Spybot won't launch, several trojans and viruses found on pc
Hello all. Hopefully I'll be able to accurately describe my ordeal over the last 2 days. Let me start by saying my home PC is used buy multiple people, and I'm hoping that I will not have to reformat yet again since I have some files not backed up and I do not want to hook-up my external hard drive since I know the pc is infected.
So 2 days ago while my husband was online my computer started "going crazy" since I was out of the house he tried to run Spybot, but it would not work. He then started to run AVG, well it started right away picking up some trojans. This I found pretty shocking since I scan my computer once a week, unfortunately my son interrupted the scan half way through and I had to start all over again. After a few hours and due to the lateness of the day I decided to let it run overnight... big mistake.
I got up the next morning and right away was greeted not by AVG but yet another program that would immediatly re-launch after I closed it out. So I restarted my computer went into msconfig and stopped a few new unfamiliar programs from starting on launch. Restarted my computer and now all of a sudden I could not open any of my spyware / virus search programs, internet explorer, firefox, and any other .exe files. After finding a work around to access the internet and doing a registry edit for exe I was able to open several programs again, including AVG but not spybot. So I uninstalled and reinstalled spybot. Still it would not launch but the tea timer would start
up.
While installing spybot I saw that a program popped up that was self installing. I quickly exited it and disconnected the internet. Next I set out to remove a few of the program files that I could find such as Personal Antivirus, Antivirus 2010, and Bravix. Unfortunately I ended up removing something that caused me to have to reactivate windows upon restart of the pc. After removing those my computer stopped downloading and self installing those programs. After running AVG a third time it had found 15 trojans and 2 viruses. Still after removal spybot would not work.
So I came here, then to trend micro to get Hijack this. But hijack this would not install or open, so I went back to trend micro and did an online scan. It found an additional trojan and 2 instances of malware. After removing those I was able to run the exe for hijack this but not able to install. At this point spybot still won't open.
So I'm back here and below you will find the hijack this log, hopefully you can help me out since I know that there is sill something lurking on my computer. Thanks in advance for your assistance.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:43:23 AM, on 7/30/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal
Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Documents and Settings\Kathrine\Desktop\HJTInstall.exe
C:\Documents and Settings\Kathrine\Desktop\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: AT&&T Toolbar - {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} - C:\PROGRA~1\ATTTOO~1\ATTTOO~1.DLL (file missing)
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [minix32] C:\WINDOWS\system32\minix32.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [minix32] C:\WINDOWS\system32\minix32.exe (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1223821276812
O16 - DPF: {EA7F451B-94DD-4009-A8BF-8F977B0B2696} - http://pbells.broadjump.com/wizlet/S...ller_4-2-0.cab
O20 - AppInit_DLLs: cru629.dat
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
--
End of file - 3901 bytes
