Please Help HJT Log

[aturro]

Hello,

Using Windows XP SP2

Nothing opens in Control Panel (System, Add Hardware, Add or Remove Programs, Security, etc.) says "system32\rundll32.exe not found."

A unnamed Protection System installed itself on computer and I can't uninstall. Keep getting pop ups for various infections "virtob.win" is one and "backdoor win 32" is another.

Can't print. No printer listed. Tried to add printer and says "no print spooler service."

Ran Spy Bot and Adaware and still having same problems.

Here is the HJT Log

Thanks

Logfile of HijackThis v1.99.1
Scan saved at 10:52:57 AM, on 11/11/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\cisvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\FastNetSrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\sc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\America Online 9.0\waol.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Java\jre1.5.0_11\bin\jucheck.exe
C:\Program Files\America Online 9.0\aolwbspd.exe
C:\Program Files\Common Files\AOL\1186086070\ee\aolsoftware.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://join.clonecashsystem.com/track/N ... 4wLjAuMC4w
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Security Center] C:\WINDOWS\sc.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O15 - Trusted Zone: *.antimalwareguard.com
O15 - Trusted Zone: *.antimalwareguard.com (HKLM)
O17 - HKLM\System\CCS\Services\Tcpip\..\{1013D418-B9A1-482C-9F41-9B2DEEA3E071}: NameServer = 205.188.146.145
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Filter: text/html - {8b653efb-e54f-4b89-9b76-be145b7fcd09} - C:\WINDOWS\mark_32.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\kbdnet.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O21 - SSODL: vonibumid - {5223597f-899c-45c3-a61a-af7f4c9bfe61} - c:\windows\system32\lagoguze.dll (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Media Center Scheduler Service (ehSched) - Unknown owner - C:\WINDOWS\ehome\ehSched.exe (file missing)
O23 - Service: fastnetsrv Service (fastnetsrv) - Netopsystems A - C:\WINDOWS\system32\FastNetSrv.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe (file missing)
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Remote Desktop Help Session Manager (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe (file missing)
O23 - Service: Print Spooler (Spooler) - Unknown owner - C:\WINDOWS\system32\spoolsv.exe (file missing)
O23 - Service: Performance Logs and Alerts (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe (file missing)
O23 - Service: Uninterruptible Power Supply (UPS) - Unknown owner - C:\WINDOWS\System32\ups.exe (file missing)
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

[Gecko]

aturro,

Please download to your desktop.

Double click combofix.exe and follow the prompts.

Do not exit Combofix while it is running you my loose all your personal settings!
Important Note - Do not mouseclick combofix's window while it's running, that may cause it to stall.

When it's done running it will produce a log for you. Please post that log in your next reply.

[aturro]

Hello,

Thanks for your response. I tried to do what you said but after downloading Combofix and trying to run it, I got a small combofix screen and it started to load but then I was greeted with this message:

"Error - Alert - It is not safe to continue. The contents of the combo fix package has been compromised. Please download a fresh copy from http://www.bleepingcomputer.com/combofi ... e-combofix.

I tried it a few more times but got same result.

I then went to the website in the error message and tried to download it from that page but the samething happened. I even tried to download from from foro spyware which is listed under bleeping computer. I thought it was going to work but then I got this message:

"Error Win 32 only. Incompatible OS. Combofix only works for workstations with Windows 2000 & XP. OS Incompatible."

I am using XP so I'm assuming this has gotten so bad that it's knocking out my OS.

All the while that I was trying to download, I kept getting these pop ups that said:

"System alert: virus Vitrob.Win. Vulnwerable OS:Windows 2000/XP/Vista. Description: Appends itself to EXE and HTML files..."

I also noticed that the Windows Security Center page doesn't look the way it's supposed to. It says my virus protection is "Not Found" and it prompts me to purchase a Security System. The same one that seems to be installing on my computer every time I start it.

I am hoping you will have something else for me to try.

Thanks,

Pat

[Gecko]

aturro

Rename Combofix.exe to CBF.exe and try running it again.

You might also have to disable your anti virus program to get it to run.