[yrawls]

My computer was fried on Sat, so I did a reinstall because I had zero programs. I reinstalled and couldn't update any windows service packs. So I downloaded a bunch of windows plug ins from the microsoft site until I could enter the windows update service. I kept googleing fixes for the install errors and I think I got download happy and downloaded a registry error fix....I realized what I did and then deleted it from my program files. I was never able to download an updated version of IE and couldn't download firefox either. I could; however, get into the microsoft sites. Now I can't download I.E. and can't enter ANY site that microsoft has. I downloaded spybot and it found 2 trojans. I ran it in safe mode and there were no errors. When my computer logs me in something is running (I think) b/c I get the internet explorer needs to shut down as soon as my icons and system tray load. I'm scared to download anything else b/c of what already happened and I still get the error reporting messages about every 15 s, with IE closed. It is causing me paranoia. I have an HP pavillion laptop with windows xp and supposedly had the sp 3 installed...looks like only sp 1 is installed though b/c that's what came up in safe mode. Oh..here's my log. I am not very tech savvy but I do know how to run commands/bring up the command window and when I have screwed up. PLEASE HELP ME!!!! I don't know if I'm doing this correctly or if anyone will help me but I've been at this since three p.m.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:05:38 PM, on 7/15/2009
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\carpserv.exe
C:\WINDOWS\System32\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Notebook Utilities\hptasks.exe
C:\PROGRA~1\HEWLET~1\ONE-TO~1\OneTouch.EXE
C:\windows\system\hpsysdrv.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Lexmark 3500-4500 Series\lxdiamon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\System32\firewall.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\Hewlett-Packard\HP Notebook Utilities\HPWirelessMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\dwwin.exe
C:\WINDOWS\System32\irdvxc.exe
C:\Program Files\New Folder\HijackThis.exe
C:\WINDOWS\explorer.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us4nb.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hp.com/info/e-center-p
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com/info/e-center-p
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4nb.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4nb.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us4nb.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://srch-us4nb.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HP TV Now] C:\Program Files\Hewlett-Packard\HP TV Now\HpTvNow.exe /RK
O4 - HKLM\..\Run: [HP Display Settings] C:\Program Files\Hewlett-Packard\HP Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HEWLET~1\ONE-TO~1\OneTouch.EXE
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [NAV CfgWiz] C:\PROGRA~1\NORTON~1\Cfgwiz.exe /R
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [lxdimon.exe] "C:\Program Files\Lexmark 3500-4500 Series\lxdimon.exe"
O4 - HKLM\..\Run: [lxdiamon] "C:\Program Files\Lexmark 3500-4500 Series\lxdiamon.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [Windows Network Firewall] C:\WINDOWS\System32\firewall.exe
O4 - HKLM\..\Run: [Microsoft Internet Explorer] C:\WINDOWS\System32\iexplore.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com/info/e-center-p
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1247356647468
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1247359819600
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\Hewlett-Packard\HP Notebook Utilities\HPWirelessMgr.exe
O23 - Service: lxdiCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdiserv.exe
O23 - Service: lxdi_device - - C:\WINDOWS\System32\lxdicoms.exe
O23 - Service: Network helper Service (MSDisk) - Unknown owner - C:\WINDOWS\System32\irdvxc.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe

--
End of file - 6542 bytes

[yrawls]

still waiting for help 7.18

[yrawls]

still waiting

[flavallee]

yrawls:

I received your private message and have read your comments.

Here is the support and software site for your HP Pavilion ze4145 laptop. I suggest that you save this site in your favorites list for reference to when needed.

I can tell that's a pretty old laptop because of the processor type and speed and the amount of RAM and Adobe Reader 5.0(a very old version) being in it.

What did you use to reinstall XP? It's my guess that you used a recovery CD that includes XP SP1 and all the outdated programs that came in it.

You need to go here and download the full 316 MB-size SP3 upgrade, then burn it off to a CD-R.

Since you've run your computer through the mill since you reinstalled XP, I suggest that you do it all over again, then install the SP3 upgrade afterwards.

There's nothing that the malware section can help you with, so I've requested your thread be moved to the XP section.

---------------------------------------------------------------

[yrawls]

thank you for replying flavallee, mwaah for answering

[flavallee]

Another good reason for starting out fresh is because that computer is badly infected. These log entries confirm that. Click the links to see what the infection is.

O4 - HKLM\..\Run: [Windows Network Firewall] C:\WINDOWS\System32\firewall.exe

http://www.sysinfo.org/startuplist.p...twork+Firewall

O4 - HKLM\..\Run: [Microsoft Internet Explorer] C:\WINDOWS\System32\iexplore.exe

http://www.sysinfo.org/startuplist.p...ernet+Explorer

----------------------------------------------------------------

[yrawls]

Ok, flavalle...got a couple of questions.

1. How do I begin to comprehend how to look for these entries now that I have reinstalled my system? I looked at the website you referenced, but I'm not sure that I know what I'm doing. I re-ran spybot and it found a couple of programs that were installed, but I don't know how they keep getting on the system. I only downloaded microsoft programs: the service packs first, then I loaded spy-bot and then windows defender after reading the post. I am I supposed to look up the entries you referenced? I don't understand where in the HJT log that I am supposed to look--the file extension?

2. Should I post another HJT log?



3. You can ignore the first part of this post....I figured out what was in the blue box....I got it.

[flavallee]

If you downloaded and installed Spybot - Search & Destroy and Windows Defender, uninstall them both, restart your computer, then go into the C:\Program Files folder and delete their leftover folders - if they're still there.

Download and install Malwarebytes Anti-Malware 1.39 and SUPERAntiSpyware 4.27.0.1000 in their place. Click the green icon in each page to download them.

After they're installed, run their update function and get them up-to-date with the latest definition files.

Run a quick scan with Malwarebytes. When the scan finishes, select and allow it to fix everything it finds. Restart your computer afterwards.

Run a quick scan with SUPERAntiSpyware. When the scan finishes, select and allow it to fix everything it finds. Restart your computer afterwards.

Run a scan with HijackThis, then post that new log here.

Also post the Malwarebytes and SUPERAntiSpyware scan logs here.

----------------------------------------------------------------