machine acting strange

That maybe. When we were transferring files using the flashdrive when I placed in the clean computer and ran a norton scan there was a win32 virus detected and cleaned from the drive. I just dont remember the entire name. Now how do we erradicated this pesky devil??

Download & run this file
http://www.techsupportforum.com/sectools/s…Disinfector.exe

Be sure to insert any flash drives or USB devices that you use.


Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

File::
C:\WINDOWS\TEMP\winpwuh.exe
C:\WINDOWS\TEMP\lmjb.exe
C:\WINDOWS\TEMP\winogmn.exe
C:\WINDOWS\TEMP\windngm.exe
C:\WINDOWS\TEMP\euwf.exe
C:\WINDOWS\TEMP\winexpld.exe
C:\WINDOWS\TEMP\winarrsbc.exe
C:\WINDOWS\TEMP\winvnejcs.exe
C:\WINDOWS\TEMP\pdwh.exe
C:\WINDOWS\TEMP\windvwe.exe
C:\WINDOWS\TEMP\kqyvc.exe
C:\WINDOWS\TEMP\winmkcj.exe
C:\WINDOWS\TEMP\myai.exe
C:\WINDOWS\TEMP\wineanbk.exe
C:\WINDOWS\TEMP\winfwgc.exe
C:\autorun.inf
C:\WINDOWS\system32\drivers\hhgmrs.sys 

Folder::
C:\Program Files\Viewpoint

Driver::
hhgmrs
abp470n5

Registry::
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\WINDOWS\TEMP\winpwuh.exe"=-
"C:\WINDOWS\TEMP\lmjb.exe"=- 
"C:\WINDOWS\TEMP\winogmn.exe"=- 
"C:\WINDOWS\TEMP\windngm.exe"=-
"C:\WINDOWS\TEMP\euwf.exe"=- 
"C:\WINDOWS\TEMP\winexpld.exe"=- 
"C:\WINDOWS\TEMP\winarrsbc.exe"=-
"C:\WINDOWS\TEMP\winvnejcs.exe"=-
"C:\WINDOWS\TEMP\pdwh.exe"=-
"C:\WINDOWS\TEMP\windvwe.exe"=-
"C:\WINDOWS\TEMP\kqyvc.exe"=-
"C:\WINDOWS\TEMP\winmkcj.exe"=-
"C:\WINDOWS\TEMP\myai.exe"=-
"C:\WINDOWS\TEMP\wineanbk.exe"=-
"C:\WINDOWS\TEMP\winfwgc.exe"=-

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.

The thumb drive shouldn't be ever used again. If it's infected with Salty as well, chances are it can't be cleaned.

I need you to go into IE Tools > Internet Options > Security > Trusted Sites and add *.kaspersky.com.
Also add *.windows.com
Be sure to use the *and .

Next:

Please download HoxtXpert.

• Unzip HostsXpert.zip
• Double click on HostsXpert.exe
• Then click on "Restore Original Hosts" to restore your Hosts file to its default condidtion..
• Click on Make Hosts Read Only to secure it against further infection.
• Close program when complete.

If you can run the host fix, just move on.

Please go to Kaspersky website and perform an online antivirus scan.

• Read through the requirements and privacy statement and click on Accept button.
• It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
• When the downloads have finished, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, Adware, Dialers, and other potentially dangerous programs
    Archives
    Mail databases
• Click on My Computer under Scan.
• Once the scan is complete, it will display the results. Click on View Scan Report.
• You will see a list of infected items there. Click on Save Report As….
• Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
• Please post this log in your next reply.

Unable to add those sites to trusted list. Got dialog box stating that all sites added must use https:// prefix. Ran HoxtXpert.exe Unable to get to Kaspersky website.

I need you to go into IE Tools > Internet Options > Security > Trusted Sites and
add https://*.kaspersky.com.
Also add https://*.windows.com
Be sure to use the *and .

Now try it.

Items added ok but still unable to access site.

Please download DDS and save it to your desktop.

