I dont know where to start, when I turn on the computer I am automatically greeted with this message....SVEhost.exe has encountered a problem and needs to close....When I have tried to run any kind of virus scan, automatically I get this message.....NT Authority\system remote Procedure call RPC service terminated unexpectedly, and then a count down begains and shuts down the computer.....I have tried to go into safe mode and run a scan but the same thing happens Then when it reboots I get the SVEhost message again along with this one....... drwtsn32.exe Application erroe Application failed to initialized (0xc0000142).... needless I am at a loss for what to do...lol

Here is my HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:00:24 AM, on 11/29/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\-867784421.exe
C:\WINDOWS\System32\clcl4.exe
C:\WINDOWS\System32\dglyabxk.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\SBC Yahoo!\Connection Manager\ConnectionManager.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\yupdater.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [BearFlix] "C:\Program Files\BearFlix\BearFlix.exe" /pause
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Y!TunnelPro] C:\Program Files\Digital Asphyxia\Y!TunnelPro 2.0\YTPro.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" -quiet
O4 - Startup: MSWin-929371122.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...p=ZJxdm088YYUS
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idryhmb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idryhmb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idryhmb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idryhmb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idryhmb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idryhmb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idryhmb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idryhmb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idryhmb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idryhmb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idryhmb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idryhmb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idryhmb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idryhmb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idryhmb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idryhmb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idryhmb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idryhmb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idryhmb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idryhmb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idryhmb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idryhmb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idryhmb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idryhmb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idryhmb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\sygphxmqhil.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\sygphxmqhil.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\sygphxmqhil.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\sygphxmqhil.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\sygphxmqhil.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\sygphxmqhil.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\sygphxmqhil.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\sygphxmqhil.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\sygphxmqhil.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\sygphxmqhil.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idryhmb.dll
O15 - Trusted Zone: *.sbcglobal.net
O15 - Trusted Zone: http://*.sbcglobal.net
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/noc...up1.0.0.15.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1B71FB40-3D0E-457F-85C6-BAE11A1C3042}: NameServer = 151.164.1.8 206.13.28.12
O20 - AppInit_DLLs:
O21 - SSODL: DCOM Server 20509 - {2C1CD3D7-86AC-4068-93BC-A02304B20509} - C:\WINDOWS\System32\zhen.dll
O22 - SharedTaskScheduler: DCOM Server 20509 - {2C1CD3D7-86AC-4068-93BC-A02304B20509} - C:\WINDOWS\System32\zhen.dll
O23 - Service: DomainService - - C:\WINDOWS\System32\dglyabxk.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe (file missing)
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

--
End of file - 7373 bytes

Your best option may be to try a system restore point (if available) to a date before any known problems or before you started performing any recent fixes:

Click on Start>All Programs>Accessories>System Tools>System Restore.

Check Restore my computer to an earlier date> Click Next.

Choose the date before you performed any recent fixes and click Next and Next again.

REBOOT.




POST A REVISED HIJACKTHIS LOG for review:
Reboot and post a new HijackThis log with any feedback as appropriate - how things are now behaving: any new or remaining apparent issues.

I have tried to do the system restore and it will not let me do these....I have done this several times but each time it tells me the system can not be restored and to pick a new date...after each different date it tells me the same thing....ty

HIDDEN FILES: To make sure you can see any and all hidden files, please follow the directions here



Submit the following file(s) to VirusTotal for their immediate evaluation and feedback. Use any of the following methods, as appropriate:

• Locate FULL FILE PATH if not apparent. Use Start (BUTTON)>Search, [WINDOWS+F] keys, or F3 key (from desktop).
• Copy & Paste the FULL FILE PATH in the input BOX
  -- OR --
• Navigate to the file in question.

