Computer Hope

Microsoft => Microsoft Windows => Windows Server => Topic started by: Dummy on December 28, 2005, 11:36:31 AM

Title: Virus ?
Post by: Dummy on December 28, 2005, 11:36:31 AM
This problem has persisted for awhile. I have a HP Pavillion with Norton antivirus. The problen is that some how some has put me on a network of computers and they stop the downloads of some programs. I did what I thought was a full hard drive format however the problem persists. HP sent a new hard drive and still the same problem. I have enough computer skills to make me dangerous, but have been playing with the dos progam. Most of the programs are loaded in HIMEM with I did not do. ALso when I do a system restore it shows I have alot of new progams added rather than everything new. Any help is appreciated.
Title: Re: Virus ?
Post by: Tadracket on December 28, 2005, 11:57:23 AM
What are you trying to accomplish? Do you want off the network? Do you want to dl programs you can't? On a personal note: if you have just enough skills to make you dangerous, you might want to play somewhere other than DOS. Just a suggestion. Give me some more info.
Title: Re: Virus ?
Post by: Dummy on December 28, 2005, 12:05:32 PM
yes i want off the network. I did complete destructive recovery this morning to no avail. I'm sure that it is in the restore partition of the disk and possibly memory resident.
Title: Re: Virus ?
Post by: Tadracket on December 28, 2005, 12:09:15 PM
Are you at work or on a home computer?
Title: Re: Virus ?
Post by: Dummy on December 28, 2005, 12:10:09 PM
This is a home computer,
Title: Re: Virus ?
Post by: Tadracket on December 28, 2005, 12:17:31 PM
That is a strange one. We have firewalls here at work that lock people off certain websites and programs that lock certain executables but for someone to install this on your home computer to keep you from running some programs makes no sense to me. What programs are being blocked? Maybe it is an ISp thing. Are you a known file sharer? Who is you isp?
Title: Re: Virus ?
Post by: Dummy on December 28, 2005, 12:20:02 PM
I understand the statement of playing in dos as it can sure mess things up, but this is where I found some stange things. I would love to just wipe out everything and start over. I have lost all important information already, and replace the hard drive. I've pulled the pugged and almost cussed once ??? I've pulled the battery to reset bios, I,ve did serveral dos progams to clean the hard drive 1 that I found on computerhope and it's still there.
Title: Re: Virus ?
Post by: Dummy on December 28, 2005, 12:24:58 PM
No I do not share normally and have never done so in the past. I use this computer for a home business. Charter is my isp. The strange thing is that if I go to cmd and type ipconfig/all everything looks normal until I go online then I have a DHCP (I don't normally have 1)
Title: Re: Virus ?
Post by: Dummy on December 28, 2005, 12:29:44 PM
Also when I do a system restore from disks it hangs up on driv\apps.log not recoverable along with serveral others. I retry and usually get through to get back on line.
Title: Re: Virus ?
Post by: Tadracket on December 28, 2005, 12:51:31 PM
What programs are you trying to install that it won't let you?
Title: Re: Virus ?
Post by: Dummy on December 28, 2005, 12:59:31 PM
Any program from the internet usually will be missing part of the progam I can load from home with no  problem, the Norton anti-virus progam, of course is redirected to the host computer so I cannot be sure if I download updates. It finds nothing anyway.
Title: Re: Virus ?
Post by: Tadracket on December 28, 2005, 01:12:20 PM
Maybe there is enough info here for someone to offer ideas 'cause I am at a loss. Never seen anything like this before. Hope you get it remedied.
Title: Re: Virus ?
Post by: Dummy on December 28, 2005, 01:15:44 PM
Thanks, I do too. I appreaciate all the help, and again amazied at all people are able to accomplish with a computer.
Title: Re: Virus ?
Post by: Fed on December 28, 2005, 03:13:14 PM
What is your Operating System?
Do you have a full version Operating System Disk?
Are you using your 1st Hard drive or the one that HP sent you?
Title: Re: Virus ?
Post by: Dummy on December 28, 2005, 04:28:21 PM
I'm running XP Home with the new hard drive and with in 1 min of accessing the internet I developed the same condition.
Title: Re: Virus ?
Post by: Dummy on December 28, 2005, 05:00:34 PM
Sorry I forgot to add all I have is the system restore disks HP sent. These are factory disks not my downloads.
Title: Re: Virus ?
Post by: Fed on December 28, 2005, 05:38:40 PM
I don't think you can do a clean install with restore disks, I may be wrong, I've never owned any.
Someone? Anyone?  ???
Title: Re: Virus ?
Post by: GX1_Man on December 28, 2005, 06:02:55 PM
Depends on the manufacturer and what they were made to do. Not even consistent between manufacturer's (i.e. some Compaqs yes, others no).
Title: Re: Virus ?
Post by: J0K3R on December 28, 2005, 08:43:38 PM
Get rid of Nortons,, i'm serious man
Title: Re: Virus ?
Post by: Dell4700 on December 28, 2005, 10:33:27 PM
Is the PC still under warranty?  Fixing the PC yourself may void some or all of your warranty (not recommended)?