• Disable any script blocking protection
• Double click dds.scr to run the tool.
• When done, DDS.txt will open.
• Click Yes at the next prompt for Optional Scan.
• Save both reports to your desktop.

—————————————————

Please include the contents of the following in your next reply:

DDS.txt
Attach.txt


Use notepad to open both and Copy / Paste the contents here.

How do I disable script blocking?

How do I disable script blocking?

I'm sure you're ok to move on.

Here are the logs DDS (Version 1.0) - NTFSx86 Run by [removed] at 18:00:05.23 on 2008-11-13 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1524 [GMT -5:00] ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\Program Files\Dell Support Center\bin\sprtsvc.exe svchost.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\system32\WLTRAY.exe C:\WINDOWS\stsystra.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\NetWaiting\netWaiting.exe C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\internet explorer\iexplore.exe C:\WINDOWS\TEMP\windumtar.exe C:\WINDOWS\TEMP\winajnjv.exe C:\WINDOWS\TEMP\bklwon.exe C:\Documents and Settings\James\Desktop\dds.scr C:\DOCUME~1\James\LOCALS~1\Temp\RarSFX0\FI.exe ============== Psuedo HJT Report =============== uStart Page = hxxp://www.google.com/ uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=4070123 BHO: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll BHO: {5CA3D70E-1895-11CF-8E15-001234567890} - c:\windows\system32\dla\tfswshx.dll BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll BHO: {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\program files\bae\BAE.dll BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll uRun: [ModemOnHold] c:\program files\netwaiting\netWaiting.exe uRun: [OE_OEM] "c:\program files\trend micro\internet security 14\tmas_oe\TMAS_OEMon.exe" uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [ehTray] c:\windows\ehome\ehtray.exe mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe mRun: [SigmatelSysTrayApp] stsystra.exe mRun: [Dell QuickSet] c:\program files\dell\quickset\quickset.exe mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\cli.exe" runtime -Delay mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe" mRun: [pccguide.exe] "c:\program files\trend micro\internet security 14\pccguide.exe" mRun: [dla] c:\windows\system32\dla\tfswctrl.exe mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [dellsupportcenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P dellsupportcenter StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\dlbcserv.lnk - c:\program files\dell photo printer 720\dlbcserv.exe mPolicies-system: InstallVisualStyle = c:\windows\resources\themes\royale\Royale.msstyles mPolicies-system: InstallTheme = c:\windows\resources\themes\Royale.theme mPolicies-system: EnableLUA = 0 (0x0) dPolicies-system: DisableTaskMgr = 1 (0x1) dPolicies-system: DisableRegistryTools = 1 (0x1) IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000 IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office11\MSOXMLMF.DLL Notify: AtiExtEvent -Ati2evxx.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ============= SERVICES / DRIVERS =============== R3 abp470n5;abp470n5;\??