Advanced Search
Welcome to Omgili,
Omgili (Oh My God I Love It ;) is a search engine for discussions. With Omgili you can find answers and solutions, debates, discussions, personal experiences, opinions and more... To learn more about Omgili click here.

This is a complete preview of the discussion as it was indexed by Omgili crawlers. Use this preview if the original discussion is unavailable.
Click here to view the original discussion.

PLEASE HELPPP!!! I suck at computers lol. (moved from Internet Forum) - Cyber Tech Help Support Forums

Ok so i had this virus where popups would come up every probably 20 seconds and eventually it made it so the internet would not load.

I finally used a virus remover to get rid of the virus and im pretty sure it is gone.

But now there is a horrible problem...whenever i try to load the internet (doesn't matter its its firefox, chrome, explorer, whatever) the internet will not load.

Now by load i don't mean like it will come up saying it can't connect, but the actual internet screen will not come up at all.

I will literally double click and it looks like something is loading and then nothing, not even a blank page comes up.

Anyway if anybody could PLEASE help me or at least tell me where to start i would honestly appreciate it so much. Thanks!

Hi Adam and welcome.

I have moved your topic to the Malware Removal Forum for now.

Your operating system may still be infected and I think it would be a good idea to have a look at what is running on your computer. I need to see some logs to do this but before you provide them, you need to know that I have made a personal decision not to help anyone who has peer to peer software installed on their computers (and this includes Bit Torrent software) so if you want my help, please uninstall any such programs now and reboot. Go here and download DDS to your Desktop and doubleclick on DDs.scr to run it.

If your security software includes script blocking features, please disable these before you run this utility.

When the scan has finished, two logs will open.

Copy and paste both reports in this topic.

The logs will be reasonably large so you may have to divide them into sections and make several posts to post them. Please do not run any programs other than those that I suggest or install any new software while I am helping you.

DDS (Ver_09-03-16.01) - NTFSx86 Run by AdamL at 14:28:06.87 on Mon 04/20/2009 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.255.77 [GMT -5:00] AV: Norton AntiVirus *On-access scanning disabled* (Outdated) AV: CyberDefender Internet Security *On-access scanning enabled* (Updated) FW: Norton AntiVirus *enabled* Running Processes C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\DNA\btdna.exe C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\16.0.0.125\ccSvcHst.exe C:\Documents and Settings\AdamL \Local Settings\Application Data\Google\Update\GoogleUpdate.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\wanmpsvc.exe C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\16.0.0.125\ccSvcHst.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Documents and Settings\AdamL \Local Settings\Application Data\Google\Update\GoogleUpdate.exe C:\Program Files\Common Files\Symantec Shared\SymSetup\{830D8CBD-C668-49e2-A969-C2C2106332E0}_14_0_0_89\{830D8CBD-C668-49e2-A969-C2C2106332E0}.exe C:\WINDOWS\system32\msiexec.exe C:\Documents and Settings\AdamL \Desktop\dds.scr Pseudo HJT Report uURLSearchHooks: N/A: {0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2} - c:\program files\asksbar\srchastt\1.bin\A2SRCHAS.DLL uURLSearchHooks: Harmony Hollow Software Toolbar: {3806b089-6759-411d-b2c3-b7995a9f34d7} - c:\program files\harmony_hollow_software\tbHarm.dll BHO: Yahoo!

Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll BHO: Video: {04a67da5-880b-452f-b193-463452c40b41} - c:\windows\tokry.dll BHO: Ask Search Assistant BHO: {0579b4b1-0293-4d73-b02d-5ebb0ba0f0a2} - c:\program files\asksbar\srchastt\1.bin\A2SRCHAS.DLL BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton antivirus\norton antivirus\engine\16.0.0.125\IPSBHO.DLL BHO: MyIdentityDefender: {a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6} - c:\documents and settings\lefty00\local settings\application data\cyberdefender\cdmyidd.dll BHO: Ask Toolbar BHO: {f0d4b231-da4b-4daf-81e4-dfee4931a4aa} - c:\program files\asksbar\bar\1.bin\ASKSBAR.DLL TB: Yahoo!

Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll TB: Ask Toolbar: {f0d4b239-da4b-4daf-81e4-dfee4931a4aa} - c:\program files\asksbar\bar\1.bin\ASKSBAR.DLL TB: MyIdentityDefender: {a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6} - c:\documents and settings\lefty00\local settings\application data\cyberdefender\cdmyidd.dll TB: Harmony Hollow Software Toolbar: {3806b089-6759-411d-b2c3-b7995a9f34d7} - c:\program files\harmony_hollow_software\tbHarm.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [ares] "c:\program files\ares\Ares.exe" -h uRun: [Veoh] "c:\program files\veoh networks\veoh\VeohClient.exe" /VeohHide uRun: [<NO NAME>] uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background uRun: [BitTorrent DNA] "c:\program files\dna\btdna.exe" uRun: [Google Update] "c:\documents and settings\adaml \local settings\application data\google\update\GoogleUpdate.exe" /c uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe" mRun: [osCheck] "c:\program files\norton antivirus\osCheck.exe" mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [Symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll" mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRunServices: [freestyle] dRun: [ALUAlert] c:\program files\symantec\liveupdate\ALUNotify.exe IE: Build LinkLister List from Selected Url(s) - c:\program files\linklister\build_from_sel.html IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.servicemenutool.com/redirect.php IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: {FCF289D4-0AC8-4ED8-BE31-E8AF09606AB5} - hxxp://static.35mb.com/applet/applet_o.cab Notify: WRNotifier - WRLogonNTF.dll AppInit_DLLs: c:\progra~1\google\google~1\goec62~1.dll, c:\progra~1\google\google~1\goec62~1.dll LSA: Notification Packages = scecli scecli FIREFOX FF - ProfilePath - c:\docume~1\adaml0~1\applic~1\mozilla\firefox\prof iles\ldp60ua6.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p= FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/ FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p= FF - component: c:\documents and settings\adaml \application data\mozilla\firefox\profiles\ldp60ua6.default\ext ensions\{7c5c0f58-e061-457d-9033-77307f5ed00c}\components\FFAlert.dll FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\ipsffplgn\components\IPSFFPl.

Dll FF - plugin: c:\documents and settings\adaml \local settings\application data\google\update\1.2.141.5\npGoogleOneClick7.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPAskSBr.dll FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll SERVICES / DRIVERS R0 SSFS041A;Spy Sweeper File System Filer Driver: 041A;c:\windows\system32\drivers\SSFS041A.sys [2006-10-26 13824] R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nav\1 .07d\SymEFA.sys [2008-12-21 309296] R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\nav\1 .07d \BHDrvx86.sys [2008-12-21 254512] R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\nav\1 .0 7d\ccHPx86.sys [2008-12-21 362544] R2 5F510EF6B3B36214;5F510EF6B3B36214;c:\documents and settings\wrestling\5f510ef6b3b36214\5F510EF6B3B362 14 [] R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2006-9-3 105632] R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2006-9-3 105632] R2 Norton AntiVirus;Norton AntiVirus;c:\program files\norton antivirus\norton antivirus\engine\16.0.0.125\ccSvcHst.exe [2008-12-21 115560] R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [2005-10-17 2368] R2 Symantec Core LC;Symantec Core LC;c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe [2005-5-21 1087680] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2007-1-10 24652] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2008-12-21 99376] R3 WUSB54GV4SRV;Linksys Wireless-G USB Network Adapter Driver;c:\windows\system32\drivers\rt2500usb.sys [2005-4-27 79616] S1 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\ipsdefs\20080826.

