SELECT HijackThis FIX ITEMS: Scan with HijackThis and place a check next to these items:

O4 - HKLM\..\Run: [AVAST!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"

Make sure that all browser windows and internet links are closed, even this one!
CLICK ’FIX CHECKED’ with HijackThis.


Also, delete the "C:\Program Files\Alwil Software" FOLDER if still present.



Has your Internet problems arisen since you installed AVG8? Maybe they surfaced with 'Advanced WindowsCare 3 Beta'? Betas can often create strange issues in combination with other software program interactions that may contain competing real-time processes:

Advanced WindowsCare 3 Beta Testing | IObit


Meanwhile 'system restore', JAVA, and DSS does not work. One misbehaving program could have impacted new software installs or uninstalls. Also, AVG8 did have initial compatibility problems and may not have completely installed properly if Avast was present at the time.


I would suggest you download and try out a less complex and more basic antivirus tool such as NOD32 (30 day trial):

NOD32 Antivirus Protection for Your PC: Antivirus for Windows XP and more


Once downloaded, would suggest you stay off the Internet, and uninstall AVG8 and 'Advanced WindowsCare 3 Beta'. REBOOT before installing NOD32 or a clean install of AVG8, if desired.

when I try to uninstall/repair AVG8 I get this error

"Local machine: installation failed
Installation:
Error: Action failed for registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: creating registry key....
Error 0x80070005"

Yet another step that is proving very troublesome and further suggesting potential serious corruption issues. Did you try the procedure in 'NORMAL MODE'?


Maybe time to consider using a prior Acronis image if available. I favor using a brand new drive in that attempt or clean install of XP and either slaving the old drive or putting it in a USB external enclosure if you need to directly recover any important user files.

I dont have a install disk for windows. It came preinstalled. How do I uninstall / reinstall windows? If I reinstall it, will me files still be there?

You may want try a few additional steps:

Try uninstalling 'ZoneAlarm' in NORMAL MODE.

* Please download Malwarebytes' Anti-Malware from HERE or HERE

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Full Scan", then click Scan.
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked , and click Remove Selected.
• When disinfection is completed , a log will open in Notepad and you may be prompted to Restart(See Extra Note).
• A run log is automatically saved by MBAM and can be viewed by clicking the Logs TAB in MBAM.
• Copy&Paste the entire report in your next reply along with a fresh HijackThis log.

Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

I dont have a install disk for windows. It came preinstalled. How do I uninstall / reinstall windows?

Some PCs don't come with an install CD (or user declined that available fee based option). In such cases, a separate partition may be created on your hard drive (D:/ or E:/) which contains recovery/reinstall files (possibly an Acronis backup image). Normally, this will completely wipe your PC and reinstall back to 'factory default' starting point. If you have such an additional partition on your hard drive, you need to locate any documentation on this to know exactly what will happen if you pursue this course.

I note that you have 'Acronis' on your PC. Did a friend put this on your system? Acronis is an imaging tool that is capable of creating a complete backup image of your hard drive. I use this tool myself to create minimum weekly 'backups' to a USB external hard drive. I recently had a hard drive present with serious problems. Rather than mess with the ailing or corrupted drive, I purchased a brand new drive and did a recovery from a recent backup image produced by 'Acronis'. That left my recent user files still available from the old drive, as needed.


Often, an OEM install of XP will also place a 'product key' label somewhere on your PC BOX. A name brand PC, such as DELL, will have proprietary components installed which will be specific to your model. If you call DELL they may be able to provide you with a replacement install CD for a fee and further advice on you availalble options.

If I reinstall it, will me files still be there?

A clean reinstall of XP will destroy all existing files. You could try a repair install (still need the install CD for this) but that could also put your user files at risk:

Perform a Repair Installation

Sorry for my lengthy absence, I just recently moved and I didn't have time to set up my computer.