\c:\windows\system32\drivers\hhgmrs.sys S3 w300bus;Sony Ericsson W300 Driver driver (WDM);c:\windows\system32\drivers\w300bus.sys S4 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\viewpoint\common\ViewpointService.exe" =============== Created Last 30 ================ 2008-11-12 17:25 3,212 a——- c:\windows\system32\tmp.reg 2008-11-12 16:51 434 a——- c:\windows\Shortcut to Shared Documents.lnk 2008-11-12 14:33 –d—– C:\SDFix 2008-11-11 22:04 118 a——- c:\windows\system32\MRT.INI 2008-11-11 22:01 455,296 ——– c:\windows\system32\dllcache\mrxsmb.sys 2008-11-11 21:59 1,106,944 ——– c:\windows\system32\dllcache\msxml3.dll 2008-11-11 21:33 –d—– c:\documents and settings\james\DoctorWeb 2008-11-11 11:16 –d-h— c:\windows\system32\GroupPolicy 2008-11-09 13:49 7,168 a——- c:\windows\system32\dllcache\wamregps.dll 2008-11-09 13:49 66,048 a——- c:\windows\system32\dllcache\s3legacy.dll 2008-11-09 13:49 19,968 a——- c:\windows\system32\dllcache\inetsloc.dll 2008-11-09 13:49 7,680 a——- c:\windows\system32\dllcache\inetmgr.exe 2008-11-09 13:49 169,984 a——- c:\windows\system32\dllcache\iisui.dll 2008-11-09 13:49 5,632 a——- c:\windows\system32\dllcache\iisrstap.dll 2008-11-09 13:49 14,336 a——- c:\windows\system32\dllcache\iisreset.exe 2008-11-09 13:49 6,144 a——- c:\windows\system32\dllcache\ftpsapi2.dll 2008-11-09 13:49 94,720 a——- c:\windows\system32\dllcache\certmap.ocx 2008-11-09 11:28 –d—– c:\program files\Sun 2008-11-09 11:27 410,976 a——- c:\windows\system32\deploytk.dll 2008-11-09 11:27 73,728 a——- c:\windows\system32\javacpl.cpl 2008-11-09 10:14 –d—– C:\Lop SD 2008-11-09 08:45 a-d—– C:\autorun.inf 2008-11-07 21:00 –d—– C:\cmdcons 2008-11-07 20:57 161,792 a——- c:\windows\SWREG.exe 2008-11-07 20:57 98,816 a——- c:\windows\sed.exe 2008-11-07 20:57 a-d—– c:\program files\Qoobox 2008-11-05 15:35 –d—– c:\docume~1\james\applic~1\Malwarebytes 2008-11-05 15:35 15,504 a——- c:\windows\system32\drivers\mbam.sys 2008-11-05 15:35 38,496 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2008-11-05 15:35 –d—– c:\program files\Malwarebytes' Anti-Malware 2008-11-05 15:35 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2008-10-16 00:07 333,824 ——– c:\windows\system32\dllcache\srv.sys 2008-10-16 00:07 1,846,400 ——– c:\windows\system32\dllcache\win32k.sys 2008-10-16 00:06 2,189,184 a——- c:\windows\system32\dllcache\ntoskrnl.exe 2008-10-16 00:06 2,066,048 ——– c:\windows\system32\dllcache\ntkrnlpa.exe 2008-10-16 00:06 2,023,936 ——– c:\windows\system32\dllcache\ntkrpamp.exe ==================== Find3M ==================== 2008-11-12 12:23 –d—– c:\docume~1\alluse~1\applic~1\Kodak 2008-11-12 09:47 –d—– c:\program files\Kodak 2008-11-11 21:04 –d—– c:\program files\Trend Micro 2008-10-15 11:34 337,408 a——- c:\windows\system32\dllcache\netapi32.dll 2008-10-13 20:11 –d—– c:\program files\LimeWire 2008-10-08 12:08 –d—– c:\program files\Messenger 2008-10-08 11:41 88,183 a——- c:\windows\pchealth\helpctr\offlinecache\index.dat 2008-10-08 11:30 –d—– c:\program files\Windows NT 2008-09-30 16:43 1,286,152 a——- c:\windows\system32\msxml4.dll 2008-09-15 07:12 1,846,400 a——- c:\windows\system32\win32k.sys 2008-09-09 20:14 1,307,648 a——- c:\windows\system32\msxml6.dll 2008-09-09 20:14 1,307,648 ——– c:\windows\system32\dllcache\msxml6.dll 2008-09-04 12:15 1,106,944 a——- c:\windows\system32\msxml3.dll 2008-08-27 22:03 –d—– c:\docume~1\alluse~1\applic~1\Viewpoint 2008-08-23 18:57 –d—– c:\docume~1\james\applic~1\alot 2008-08-20 00:30 3,067,904 ——– c:\windows\system32\dllcache\mshtml.dll 2008-08-20 00:30 619,520 a——- c:\windows\system32\dllcache\urlmon.dll 2008-08-20 00:30 1,499,136 a——- c:\windows\system32\dllcache\shdocvw.dll 2008-08-20 00:30 666,112 a——- c:\windows\system32\wininet.dll 2008-08-20 00:30 666,112 a——- c:\windows\system32\dllcache\wininet.dll 2008-05-26 12:22 –d—– c:\docume~1\alluse~1\applic~1\Adobe(2) 2008-05-26 12:21 –d—– c:\docume~1\alluse~1\applic~1\Symantec 2008-02-27 14:24 –d—– c:\docume~1\alluse~1\applic~1\Dell 2008-01-11 19:16 –d—– c:\docume~1\alluse~1\applic~1\Dell Photo Printer 720 2007-12-28 11:53 –d—– c:\docume~1\alluse~1\applic~1\SupportSoft 2007-08-15 18:20 –d—– c:\docume~1\alluse~1\applic~1\STOPzilla! 