[paulxh]

I have an IBM ThinkPad laptop, running XP-pro, I picked up a malware and now the WIFI will no longer connect. I believe I have removed the malware file, "hppuser.exe", I uninstalled my one HP driver and made sure the hard disk was cleaned up of all HP files, even took "hppuser.exe" out of the regestry.
The malware also shut-down the windows firewall. I ran "IPCONFIG/all", perhaps this is a starting point. Maybe you can give me any help or ideas of what to do.

Windows IP Configuration

Host Name . . . . . . . . . . . . : think_pad
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Wireless Network Connection:

Media State . . . . . . . . . . . : Media disconnected
Description . . . . . . . . . . . : Intel(R) PRO/Wireless 2915ABG Network Connection
Physical Address. . . . . . . . . : 00-12-F0-EF-76-07

Ethernet adapter Local Area Connection:

Media State . . . . . . . . . . . : Media disconnected
Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet
Physical Address. . . . . . . . . : 00-11-25-D3-A5-11

[flavallee]

Download and save and then reinstall the Intel PRO/Wireless 2915ABG driver (topmost download link).

http://downloadcenter.intel.com/Deta...adType=Drivers

------------------------------------------------------------

If reinstalling the wireless driver doesn't resolve the issue, click the orange "Report" link and then request to have your thread moved to the Networking forum.

------------------------------------------------------------

[paulxh]

after running the Intel PRO/Wireless 2915ABG driver, I do have an IP: Autoconfiguration IP Address. . . : 169.254.49.207

but even when the WIFI signal is excellent, I still get low or no conductivity

[etaf]

What firewall / security suite or anti-virus do you currently have on the PC - or you have ever had on the PC in the past - any trial ware - like Norton, Mcafee , AVG etc


do the following tcp/ip stack repair and post back the status of services - see below
------------------------------------------------------------------------

TCP/IP stack repair options for use with Windows XP with SP2/SP3

Start, Run, CMD to open a command prompt box (A new dialogue box - black with white font, will appear on screen ):

In the command prompt window that opens, type type the following commands:

Note: Type only the text in bold and red for the following commands.

Reset TCP/IP stack to installation defaults, type: netsh int ip reset reset.log and press enter

Reset WINSOCK entries to installation defaults, type: netsh winsock reset catalog and press enter

ReStart (reboot) the machine.

Please note and post back - if you receive the following message :-
Access is Denied

please Post back the results in a reply here - its important we know that these commands have worked correctly and not produced any errors
rightclick in the command prompt box
select all
enter
control key + C key - to copy
then reply here and
control key + V to paste

Details also here
http://support.microsoft.com/kb/299357

------------------------------------------------------------------------

------------------------------------------------------------------------
Status of Services

We would like to see some status information for each of the services listed below.

To do this goto

Start> Run {search bar in Vista/W7}> type CMD to open a command prompt box (A new dialogue box - black with white font, will appear on screen ):

Type the following command
SERVICES.MSC

OR
Control Panel>
Administrative Tools>
Services>

then for each of the services listed below - Please post back the following status information;
If the service is set to Started or Stopped
and
If the service is set to Automatic or Manual

• COM+ Event System (for WZC issues)
• Computer Browser
• DHCP Client
• DNS Client
• Network Connections
• Network Location Awareness
• Remote Procedure Call (RPC)
• Server
• TCP/IP Netbios helper
• Wireless Zero Configuration (XP wireless configurations only)
• WLAN AutoConfig (Windows 7 & Vista wireless configurations only)
• Workstation

If any of those services are not started/running,
then right click on the service
then from the menu choose properties and now check the dependencies.

for each dependancy entry - Check each of one of the dependencies and see which one is preventing the service from running/starting.

[paulxh]

No external fire wall has ever been on this labtop as far as I know,
for I did buy the laptop as an offlease.

* --- command ----- netsh int ip reset reset.log --------------
nothing but a prompt came back
job done, - I guess.

* --- command ----- netsh winsock reset catalog ---------------
Unable to reset the Winsock Catalog.
The system cannot find the file specified.

