Virtumode help please!!!

Hi

Yes, I think reinstalling is worth trying since the infection probably harmed something earlier causing uninstall failure. You won't get vundo if you use official source for Avast!.
 
I just tried to cleaning the folder using OTMoveIt2 and I believe it says it was successfully deleted, but the C:\Program Files\Avast Antivirus file still exists and still wont delete :sad:

Anyways here is the log file that was created. Hope this helps if nothing else....


File/Folder avenger.zip not found.
File/Folder avenger.exe not found.
File/Folder Avenger not found.
File/Folder avenger.txt not found.
File/Folder bfu.zip not found.
File/Folder BFU not found.
C:\WINDOWS.0\erdnt\subs folder deleted successfully.
C:\WINDOWS.0\erdnt\Hiv-backup\Users\00000006 folder deleted successfully.
C:\WINDOWS.0\erdnt\Hiv-backup\Users\00000005 folder deleted successfully.
C:\WINDOWS.0\erdnt\Hiv-backup\Users\00000004 folder deleted successfully.
C:\WINDOWS.0\erdnt\Hiv-backup\Users\00000003 folder deleted successfully.
C:\WINDOWS.0\erdnt\Hiv-backup\Users\00000002 folder deleted successfully.
C:\WINDOWS.0\erdnt\Hiv-backup\Users\00000001 folder deleted successfully.
C:\WINDOWS.0\erdnt\Hiv-backup\Users folder deleted successfully.
C:\WINDOWS.0\erdnt\Hiv-backup folder deleted successfully.
C:\WINDOWS.0\erdnt folder deleted successfully.
C:\QooBox\Quarantine\Registry_backups folder deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS.0\system32\dllcache folder deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS.0\system32 folder deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS.0 folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Cookies folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Starware347\TravelSearch folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Starware347\ToolbarSearch folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Starware347\ToolbarLogo folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Starware347\Toolbar folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Starware347\SearchMatch folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Starware347\SearchAssistPlus folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Starware347\ScreensaversMarketingSitePager folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Starware347\RelatedSearch folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Starware347\Pranks folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Starware347\Movies folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Starware347\Manager folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Starware347\Layouts folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Starware347\JokeSearch folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Starware347\Games folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Starware347\ErrorSearch folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Starware347\EntertainmentMarketingSP folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Starware347\Configurator folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Starware347\BrowserSearch folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Starware347 folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Macromedia\Flash Player\macromedia.com\support folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Macromedia\Flash Player\macromedia.com folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Macromedia\Flash Player\#SharedObjects\6VTRVH3V\interclick.com folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Macromedia\Flash Player\#SharedObjects\6VTRVH3V folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Macromedia\Flash Player\#SharedObjects folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Macromedia\Flash Player folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data\Macromedia folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44\Application Data folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\JOHN.V-A03C621E02B44 folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\John\Cookies folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\John folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\All Users.WINDOWS.0\Application Data\Starware347\SimpleUpdate folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\All Users.WINDOWS.0\Application Data\Starware347\ScreensaversMarketingSitePager\images\active folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\All Users.WINDOWS.0\Application Data\Starware347\ScreensaversMarketingSitePager\images folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\All Users.WINDOWS.0\Application Data\Starware347\ScreensaversMarketingSitePager folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\All Users.WINDOWS.0\Application Data\Starware347\Movies\images\active folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\All Users.WINDOWS.0\Application Data\Starware347\Movies\images folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\All Users.WINDOWS.0\Application Data\Starware347\Movies folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\All Users.WINDOWS.0\Application Data\Starware347\Games\images\active folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\All Users.WINDOWS.0\Application Data\Starware347\Games\images folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\All Users.WINDOWS.0\Application Data\Starware347\Games folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\All Users.WINDOWS.0\Application Data\Starware347\EntertainmentMarketingSP\images\active folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\All Users.WINDOWS.0\Application Data\Starware347\EntertainmentMarketingSP\images folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\All Users.WINDOWS.0\Application Data\Starware347\EntertainmentMarketingSP folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\All Users.WINDOWS.0\Application Data\Starware347\contexts folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\All Users.WINDOWS.0\Application Data\Starware347\buttons folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\All Users.WINDOWS.0\Application Data\Starware347 folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\All Users.WINDOWS.0\Application Data folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\All Users.WINDOWS.0 folder deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings folder deleted successfully.
C:\QooBox\Quarantine\C folder deleted successfully.
C:\QooBox\Quarantine folder deleted successfully.
C:\QooBox\BackEnv folder deleted successfully.
C:\QooBox folder deleted successfully.
Service not present: catchme.
Service not present: gmer.
File delete failed. C:\Documents and Settings\JOHN.V-A03C621E02B44\Desktop\OTMoveIt2.exe scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\JOHN.V-A03C621E02B44\Desktop\OTMoveIt2.exe scheduled to be deleted on reboot.
C:\_OTMoveIt\MovedFiles\08192008_093058\Program Files\Avast Antivirus\Setup\INF\IA64 folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_093058\Program Files\Avast Antivirus\Setup\INF\AMD64 folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_093058\Program Files\Avast Antivirus\Setup\INF folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_093058\Program Files\Avast Antivirus\Setup folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_093058\Program Files\Avast Antivirus\images folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_093058\Program Files\Avast Antivirus\HtmlData folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_093058\Program Files\Avast Antivirus\ENGLISH\HtmlData folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_093058\Program Files\Avast Antivirus\ENGLISH\HELP folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_093058\Program Files\Avast Antivirus\ENGLISH folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_093058\Program Files\Avast Antivirus\DATA\Skin folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_093058\Program Files\Avast Antivirus\DATA\report folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_093058\Program Files\Avast Antivirus\DATA\moved folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_093058\Program Files\Avast Antivirus\DATA\log folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_093058\Program Files\Avast Antivirus\DATA\journal folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_093058\Program Files\Avast Antivirus\DATA\integ folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_093058\Program Files\Avast Antivirus\DATA\chest folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_093058\Program Files\Avast Antivirus\DATA\backup folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_093058\Program Files\Avast Antivirus\DATA folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_093058\Program Files\Avast Antivirus folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_093058\Program Files folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_093058 folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_092523\Program Files\Avast Antivirus\Setup\INF\IA64 folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_092523\Program Files\Avast Antivirus\Setup\INF\AMD64 folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_092523\Program Files\Avast Antivirus\Setup\INF folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_092523\Program Files\Avast Antivirus\Setup folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_092523\Program Files\Avast Antivirus\images folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_092523\Program Files\Avast Antivirus\HtmlData folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_092523\Program Files\Avast Antivirus\ENGLISH\HtmlData folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_092523\Program Files\Avast Antivirus\ENGLISH\HELP folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_092523\Program Files\Avast Antivirus\ENGLISH folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_092523\Program Files\Avast Antivirus\DATA\Skin folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_092523\Program Files\Avast Antivirus\DATA\report folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_092523\Program Files\Avast Antivirus\DATA\moved folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_092523\Program Files\Avast Antivirus\DATA\log folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_092523\Program Files\Avast Antivirus\DATA\journal folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_092523\Program Files\Avast Antivirus\DATA\integ folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_092523\Program Files\Avast Antivirus\DATA\chest folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_092523\Program Files\Avast Antivirus\DATA\backup folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_092523\Program Files\Avast Antivirus\DATA folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_092523\Program Files\Avast Antivirus folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_092523\Program Files folder deleted successfully.
C:\_OTMoveIt\MovedFiles\08192008_092523 folder deleted successfully.
C:\_OTMoveIt\MovedFiles folder deleted successfully.
C:\_OTMoveIt folder deleted successfully.
File delete failed. C:\Documents and Settings\JOHN.V-A03C621E02B44\Desktop\OTMoveIt2.exe scheduled to be deleted on reboot.