Malwarebytes' Anti-Malware 1.28
Database version: 1222
Windows 5.1.2600 Service Pack 2

10/1/2008 7:16:49 AM
mbam-log-2008-10-01 (07-16-49).txt

Scan type: Full Scan (C:\|)
Objects scanned: 148603
Time elapsed: 57 minute(s), 48 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\OneStepSearch (Adware.OneStepSearch) -> Quarantined and deleted successfully.

Files Infected:
(No malicious items detected)



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:18:42 AM, on 10/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\ehome\RMSvc.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-2190892928-2244043680-19868346-1005\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe

--
End of file - 4215 bytes

Suggest you try one more scan tool:


Download SDFix and save it to your Desktop.

Double click SDFix.exe and choose Install to extract it to its own folder on the Desktop. Please then reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, a menu with options should appear;
• Select the first option, to run Windows in Safe Mode, then press "Enter".
• Choose your usual account.

• In Safe Mode, right click the SDFix.zip folder and choose Extract All,
• Open the extracted folder and double click RunThis.bat to start the script.
• Type Y to begin the script.
• It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• Your system will take longer that normal to restart as the fixtool will be running and removing files.
• When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons.
• Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt back onto the forum.
  
  
  Please also provide any new current observations.

Otherwise and additionally, you will need to work through my last set of remaining instructions and/or talk to DELL (install disk). This may also be needed to resolve or mitigate any potential subsequent issues at a later date. This may not be possible once XP is fully decommissioned (becoming mostly unavailable at that time). Furthermore, Acronis is a very valuable tool that you should be using but apparently haven't been.

actually, i was able to uninstall ZoneAlarm and everything is fine for some weird reason. I am having some other problems and I hope you can direct me where to take them.

1) My computer doesnt detect that I have any speakers. It doesnt play any sounds. I know the speakers work (tried them on another computer) and I know it cant be the soundcard (dell has and intergrated one). I've tried updating every driver I can find.

2) Somewhere in the process of trying to get my computer fixed, I'm pretty sure that I deleted some services. They no longer appear on any lists of services. The two ones that I know of (and need) are Cryptographics services and System restore service. Is it even possible to recover them without a complete reinstall of Windows?

Oh and btw, I found out that when my computer is booting if I press Ctrl+ F11 it will take me to a place that will let me reintall windows (no repair install though)

Besides these matters, my computer is working in perfect order.

I ran SDFix just for any scrutiny.


SDFix: Version 1.230
Run by Alex on Fri 10/03/2008 at 08:37 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\Documents and Settings\Alex\Desktop\SDFix\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File
Restoring Missing Security Center Service

Rebooting


Checking Files :

Trojan Files Found:

C:\LOGD.TMP - Deleted
C:\LOGE5B.TMP - Deleted





Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

http://www.gmer.net
Rootkit scan 2008-10-03 20:48:52
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\s ptd\Cfg\19659239224E364682FA4B

AF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:f9,22,42,9f,7d,35,21,d8,bb,b2,a4,96,39 ,c4,49,c5,cf,c1,8b,82,4f,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\s ptd\Cfg\19659239224E364682FA4B

AF72C53EA4\00000001]
"a0"=hex:20,01,00,00,6f,70,8b,fa,55,05,ab,62,cb,ac ,73,01,11,3e,91,a0,f1,..
"khjeh"=hex:97,21,c6,aa,c7,03,86,c4,66,9c,c6,33,5a ,89,c4,9d,13,ab,48,3f,52,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\s ptd\Cfg\19659239224E364682FA4B

AF72C53EA4\00000001\0Jf40]
"khjeh"=hex:48,bd,09,0d,04,bf,19,87,bf,ce,6d,8e,f3 ,3e,b8,ef,2f,27,30,68,d1,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\s ptd\Cfg\19659239224E364682FA4B

AF72C53EA4\00000001\0Jf41]
"khjeh"=hex:89,4a,a1,4c,b4,f7,80,d0,1b,94,2f,73,65 ,86,e0,82,03,33,68,6f,0a,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\sptd\Cfg\19659239224E364682

FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:f9,22,42,9f,7d,35,21,d8,bb,b2,a4,96,39 ,c4,49,c5,cf,c1,8b,82,4f,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\sptd\Cfg\19659239224E364682

FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,6f,70,8b,fa,55,05,ab,62,cb,ac ,73,01,11,3e,91,a0,f1,..
"khjeh"=hex:97,21,c6,aa,c7,03,86,c4,66,9c,c6,33,5a ,89,c4,9d,13,ab,48,3f,52,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\sptd\Cfg\19659239224E364682

FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:48,bd,09,0d,04,bf,19,87,bf,ce,6d,8e,f3 ,3e,b8,ef,2f,27,30,68,d1,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\sptd\Cfg\19659239224E364682

FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:89,4a,a1,4c,b4,f7,80,d0,1b,94,2f,73,65 ,86,e0,82,03,33,68,6f,0a,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710
"NoPopUpsOnBoot"=dword:00000001
"AppInit_DLLs"="avgrsstx.dll"
"LoadAppInit_DLLs"=dword:00000001

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\servic es\sharedaccess\parameters\fir

ewallpolicy\standardprofile\authorizedapplications \list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\syste m32\\sessmgr.exe:*:enabled:@xps

p2res.dll,-22019"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program

Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program

Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network

Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\WINDOWS\\ehome\\ehshell.exe"="C:\\WINDOWS\\eh ome\\ehshell.exe:LocalSubNet:En

abled:Media Center"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program

Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program

Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program

Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe"
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"="C:\\Program

Files\\AVG\\AVG8\\avgemc.exe:*:Enabled:avgemc.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\servic es\sharedaccess\parameters\fir

ewallpolicy\domainprofile\authorizedapplications\l ist]
"%windir%\\system32\\sessmgr.exe"="%windir%\\syste m32\\sessmgr.exe:*:enabled:@xps

p2res.dll,-22019"
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program

Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL"
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program

Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL"
"C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America

Online 9.0\\waol.exe:*:Enabled:America Online 9.0"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network

Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files :


File Backups: - C:\DOCUME~1\Alex\Desktop\SDFix\SDFix\backups\backu ps.zip

Files with Hidden Attributes :

Tue 10 Aug 2004 60,416 A.SH. --- "C:\Program Files\Outlook

Express\msimn.exe"
Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot - Search &

Destroy\SDUpdate.exe"
Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search &

Destroy\SpybotSD.exe"
Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Program Files\Spybot - Search &

Destroy\TeaTimer.exe"
Mon 4 Dec 2006 56 ..SHR --- "C:\WINDOWS\system32\411E15C4E7.sys"
Mon 4 Dec 2006 3,350 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Sun 10 Sep 2006 19,456 ...H. --- "C:\Documents and

Settings\Alex\Application Data\Microsoft\Word\~WRL0003.tmp"
Sat 13 Sep 2008 8 A..H. --- "C:\Documents and

Settings\Administrator\Application

Data\Gtek\GTUpdate\AUpdate\Channels\ch_u1\lock.tmp "
Sat 13 Sep 2008 8 A..H. --- "C:\Documents and

Settings\Administrator\Application

Data\Gtek\GTUpdate\AUpdate\Channels\ch_u2\lock.tmp "
Sat 13 Sep 2008 8 A..H. --- "C:\Documents and Settings\All

Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch7\lock.tmp"
Sat 13 Sep 2008 8 A..H. --- "C:\Documents and Settings\All

Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch8\lock.tmp"
Sat 13 Sep 2008 8 A..H. --- "C:\Documents and

Settings\Eric\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u1\lock.tmp "
Sat 13 Sep 2008 8 A..H. --- "C:\Documents and

Settings\Eric\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u2\lock.tmp "
Sat 13 Sep 2008 8 A..H. --- "C:\Documents and

Settings\Kevin\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u5\lock.tmp "
Sat 13 Sep 2008 8 A..H. --- "C:\Documents and

Settings\Kevin\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u6\lock.tmp "

Finished!