help spybot won't open

[John Conner]

Ok here are my problems. I cannot get my spybot to open no matter what I try.

It cannot access the internet to update.

I cannot open any pages from google which has anything to do with anti virus or anti spyware--I am on a different computer. I just get routed to completely unrelated pages.

My AVG can no longer update--yet I can get online and surf. I have tried everything. Here is my hijack this logfile. Beneath that I havemy uninstall list. HELP PLEASE!

Logfile of HijackThis v1.99.1
Scan saved at 12:23:42 PM, on 12/4/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\LxrSII1s.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Documents and Settings\Maken Change\Desktop\HijackThis.exe

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - Unknown owner - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe" /service /P ddoctorv2 (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

THIS IS MY UNINSTALL LOG

7-Zip 4.42
Adobe Bridge 1.0
Adobe Common File Installer
Adobe Flash Player 9 ActiveX
Adobe Flash Player Plugin
Adobe Help Center 1.0
Adobe Illustrator CS2
Adobe InDesign CS2
Adobe Photoshop CS2
Adobe Reader 7.0
Adobe Stock Photos 1.0
Adobe SVG Viewer 3.0
AirPlus G
ANIO Service
ANIWZCS2 Service
ArcSoft PhotoStudio 5.5
Audacity 1.2.5
AVG 8.0
BCL easyPDF Printer Driver 4.3
BitLord 1.1
BLM 2.7.7
Canon CanoScan LiDE 90 User Registration
Canon MP Navigator EX 1.0
Canon Utilities Solution Menu
CanoScan LiDE 90
CDisplay 1.8
ClickArt Fonts 4
Comcast High-Speed Internet Install Wizard
Comcast Toolbar
Correlate K-Map 3.9
CZ-Pdf2Txt V2.0 Demo
Desktop Doctor
DivX Codec
DivX Converter
DivX Player
DivX Web Player
Flickr Uploadr 3.0.5
Free PDF to Word Doc Converter v1.1
GMail Drive Shell Extension
Google Earth
HijackThis 1.99.1
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows XP (KB952287)
hp deskjet 3820 series
hp deskjet 3820 series (Remove only)
HP Document Viewer 7.0
HP Imaging Device Functions 7.0
HP Photosmart and Deskjet 7.0.A
HP Photosmart Essential
HP Software Update
HP Solution Center 7.0
InterActual Player
Internet Speed Monitor
IrfanView (remove only)
J2SE Runtime Environment 5.0 Update 6
Logitech Desktop Messenger
Logitech MouseWare 9.79
Logitech Resource Center
Macromedia Dreamweaver MX 2004
Macromedia Extension Manager
Macromedia Fireworks MX 2004
Macromedia Flash MX 2004
Macromedia FreeHand MXa
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft AntiSpyware
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Money 2002
Microsoft Money 2002 System Pack
Microsoft National Language Support Downlevel APIs
Microsoft Office Excel Viewer 2003
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable
Microsoft Word 2002
Microsoft Works 2002 Setup Launcher
Microsoft Works 7.0
Microsoft Works Suite Add-in for Microsoft Word
Mozilla Firefox (2.0.0.18)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
NVIDIA Display Driver
OCR Software by I.R.I.S 7.0
palmOne
PeerGuardian 2.0
podAmigo 1.25
PowerDVD
PowerISO
Print Designer GOLD 8.5.1.0
QuickTime
RealPlayer
RegScrubXP 3.25
ScanSoft OmniPage SE 4
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 8 (KB911565)
Security Update for Windows Media Player 8 (KB917734)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Skype 2.5
Sound Solution 1.31b
Split and Tile Trial
Spybot - Search & Destroy
TBS WMP Plug-in
TUGZip 3.4
Uniblue RegistryBooster 2
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
VeohTV BETA
VideoLAN VLC media player 0.8.6c
Viewpoint Manager (Remove Only)
Viewpoint Media Player
WinAce Archiver
Winamp (remove only)
Windows Genuine Advantage v1.3.0254.0
Windows Media Format Runtime
Windows Media Player 10
Windows Media Player Firefox Plugin
Windows XP Service Pack 3
WinPcap 3.1
WinRAR archiver
WM Recorder 11.2
Xvid 1.1.2 final uninstall
ZoneAlarm
ZoneAlarm Spy Blocker

[pskelley]

Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
"BEFORE you POST" (READ this Procedure before Requesting Assistance) http://forums.spybot.info/showthread.php?t=288
All advice given is taken at your own risk.
Please make sure you have read this information so we are on the same page.