Post those results in your next reply (if malware findings were indicated) for:

c:\windows\system32\idryhmb.dll
c:\windows\system32\sygphxmqhil.dll

After several tries I think I have finally gotten the info that you requested...

idryhmb.dll report:

File idryhmb.dll received on

06.13.2007 17:50:08

(CET)Antivirus Version Last

Update Result
AhnLab-V3 - -

Win-Trojan/Xema.variant
AntiVir - - TR/Agent.8788
Authentium - - -
Avast - - Win32:Agent-GPJ
AVG - - PSW.Generic4.BKT
BitDefender - - Trojan.Vqten.A
CAT-QuickHeal - -

Trojan.Agent.afg
ClamAV - - -
DrWeb - - Trojan.Vqten
eSafe - - Win32.Agent.afg
eTrust-Vet - -

Win32/Netvq!generic
Ewido - - Trojan.Vqten
FileAdvisor - - Not analyzed yet
Fortinet - - W32/Agent.NQX!tr
F-Prot - - -
F-Secure - -

Trojan.Win32.Agent.afg
Ikarus - - Trojan.Vqten
Kaspersky - -

Trojan.Win32.Agent.afg
McAfee - - PWS-LSP
Microsoft - -

Trojan:Win32/Agent!5760
NOD32v2 - - -
Norman - - -
Panda - - Trj/Spabot.AS
Prevx1 - -

Polynomial.Code.Exploit
Sophos - - Troj/NetVQ-Gen
Sunbelt - - Trojan.Vqten.A
Symantec - - Trojan.SpamThru
TheHacker - - -
VBA32 - - Trojan.Vqten
VirusBuster - - Trojan.Agent.TKB
Webwasher-Gateway - -

Trojan.Agent.8788

Additional information
MD5:

39d4e9e26f506657a31f64434fd192

16



sygphxmghil.dll report:



File sygphxmqhil.dll received on

12.07.2007 16:37:40

(CET)Antivirus Version Last

Update Result
AhnLab-V3 - -

Win-Trojan/Agent.21504.AM
AntiVir - - TR/Agent.afg.2
Authentium - - W32/Trojan.AHSK
Avast - - Win32:Agent-GPJ
AVG - - Agent.AQN
BitDefender - - Trojan.Agent.AFG
CAT-QuickHeal - -

Trojan.Agent.afg
ClamAV - - -
DrWeb - - Trojan.Vqten
eSafe - - Win32.Agent.afg
eTrust-Vet - -

Win32/Netvq!generic
Ewido - - Trojan.Agent.afg
FileAdvisor - - High threat

detected
Fortinet - - W32/Agent.AFG!tr
F-Prot - - W32/Trojan.AHSK
F-Secure - -

Trojan.Win32.Agent.afg
Ikarus - - Trojan.Vqten
Kaspersky - -

Trojan.Win32.Agent.afg
McAfee - - PWS-LSP
Microsoft - - -
NOD32v2 - - Win32/Agent.NHD
Norman - - -
Panda - - Adware/WebAttaker
Prevx1 - - TROJAN.VQTEN.A
Rising - - Trojan.Mnless.kpe
Sophos - - Troj/NetVQ-Gen
Sunbelt - -

Trojan.Win32.Agent.afg
Symantec - - Trojan Horse
TheHacker - - Trojan/Agent.afg
VBA32 - - Trojan.Vqten
VirusBuster - - Trojan.Agent.HGA
Webwasher-Gateway - -

Trojan.Agent.afg.2

Additional information
MD5:

4a7c93cdc17dfc8fed849b57cdc8ce

88

You will need to be REBOOTING a number of times in the fix procedures. Accordingly, it is probably a good idea to print out the following directions or copy them to a text file on your desktop using NOTEPAD. Read these instructions carefully and feel free to ask if you're unsure about anything.


Download LSPFix by clicking here:
http://www.snapfiles.com/get/lspfix.html
Or here:
http://www.cexx.org/lspfix.htm


To run it, be sure you are NOT connected to the Internet.

Please, make sure that all IE browser windows and internet connections are closed. Run the program (LSPFix) and click the "I know what I'm doing" box.