Otherwise, please provide the following information:

- your PC Model Number (HP Pavillion is not enough info)
- your PC hardware/firmware configuration (BIOS, drives, video card, other peripherals, etc.) (new hard drive or old hard drive is not enough info)
- normal current software configuration (common programs, antivirus/anti-malware, firewall, browser, etc.) (Norton is not enough info)
- what was the normal operating configuration when you first purchased the PC?  What operating system came with it?
- more background info on what happened or what you think happened.  Include any changes you may have made at the time things began going south (new hardware/software, etc.)
- you describe problems while online?  Do you have problems when not online?
- what specific programs are you unable to download?  What specific web sites give you this problem?

Try to give as much info as you can to avoid guesswork on our part.  If you don't understand any of the above or you don't know how to get the info, please let us know and we'll help.

Dell
Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 12:45:47 PM
OS Name      Microsoft Windows XP Home Edition      
Version      5.1.2600 Service Pack 1 Build 2600      
OS Manufacturer      Microsoft Corporation      
System Name      YOUR-XHTR8HVC4P      
System Manufacturer      HP Pavilion 061      
System Model      DM181A-ABA a305w      
System Type      X86-based PC      
Processor      x86 Family 15 Model 2 Stepping 9 GenuineIntel ~2691 Mhz      
BIOS Version/Date       3.24, 10/14/2003      
SMBIOS Version      2.31      
Windows Directory      C:\WINDOWS      
System Directory      C:\WINDOWS\System32      
Boot Device      \Device\HarddiskVolume1      
Hardware Abstraction Layer      Version = "5.1.2600.1106 (xpsp1.020828-1920)"      
User Name      YOUR-XHTR8HVC4P\Owner      
Time Zone      Central Standard Time      
Total Physical Memory      256.00 MB      
Available Physical Memory      120.98 MB      
Total Virtual Memory      853.33 MB      
Available Virtual Memory      628.63 MB      
Page File Space      606.35 MB      
Page File      C:\pagefile.sys      
Memory Address 0xA0000-0xBFFFF      PCI bus      
Memory Address 0xA0000-0xBFFFF      Intel(R) 82845G/GL/GE/PE/GV Graphics Controller      
Channel 4      Direct memory access controller
Channel 3      ECP Printer Port (LPT1)      OK
Channel 2      Standard floppy disk controller

82845G/GL/GE/PE/GV Graphics Controller      OK      
&REV_10\4&2C53C0AE&0&10F0      
Last Reset      1/1/2002 4:24 AM      
Index      1      
Service Name      RTL8139      
IP Address      24.176.117.20      
IP Subnet      255.255.248.0      
Default IP Gateway      24.176.112.1      
DHCP Enabled      Yes      
DHCP Server      68.114.38.178      
DHCP Lease Expires      1/3/2002 4:32 AM      
DHCP Lease Obtained      1/1/2002 4:32 AM      
MAC Address      00:40:2B:69:84:47      
I/O Port      0x00002000-0x000020FF      
Memory Address      0xE8100000-0xE81000FF      
IRQ Channel      IRQ 17      
Driver      c:\windows\system32\drivers\r8139n51.sys (5.505.1004.2002 built by: WinDDK, 45.88 KB (46,976 bytes), 8/23/2003 8:41 AM)      
           
Name      [00000002] RAS Async Adapter      
Adapter Type      Not Available      
Installed      Yes      
PNP Device ID      Not Available      
Index      2      
Name      [00000003] Packet Scheduler Miniport      
Adapter Type      Ethernet 802.3      
Product Type      Packet Scheduler Miniport      
Installed      Yes      
PNP Device ID      ROOT\MS_PSCHEDMP\0000      
Last Reset      1/1/2002 4:24 AM      
MAC Address      00:40:2B:69:84:47      
Driver      c:\windows\system32\drivers\psched.sys (5.1.2600.1106 (xpsp1.020828-1920), 64.50 KB (66,048 bytes), 1/1/2002 1:25 AM)      
           