Make sure you read and follow the directions, anything else will slow the process and waste both of our time. I suggest you keep this computer offline except when troubleshooting, the junk may download more. If you have any tool I use, delete it and download it new from the link I provide. Read and follow the directions carefully, the tools will not work unless you do.
The junk can be tough to remove, so do not expect fast or easy.

Are you in charge of this computer? I see many issues and don't know if malware is hidden or not.
Have you removed anything from this HJT log or used the whitelist in HJT? If so, stop...I need to see the complete HJT log.

If you want help you will need to read and follow the directions carefully.

1) Read the directions, if you had you would not have posted an out of date HJT log. If you are having problems with Spybot, uninstall it until later. Once you have done that, then follow these directions to update HijackThis.

Download Trend Micro Hijack This™ to your Desktop
http://download.bleepingcomputer.com...HJTInstall.exe
Doubleclick the HJTInstall.exe to start it.
By default it will install HijackThis in the Program Files\Trendmicro folder and create a desktop shortcut.
HijackThis will open after install. Press the Scan button below.
This will start the scan and open a log. <<< Close HJT until I ask for a log later.

2) Uninstall list: I look for malware and security issues and will not know all of your programs, but you should.

Hackers are using out of date programs to infect folks more and more,
Here is a small free tool that lets you know when something needs an update if you are interested:
http://secunia.com/vulnerability_scanning/personal/ While PSI runs in the System Tray for realtime notifications, I personally prefer to turn it off in MSConfig and run it from All Programs when I want to do a check.

Adobe Reader 7.0 <<< out of date and being exploited, see this:
http://news.cnet.com/8301-1009_3-100...ml?tag=nl.e433
http://www.filehippo.com/download_adobe_reader/
(if you want a smaller program, look at this one)
Foxit Reader 2.3 for Windows
http://www.foxitsoftware.com/pdf/rd_intro.php

BitLord 1.1 <<< uninstall this and all p2p programs on the computer, see this:
http://forums.spybot.info/showthread.php?t=282

If your helper detects the presence of such programs on your computer he/she will ask you to remove them. Help will be withdrawn should you not agree to their removal.

J2SE Runtime Environment 5.0 Update 6 <<< out of date, see this:
http://forums.spybot.info/showpost.p...80&postcount=2
Be aware of this information so you can opt out of anything you do not want.
Microsoft Does MSN Toolbar Distribution Deal With Java:
http://searchengineland.com/microsof...java-15413.php

Logitech Desktop Messenger <<< this resource hog gets installed with other Ligitech software, usually because the EULA is not red. If you don't use it, I suggest you uninstall it.

Mozilla Firefox (2.0.0.18) <<< out of date and a security issues, I suggest if you are going to run programs, you must keep them up to date:
http://www.mozilla.com/en-US/firefox/

Viewpoint Manager (Remove Only)
Viewpoint Media Player
Suggest you read this information and uninstall this:
For your information, Viewpoint is installed by aol probably without your knowledge. I suggest you uninstall this resource waster in Add Remove programs.
http://www.spywareinfo.com/newslette....php#viewpoint
http://www.clickz.com/news/article.php/3561546

ZoneAlarm Spy Blocker <<< uninstall this (NOT ZONE ALARM) See the links:
http://securitygarden.blogspot.com/2...zonealarm.html
http://www.benedelman.org/spyware/in...jeeves-banner/
http://www.malwarebytes.org/forums/i...showtopic=3143

When you get to this point, post a new HJT log and tell me exactly what problems you are having. If you receive error messages I need those word for word.

Thanks

[John Conner]

Line for line that I could.

1. Removed viewpoint manager and media player.
2. Removed Bitlord
3.Got and ran the Secunia PSI
4. Removed fake Zone Alarm Spy Blocker
5.Updated my mozilla.
6. Removed Logitech desktop manager.
7. Removed J2SE Runtime
8. Removed Adobe reader and switched to Foxit Reader.

I am on a different computer and only have the other one to do your suggestions.