006\IDSxpx86.sys [2008-12-21 274808] S3 CDAVFS;CDAVFS;c:\windows\system32\drivers\CDAVFS.s ys [2008-11-28 67424] S3 IKFileSec;File Security Driver;c:\windows\system32\drivers\ikfilesec.sys [2009-2-17 40840] S3 IKSysFlt;System Filter Driver;c:\windows\system32\drivers\iksysflt.sys [2009-2-17 66952] S3 IKSysSec;System Security Driver;c:\windows\system32\drivers\iksyssec.sys [2009-2-17 81288] S3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\2008082 9.024\NAVENG.SYS [2008-12-21 89104] S3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\2008082 9.024\NAVEX15.SYS [2008-12-21 873552] S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-2-17 356920] S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-2-17 1079176] S3 tcpip_patcher;tcpip_patcher;\??\c:\program files\ares\tcpip_patcher.sys -->

C:\program files\ares\tcpip_patcher.sys [?] S3 YFBPCHIOWFC;YFBPCHIOWFC;c:\docume~1\adam00\locals~ 1\temp\yfbpchiowfc.exe -->

C:\docume~1\adam00\locals~1\temp\YFBPCHIOWFC.exe [?] S3 ZVVQA;ZVVQA;c:\docume~1\adam00\locals~1\temp\zvvqa .exe -->

C:\docume~1\adam00\locals~1\temp\ZVVQA.exe [?] Created Last 30 2009-04-19 17:14 <DIR>

--dsh--- c:\documents and settings\adaml \IECompatCache 2009-04-19 17:10 <DIR>

--dsh--- c:\documents and settings\adaml \PrivacIE 2009-04-19 17:01 <DIR>

--dsh--- c:\documents and settings\adaml \IETldCache 2009-04-19 16:55 <DIR>

-cd-h--- c:\windows\ie8 2009-04-12 22:28 <DIR>

--d c:\docume~1\alluse~1\applic~1\Azureus 2009-04-12 22:27 <DIR>

--d c:\docume~1\adaml0~1\applic~1\Azureus 2009-04-12 22:23 <DIR>

--d c:\program files\common files\i4j_jres 2009-04-12 22:03 <DIR>

--d c:\program files\TorrentMan 2009-04-12 22:03 <DIR>

--d c:\program files\BitLord 2009-04-12 21:51 <DIR>

--d c:\docume~1\adaml0~1\applic~1\uTorrent 2009-04-07 22:48 149,833 a C:\jg.jpg Find3M 2009-03-08 04:34 914,944 a c:\windows\system32\wininet.dll 2009-03-08 04:34 43,008 a c:\windows\system32\licmgr10.dll 2009-03-08 04:33 18,944 a c:\windows\system32\corpol.dll 2009-03-08 04:33 420,352 a c:\windows\system32\vbscript.dll 2009-03-08 04:32 72,704 a c:\windows\system32\admparse.dll 2009-03-08 04:32 71,680 a c:\windows\system32\iesetup.dll 2009-03-08 04:31 34,816 a c:\windows\system32\imgutil.dll 2009-03-08 04:31 48,128 a c:\windows\system32\mshtmler.dll 2009-03-08 04:31 45,568 a c:\windows\system32\mshta.exe 2009-03-08 04:22 156,160 a c:\windows\system32\msls31.dll 2009-02-17 13:08 1,594 a c:\windows\system32\tmp.reg 2009-02-09 13:56 67,584 a c:\windows\system32\ff_vfw.dll 2009-02-09 05:19 1,846,272 a c:\windows\system32\win32k.sys FINISH: 14:29:09.75