Name      [00000004] WAN Miniport (L2TP)      
Adapter Type      Not Available      
Product Type      WAN Miniport (L2TP)      
Installed      Yes      
PNP Device ID      ROOT\MS_L2TPMINIPORT\0000
Name      [00000005] WAN Miniport (PPTP)      
Adapter Type      Wide Area Network (WAN)      
Product Type      WAN Miniport (PPTP)      
Installed      Yes      
PNP Device ID      ROOT\MS_PPTPMINIPORT\0000      
MAC Address      50:50:54:50:30:30      
Driver      c:\windows\system32\drivers\raspptp.sys (5.1.2600.1106 (xpsp1.020828-1920), 45.25 KB (46,336 bytes), 1/1/2002 1:25 AM)      
           
Name      [00000006] WAN Miniport (PPPOE)      
Adapter Type      Wide Area Network (WAN)      
Product Type      WAN Miniport (PPPOE)      
Installed      Yes      
PNP Device ID      ROOT\MS_PPPOEMINIPORT\0000      
MAC Address      33:50:6F:45:30:30      
Driver      c:\windows\system32\drivers\raspppoe.sys (5.1.2600.0 (xpclient.010817-1148), 38.00 KB (38,912 bytes), 1/1/2002 1:25 AM)      
           
Name      [00000007] Direct Parallel      
Adapter Type      Not Available      
Product Type      Direct Parallel      
Installed      Yes      
PNP Device ID      ROOT\MS_PTIMINIPORT\0000      
MAC Address      Not Available      
Driver      c:\windows\system32\drivers\raspti.sys (5.1.2600.0 (xpclient.010817-1148), 16.13 KB (16,512 bytes), 1/1/2002 1:25 AM)      
           
Name      [00000008] WAN Miniport (IP)      
Adapter Type      Not Available      
Product Type      WAN Miniport (IP)      
Installed      Yes      
PNP Device ID      ROOT\MS_NDISWANIP\0000      
Last Reset      1/1/2002 4:24 AM      
Index      8      
Service Name      NdisWan      
Driver      c:\windows\system32\drivers\ndiswan.sys (5.1.2600.1106 (xpsp1.020828-1920), 85.50 KB (87,552 bytes), 1/1/2002 1:25 AM)      
           
Name      [00000009] Packet Scheduler Miniport      
Adapter Type      Ethernet 802.3      
Product Type      Packet Scheduler Miniport      
Installed      Yes      
PNP Device ID      ROOT\MS_PSCHEDMP\0001      
MAC Address      DA:DA:20:52:41:53      
Driver      c:\windows\system32\drivers\psched.sys (5.1.2600.1106 (xpsp1.020828-1920), 64.50 KB (66,048 bytes), 1/1/2002 1:25 AM)      
Driver      c:\windows\system32\drivers\serial.sys (5.1.2600.1106 (xpsp1.020828-1920), 61.00 KB (62,464 bytes), 1/1/2002 1:25 AM)      
[Parallel]
Name      LPT1      
PNP Device ID      ACPI\PNP0401\1      
I/O Port      0x00000378-0x0000037F      
I/O Port      0x00000778-0x0000077F      
DMA Channel      Channel 3      
Driver      c:\windows\system32\drivers\parport.sys (5.1.2600.1106 (xpsp1.020828-1920), 74.25 KB (76,032 bytes), 8/29/2002 3:27 AM)      
[Drives]
Item      Value      
Drive      A:      
Description      3 1/2 Inch Floppy Drive      
Drive      C:      
Description      Local Fixed Disk      
Compressed      No      
File System      NTFS      
Size      31.70 GB (34,039,107,584 bytes)      
Free Space      27.70 GB (29,747,302,400 bytes)
Volume Name      HP_PAVILION      
Volume Serial Number      B43FDB55      
Drive      E:      
Description      CD-ROM Disc      
[Disks]
Item      Value      
Description      Disk drive      
Manufacturer      (Standard disk drives)      
Model      ST340015A      
Bytes/Sector      512      
Media Loaded      Yes      
Media Type      Fixed hard disk      
Partitions      1      
SCSI Bus      0      
SCSI Logical Unit      0      
SCSI Port      0      
SCSI Target ID      0      
Sectors/Track      63      
Size      37.27 GB (40,015,503,360 bytes)      
Total Cylinders      5,169      
Total Sectors      78,155,280      
Total Tracks      1,240,560      
Tracks/Cylinder      240      
Partition      Disk #0, Partition #0      
Partition Size      31.70 GB (34,039,111,680 bytes)
Partition Starting Offset      5,968,650,240 bytes
Item      Value      
Name      Intel(r) 82801DB Ultra ATA Storage Controller-24CB      
Manufacturer      Intel      
Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 01:06:36 PM
Hope this helps
The problem started months ago but I wasn't aware of it until recently. I'm almost positive I opened an e-mail attachment that started the problem. I am working on a Biogas project which some people wanted to invest in, and of course this. I do however have a nicely forged cashiers check for $9,800. No, I didnt lose any money :D
Since I started nocticing some e-mail I sent several times did not go through I started browsing in my computer and 1) I don't know much 2) I knew it was'nt right. I called HP am they sent a new hard drive, I installed it but nothing really changed. Countless phone calls later they told me if I could access the internet "Good Luck". I started looking in dos and noticed several drivers and programs there. When I did a system recovery normally everything is new, however now when I do a recovery when I go to start it shows alot of new programs installed (highlited).  
Title: Re: Virus ?
Post by: dl65 on December 29, 2005, 01:15:27 PM
Dummy   ....How about running a scan with hijackthis and posting it here ....it may reveal something ......
http://www.majorgeeks.com/download3155.html
After you run the scan .....save it to your desktop ......and then copy it and then paste it into the Compter Hope thread that you have going ........if its too large to get it in one post ........post it in 2 or more . Be sure to post the entire log including the info on your system and the running processes .