2007-08-14 16:22 –d—– c:\docume~1\alluse~1\applic~1\Lavasoft 2007-01-23 16:40 –d—– c:\docume~1\alluse~1\applic~1\Trend Micro 2005-08-16 21:54 –d—– c:\docume~1\alluse~1\applic~1\DIGStream ============= FINISH: 18:00:28.58 =============== UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Version 1.0) Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume2 Install Date: 2007-01-31 15:31:25 System Uptime: 2008-11-13 17:19:59 (1 hours ago) Motherboard: Dell Inc. | | 0XD720 Processor: Intel® Core™2 CPU T5600 @ 1.83GHz | Microprocessor | 1828/166mhz BIOS: Phoenix ROM BIOS PLUS Version 1.10 A15 | DELL - 27d70414 | A15 | 2007-04-19 20:00:00 ==== Disk Partitions ========================= C: is FIXED (NTFS) - 68 GiB total, 45.902 GiB free. D: is CDROM () E: is CDROM (CDFS) F: is Removable ==== Disabled Device Manager Items ============= ==== System Restore Points =================== RP313: 2008-08-14 21:14:00 - Software Distribution Service 3.0 RP314: 2008-08-16 13:12:19 - System Checkpoint RP315: 2008-08-18 16:18:44 - System Checkpoint RP316: 2008-08-20 10:03:05 - System Checkpoint RP317: 2008-08-23 13:55:16 - System Checkpoint RP318: 2008-08-25 18:30:33 - System Checkpoint RP319: 2008-08-26 18:39:12 - System Checkpoint RP320: 2008-08-27 19:28:45 - System Checkpoint RP321: 2008-08-28 20:12:01 - System Checkpoint RP322: 2008-08-29 20:12:57 - System Checkpoint RP323: 2008-08-30 20:55:31 - System Checkpoint RP324: 2008-08-31 21:13:37 - System Checkpoint RP325: 2008-09-02 11:43:21 - System Checkpoint RP326: 2008-09-03 13:46:41 - System Checkpoint RP327: 2008-09-05 12:28:22 - System Checkpoint RP328: 2008-09-08 18:01:20 - System Checkpoint RP329: 2008-09-09 23:47:06 - Software Distribution Service 3.0 RP330: 2008-09-11 15:51:48 - System Checkpoint RP331: 2008-09-13 12:09:31 - System Checkpoint RP332: 2008-09-15 00:34:08 - System Checkpoint RP333: 2008-09-16 18:10:53 - System Checkpoint RP334: 2008-09-17 19:04:16 - System Checkpoint RP335: 2008-09-18 11:33:29 - Software Distribution Service 3.0 RP336: 2008-09-19 12:18:45 - System Checkpoint RP337: 2008-09-21 00:27:45 - System Checkpoint RP338: 2008-09-22 19:17:21 - Software Distribution Service 3.0 RP339: 2008-09-25 17:18:51 - Restore Operation RP340: 2008-09-26 19:37:02 - System Checkpoint RP341: 2008-09-29 14:00:59 - System Checkpoint RP342: 2008-10-05 11:12:57 - System Checkpoint RP343: 2008-10-08 12:17:33 - Software Distribution Service 3.0 RP344: 2008-10-09 18:14:46 - System Checkpoint RP345: 2008-10-09 19:33:09 - Software Distribution Service 3.0 RP346: 2008-10-10 22:40:54 - System Checkpoint RP347: 2008-10-11 22:47:49 - System Checkpoint RP348: 2008-10-13 18:19:54 - System Checkpoint RP349: 2008-10-15 12:43:32 - System Checkpoint RP350: 2008-10-16 01:37:21 - Software Distribution Service 3.0 RP351: 2008-10-17 12:43:58 - System Checkpoint RP352: 2008-10-18 18:05:38 - System Checkpoint RP353: 2008-10-19 19:09:00 - System Checkpoint RP354: 2008-10-20 20:10:43 - System Checkpoint RP355: 2008-10-22 20:06:25 - System Checkpoint RP356: 2008-10-23 22:20:15 - System Checkpoint RP357: 2008-10-24 13:55:08 - Software Distribution Service 3.0 RP358: 2008-10-25 20:22:01 - System Checkpoint RP359: 2008-10-26 20:25:16 - System Checkpoint RP360: 2008-10-27 21:09:30 - System Checkpoint RP361: 2008-10-28 22:32:58 - System Checkpoint RP362: 2008-10-30 21:08:55 - System Checkpoint RP363: 2008-11-01 14:27:02 - System Checkpoint RP364: 2008-11-02 15:02:52 - System Checkpoint RP365: 2008-11-03 15:09:18 - System Checkpoint RP366: 2008-11-05 14:45:59 - Restore