I am in charge of this computer now--was my wifes.

I uninstalled Spybot.

Here are the exact problems I am having. Beneath that will be a HJT log I am running right now.

1. I could not open Spybot.
2. My AVG anti virus would not update and completely went on the fritz.
3. Any website I attempted to go to that mentioned spyware or virus or anything that could help me I was either told the server could not be reached--or forwarded to another site. This is still the case.
4. Periodically an ad will pop up telling me that my computer is not safe--take me to a website and promply would start a "free scan" and offers to download regardless of what button I press--I always say no.

Here is the current log. I have to put this on a flash drive and transfer it to this computer because the problem computer will not let me open this webpage. Thank you for any help. I am diligently following ever suggestion you make word for word.

This is the complete log--no editing.

Logfile of HijackThis v1.99.1
Scan saved at 8:50:34 PM, on 12/7/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LxrSII1s.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Maken Change\Desktop\HijackThis.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - Unknown owner - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe" /service /P ddoctorv2 (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

[John Conner]

When I try goto the website you provided I get told that Firefox cannot establish a connection with download.bleepingcomputer.com

This is what happens whenever I try to goto a security related website or try to do an update.

[pskelley]

When I try goto the website you provided I get told that Firefox cannot establish a connection with download.bleepingcomputer.com

Use Internet Explorer, sounds like Firefox may be corrupt and will probably need to be reinstalled. We will likely need additional downloads and if you can't download HJT, we have a real problem. An option would be to download the tool on a clean computer to a clean USB drive or Flash drive and bring it to the infected computer.

When you post information I need any and all error message "word for word".

This is what happens whenever I try to goto a security related website or try to do an update.

Almost certainly malware causing it, this is a hackers attempt to get you to purchase their junk which will not help and is the cause of the problems...called fraud.

Thanks

[John Conner]

OK I updated all of my programs using Secunia.

I tried to update using a clean computer--but it would not let me open the new HJT.

I did manage to open the malicious software tool IE includes with there new version of IE--but it told me no problems.

I am starting to get a bad feeling like I may need to just wipe my drive and start over--but I hate to give in to the people who create this malware to get me to buy their garbage.

[pskelley]

Let's see what a Kaspersky Online Scan reports:

Run this online scan using Internet Explorer:
Kaspersky Online Scanner from http://www.kaspersky.com/virusscanner

Next Click on Launch Kaspersky Online Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

* The program will launch and then begin downloading the latest definition files:
* Once the files have been downloaded click on NEXT
* Now click on Scan Settings
* In the scan settings make that the following are selected:
* Scan using the following Anti-Virus database:
* Standard
* Scan Options:
* Scan Archives
* Scan Mail Bases
* Click OK
* Now under select a target to scan:
* Select My Computer
* This will program will start and scan your system.
* The scan will take a while so be patient and let it run.
* Once the scan is complete it will display if your system has been infected.
* Now click on the Save as Text button:
* Save the file to your desktop.

Then post it here.

Thanks

[John Conner]

Internet explorer cannot display the webpage.

But I can goto google.

Thats the thing about this malware. It blocks me from any legitimate virus webpage.

It also will not open any new files I bring in from a clean program with anti virus or anti spyware. It allowed IE to update and open--and my new mozilla.

Adaware is the only exception--but its completely screwed up when it opens. Its in two different langueges.

But no kasperky online scan.

[pskelley]

It's going to be hard to help if you can not download any tools we use. You can try downloading from another computer that is clean to removable media. Then bring it to the infected computer and run it. Keep in mind that this first tool is 2.91 MB's in size.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
• See this Link for programs that need to be disabled and instruction on how to disable them.
• Remember to re-enable them when we're done.
  
  
• Double click on ComboFix.exe & follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply along with a New Hijackthis log.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

Tutorial if needed
http://www.bleepingcomputer.com/comb...o-use-combofix

Thanks

[John Conner]

Hey I got a program called avast over from a clean computer and it opened and ran--but was blocked from updating. I downloaded the update and it ran to.

Running right now--has taken out 4 viruses so far it says.

fingers crossed.

The avast website said it is built to resist commands to shut it down--which seems to be what happened with the other programs.

fingers crossed.

http://www.pcworld.com/downloads/fil...scription.html