dl65  ::)
Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 01:41:53 PM
Logfile of HijackThis v1.99.1
Scan saved at 6:52:56 AM, on 1/1/2002
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\ps2.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us9.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us9.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us9.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us9.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us9.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://msn.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - (no file)
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AutoTKit] C:\hp\bin\AUTOTKIT.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

PLEASE NOTE THE TIME AND DATE ARE INCORRECT
I DID NOT RESET TIME OR DATE WHEN I PULLED THE BATTERY ON BIOS ;D
Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 01:59:34 PM
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Owner>cd..

C:\Documents and Settings>cd..

C:\>dir /a
Volume in drive C is HP_PAVILION
Volume Serial Number is B43F-DB55

Directory of C:\

08/23/2003  06:53 AM                 0 AUTOEXEC.BAT
01/01/2002  03:09 AM               196 BOOT.BAK
01/01/2002  04:28 AM               266 boot.ini
01/01/2002  03:18 AM    <DIR>          cmdcons
08/29/2002  06:00 AM           245,920 cmldr
01/01/2002  04:13 AM    <DIR>          Config.Msi
08/23/2003  06:53 AM                 0 CONFIG.SYS
08/23/2003  06:56 AM    <DIR>          Documents and Settings
01/01/2002  04:24 AM       259,047,424 hiberfil.sys
01/01/2002  03:58 AM    <DIR>          hp
01/01/2002  03:26 AM    <DIR>          I386
08/23/2003  06:53 AM                 0 IO.SYS
08/23/2003  06:53 AM                 0 MSDOS.SYS
08/29/2002  06:00 AM            47,580 NTDETECT.COM
08/29/2002  06:00 AM           233,632 ntldr
01/01/2002  04:24 AM       390,070,272 pagefile.sys
01/01/2002  06:46 AM    <DIR>          Program Files
01/01/2002  03:19 AM    <DIR>          RECYCLER
01/01/2002  03:14 AM    <DIR>          System Volume Information
08/23/2003  07:11 AM    <DIR>          system.sav
01/01/2002  04:13 AM    <DIR>          WINDOWS
             11 File(s)    649,645,290 bytes
             10 Dir(s)  29,745,631,232 bytes free

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Owner>cd..

C:\Documents and Settings>cd..

C:\>MEM /D

 Address     Name          Size       Type
 -------     --------     ------     ------
 000000                   000400     Interrupt Vector
 000400                   000100     ROM Communication Area
 000500                   000200     DOS Communication Area

 000700      IO           000370     System Data
                 CON                   System Device Driver
                 AUX                   System Device Driver
                 PRN                   System Device Driver
                 CLOCK$                System Device Driver
                 COM1                  System Device Driver
                 LPT1                  System Device Driver
                 LPT2                  System Device Driver
                 LPT3                  System Device Driver
                 COM2                  System Device Driver
                 COM3                  System Device Driver
                 COM4                  System Device Driver

 000A70      MSDOS        001630     System Data

 0020A0      IO           001FF0     System Data
               KBD        000CE0      System Program
               HIMEM      0004E0      DEVICE=
                 XMSXXXX0              Installed Device Driver
                          000490      FILES=
                          000090      FCBS=
                          0000E0      LASTDRIVE=
                          0007D0      STACKS=
 0040A0      COMMAND      000A20     Program
 004AD0      MSDOS        000070     -- Free --
 004B50      COMMAND      000440     Environment
 004FA0      MEM          000380     Environment
 005330      MEM          0174E0     Program
 01C820      MSDOS        0837C0     -- Free --
 09FFF0      SYSTEM       02C000     System Program