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-03-16.01) Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume2 Install Date: 4/25/2005 8:31:32 PM System Uptime: 4/20/2009 2:13:58 PM (0 hours ago) Motherboard: Intel Corporation | | D845PT Processor: Intel(R) Pentium(R) 4 CPU 1.70GHz | J1E1 | 1694/100mhz ==== Disk Partitions A: is Removable C: is FIXED (NTFS) - 37 GiB total, 0.265 GiB free. D: is CDROM () E: is CDROM () ==== Disabled Device Manager Items Class GUID: {4D36E96B-E325-11CE-BFC1-08002BE10318} Description: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard Device ID: ACPI\PNP0303\4&268D196D&0 Manufacturer: (Standard keyboards) Name: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard PNP Device ID: ACPI\PNP0303\4&268D196D&0 Service: i8042prt ==== System Restore Points No restore point in system. ==== Installed Programs Ad-Aware SE Personal Adobe Flash Player 9 Adobe Flash Player ActiveX Adobe Shockwave Player Amazing Photo Editor V6.2 America Online (Choose which version to remove) AOL Coach Version 1.0(Build:20030807.3) AppCore Apple Software Update Ask Toolbar AutoUpdate AV ccCommon CD-DA X-Tractor v0.24 Conexant HSF V92 56K Data Fax PCI Modem CyberDefender Early Detection Center DivX Converter DivX Player DivX Web Player DNA ESPN RunTime Gamevance Google Chrome Google Desktop Google Toolbar for Internet Explorer Harmony_Hollow_Software Toolbar Hotfix for Windows XP (KB896344) Hotfix for Windows XP (KB952287) K-Lite Codec Pack 4.6.2 (Full) Learn2 Player (Uninstall Only) Linksys Wireless-G USB Network Adapter LiveUpdate 3.1 (Symantec Corporation) LiveUpdate Notice (Symantec Corporation) Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft .NET Framework 2.0 Service Pack 1 Mozilla Firefox (3.0.8) MSN Music Assistant MyIdentityDefender Toolbar (CyberDefender Corporation) NoAdware v5.0 Norton AntiVirus Norton AntiVirus (Symantec Corporation) Norton AntiVirus Parent MSI Norton AntiVirus SYMLT MSI Norton Protection Center NVIDIA Drivers Project64 1.6 QuickTime RealPlayer Security Update for CAPICOM (KB931906) Security Update for Step By Step Interactive Training (KB898458) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player 10 (KB936782) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows Media Player 9 (KB917734) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899588) Security Update for Windows XP (KB899589) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911567) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB917159) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB918899) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920214) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921398) Security Update for Windows XP (KB921883) Security Update for Windows XP (KB922616) Security Update for Windows XP (KB922760) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923694) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925454) Security Update for Windows XP (KB925486) Security Update for Windows XP (KB925902) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928090) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) Security Update for Windows XP (KB929123) Security Update for Windows XP (KB929969) Security Update for Windows XP (KB930178) Security Update for Windows XP (KB931261) Security Update for Windows XP (KB931768) Security Update for Windows XP (KB931784) Security Update for Windows XP (KB932168) Security Update for Windows XP (KB933566) Security Update for Windows XP (KB933729) Security Update for Windows XP (KB935839) Security Update for Windows XP (KB935840) Security Update for Windows XP (KB936021) Security Update for Windows XP (KB937894) Security Update for Windows XP (KB938127) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB938829) Security Update for Windows XP (KB941202) Security Update for Windows XP (KB941568) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB941644) Security Update for Windows XP (KB941693) Security Update for Windows XP (KB943055) Security Update for Windows XP (KB943460) Security Update for Windows XP (KB943485) Security Update for Windows XP (KB944338) Security Update for Windows XP (KB944533) Security Update for Windows XP (KB944653) Security Update for Windows XP (KB945553) Security Update for Windows XP (KB946026) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB947864) Security Update for Windows XP (KB948590) Security Update for Windows XP (KB948881) Security Update for Windows XP (KB950749) Security Update for Windows XP (KB950759) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953838) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956390) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958215) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960714) Security Update for Windows XP (KB960715) Spyware Doctor 6.0 Symantec SymNet The Weather Channel Desktop 6 Update for Windows XP (KB894391) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB904942) Update for Windows XP (KB908531) Update for Windows XP (KB910437) Update for Windows XP (KB911280) Update for Windows XP (KB916595) Update for Windows XP (KB920342) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB927891) Update for Windows XP (KB929338) Update for Windows XP (KB930916) Update for Windows XP (KB931836) Update for Windows XP (KB936357) Update for Windows XP (KB938828) Update for Windows XP (KB942763) Update for Windows XP (KB942840) Update for Windows XP (KB951072-v2) Update for Windows XP (KB955839) Update for Windows XP (KB967715) Viewpoint Manager (Remove Only) Viewpoint Media Player WebFldrs XP Windows Genuine Advantage Validation Tool (KB892130) Windows Internet Explorer 8 Windows Media Format Runtime Windows Media Format SDK Hotfix - KB891122 Windows Media Player 10 Windows XP Hotfix - KB873333 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891781 WinRAR archiver Yahoo!