After reboot


* - status of service -

COM+ Event System: started manual
Computer Browser: started automatic
DHCP Client: started automatic
DSN Client: started automatic
Network Connections: started manual
Network Location Awareness: "blank" manual
Remote Procedure Call (RPC): started automatic
Server: started automatic
TCP/IP Netbios helper: started automatic
Wireless Zero Configuration, (for XP): started automatic
Workstation: started automatic

[etaf]

what SP (service pack) version is XP running ?
needs to be at SP3

[paulxh]

it is service pack 3

[etaf]

I think we have an issue with the TCP/IP stack repair

this is where my expertise starts to be pushed to the limit , so please have a read here
http://support.microsoft.com/kb/811259
about half way done the page , it starts to talk about windows XP

also i see a few issues with

Unable to reset the Winsock Catalog.
The system cannot find the file specified.

where winsockxpFix has resolved the issue
Now I have not run this here, but have seen this run here, but that wasfor machines before XP SP2 and the commands i posted should do that for SP3
anyway heres the links
http://www.spychecker.com/program/winsockxpfix.html
http://majorgeeks.com/WinSock_XP_Fix_d4372.html

[paulxh]

I ran several of the commands that were on the microsoft link that you sent me and I am able to connect back to the internet, I am writing this from my once broken laptop, Thanks. Still one issue - when I try using the FTP protocol to upload to a website, I get a winsock error and the connection aborts.

Unable to connect: powerministries.info! (500 Control connection closed. Connection aborted (Winsock error #10053))
/* Winsock Error #10053:
WSAECONNABORTED - Software caused connection abort. An established connection was aborted due to a data transmission time-out or protocol error. The time-out was possibly caused by a Firewall program. */

This was the original malware error, so there is still a concern that not all is yet totally fixed. I have not yet downloaded the repair tools that you pointed me to, should I do that?

[etaf]

No - lets assume its malware related- in which case on this forum you need advice from an authorised malware member in the virus forum - BUT before i transfer to that forum, read here and post all the logs

http://forums.techguy.org/virus-othe...e-posting.html

and once the logs are posted and transferred - it can take 48hrs before a reply - if no reply then you reply with the word bump in the reply to bring to the top of the forum again - but only after 48 hours have elapsed after logs posted and moved

[paulxh]

I ran both the tools HijackThis and DDS, here are the results, you guys are GREAT for doing this - thanks.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 1:22:18 PM, on 7/28/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\ICO.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Paul\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Freecorder - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\prxtbFre0.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} - (no file)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: UrlHelper Class - {474597C5-AB09-49d6-A4D5-2E8D7341384E} - (no file)
O2 - BHO: MediaBar - {ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F} - (no file)
O2 - BHO: PhotoJoy Bar - {cf45c54f-801c-41b5-ac77-57f2bf418edc} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: MediaBar - {ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F} - (no file)
O3 - Toolbar: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\prxtbFre0.dll
O3 - Toolbar: PhotoJoy Bar Toolbar - {cf45c54f-801c-41b5-ac77-57f2bf418edc} - (no file)
O3 - Toolbar: Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Advanced SystemCare 5] "C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe" /Manual
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Monitor Apache Servers.lnk = C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs:
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Advanced SystemCare Service 5 (AdvancedSystemCareService5) - IObit - C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe
O23 - Service: Apache2.2 - Apache Software Foundation - C:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exe
O23 - Service: Defragmentation-Service (DfSdkS) - mst software GmbH, Germany - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 7\DfsdkS.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless WiFi Service (S24EventMonitor) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 7136 bytes

[paulxh]