 0CC000      MSDOS        000360     -- Free --
 0CC370      MSCDEXNT     0001D0     Program
 0CC550      REDIR        000A70     Program
 0CCFD0      DOSX         0087A0     Program
 0D5780      DOSX         000080     Data
 0D5810      MSDOS        00E7D0     -- Free --
 0E3FF0      SYSTEM       001000     System Program

 0E5000      IO           003100     System Data
               MOUSE      0030F0      System Program
 0E8110      MSDOS        007EE0     -- Free --
This is my MS DOS INFORMATION
Title: Re: Virus ?
Post by: dl65 on December 29, 2005, 02:08:12 PM
 Dummy....  ok ......here's what I'm seeing .......
For some reason you do not have the latest M/S updates installed .....and in particular SP2 ......... Is there some reason you havent upgraded to SP2 ?
Before you start ....turn off the system restore feature of XP.
Now open up hijackthis and run the scan ......when its done ...go down to the lower right corner and click on CONFIG ..... then when the new window opens ....Down in the 4 boxes that have the Default page URLS ........change them all to http://www.msn.com ( in all 4 places ) ...now click BACK ( lower right corner)

Now then in your hijack log mark for removal the following :

All R1 and R0 entries

O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - (no file)

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

Then click FIX CHECKED ......

When its finished ....reboot and see how things are .......
then rerun hijackthis again and let's have a look at it .

dl65  ::)

Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 02:32:16 PM
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\ps2.exe
C:\Program Files\Hijackthis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AutoTKit] C:\hp\bin\AUTOTKIT.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

To answer the question service pack 2 only reason is until I get off the "network" it really does no good. 1) All of the things get changed back to whatever "they" want
I have a service pack 2 disk from Microsoft and downloaded all the updates yesterday, last night I had to do another system restore in order to get back on the internet. Now I click explorer until I see the "green bar" then turn my modem on till I get a response then turn it off while I post to keep some acess to the net. I had downloaded the Hijack this and saved it to disk otherwise I probally would not beem able to get it.  
Title: Re: Virus ?
Post by: dl65 on December 29, 2005, 02:54:15 PM
Dummy....   Are you still connecting to the net on that odd net work ?

Do you have msn messenger installed by any chance ?
I ask because if you ask for remote assistance , I may be able to clear up your issue .

dl65  ::)

Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 03:01:24 PM
As far as I know yes
Title: Re: Virus ?
Post by: dl65 on December 29, 2005, 03:06:03 PM
Dummy.....  
Quote
As far as I know yes


is that the response to the network  or msn messenger ?

dl65  ::)
Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 03:14:14 PM
messenger
Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 03:16:42 PM
I tried to open messenger it does not work
Title: Re: Virus ?
Post by: dl65 on December 29, 2005, 03:17:09 PM
Dummy....ok ...what about the network your connecting on .......is it still the odd one ?

dl65  ::)
Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 03:17:32 PM
will remote desktop work it at least opened
Title: Re: Virus ?
Post by: dl65 on December 29, 2005, 03:20:45 PM
Dummy...  I'll private message ..... you my username for hotmail and you can add me to your list then ask me to connect to you

dl65  ::)
Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 03:43:06 PM
Sorry I cannot get it to work
Title: Re: Virus ?
Post by: dl65 on December 29, 2005, 03:46:25 PM
Dummy.....  Did you turn off your system restore before you ran the hijackthis scan as I mentioned ?

dl65  ::)
Title: Re: Virus ?
Post by: dl65 on December 29, 2005, 03:47:50 PM
Dummy ...can you go into control panel and click on Internet connections and tell me what is being displayed ?
When you go into control panel ...make sure its set to display the "CLASSIC " view

dl65  ::)
Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 03:57:54 PM
Yes system restore is off

Contol panel shows local area connection enabled
with a right click shows all 4 with a check mark Microsoft Clients etc.
However if I clear them I cannot acess the internet
Title: Re: Virus ?
Post by: dl65 on December 29, 2005, 04:00:35 PM
Dummy....
Quote
ALso when I do a system restore it shows I have alot of new progams added rather than everything new. Any help is appreciated.


Did you install all the programs ...that show up in system restore ?

When you did the format , was it a clean install ...or did you attempt a repair ?