Toolbar ==== Event Viewer Messages From Past Week 4/20/2009 5:02:12 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 29 time(s). 4/20/2009 4:57:51 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 28 time(s). 4/20/2009 4:52:49 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 27 time(s). 4/20/2009 4:48:16 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 26 time(s). 4/20/2009 4:42:42 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 25 time(s). 4/20/2009 4:38:58 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 24 time(s). 4/20/2009 4:34:41 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 23 time(s). 4/20/2009 4:29:58 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 22 time(s). 4/20/2009 4:24:21 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 21 time(s). 4/20/2009 4:18:49 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 20 time(s). 4/20/2009 4:14:35 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 19 time(s). 4/20/2009 4:09:51 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 18 time(s). 4/20/2009 4:04:42 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 17 time(s). 4/20/2009 4:00:12 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 16 time(s). 4/20/2009 3:55:16 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 15 time(s). 4/20/2009 3:51:08 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 14 time(s). 4/20/2009 3:46:32 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 13 time(s). 4/20/2009 3:40:50 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 12 time(s). 4/20/2009 3:35:42 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 11 time(s). 4/20/2009 3:30:48 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 10 time(s). 4/20/2009 3:25:54 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 9 time(s). 4/20/2009 3:21:37 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 8 time(s). 4/20/2009 3:17:50 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 7 time(s). 4/20/2009 3:12:52 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 6 time(s). 4/20/2009 3:08:14 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 5 time(s). 4/20/2009 3:02:59 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 4 time(s). 4/20/2009 2:58:02 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 3 time(s). 4/20/2009 2:28:46 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the Norton AntiVirus service. 4/19/2009 4:54:29 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {9B1F122C-2982-4E91-AA8B-E071D54F2A4D} 4/19/2009 4:39:36 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD BHDrvx86 ccHP eeCtrl Fips IPSec MRxSmb NetBIOS NetBT Processor RasAcd Rdbss SRTSPX SYMTDI Tcpip 4/19/2009 4:39:33 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning. 4/19/2009 4:39:33 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning. 4/19/2009 4:39:33 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 4/19/2009 4:39:33 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning. 4/19/2009 4:29:25 PM, error: Dhcp [1002] - The IP address lease 192.168.1.101 for the Network Card with network address 001217A3C664 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). 4/18/2009 9:55:27 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} 4/18/2009 5:24:09 PM, error: SideBySide [61] - Syntax error in manifest or policy file "C:\Program Files\Apple Software Update\Plugins\MSIInstallPlugin.dll.Manifest" on line 2.

The required attribute version is missing from element assemblyIdentity. 4/18/2009 5:24:09 PM, error: SideBySide [59] - Generate Activation Context failed for C:\Program Files\Apple Software Update\Plugins\MSIInstallPlugin.dll.Manifest.

Reference error message: The operation completed successfully.

. 4/18/2009 5:24:09 PM, error: SideBySide [58] - Syntax error in manifest or policy file "C:\Program Files\Apple Software Update\Plugins\MSIInstallPlugin.dll.Manifest" on line 2. 4/18/2009 5:24:08 PM, error: SideBySide [61] - Syntax error in manifest or policy file "C:\Program Files\Apple Software Update\Plugins\EXEInstallPlugin.dll.Manifest" on line 2.

The required attribute version is missing from element assemblyIdentity. 4/18/2009 5:24:08 PM, error: SideBySide [59] - Generate Activation Context failed for C:\Program Files\Apple Software Update\Plugins\EXEInstallPlugin.dll.Manifest.

Reference error message: The operation completed successfully.

. 4/18/2009 5:24:08 PM, error: SideBySide [58] - Syntax error in manifest or policy file "C:\Program Files\Apple Software Update\Plugins\EXEInstallPlugin.dll.Manifest" on line 2. 4/16/2009 12:55:33 PM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 2 time(s). 4/16/2009 12:23:07 AM, error: Service Control Manager [7000] - The Application Layer Gateway Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 4/16/2009 12:23:06 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Application Layer Gateway Service service to connect. 4/16/2009 12:17:24 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 4/15/2009 12:47:06 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811} 4/15/2009 11:39:22 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: BHDrvx86 ccHP eeCtrl Fips Processor SRTSPX SYMTDI 4/15/2009 1:07:44 AM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly.