Highlight all instances of "idryhmb.dll and sygphxmqhil.dlll" and move them to the "Remove" side and click finish. Don't remove anything else there.

Do a full power down REBOOT.

Navigate to and delete this file(s) (let me know if they were present):
c:\windows\system32\idryhmb.dll
c:\windows\system32\sygphxmqhil.dll




Clean out TEMPORARY FILES procedures:
To clean your temp folder, recycle bin, etc..please download this free tool:

CCleaner http://www.ccleaner.com/downloadbuilds.asp

Install Options:

• Don't install any Toolbars, or other programs, should it ask you!
• Just uncheck the option of installing the Yahoo toolbar.

It will put a shortcut on your Desktop.

Do not run CCleaner until requested later.



SELECT HijackThis FIX ITEMS: Scan with HijackThis and place a check next to these items:

O4 - Startup: MSWin-929371122.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...p=ZJxdm088YYUS

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/noc...up1.0.0.15.cab

O20 - AppInit_DLLs:

O21 - SSODL: DCOM Server 20509 - {2C1CD3D7-86AC-4068-93BC-A02304B20509} - C:\WINDOWS\System32\zhen.dll
O22 - SharedTaskScheduler: DCOM Server 20509 - {2C1CD3D7-86AC-4068-93BC-A02304B20509} - C:\WINDOWS\System32\zhen.dll

O23 - Service: DomainService - - C:\WINDOWS\System32\dglyabxk.exe

Make sure that all browser windows and internet links are closed, even this one!
CLICK ’FIX CHECKED’ with HijackThis.



HIDDEN FILES: To make sure you can see all hidden files, please follow the directions here

SAFEMODE: Boot into safe mode by tapping the F8 key at restart and choosing 'safe mode' menu option (explained here if needed).



Delete TEMPORARY FILES: Now, use CCleaner to hunt down the most common temporary file locations and the temporary file clutter contained therein (and of possible malware hiding places):

Run CCleaner.

FIRST-TIME USE:
Select the ”Options” BUTTON option (top LEFT), ”Advanced” BUTTON, and then UNCHECK the ”Only delete files in Windows Temp Folders older than 48 hours”. Set back to default afterwards.

Select the ”Cleaner” BUTTON option (top LEFT), if not already selected. Use the ”Windows” TAB up front by default.

• Uncheck ”Cookies” option (advisable)
• Optionally, Uncheck ”Recently Typed URLs” option (potentially still useful)
• Click the ”Analyse” button.
• Thereafter, click ”Run Cleaner” after you have reviewed what it proposes to clean.

***** Clean out the Recycle Bin for items removed below, ONLY once you have regained the full functional use of your PC.




Navigate to these files or folders using Windows Explorer (OR Start -> Search) and delete (if present):


DELETE FILES:

MSWin-929371122.exe
C:\WINDOWS\System32\zhen.dll
C:\WINDOWS\System32\dglyabxk.exe
C:\WINDOWS\System32\-867784421.exe
C:\WINDOWS\System32\clcl4.exe





POST A REVISED HIJACKTHIS LOG for review:
Reboot and post a new HijackThis log with any feedback as appropriate - how things are now behaving: any new or remaining apparent issues.

ok I got as far as the HJT part but now my HJT will not work.....and yes after I did the LSPfix and rebooted the files c:\windows\system32\idryhmb.dll....&
c:\windows\system32\sygphxmqhil.dll were still present, so I deleted....I wasn't sure if it was safe to uninstall and reinstall HJT, the way this computer was acting, so I figured I would post a quick message...ty

I wasn't sure if it was safe to uninstall and reinstall HJT

On its own, without running fixes, HJT is only a diagnostic tool.


Running CCleaner may be a big initial help, here.


Try running HJT in 'SAFE MODE' if necessary.