If it was a clean install and you did a clean install of win xp .......then installed your AV ....and then connected to your home dsl modem .......... went online and got the XP updates there is no way could you could possibly be connected to some " Odd network"
dl65  ::)
Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 04:09:26 PM
This is how restore was done
1) System Restore 1 disk was inserted into cd rive
2) When it asked for which method I did what HP calls a manufactuers cleaning by pressing CRTL and Backspace
this brings up a selection of clearing all of the hard drive I clear all partitions and erase the disk
then the only option is "r" for recovery. I assure you that I have tried all the various methods.
Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 04:10:28 PM
I only have system restore disks  (2 sets) from HP
Title: Re: Virus ?
Post by: dl65 on December 29, 2005, 04:11:20 PM
Dummy ...... does it look like this ?
http://server2.uploadit.org/files/jochrobo-network.JPG


dl65  ::)
Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 04:13:43 PM
Curious question if programs are loaded into dos along with drivers could not that be the problem?
Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 04:15:03 PM
yes that's it
Title: Re: Virus ?
Post by: dl65 on December 29, 2005, 04:15:10 PM
Dummy ....... It's possible , but why would you be loading programs in dos ?

dl65  ::)
Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 04:18:28 PM
that's just it I didn't if you look at one of the earlier posts you will see them
Title: Re: Virus ?
Post by: dl65 on December 29, 2005, 04:22:16 PM
Dummy ...ok then go into the contol panel / add or remove programs and remove all the programs you didnt install .......dont remove any microsoft programs .

dl65  ::)
Title: Re: Virus ?
Post by: dl65 on December 29, 2005, 04:26:54 PM
Dummy .....I'm thinking I'm losing my eyesight ...I dont see a list of programs that appeared ...as opposed to you installing them ........would you please list them here as I really dont see them.

dl65  ::)
Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 04:27:26 PM
Sorry I have uninstalled most all the programs however they were the progams loaded from factory Adobe is still there and only 2 that I loaded Hijack this and crap cleaner
Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 04:34:55 PM
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Owner>cd..

C:\Documents and Settings>cd..

C:\>mem /D

 Address     Name          Size       Type
 -------     --------     ------     ------
 000000                   000400     Interrupt Vector
 000400                   000100     ROM Communication Area
 000500                   000200     DOS Communication Area

 000700      IO           000370     System Data
                 CON                   System Device Driver
                 AUX                   System Device Driver
                 PRN                   System Device Driver
                 CLOCK$                System Device Driver
                 COM1                  System Device Driver
                 LPT1                  System Device Driver
                 LPT2                  System Device Driver
                 LPT3                  System Device Driver
                 COM2                  System Device Driver
                 COM3                  System Device Driver
                 COM4                  System Device Driver

 000A70      MSDOS        001630     System Data

 0020A0      IO           001FF0     System Data
               KBD        000CE0      System Program
               HIMEM      0004E0      DEVICE=
                 XMSXXXX0              Installed Device Driver
                          000490      FILES=
                          000090      FCBS=
                          0000E0      LASTDRIVE=
                          0007D0      STACKS=
 0040A0      COMMAND      000A20     Program
 004AD0      MSDOS        000070     -- Free --
 004B50      COMMAND      000440     Environment
 004FA0      MEM          000380     Environment
 005330      MEM          0174E0     Program
 01C820      MSDOS        0837C0     -- Free --
 09FFF0      SYSTEM       02C000     System Program

 0CC000      MSDOS        000360     -- Free --
 0CC370      MSCDEXNT     0001D0     Program
 0CC550      REDIR        000A70     Program
 0CCFD0      DOSX         0087A0     Program
 0D5780      DOSX         000080     Data
 0D5810      MSDOS        00E7D0     -- Free --
 0E3FF0      SYSTEM       001000     System Program

 0E5000      IO           003100     System Data
               MOUSE      0030F0      System Program
 0E8110      MSDOS        007EE0     -- Free --


   655360 bytes total conventional memory
   655360 bytes available to MS-DOS
   634032 largest executable program size

  1048576 bytes total contiguous extended memory
        0 bytes available contiguous extended memory
   941056 bytes available XMS memory
          MS-DOS resident in High Memory Area

I sure don't understand it either but honestly if I do a complete Destructive recovery most of the progams will show as being "new" I strongly suspect that it's in the very first part of the hard drive and is not being deleted
Title: Re: Virus ?
Post by: dl65 on December 29, 2005, 04:35:02 PM
Dummy ..... Is your pc in your home and is it the only one there ?  What type of disks did you use when you formatted ? Win XP or some propietory thing from HP .....