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_24
Run by Paul at 13:34:36 on 2012-07-28
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.418 [GMT -6:00]
.
.
============== Running Processes ===============
.
C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\ICO.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\System32\NOTEPAD.EXE
.
============== Pseudo HJT Report ===============
.
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - c:\program files\freecorder\prxtbFre0.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Babylon toolbar helper: {2eecd738-5844-4a99-b4b6-146bf802613b} - Babylon toolbar helper
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: {474597c5-ab09-49d6-a4d5-2e8d7341384e} - UrlHelper Class
BHO: MediaBar: {abb49b3b-ab7d-4ed0-9135-93fd5aa4f69f} - MediaBar
BHO: PhotoJoy Bar: {cf45c54f-801c-41b5-ac77-57f2bf418edc} - PhotoJoy Bar Toolbar
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: MediaBar: {abb49b3b-ab7d-4ed0-9135-93fd5aa4f69f} -
TB: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - c:\program files\freecorder\prxtbFre0.dll
TB: PhotoJoy Bar Toolbar: {cf45c54f-801c-41b5-ac77-57f2bf418edc} -
TB: Babylon Toolbar: {98889811-442d-49dd-99d7-dc866be87dbc} -
uRun: [Advanced SystemCare 5] "c:\program files\iobit\advanced systemcare 5\ASCTray.exe" /Manual
mRun: [SoundMAXPnP] c:\program files\analog devices\soundmax\SMax4PNP.exe
mRun: [SoundMAX] c:\program files\analog devices\soundmax\Smax4.exe /tray
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [Mouse Suite 98 Daemon] ICO.EXE
mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\monito~1.lnk - c:\program files\apache software foundation\apache2.2\bin\ApacheMonitor.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
TCP: DhcpNameServer = 10.40.100.3 10.1.100.58 10.110.100.2
TCP: Interfaces\{9C297F9B-8635-407B-A84A-524173B195AB} : DhcpNameServer = 10.40.100.3 10.1.100.58 10.110.100.2
Notify: igfxcui - igfxdev.dll
AppInit_DLLs:
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: {a5780613-492e-4a2a-a7fd-549610edf6cc} - HookRC Class
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\paul\application data\mozilla\firefox\profiles\etz01d75.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2966884&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Blekko
FF - prefs.js: browser.startup.homepage - hxxp://powerministries.info/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?btnI=I%27m+Feeling+Lucky&ie=UTF-8&oe=UTF-8&q=
FF - component: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrows errecordext.dll
FF - component: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrows errecordlegacyext.dll
FF - component: c:\documents and settings\paul\application data\mozilla\firefox\profiles\etz01d75.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\components\RadioWMPCoreGecko19.dll
FF - component: c:\documents and settings\paul\application data\mozilla\firefox\profiles\etz01d75.default\extensions\{cf45c54f-801c-41b5-ac77-57f2bf418edc}\components\RadioWMPCoreGecko19.dll
FF - component: c:\documents and settings\paul\application data\mozilla\firefox\profiles\etz01d75.default\extensions\engine@conduit.co m\components\RadioWMPCoreGecko19.dll
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserre cordext.dll
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim. dll
FF - plugin: c:\documents and settings\paul\application data\mozilla\firefox\profiles\etz01d75.default\extensions\{cf45c54f-801c-41b5-ac77-57f2bf418edc}\plugins\np-mswmp.dll
FF - plugin: c:\documents and settings\paul\application data\mozilla\plugins\np-mswmp.dll
FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\nphssb.dll
FF - plugin: c:\program files\wordweb\wcapturemoz\plugins\npWCX.dll
.
---- FIREFOX POLICIES ----
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true);user_pref(extensions.BabylonToolbar_i.babTrack, affID=110806
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 28afdbaf0000000000000012f0ef7607
FF - user.js: extensions.BabylonToolbar_i.hardId - 28afdbaf0000000000000012f0ef7607
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15430
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1714:05:07
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: security.csp.enable - false
.
.
============= SERVICES / DRIVERS ===============
.
R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files\iobit\advanced systemcare 5\ASCService.exe [2012-6-20 500568]
R2 Apache2.2;Apache2.2;c:\program files\apache software foundation\apache2.2\bin\httpd.exe [2011-5-20 20549]
S3 DfSdkS;Defragmentation-Service;c:\program files\ashampoo\ashampoo winoptimizer 7\DfSdkS.exe [2011-8-13 406016]
.
=============== Created Last 30 ================
.
2012-07-28 18:59:59 283504 ----a-w- c:\program files\ReimageRepair.exe
2012-07-28 18:41:06 1445888 ----a-w- c:\program files\WinsockxpFix.exe
2012-07-28 18:38:00 650240 ----a-w- c:\program files\MicrosoftFixit50203.msi
2012-07-28 02:04:26 -------- d-----w- c:\program files\Support Tools
2012-07-20 00:32:14 4679665 ----a-w- c:\program files\ICS_Dx32.exe
2012-07-18 14:51:10 -------- d-----w- c:\windows\system32\wbem\Logs
2012-07-11 22:53:32 60032 -c--a-w- c:\windows\system32\dllcache\usbaudio.sys
2012-07-11 22:53:32 60032 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys
2012-07-07 17:33:50 -------- d-----w- c:\windows\system32\wbem\repository\FS
2012-07-07 17:33:50 -------- d-----w- c:\windows\system32\wbem\Repository
.
==================== Find3M ====================
.
2012-06-23 18:41:01 1565943 ----a-w- c:\program files\scantool_setup.exe
2012-06-23 18:31:39 1501801 ----a-w- c:\program files\ErrorRepair_file.exe
2012-06-20 23:00:18 605528 ----a-w- c:\program files\asc5-pro-setup.exe
2012-06-20 22:36:00 463080 ----a-w- c:\program files\cnet2_RegpairSetup_exe.exe
2012-06-20 21:48:07 4765704 ----a-w- c:\program files\PC Utility Kit Installer.exe
2012-06-02 21:19:44 22040 ----a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 21:19:38 219160 ----a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 21:19:38 15384 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 21:19:34 15384 ----a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 21:19:30 17944 ----a-w- c:\windows\system32\wuaueng.dll.mui
2012-05-11 11:38:02 385024 ----a-w- c:\windows\system32\html.iec
2011-11-19 22:45:52 273912 -c--a-w- c:\program files\DriverPerformer-T2FIBDCO.exe
2011-07-09 18:35:43 5142844 -c--a-w- c:\program files\httpd-2.2.19-win32-x86-no_ssl.msi
2011-05-17 00:55:56 15872 -c--a-w- c:\program files\WIFISignalStrength.exe
2009-12-11 23:49:50 10240536 -c--a-w- c:\program files\WhiteSmoke_Enrichment_Full.exe
2009-10-05 22:03:09 18489584 -c--a-w- c:\program files\ActivePerl-5.10.1.1006-MSWin32-x86-291086.msi
.
============= FINISH: 13:34:50.92 ===============