Cheers,
John
 
Hey Blade,

Sorry for the delay...
Well I uninstalled AVG and reinstalled Avast from the link you provided and well Im now unable to uninstall Avast again from Add/Remove programs. When i try to click on the uninstall button, nothing happens like before. Also my internet explore has slowed down again.

Here is a fresh HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:00:34 AM, on 22/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\Program Files\Avast Antivirus\aswUpdSv.exe
C:\WINDOWS.0\system32\spoolsv.exe
C:\WINDOWS.0\Explorer.EXE
C:\Program Files\Multimedia Control Center\MCC.exe
C:\WINDOWS.0\system32\rundll32.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS.0\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS.0\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
C:\WINDOWS.0\system32\nvsvc32.exe
C:\WINDOWS.0\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS.0\system32\wscntfy.exe
C:\WINDOWS.0\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS.0\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [MCC] C:\Program Files\Multimedia Control Center\MCC.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS.0\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS.0\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS.0\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS.0\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by21fd.bay21.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD44/JSCDL...-jc.cab&File=jinstall-6u7-windows-i586-jc.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast Antivirus\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast Antivirus\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast Antivirus\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast Antivirus\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS.0\system32\nvsvc32.exe

--
End of file - 8005 bytes
 
Hey Blade,

when i try to run that software I get this message:

The avast! self protection module is enabled. For this reason, the operation cannot be completed.

To complete the operation, either run this program in safe mode, or disable the avast! self protection (via settings -> Troubleshooting page).


I disabled the avast self protection, but I still get this message. Not to sure how to run in safe mode.

Thanks,
John
 
Thx for all the help Blade, again I really appreciate it. Looks like everything is working great now and I was finally able to uninstall that Avast folder.

Here is a final HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:40:17 AM, on 24/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\system32\spoolsv.exe
C:\WINDOWS.0\Explorer.EXE
C:\Program Files\Multimedia Control Center\MCC.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS.0\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS.0\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS.0\system32\rundll32.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
C:\WINDOWS.0\system32\nvsvc32.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\WINDOWS.0\system32\svchost.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS.0\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [MCC] C:\Program Files\Multimedia Control Center\MCC.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS.0\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS.0\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS.0\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS.0\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by21fd.bay21.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD44/JSCDL...-jc.cab&File=jinstall-6u7-windows-i586-jc.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS.0\system32\nvsvc32.exe

--
End of file - 8430 bytes


Cheers!!!!
 
You're welcome :)

Log looks indeed good now. Guess we're ready for archiving the topic?
 
Since this issue appears to be resolved ... this Topic has been closed. Glad I could help. :)

Note:If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than five days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.
 
You must log in or register to reply here.
Back
Top