dl65  ::)
Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 04:36:41 PM
Yes my pc is at home and yes they are factory disks from HP sent with the new hard drive
Title: Re: Virus ?
Post by: dl65 on December 29, 2005, 04:37:42 PM
Dummy....Do you have a partition on the HD .......?
When you formatted ....didnt you remove the partitions and then do the reinstall ?

dl65  ::)
Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 04:40:51 PM
yes i have at one time used fdisk, several times doing a manufacturer but it always saids the partition is non-existant or corruted I do delete them or at least press the button it says
Title: Re: Virus ?
Post by: dl65 on December 29, 2005, 04:43:50 PM
Dummy ....could you post your directory of Windows ?

dl65  ::)
Title: Re: Virus ?
Post by: dl65 on December 29, 2005, 04:45:29 PM
Dummy ...when you run Fdisk ....and display partitions ...does it show one or 2 ?

dl65  ::)
Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 04:46:05 PM
Yes I will however I don't know how
Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 04:47:09 PM
it shows 0 partitions however now I cannot run fdisk as my boot disks got corrupted
Title: Re: Virus ?
Post by: dl65 on December 29, 2005, 04:49:01 PM
Dummy .....It's my opinion for what it's worth ....that you should consider getting another boot disk , and doing a full format ...and then reinstall win XP .......... I see no future in what your trying now...........
And this time please let windows install the drivers .......dont attempt to install driver from dos .

dl65  ::)
Title: Re: Virus ?
Post by: dl65 on December 29, 2005, 04:52:28 PM
Dummy ......Is the partition that shows up the same size as the hard drive or substantialy smaller?
BTW ..you can get a win98x boot disk at bootdisk.com

dl65  ::)

Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 04:58:11 PM
Sir I have not been installing drivers and know very little about DOS what I have learned was reading and mostly just typing help as for doing a clean install HP will not allow it or I'm not doing it right I have 6 floppies from microsoft and it will always stop on the 4th disk with an error. when I do a system restore the C:\I386|drvapps.log and several others will say they are not recoverable when I retry it will take them but what I have learned from dealing in the registry it always has alot of keys that should not be there.
Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 05:04:07 PM
Funny thing is for instance if I look at defrag right after I do a restore it shows 2 partitions for C: when I format D and clear the partition it still shows 2 for a little while and then becomes 1 I know it does not make sense but neither does alot of things with this computer. I downloaded a program from Systimarials on the desktop last night and later it disappered in thin air
Title: Re: Virus ?
Post by: dl65 on December 29, 2005, 05:18:57 PM
Dummy ....do you have the 25 character M/S product key code ?   It should be on a sticker mounted on the outside of the case somewhere .

dl65  ::)
Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 05:21:33 PM
Yes Sir
Title: Re: Virus ?
Post by: dl65 on December 29, 2005, 05:25:17 PM
Dummy ....LOL .....you can dispense with the sir ......LOL
Ok then do you know anyone that you can borrow a original copy of M/S Win XP from and then do a proper clean innstall using that original disk and your product code .