[paulxh]

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 5/1/2009 10:13:56 PM
System Uptime: 7/28/2012 11:49:30 AM (2 hours ago)
.
Motherboard: IBM | | 1871FU1
Processor: Intel(R) Pentium(R) M processor 1.60GHz | None | 798/533mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 34 GiB total, 23.327 GiB free.
D: is CDROM (CDFS)
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP197: 6/18/2012 9:25:04 PM - Removed Visual C++ Runtime for Dragon NaturallySpeaking.
RP198: 6/20/2012 6:12:10 PM - SpeedyPC Pro Backup
RP199: 6/20/2012 6:12:23 PM - PC Utility Kit Backup
RP200: 6/20/2012 6:12:35 PM - SpeedyPC Pro Backup
RP201: 7/3/2012 9:18:25 PM - Software Distribution Service 3.0
RP202: 7/3/2012 9:19:28 PM - Software Distribution Service 3.0
RP203: 7/3/2012 9:18:37 PM - Installed WISE-FTP
RP204: 7/3/2012 9:19:56 PM - Removed WISE-FTP
RP205: 7/3/2012 9:20:11 PM - System Checkpoint
RP206: 7/3/2012 9:19:14 PM - System Checkpoint
RP207: 7/3/2012 9:19:40 PM - System Checkpoint
RP208: 7/3/2012 9:19:01 PM - IObit Uninstaller restore point
RP209: 7/3/2012 9:18:14 PM - Removed e-Sword
RP210: 7/3/2012 9:18:48 PM - IObit Uninstaller restore point
RP211: 7/17/2012 10:13:23 PM - PC Utility Kit Backup
RP212: 7/17/2012 10:14:38 PM - Restore Operation
RP213: 7/7/2012 1:20:45 PM - Installed e-Sword
RP214: 7/7/2012 1:24:58 PM - Installed e-Sword
RP215: 7/17/2012 10:13:33 PM - Installed e-Sword
RP216: 7/17/2012 10:14:27 PM - System Checkpoint
RP217: 7/17/2012 10:13:57 PM - PC Utility Kit Backup
RP218: 7/17/2012 10:14:06 PM - PC Utility Kit Backup
RP219: 7/17/2012 10:13:43 PM - PC Utility Kit Backup
RP220: 7/17/2012 10:14:17 PM - PC Utility Kit Backup
RP221: 7/18/2012 8:23:03 AM - PC Utility Kit Backup
RP222: 7/18/2012 8:23:14 AM - PC Utility Kit Backup
RP223: 7/18/2012 8:44:12 AM - PC Utility Kit Backup
RP224: 7/18/2012 9:06:05 AM - SpeedyPC Pro Backup
RP225: 7/18/2012 9:05:46 AM - SpeedyPC Pro Backup
RP226: 7/18/2012 9:05:55 AM - SpeedyPC Pro Backup
RP227: 7/18/2012 9:06:16 AM - SpeedyPC Pro Backup
RP228: 7/18/2012 7:36:07 PM - PC Utility Kit Backup
RP229: 7/19/2012 7:06:32 AM - PC Utility Kit Backup
RP230: 7/20/2012 7:21:56 AM - SpeedyPC Pro Backup
RP231: 7/20/2012 7:22:07 AM - PC Utility Kit Backup
RP232: 7/20/2012 9:03:19 AM - PC Utility Kit Backup
RP233: 7/20/2012 4:10:47 PM - PC Utility Kit Backup
RP234: 7/27/2012 8:56:02 PM - PC Utility Kit Backup
RP235: 7/27/2012 8:55:52 PM - Installed Windows Support Tools
.
==== Installed Programs ======================
.
.
32 Bit HP BiDi Channel Components Installer
Acrobat.com
ActivePerl 5.10.1 Build 1006
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader 9.4.6
Advanced SystemCare 5
Apache HTTP Server 2.2.19
AVS Video Converter 8
CCScore
Comcast Desktop Software (v1.2.0.9)
e-Sword
Encyclopaedia Britannica Ready Reference 2004 CD-ROM
ESSBrwr
ESSCDBK
ESScore
ESSgui
ESSini
ESSPCD
ESSPDock
ESSSONIC
ESSTOOLS
essvatgt
fflink
Free Window Registry Repair
Freecorder
Freecorder Toolbar
GoldWave v5.20
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB2633952)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
HTML Link Validator
IBM ThinkPad UltraNav Driver
Intel(R) Graphics Media Accelerator Driver for Mobile
InterVideo WinDVD
Java Auto Updater
Java(TM) 6 Update 24
