[Mdog73]

Here's the smitrem log.


smitRem log file
version 2.3

by noahdfear

The current date is: Fri 09/02/2005
The current time is: 12:11:50.09

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run Files Present


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Post-run Files Present


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~



~~~ Wininet.dll ~~~

CLEAN!

[Advertisements]

Hi,

Do you have any issues with your PC ?? i.e. apart from Service Pack 1a.

You dont have internet access from your PC ???

[tampabelle]

Hi,

Do you have any issues with your PC ?? i.e. apart from Service Pack 1a.

You dont have internet access from your PC ???

[Mdog73]

Yes I have some issues. Which started happening after the malware. But it may have been my fault rather than the malware. I may have deleted some things I shouldn't have. I tried to follow the instructions in a few posts.

Here are some of the things that happen off the top of my head.

1. When I put in a disk like the linksys driver disk for my wireless card it starts to run then shuts down. Even when I open the disk and run the setup.exe the setup program closes. So some disks can't load.
2. When I put in a movie it just shows audio and viual files but won't play the movie.
3. My interenet stopped working.
4. Games that used to run won't start up.
5. I can't uninstall everything through the control panel.
6. System restore does not work.


I'm sure there are more. I haven't tried to do much more than that.
I know some key files are missing but I have no clue where to begin.
I did reinstall windows xp before I made this thread, not the reformat, so I didn't lose any data, but that may have kept what ever problems I had or even made them worse.

[tampabelle]

Did you do a reinstall ??? in the same folder as the original Windows ??

[Mdog73]

I just clicked ok through the install, I don't remember it giving me a choice of where to put it. Yeah it was a reinstall.

Edited by Mdog73, 02 September 2005 - 06:16 PM.

[tampabelle]

Lets try this option first -

Put the Windows CD in the CD drive.

Click on Start ---> Run. Type in

sfc /scannow

and hit enter.

This tool will search for system files and verify that they are intact.

Let me know how it goes.

[Mdog73]

I ran it and it completed and nothing happened, I assume it thinks evrything is fine. No log or anything. It appears everything is the same.

[tampabelle]

I was hoping that it would find soething !!!


Lets try the backup option.


We will do a repair install of windows. It is quite possible that earlier the reinstall was also corrupted due to infections already present on your PC !!!!

Please visit this page - http://www.windowsreinstall.com/

Scroll down right down to the bottom of the page and then choose the appropriate windows version XP ( Home or Pro).

You need to read about Repair Install. Please make special note of the step 3. When the PC reboots, do not press any key, even though you are prompted for it !!!!

In case you dont understand any specific step or need further clarifications, please check back with me before you start the process.

[Mdog73]

I followed all the instructions exactly as far as I could tell, but the results appear to be the same. I still can't create a restore point, couldn't read an installation Cd for my ethernet card as before, had trouble removing things through the control panel.

While I was going through the setup process 2 errors came up.
1st was:

Device installer error
Windows could not load the installer TypeController

2nd was
Software Installation
(a red circle with a white X in it) has not passed Windows logo testing to verify its compatibility with Windows XP.
The software will not be installed.

[tampabelle]

Can you post a fresh HJT log ???

[Mdog73]

After I reinstalled xp the first screen I see requires me to hit ctrl+alt+del to enter windows. Here is the log.

Logfile of HijackThis v1.99.1
Scan saved at 1:41:41 PM, on 9/6/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\gearsec.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\sstray.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\Explorer.EXE
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Yahoo!
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5_1_5_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5_1_5_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop...p/PCPitStop.CAB
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1125137787499
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.googl...gleActivate.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/z...s/heartbeat.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.c...ropper1_1us.cab
O20 - Winlogon Notify: ComPlusSetup - C:\WINDOWS\System32\catsrvut.dll
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

[tampabelle]

Lets leave the ethernet card for now. Chances are that it may be a hardware issue !!!



For system restore lets try two things -


1. Click on Start ---> Run. Type Services.msc and hit enter. Locate the item - System Restore Service. Right click on it and then click on properties. In the Startup Type choose the option Automatic.

Under Service Status, click on Start, if the the status indicated is not started.


Check if System Restore works now.


2. In case above doesnt work, then try this.

Click on Start ---> Run. Type in C:\windows\inf and hit enter. In the new window locate the item sr.inf (it may appear without the extension). Right click on it and then click on Install. The PC may prompt you for the Windows CD !!!


Let me know how the above steps work out.

Regarding the items in Control panel, can you tell me which items you are not able to remove ????

[Mdog73]

System restore seems to work now.
I tried your first suggestion that didn't work then I tried the second one and 1st again and it worked.

Things that won't uninstall are mainly games.
BF1942 and a coupleof its add ons.
Joint operations Demo
Black Hawk down and its add on.
I am also unable to uninstall Norton Anitvirus 2005. It says there is a another version that needs to be uninstalled first but there is no other version as far as I can tell.

[tampabelle]

Norton can be very sticky when you try to uninstall it.

There are detailed instructions given by Symantec (the company which owns Norton) here - http://service1.syma...001092114452606

Try those and let me know if you are able to uninstall Norton

[Mdog73]

Yep I was just able to uninstall norton.
Thanks.

I am still unable to run the disk that goes with my linksys card. Maybe I need to be able to do that before I can get online and then get sp1a.