It has done this 1 time(s). 4/15/2009 1:07:40 AM, error: Service Control Manager [7022] - The PC Tools Security Service service hung on starting. 4/15/2009 1:06:04 AM, error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: This operation returned because the timeout period expired. 4/14/2009 12:54:08 PM, error: Service Control Manager [7022] - The IPSEC Services service hung on starting. 4/14/2009 1:06:23 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the LiveUpdate service to connect. 4/14/2009 1:06:23 PM, error: Service Control Manager [7000] - The LiveUpdate service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 4/14/2009 1:06:16 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service LiveUpdate with arguments "" in order to run the server: {03E0E6C2-363B-11D3-B536-00902771A435} 4/13/2009 6:52:36 PM, error: Dhcp [1002] - The IP address lease 192.168.1.102 for the Network Card with network address 001217A3C664 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). ==== End Of File

Btw i am using the internet in safe mode with networking that is how i can post this but i did the scan in normal mode.

Just wanted to let you know in case it matters.

I really do appreciate the help thank you.

Haha sorry for posting so much but one last thing...I had a P2P program called Vezu(sp.?) and Bittorrent but i deleted them both and i hope i did it correctly and uninstalled it right...Thanks!

Yes and can you please also uninstall DNA.

Reboot when you have done this. Adam there are malware startups still showing in your log so I also need to see another type of log. Download the latest version of Gmer from here to your Desktop.

Once downloaded, doubleclick on gmer.zip and unzip the file to its own folder When you have done this, close all running programs including those in your notification area (bottom righthand corner of your screen) and doubleclick on Gmer.exe to run it.

Click on the Rootkit tab and look at the righthand side (under Files) and uncheck all drives with the exception of your C drive and then click on Scan (before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while this scan completes.

Also do not use your computer during the scan).

When completed, click on the Copy button and rightclick on your Desktop, choose "New" >

Text document. Once the file is created, open it and rightclick again and choose Paste.

Save the file and copy the information and post it here please. Warning!

Please do not select the "Show all" checkbox during the scan What was the name of the virus that you were infected with?

Also please confirm that you have uninstalled DNA.

Ok the DNA is gone and i did the scan (hopefully correctly).

Thanks again seriously you're awesome! GMER 1.0.15.14966 - http://www.gmer.net Rootkit scan 2009-04-21 00:02:46 Windows 5.1.2600 Service Pack 2 ---- System - GMER 1.0.15 ---- SSDT 8237EA20 ZwAlertResumeThread SSDT 8237EAE0 ZwAlertThread SSDT 8237F1E8 ZwAllocateVirtualMemory SSDT 8237E290 ZwAssignProcessToJobObject SSDT 82645E88 ZwConnectPort SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwCreateKey [0xF6ED4020] SSDT 8237E7D0 ZwCreateMutant SSDT 8275D460 ZwCreateProcess SSDT 8275D3E8 ZwCreateProcessEx SSDT 8237E0F0 ZwCreateSymbolicLinkObject SSDT 82382388 ZwCreateThread SSDT 8237E350 ZwDebugActiveProcess SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteKey [0xF6ED42A0] SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteValueKey [0xF6ED4800] SSDT 8237F378 ZwDuplicateObject SSDT 8237F048 ZwFreeVirtualMemory SSDT 8237E8A0 ZwImpersonateAnonymousToken SSDT 8237E960 ZwImpersonateThread SSDT 8237E4D0 ZwLoadDriver SSDT 8237EF70 ZwMapViewOfSection SSDT 8237E710 ZwOpenEvent SSDT 8237F518 ZwOpenProcess SSDT 8237F2B8 ZwOpenProcessToken SSDT 8237E590 ZwOpenSection SSDT 8237F448 ZwOpenThread SSDT 8237E1C0 ZwProtectVirtualMemory SSDT 82748DC8 ZwQueueApcThread SSDT 82748C60 ZwReadVirtualMemory SSDT 8275D640 ZwRenameKey SSDT 82383288 ZwResumeThread SSDT 8237ED20 ZwSetContextThread SSDT 8275D5C8 ZwSetInformationKey SSDT 8237EDE0 ZwSetInformationProcess SSDT 82748F30 ZwSetInformationThread SSDT 8237E410 ZwSetSystemInformation SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwSetValueKey [0xF6ED4A50] SSDT 8237E650 ZwSuspendProcess SSDT 8237EBA0 ZwSuspendThread SSDT 8237F630 ZwTerminateProcess SSDT 8237EC60 ZwTerminateThread SSDT 8237EEB0 ZwUnmapViewOfSection SSDT 8237F118 ZwWriteVirtualMemory ---- Kernel code sections - GMER 1.0.15 ---- .text ntoskrnl.exe!_abnormal_termination + 7C 804E26D8 8 Bytes JMP EAE08237 .text ntoskrnl.exe!_abnormal_termination + 90 804E26EC 4 Bytes CALL D1D05EE2 .text ntoskrnl.exe!_abnormal_termination + 199 804E27F5 3 Bytes [F0, 37, 82] .text ntoskrnl.exe!_abnormal_termination + 1B0 804E280C 4 Bytes CALL 643BAA48 .text ntoskrnl.exe!_abnormal_termination + 1B8 804E2814 4 Bytes JMP B07FAA50 ?