Operation RP367: 2008-11-05 14:49:55 - Restore Operation RP368: 2008-11-05 15:29:47 - Software Distribution Service 3.0 RP369: 2008-11-06 19:13:12 - System Checkpoint RP370: 2008-11-07 20:57:40 - ComboFix created restore point RP371: 2008-11-07 21:44:27 - ComboFix created restore point RP372: 2008-11-07 22:08:08 - ComboFix created restore point RP373: 2008-11-08 19:09:06 - ComboFix created restore point RP374: 2008-11-08 22:41:21 - ComboFix created restore point RP375: 2008-11-09 11:27:10 - Installed Java™ 6 Update 10 RP376: 2008-11-09 11:28:00 - Installed OpenOffice.org Installer 1.0 RP377: 2008-11-09 16:33:56 - Software Distribution Service 3.0 RP378: 2008-11-11 08:48:29 - System Checkpoint RP379: 2008-11-11 11:31:13 - ComboFix created restore point RP380: 2008-11-11 12:19:48 - ComboFix created restore point RP381: 2008-11-11 17:26:17 - ComboFix created restore point RP382: 2008-11-11 22:02:04 - Software Distribution Service 3.0 RP383: 2008-11-12 08:10:11 - ComboFix created restore point RP384: 2008-11-12 13:28:56 - ComboFix created restore point RP385: 2008-11-12 13:58:54 - ComboFix created restore point RP386: 2008-11-12 19:21:34 - ComboFix created restore point ==== Installed Programs ====================== 32 Bit HP CIO Components Installer Acrobat.com Ad-Aware 2007 Adobe AIR Adobe Flash Player ActiveX Adobe Media Player Adobe Reader 9 AIO_Scan ALOT Toolbar America Online (Choose which version to remove) AOL Coach Version 1.0(Build:20040229.1 en) AOL Connectivity Services AOLIcon ATI Catalyst Control Center ATI Display Driver Broadcom Management Programs Conexant HDA D110 MDC V.92 Modem Dell Photo Printer 720 Dell Photo Printer 720 Logger Dell Support 3.2.1 Dell Support Center (Support Software) Dell Wireless WLAN Card Digital Content Portal Digital Line Detect Disc2Phone Documentation & Support Launcher EarthLink Setup Files EducateU ERUNT 1.1j ESPNMotion Games, Music, & Photos Launcher GemMaster Mystic Get High Speed Internet! High Definition Audio Driver Package - KB835221 HijackThis 2.0.2 Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 10 (KB903157) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB952287) HP Photosmart All-In-One Software 9.0 HP Photosmart Essential Internet Service Offers Launcher Jasc Paint Shop Photo Album Jasc Paint Shop Pro 8 Dell Edition Java™ 6 Update 10 Learn2 Player (Uninstall Only) Liberty Court Player 5.0 (build 181) LimeWire 4.14.10 Malwarebytes' Anti-Malware Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Office Small Business Edition 2003 Microsoft Plus! Digital Media Edition Installer Microsoft Plus! Photo Story 2 LE Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Works Modem Helper Mozilla Firefox (3.0.3) MSN MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) NetWaiting NetZeroInstallers OpenOffice.org Installer 1.0 Otto PowerDVD 5.7 PS_AIO_Software_min QuickSet QuickTime RealPlayer Scan SearchAssist Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950759) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953838) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956390) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958644) Sonic DLA Sonic Encoders Sonic MyDVD LE Sonic RecordNow Audio Sonic RecordNow Copy Sonic RecordNow Data Sonic Update Manager Synaptics Pointing Device Driver Toolbox Trend Micro PC-cillin Internet Security 14 Update for Windows Media Player 10 (KB910393) Update for Windows Media Player 10 (KB913800) Update for Windows Media Player 10 (KB926251) Update for Windows XP (KB951072-v2) Update for Windows XP (KB951978) Update Rollup 2 for Windows XP Media Center Edition 2005 URL