I tried your suggestion and well the computer will not go into regular safe mode, but will boot up in safe mode with networking....so then I ran HJT and found that O4 - Startup: MSWin-929371122.exe and
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...p=ZJxdm088YYUS were not there so I did not do anything cause I wasnt sure if I should while being in safe mode with networking......Also when I rebooted my computer tried to boot up 6 times and would get all the way to the desk top then shut off....on the 7th try it finally stayed on but I was greeted with a new error message....


OS: Windows XP Professional,

SP1
CPU: AuthenticAMD, AMD AMD

Athlon(tm) processor, MMX @

1000 MHz

Module name: C:\Program

Files\Internet

Explorer\iexplore.exe

Application data:
VmVyc2lvbjogV2tCeWNtOXFaMl

Z4Ykdsb1NXWmxiVlFsS2xGZGJu

NS9
aR0pnVXlNdkhScEtJendnTTNGa

GZYbHhOaVlqT1NvdE9VdC9kbjU

2Yj
NsQU1UNUZTbkZKV0FGeVcxRlh

Sa2xYZUFzPQ0KSW1hZ2VCYXNl

OiAxM
zEwMDAwMA0KLTENCkNvZGUg

PSBbMjA3XQ0KLSAwDQotIDAN

Ci0gMjI3
DQotIDANCi0gW10NCj4gQzpcUH

JvZ3JhbSBGaWxlc1xJbnRlcm5ldC

B
FeHBsb3JlclxpZXhwbG9yZS5leG

UNCj4gQzpcV0lORE9XU1xTeXN0

ZW
0zMlxudGRsbC5kbGwNCj4gQzpc

V0lORE9XU1xzeXN0ZW0zMlxrZ

XJuZ
WwzMi5kbGwNCj4gQzpcV0lORE

9XU1xzeXN0ZW0zMlxtc3ZjcnQuZ

Gxs
DQo+IEM6XFdJTkRPV1Ncc3lzdG

VtMzJcVVNFUjMyLmRsbA0KPiB

DOlx
XSU5ET1dTXHN5c3RlbTMyXEdE

STMyLmRsbA0KPiBDOlxXSU5ET

1dTXH
N5c3RlbTMyXEFEVkFQSTMyLm

RsbA0KPiBDOlxXSU5ET1dTXHN5

c3Rlb
TMyXFJQQ1JUNC5kbGwNCj4gQz

pcV0lORE9XU1xzeXN0ZW0zMlxT

SExX
QVBJLmRsbA0KPiBDOlxXSU5ET

1dTXFN5c3RlbTMyXFNIRE9DVlc

uZGx
sDQo+IEM6XFdJTkRPV1NcV2luU

3hTXHg4Nl9NaWNyb3NvZnQuV

2luZG
93cy5Db21tb24tQ29udHJvbHNfNj

U5NWI2NDE0NGNjZjFkZl82LjAu

M
TAuMF94LXd3X2Y3ZmI1ODA1XG

NvbWN0bDMyLmRsbA0KPiBDOl

xXSU5E
T1dTXHRhYmxldGdlbjMyLmRsb

A0KPiBDOlxXSU5ET1dTXFN5c3R

lbTM
yXHdzb2NrMzIuZGxsDQo+IEM6

XFdJTkRPV1NcU3lzdGVtMzJcV1

MyXz
MyLmRsbA0KPiBDOlxXSU5ET1d

TXFN5c3RlbTMyXFdTMkhFTFAu

ZGxsD
Qo+IEM6XFdJTkRPV1Ncc3lzdGVt

MzJcb2xlYXV0MzIuZGxsDQo+IE

M6
XFdJTkRPV1Ncc3lzdGVtMzJcT0x

FMzIuRExMDQo+IEM6XFdJTkR

PV1N
cc3lzdGVtMzJcdmVyc2lvbi5kbGw

NCj4gQzpcV0lORE9XU1xTeXN0Z

W
0zMlx1eHRoZW1lLmRsbA==