[bratbarb]

Hi, I hope you can help me. I've been having a problem with my mother's computer. I folowed your instructions for cleaning up the spyware. Everything seemed okay after that. Then I started to have problems with her Win2005 anti virus program. When I was trying to reinstall it I couldn't get online. I tried restarting the computer and now it just shows the wallpaper, no icons or task bar. I only know a little about computers. Where do I begin? Thank you in advance.

Edited by bratbarb, 25 September 2005 - 06:41 PM.

[Advertisements]

Did you do the below yet?

Please read the first link in my signature and follow the steps outlined there. When you are ready, post the HijackThis log here.

[greyknight17]

Did you do the below yet?

Please read the first link in my signature and follow the steps outlined there. When you are ready, post the HijackThis log here.

[bratbarb]

I have hijack this I know how to post the log...but with no icons or start button, how do I run the program?

[greyknight17]

This might not be easy for you if you are not that familiar with computers, but I'll try to walk you through this.

Did you get that HijackThis log before or after this problem started? Just asking because I need the newest log you have. If you want to run a new HijackThis scan so you can give me a more updated log, then you will have to run HijackThis log using the Task Manager. You have Windows NT or higher right (Windows 2000, NT or XP)? If so, just hit ctrl+alt+del to bring up the Task Manager. Then go to File->New Task (run) and type in the path to the HijackThis program. The path is the directory where you saved it. If you are unsure, then tell me where exactly did you save the HijackThis program.

[bratbarb]

Okay, my brother installed hijack this a couple of weeks ago. I will do what you say and post the log. Thanks.

[bratbarb]

Another thing - Hijack this was probably installed in Programs.

[greyknight17]

OK, do you know exactly where? You need to give me more details. Programs? Program Files folder? If it's Program Files folder (meaning HijackThis.exe is in the root of that folder), then go to the Task Manager->File->New Task and type in c:\program files\HijackThis.exe and hit Enter key. That should pop HijackThis right up. If not, then it's not there and located somewhere else.

If you want, download HijackThis again from another computer and save it to a floppy. Then copy that HijackThis.exe file to a folder on your c: drive.

[bratbarb]

Okay, I got into task manager and ran a Hijack This. Tried to post it but it said I needed the updated version. So, on thursday when I go to my mother's again I will install it on her computer ( I had to copy it from my computer to a disk) and run another Hijack This to post to the forum. I got my desktop back but I still think her Hijack This log needs to be looked at, has nail.exe on it. Everything is working okay except for I can't get into Internet Explorer. Should I uninstall Internet Explorer and reinstall from a disk?

[bratbarb]

I'm going to try Winsock to restore the internet connections. Then I am going to install the update HighjackThis and post the log to the forum.

[greyknight17]

Update? You shouldn't get that error. You are using the HijackThis.exe program right? Where you hit Scan and then Save Log?

[bratbarb]

Yes, I used HijackThis. When I tried to post it, it said I was using an outdated version. It told me to download new version and re post scan. My brother put the program on my mother's computer. Maybe it was on there for a while. I don't know, I don't speak to my brother that often.

[greyknight17]

Just to make sure it's correct, download HijackThis here and choose the option that says Run a scan and save the log file. A log file should open once it's done. Copy and paste that whole thing here.

[bratbarb]

Here you go Logfile of HijackThis v1.99.1
Scan saved at 7:21:14 PM, on 9/29/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\WinAntiVirus 2005 Pro\AVKernel.exe
C:\Program Files\WinAntiVirus 2005 Pro\AVSvc.exe
C:\WINDOWS\pmzyipj.exe
C:\Program Files\WinAntiVirus 2005 Pro\AVSchSvc.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\vzwjtju.EXE
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\marionk\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.optonline.net/
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [vzwjtju] C:\WINDOWS\vzwjtju.EXE
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1128033354342
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1126971345623
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AVKernel - WinSoftware, Ltd. - C:\Program Files\WinAntiVirus 2005 Pro\AVKernel.exe
O23 - Service: AVScheduler - Unknown owner - C:\Program Files\WinAntiVirus 2005 Pro\AVSchSvc.exe
O23 - Service: Pml Driver - HP - C:\WINDOWS\system32\HPHipm09.exe
O23 - Service: WinAntivirus - Unknown owner - C:\Program Files\WinAntiVirus 2005 Pro\AVSvc.exe
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\pmzyipj.exe

[greyknight17]

You must install XP SP1a (hold off on SP2 until your computer is clean). Without SP1a, you are wide open to re-infection. After that's done, restart your computer and run a new HijackThis scan. Save the log and post it here.

[bratbarb]

It won't let me install sp1a, says failed.