[gortjake]

AVG wont open, so i tried to install Win Defender, i get this error at end of installation, Service Windows Defender (Windefend) failed to start. Verify that you have sufficient privileges to start system services. Hijack this wont open up or either will spybot. HELP PLEASE

[Maurice]

It looks loike you have a virus on the system and one which is smart enough to be able to stop anti-virus software from running.

Boot into safe mode by pressing F7 key as the BIOS POST routine finishes and Windows starts to load. You should get a text-based menu of option. Choose safe mode.

This will load a bare-bones copy of Windows with limited drivers, only essential services and NONE of the normal startup programs. Hopefully this will mean that the virus is not active in memory. Now run AVG on a full scan. You should be able to run HijackThis and post the report here.

Another option in a case like this is, if you had a friend with a known clean PC and suitable AV products installed you can take the drive out of your PC and hook it up in place of the CD/DVD drive on their machine and then do a full scan of it.

[gortjake]

Ive tried that, i ran adaware, its my buddies comp. i will be over there shortly.

[gortjake]

ok, ran safemode... still wont work, any other options other than switching drives??? SICS you there?

[Lone Wolf]

Make sure that you have Local Administrator rights to the computer. Check that no restrictions on the Local Administrator or Domain Administrator accounts exist.

[gortjake]

Checked... Booted in safe mode got an error message.
---------------------------------------------
During the scan of files at system startup, potential errors in the system registry were found.

P-07-0100: 1f SYSVER 0fx0024
NT_Kernel error 1256
KMODE_EXEPTION_NOT_HANDLED.

-------------------------------------------------

Then i picked the administrator porfile and checked the user profiles in the control panel. It does sya that all profiles have administrative rights. Any ideas???

[SICS]

Hi Gortjake,

As Maurice stated it looks to be a virus. The error you are getting looks to be a bad driver loading up.

Try rebooting again and this time try safe mode with no networking. See if that will allow you to boot into the machine.

If you are able to boot into the machine, try running a system restore on the machine to the last day the machine was working good.

If you can boot into Windows then you can also try running an online virus scanner.

Some of them are:

Must be run in IE: BitDefender Online Scanner - Free Online Virus Scan
TREND MICRO HouseCall 6.5

Give that a shot and let us know. Also as Maurice said you can take out the drive and put it into a good computer as a slave drive and run a full virus scan from the host computer.

[gortjake]

We can still boot into the computer, never had a problem with that, everytime we restart though a new spyware program, ( not good ones) is on the desktop. And its running EXTREMELY slow. Mozilla takes forever to open... if it even opens. Half the time it wont.

[SICS]

download and install avast: avast! antivirus software - computer virus, worm and Trojan protection by ALWIL Software install the application, and run a boot time scan. You'll need to download it off a good machine and then install. Give that a shot.

[gortjake]

download it off a good machine?

[SICS]

download it from a good computer that you can boot into windows, such as yours, either put the software on a cd, or a usb thumb drive, and then take it to your buddy's house and run the software from there

[gortjake]

Ok got avast to run a boot scan, found some trojans, the computer is running better now. I cant seem to save hijack this log and jsut fond in the c drive... thousands of files that are only 15 kb. This is what they are called.

pos1d9 pos1ed a bunch like that. Help a bit?

[gortjake]

Previously before the boot scan i could not open hijack or spy bot or could not delete the pos files. Now it is working normally, still trying to clean it out.

[gortjake]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:08:52 AM, on 3/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = AOL.com - Welcome to AOL
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Business is better with Yahoo! Search Engine Marketing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = AOL.com - Welcome to AOL
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = Business is better with Yahoo! Search Engine Marketing
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - _{BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
F2 - REG:system.ini: Shell=
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [BM0b6b1be5] Rundll32.exe "C:\WINDOWS\system32\isrfvcxe.dll",s
O4 - HKLM\..\Run: [08582879] rundll32.exe "C:\WINDOWS\system32\fyywkasx.dll",b
O4 - HKLM\..\RunServices: [WinProfile] sndcfg16.exe
O4 - HKCU\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'Default user')
O4 - Startup: smss.lnk = ?
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\HP_Owner\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk (file missing)
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\HP_Owner\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (file missing)
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: teen-fantazi.com
O15 - Trusted Zone: *.teen-fantazi.com
O15 - Trusted Zone: install.xxxtoolbar.com
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file://C:\Program Files\Risk\Images\stg_drm.ocx
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file://C:\Program Files\Risk\Images\armhelper.ocx
O20 - AppInit_DLLs: cru629.dat
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

--
End of file - 6353 bytes




YAY!!! A HIJACK THIS LOG!!!

[SICS]

Delete the following:

R3 - URLSearchHook: (no name) - _{BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - (no file)

O4 - HKLM\..\Run: [08582879] rundll32.exe "C:\WINDOWS\system32\fyywkasx.dll",b

O4 - Startup: smss.lnk = ?

O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\HP_Owner\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk (file missing)
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\HP_Owner\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (file missing)
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)

O15 - Trusted Zone: teen-fantazi.com
O15 - Trusted Zone: *.teen-fantazi.com
O15 - Trusted Zone: install.xxxtoolbar.com

cru629.dat

Disable system restore, in computer properties. Once you have done so, and deleted the entires, clear your temp files, by using disk cleanup and run another boot time scan with AVAST.

After your done post another hijack this log please