2.exe" [06/14/2002 07:39 PM]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [04/28/2008 09:31 AM]
"Winamp Agent"="C:\WINDOWS\System32\winamp.exe" [08/29/2002 07:00 AM]
"Advanced DHTML Enable"="C:\WINDOWS\System32\icjvv.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Weather"="C:\PROGRA~1\AWS\WEATHE~1\Weather.exe" [04/07/2006 04:02 PM]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [08/21/2002 01:08 AM]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [04/19/2008 11:56 AM]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"SetDefaultMidi"=MIDIDEF.EXE
"PlayCenter2"="C:\Program Files\Creative\SBLive\PlayCenter2\MDEntry.EXE" "C:\Program Files\Creative\SBLive\PlayCenter2"

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
hp psc 2000 Series.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [6/27/2002 2:20:58 AM]
officejet 6100.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe [6/27/2002 2:21:30 AM]
Quicken Scheduled Updates.lnk - C:\Program Files\Quicken\bagent.exe [9/20/2002 10:20:02 PM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
@=

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHELPER]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIEW]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]




– End of Deckard's System Scanner: finished at 2008-05-01 18:55:09 ————

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI