messed up computer

[sweetcheekies]

I am posting this for my friend. she is running windows xp
Lately she is having a ton of trouble with her computer.. she is not able to do much when she is connected under normal mode.. she cant access her comcast things.. msn, yahoo etc.. she has uninstalled and reinstalled all of those.. after running virus scans, adaware,,, trojan scans etc.. ( housecalls, bit defender etc ) she keeps finding a whole slew of things.. she gets rid of them the way she tells them to.. or they say they fixed them .. but she is getting worse.. her computer is running worse each day.. she can do what ever she wants in safe mode / networking.. every thing runs fine. she is not able to run norton anti virus in safe mode.. it says its not able to. attatched is her hijack this log.. she had downloaded SP2 but uninstalled cause that is since when she has had even more trouble.. she cannot restore to a earlier time.. it says its not able to do that either any help with this would be greatly appreciated.. and she can use the help ASAP cause hubby is ready to throw the puter out lol Please explain things simply as she is not very good with computers.

Logfile of HijackThis v1.98.2
Scan saved at 12:42:42 PM, on 9/14/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Documents and Settings\Scott & Rachel\My Documents\My Received Files\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.comcast.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr*http://my.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: (no name) - _{1C78AB3F-A857-482e-80C0-3A1E5238A565} - (no file)
O2 - BHO: (no name) - SOFTWARE - (no file)
O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\System32\nvms.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\System32\mscb.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: All-Star Football Challenge by pogo - http://allstarfb2.pogo.com/applet-5.9.3.38/allstarfb2/allstarfb2-ob-assets.cab
O16 - DPF: Yahoo! Spades - http://download.games.yahoo.com/games/clients/y/st2_x.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

thanks SweetC

 

[Flrman1]

Run Hijack This again and put a check by these. Close ALL windows except HijackThis and click "Fix checked"

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R3 - URLSearchHook: (no name) - _{1C78AB3F-A857-482e-80C0-3A1E5238A565} - (no file)

O2 - BHO: (no name) - SOFTWARE - (no file)

O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)

O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\System32\nvms.dll

O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\System32\mscb.dll

O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll

Restart your computer.

Also I see Norton, but I do not see that Auto-Protect or Email scanning are enabled. These need to be running.

 

[Flrman1]

The HJT log shows that SP2 is installed!

 

[sweetcheekies]

sp2 does not show up in add remove programs.. how else can she uninstall it.. ? also why does system config say she has xp pro when she has the home edition?

 

[sweetcheekies]

nm found a link.. will try this one its from microsoft
http://support.microsoft.com/default.aspx?scid=kb;[LN];875350

 

[sweetcheekies]

okay well that didnt work.. she has uninstalled everything .. i mean windows messanger and msn6.. plus yahoo.. and now she cant even reinstall them.. it gives her the message of can't connect.. yet she can go anywhere on the internet.. I am totally stumped as to why she cant.. she can't do a windows update because it gives her the message that the update could not be completed.... she cant repair winxp.. she cant reinstall xp nothing ..

 

[Bob Cerelli]

You can always do a repair install of XP if you have the CD. This will put it back to SP1.

But is the problem the service pack or all the spyware that keeps showing up.

Also what programs have you used to remove it. I have yet to find one that gets them all.

 

[sweetcheekies]

we have tried several.. if u have some that work please let me know .. also we tried the cd thing and that didnt work either and she has had the problems since she installed sp2.. so we are figuring its that.

 

[pfurball]

Howdy sweetcheekies, I had a similar problem and running in safe mode means that there is NO protection when online and just about anything can get in and stuff the puter.Try Spybot to see if there are more malware things clogging but sounds more like a trojan/worm/virus. I ended up having to reformat my drives and totally reinstall XP and all my (fortunately)backed up programmes. Never did find the exact cause, but puter runs fine now. Haven't installed SP2 yet....not game!!!

 

[Bob Cerelli]

Generally I like to use Ad-Aware Pro, Spybot and SpySweeper. Spyware Blaster helps a lot in preventing getting infected in the first place.

Get all the updates.

Then boot to safe mode and scan. This way you at least have a chance at minimizing how much will be in memory at that time.

Then boot normally and scan again.

Also, in the first post you mention that there were programs that kept coming back that you were trying to remove. What were those and how would they be related to XP2 ?

What CD thing did you try. The specifics.

If you have FAT32 on the computer, you don't need to reinstall to get the benefits of a clean install. Just boot to DOS and rename the c:\windows and c:\progra~1 (program files from DOS), directories. Then just reinstall Windows. This way all the data will still be there and if there are any files in either of those two directories you need, you can retrieve them as well. But any spyware won't get install or loaded.

 

[sweetcheekies]

yea we have ran spybot.. that was one of the first things we did.. we ran adaware.. removed what was needed there.. then ran housecalls.. removed what we could there.. then rebooted..ran spybot removed there.. posted the hijack log here did that.. tried to uninstall sp2. via add/remove programs that supposedly worked.. but we find out it didnt lol .. then we removed via $nt$ that i guess didnt work either cause hijack log says its still there.. so its stuck lol

 

[Bob Cerelli]

Sorry for a typo in the prevous post.

Should have read:
If you have FAT32 on the computer, you don't need to REFORMAT to get the benefits of a clean install.

 

[Bob Cerelli]

I'm not clear at this point if all the spyware was removed or not. From the original post it didn't sound like it was.

Did you try updating and rescanning from safe mode.

 

[sweetcheekies]

okay reran bit defender.. nothing shows.. rerunning spybot.. and we tried the running windows xp pro disk for a repair.. that didnt work.. and have no clue on how to do the dos thing and I dont think she is gonna be able to get that .. and will have her update from safe mode once these are done.. will post back ASAP thanks for any advice

 

[Bob Cerelli]

What steps were taken for the repair install and what were the error messages.

Also, the post I made was not to update from safe mode but to scan from safe mode.