Assistant Viewpoint Manager (Remove Only) Viewpoint Media Player WebFldrs XP Windows Genuine Advantage Notifications (KB905474) Windows Genuine Advantage Validation Tool (KB892130) Windows Installer 3.1 (KB893803) Windows Media Format 11 runtime Windows Media Player 10 Windows Media Player 10 Hotfix [See EmeraldQFE2 for more information] Windows Media Player 11 Windows XP Media Center Edition 2005 KB908246 Windows XP Media Center Edition 2005 KB925766 Windows XP Service Pack 3 WRAL DESKTOP WEATHER ==== Event Viewer Messages =================== 2008-11-08 07:04:40, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: szkg 2008-11-08 07:04:37, error: Service Control Manager [7000] - The Viewpoint Manager Service service failed to start due to the following error: The system cannot find the path specified. 2008-11-07 22:20:46, error: System Error [1003] - Error code 1000008e, parameter1 c0000005, parameter2 b0a29b26, parameter3 ae2c1ba4, parameter4 00000000. 2008-11-07 22:00:00, error: Schedule [7901] - The At47.job command failed to start due to the following error: General access denied error 2008-11-07 22:00:00, error: Schedule [7901] - The At23.job command failed to start due to the following error: General access denied error 2008-11-07 21:44:42, error: Service Control Manager [7034] - The Viewpoint Manager Service service terminated unexpectedly. It has done this 1 time(s). 2008-11-07 20:00:00, error: Schedule [7901] - The At45.job command failed to start due to the following error: General access denied error 2008-11-07 20:00:00, error: Schedule [7901] - The At21.job command failed to start due to the following error: General access denied error 2008-11-07 19:00:00, error: Schedule [7901] - The At44.job command failed to start due to the following error: General access denied error 2008-11-07 19:00:00, error: Schedule [7901] - The At20.job command failed to start due to the following error: General access denied error 2008-11-07 18:57:31, error: System Error [1003] - Error code 10000050, parameter1 fffffff0, parameter2 00000000, parameter3 80526441, parameter4 00000000. 2008-11-06 18:00:00, error: Schedule [7901] - The At43.job command failed to start due to the following error: General access denied error 2008-11-06 18:00:00, error: Schedule [7901] - The At19.job command failed to start due to the following error: General access denied error 2008-11-08 19:44:13, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E} 2008-11-08 19:44:18, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 2008-11-08 19:44:29, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811} 2008-11-08 19:44:54, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning. 2008-11-08 19:44:54, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 2008-11-08 19:44:54, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning. 2008-11-08 19:44:54, error: Service Control Manager [7001] - The Fax service depends on the Print Spooler service which failed to start because of the following error: The dependency service or group failed to start. 2008-11-08 19:44:54, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning. 2008-11-08 19:44:54, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD APPDRV Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss szkg Tcpip tmtdi 2008-11-09 08:47:50, error: Service Control Manager [7031] - The Media Center Receiver Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service. 2008-11-09 08:47:50, error: Service Control Manager [7034] - The Dell Wireless WLAN Tray Service service terminated unexpectedly. It has done this 1 time(s). 