dl65  ::)
Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 05:49:24 PM
 ;D LOL Sir is a habit from the south and I have already searched the neighborhood either they don't have one or don't want to loan it out. I'm fairly "new" "old" here I was born here but recently moved back. I am really fustrated with this but am not ready to give up I still believe  :'( I lost control of the mouse and had to reboot I strongly suspect the problem is in the progams in DOS simply from the past experience with doing system restores.
Title: Re: Virus ?
Post by: Dummy on December 29, 2005, 06:06:37 PM
Boot      Boot Bus Extender      1      ACPI      Microsoft ACPI Driver
Boot      Boot Bus Extender      2      PCI      PCI Bus Driver
Boot      Boot Bus Extender      3      isapnp      PnP ISA/EISA Bus Driver
Boot      System Bus Extender      4      IntelIde      
Boot      System Bus Extender      8      MountMgr      
Boot      System Bus Extender      9      Ftdisk      Volume Manager Driver
Boot      System Bus Extender      5      PartMgr      
Boot      System Bus Extender      n/a*      VolSnap      
Boot      SCSI miniport      25      atapi      Standard IDE/ESDI Hard Disk Controller
Boot      SCSI Class      2      Disk      Disk Driver
Boot      Base      1      KSecDD      
Boot      NDIS Wrapper      n/a*      NDIS      NDIS System Driver
Boot      PnP Filter*      4*      agp440      Intel AGP Bus Filter
Boot      Network*      2*      Mup      Mup
Boot      PnP Filter*      6*      nv_agp      NVIDIA nForce AGP Bus Filter
Boot      PnP Filter*      3*      SISAGP      SiS AGP Filter
Boot      PnP Filter*      5*      viaagp1      VIA AGP Filter
System      System Bus Extender      14      lbrtfdc      
System      Primary disk      4      Sfloppy      
System      SCSI Class      45*      i2omgmt      
System      SCSI CDROM Class      1      AFS2K      AFS2k
System      SCSI CDROM Class      2      Cdrom      CD-ROM Driver
System      Filter      5      Changer      
System      Filter      6      Cdaudio      
System      Boot file system      n/a*      Fs_Rec      
System      Base      1      Null      
System      Base      2      Beep      
System      Keyboard Port      4      i8042prt      i8042 Keyboard and PS/2 Mouse Port Driver
System      Pointer Class      1      Mouclass      Mouse Class Driver
System      Keyboard Class      1      Kbdclass      Keyboard Class Driver
System      Video Save      1      VgaSave      
System      Video Save      n/a*      mnmdd      
System      Video Save      n/a*      RDPCDD      
System      File system      n/a*      Msfs      
System      File system      n/a*      Npfs      
System      Streams Drivers      1      RasAcd      Remote Access Auto Connection Driver
System      PNP_TDI      4      IPSec      IPSEC driver
System      PNP_TDI      3      Tcpip      TCP/IP Protocol Driver
System      PNP_TDI      5      NetBT      NetBT
System      NetBIOSGroup      1      NetBIOS      NetBIOS Interface
System      Extended base      1      Serial      Serial port driver
System      Extended Base      3      Processor      Processor Driver
System      Extended Base      5      AmdK7      AMD K7 Processor Driver
System      PCI Configuration      1*      PCIDump      
System      n/a*      n/a*      Fips      
System      Pnp Filter*      2*      Imapi      CD-Burning Filter Driver
System      Network*      5*      MRxSmb      MRXSMB
System      Network*      4*      Rdbss      Rdbss
System      Pnp Filter*      1*      redbook      Digital CD Audio Playback Filter Driver
System      n/a*      n/a*      SiSkp      
System      n/a*      n/a*      TermDD      Terminal Device Driver
Automatic      Event log      n/a*      Eventlog      Event Log
Automatic      COM Infrastructure      n/a*      RpcSs      Remote Procedure Call (RPC)
Automatic      UIGroup      n/a*      Themes      Themes
Automatic      LocalValidation      n/a*      SamSs      Security Accounts Manager
Automatic      PlugPlay      n/a*      PlugPlay      Plug and Play
Automatic      TDI      n/a*      AFD      AFD Networking Support Environment
Automatic      TDI      n/a*      Dhcp      DHCP Client
Automatic      TDI      n/a*      Dnscache      DNS Client
Automatic      TDI      n/a*      LmHosts      TCP/IP NetBIOS Helper
Automatic      TDI      n/a*      WZCSVC      Wireless Zero Configuration
Automatic      ShellSvcGroup      n/a*      ShellHWDetection      Shell Hardware Detection
Automatic      SchedulerGroup      n/a*      Schedule      Task Scheduler
Automatic      SpoolerGroup      n/a*      Spooler      Print Spooler
Automatic      AudioGroup      n/a*      AudioSrv      Windows Audio
Automatic      NetworkProvider      n/a*      lanmanworkstation      Workstation
Automatic      NetworkProvider      n/a*      WebClient      WebClient
Automatic      Extended base      2      ParVdm      
Automatic      n/a*      n/a*      Browser      Computer Browser
Automatic      n/a*      n/a*      CryptSvc      Cryptographic Services
Automatic      n/a*      n/a*      ERSvc      Error Reporting Service
Automatic      n/a*      n/a*      helpsvc      Help and Support
Automatic      n/a*      n/a*      lanmanserver      Server
Automatic      n/a*      n/a*      NVSvc      NVIDIA Driver Helper Service
Automatic      n/a*      n/a*      PolicyAgent      IPSEC Services
Automatic      n/a*      n/a*      ProtectedStorage      Protected Storage
Automatic      n/a*      n/a*      seclogon      Secondary Logon
Automatic      Network*      n/a*      SENS      System Event Notification
Automatic      n/a*      n/a*      srservice      System Restore Service
Automatic      n/a*      n/a*      TrkWks      Distributed Link Tracking Client
Automatic      n/a*      n/a*      uploadmgr      Upload Manager
Automatic      *      n/a*      W32Time      Windows Time
Automatic      n/a*      n/a*      winmgmt      Windows Management Instrumentation
Automatic      n/a*      n/a*      wuauserv      Automatic Updates
This is a program called load order from Sysinternals Freeware shows want is loaded at boot in which order don't know just thought it might help.