Java(TM) 6 Update 3
Kensington SlimBlade Driver
kgcbaby
kgcbase
kgchday
kgchlwn
kgcinvt
kgckids
kgcmove
kgcvday
Kodak EasyShare software
Lotus SmartSuite - English
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Mozilla Firefox 10.0.2 (x86 en-US)
netbrdg
OfotoXMI
OpenOffice.org 3.2
Paint Shop Pro 7 Anniversary Edition
PC Utility Kit
PhotoJoy
PowerDVD
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
RealUpgrade 1.1
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft Windows (KB2564958)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB2586448)
Security Update for Windows Internet Explorer 8 (KB2618444)
Security Update for Windows Internet Explorer 8 (KB2647516)
Security Update for Windows Internet Explorer 8 (KB2675157)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567053)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2584146)
Security Update for Windows XP (KB2585542)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB2598479)
Security Update for Windows XP (KB2603381)
Security Update for Windows XP (KB2618451)
Security Update for Windows XP (KB2619339)
Security Update for Windows XP (KB2620712)
Security Update for Windows XP (KB2621440)
Security Update for Windows XP (KB2624667)
Security Update for Windows XP (KB2631813)
Security Update for Windows XP (KB2633171)
Security Update for Windows XP (KB2639417)
Security Update for Windows XP (KB2641653)
Security Update for Windows XP (KB2646524)
Security Update for Windows XP (KB2647518)
Security Update for Windows XP (KB2653956)
Security Update for Windows XP (KB2660465)
Security Update for Windows XP (KB2661637)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165-v2)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982665)
SFR
SHASTA
skin0001
SKINXSDK
SmartFTP Client
SoundMAX
SpeedyPC Pro
staticcr
TagCheck HTML and XML Tag Checker V1.5
ThinkPad Integrated 56K Modem
ThinkPad Power Management Driver
tooltips
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB978506)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2607712)
Update for Windows XP (KB2616676-v2)
Update for Windows XP (KB2641690)
Update for Windows XP (KB898461)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB978207)
Visual C++ 8.0 CRT (x86) WinSXS MSM
Visual C++ 8.0 CRT.Policy (x86) WinSXS MSM
Visual C++ 8.0 MFC (x86) WinSXS MSM
Visual C++ 8.0 MFC.Policy (x86) WinSXS MSM
VPRINTOL
WhiteSmoke
Windows Media Format 11 runtime
Windows Support Tools
WIRELESS
WISE-FTP 5
WordWeb Pro
.
==== Event Viewer Messages From Past Week ========
.
7/21/2012 7:20:43 AM, error: Service Control Manager [7024] - The Apache2.2 service terminated with service-specific error 1 (0x1).
7/21/2012 7:20:43 AM, error: Service Control Manager [7023] - The Windows Firewall/Internet Connection Sharing (ICS) service terminated with the following error: An address incompatible with the requested protocol was used.
7/21/2012 7:20:43 AM, error: Service Control Manager [7023] - The IPSEC Services service terminated with the following error: The support for the specified socket type does not exist in this address family.
.
==== End Of File ===========================

[etaf]

moved to virus forum

[jeffce]

Hi,

Let me look this over and I will return as quickly as I can.