SYMEFA.SYS The system cannot find the file specified.

! ? C:\Documents and Settings\Wrestling\5F510EF6B3B36214\5F510EF6B3B362 14 Access is denied. ---- Kernel IAT/EAT - GMER 1.0.15 ---- IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisDeregisterProtocol] 82748B08 IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisRegisterProtocol] 82748B80 IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] 82748B80 IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] 82748B08 IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol] 82748B08 IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] 82748B80 IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] 82748B80 IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] 82748B08 IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] 82748B80 IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] 82748B08 IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] 82748B80 ---- Devices - GMER 1.0.15 ---- AttachedDevice \FileSystem\Ntfs \Ntfs SSFS041A.SYS (Spy Sweeper FileSystem Filter Driver/Webroot Software Inc ( www.webroot.com )) Device \Driver\Tcpip \Device\Ip 82566888 AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation) Device \Driver\Tcpip \Device\Tcp 82566888 AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation) Device \Driver\Tcpip \Device\Udp 82566888 AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation) Device \Driver\Tcpip \Device\RawIp 82566888 AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation) Device \Driver\Tcpip \Device\IPMULTICAST 82566888 Device \FileSystem\Fastfat \Fat F25D5C8A AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation) AttachedDevice \FileSystem\Fastfat \Fat SSFS041A.SYS (Spy Sweeper FileSystem Filter Driver/Webroot Software Inc ( www.webroot.com )) ---- Services - GMER 1.0.15 ---- Service C:\Documents and Settings\Wrestling\5F510EF6B3B36214\5F510EF6B3B362 14 (*** hidden *** ) [AUTO] 5F510EF6B3B36214 <-- ROOTKIT !!! ---- EOF - GMER 1.0.15 ----

Oh and as for the virus i remember it was a trojan but not sure which one.

I think, but am not a 100 percent positive, that it came from some fake anti-virus software or something.

And when i had it popups would come up every like 20 seconds saying i needed to purchase some software to get ride of the virus.

Im looking on the internet right now and Win32.Trojan.RX...

Sounds familiar i think that was it. ~Adam~

Wow! I actually tried downloading a product called superspyware and i did a scan and my computer somehow works again!!!

Anyway i do wanna say thank you so much for the help and im sure you would have found the problem as well so thanks again i really do appreciate your help..especially since you do not even get paid to do it! Btw, i was just wondering why you want people do delete p2p programs..this is out of total curiosity and not as an insult. Thank ya, Adam

Hi Adam, I dont mind you asking.

Someone else asked me that question a while back.

See my reply here .

Also see the warning about Virut here . I can see several problems in your logs Adam including a possible rootkit infection.

I have my doubts that SAS can get rid of these but it's up to you.

If you want me to check, you will have to post a new DDS log.