2008-11-09 08:47:50, error: Service Control Manager [7034] - The Ad-Aware 2007 Service service terminated unexpectedly. It has done this 1 time(s). 2008-11-09 08:47:50, error: Service Control Manager [7034] - The Ati HotKey Poller service terminated unexpectedly. It has done this 1 time(s). 2008-11-09 08:47:50, error: Service Control Manager [7034] - The AOL Connectivity Service service terminated unexpectedly. It has done this 1 time(s). 2008-11-09 08:47:50, error: Service Control Manager [7034] - The Media Center Scheduler Service service terminated unexpectedly. It has done this 1 time(s). 2008-11-09 08:47:50, error: Service Control Manager [7034] - The Machine Debug Manager service terminated unexpectedly. It has done this 1 time(s). 2008-11-09 08:47:50, error: Service Control Manager [7031] - The COM+ System Application service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service. 2008-11-09 08:47:50, error: Service Control Manager [7034] - The SupportSoft Sprocket Service (dellsupportcenter) service terminated unexpectedly. It has done this 1 time(s). 2008-11-09 08:47:50, error: Service Control Manager [7034] - The WMI Performance Adapter service terminated unexpectedly. It has done this 1 time(s). 2008-11-09 08:47:50, error: Service Control Manager [7034] - The LexBce Server service terminated unexpectedly. It has done this 1 time(s). 2008-11-09 08:47:50, error: Service Control Manager [7031] - The Media Center Extender Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service. 2008-11-09 08:47:50, error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. 2008-11-09 08:49:30, error: Service Control Manager [7034] - The LexBce Server service terminated unexpectedly. It has done this 2 time(s). 2008-11-09 08:49:30, error: Service Control Manager [7031] - The Media Center Extender Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service. 2008-11-09 08:49:30, error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. 2008-11-09 08:53:52, error: System Error [1003] - Error code 1000008e, parameter1 c0000005, parameter2 b0e35b26, parameter3 b964fba4, parameter4 00000000. 2008-11-11 20:32:47, error: MRxSmb [8003] - The master browser has received a server announcement from the computer RHONDA-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{1DEA4D76-3AD0-4D69. The master browser is stopping or an election is being forced. 2008-11-12 14:31:00, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume2'. It has stopped monitoring the volume. 2008-11-09 13:49:17, information: Windows File Protection [64016] - Windows File Protection file scan was started. 2008-11-09 13:50:39, information: Windows File Protection [64021] - The system file c:\program files\windows media player\mplayer2.exe could not be copied into the DLL cache. The specific error code is 0x000004c7 [The operation was canceled by the user. ]. This file is necessary to maintain system stability. 2008-11-09 13:50:45, information: Windows File Protection [64018] - Windows File Protection file scan was cancelled by user interaction, user name is James. 2008-11-09 15:46:09, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\windows\system32\shdocvw.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 6.0.2900.5659. 2008-11-09 15:58:59, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\windows\system32\shdocvw.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 6.0.2900.5512. ==== End Of File ===========================

See if you can delete this file.
c:\windows\system32\drivers\hhgmrs.sys

That file is not found.

What about this one?
See if you can delete this file.
c:\windows\system32\drivers\abp470n5

Also not found