Problem - MAJOR PROBLEM. !!!!Windows XP SP3

ksaari · 06-28-2008, 08:30 PM

I having a very serious problem. No matter what I do every time I restart my computer all I get is my screen saver. I tried a system console recovery to fix the problem but that (FAILED). I tried every option that the Safe Modes and they CAME UP WITH BLANK SCREENS : angry:
The only way I was able create this thread was is if I would use the Task Manager. The only way the Task Manager works is manually. You have to Press Ctrl. Alt Delete keys at the same time. It won't work from the drop down menu. Actually it doesn't exit any more in he menu bar.
I included a hijackthis report. I hope some can help me.

ksaari
------------------------------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:10:41 PM, on 6/28/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\SiteAdvisor\6261\SAService.exe
C:\Program Files\SPAMfighter\sfus.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\CCleaner\CCleaner.exe
C:\Program Files\blcorp\WinCleaner AntiSpyware\WCAntiSpy.exe
C:\Program Files\blcorp\WinCleaner AntiSpyware\WCAntiSpy.exe
C:\Program Files\blcorp\WinCleaner AntiSpyware\WCAntiSpy.exe
C:\Program Files\Desktop Maestro\deskmech.exe
C:\Program Files\Comodo\Firewall\cpf.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SiteAdvisor\6261\SiteAdv.exe
C:\Program Files\blcorp\WinCleaner AntiSpyware\WCAntiSpy.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
C:\Program Files\XoftSpySE\XoftSpy.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avcenter.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
F2 - REG:system.ini: Shell=
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [DesktopMechanic] "C:\Program Files\Desktop Maestro\deskmech.exe" /H
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" /min
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [SPAMfighter Agent] "C:\Program Files\SPAMfighter\SFAgent.exe" update delay 60
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [SiteAdvisor] "C:\Program Files\SiteAdvisor\6261\SiteAdv.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKLM\..\RunOnce: [wextract_cleanup0] "rundll32.exe" C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\Owner\LOCALS~1\Temp\IXP000.TMP\"
O4 - HKLM\..\RunOnce: [*Restore] "C:\WINDOWS\system32\restore\rstrui.exe" -i
O4 - HKCU\..\Run: [AutoSizer] "C:\Program Files\AutoSizer\AutoSizer.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Free Ram Optimizer] "C:\Program Files\AceLogix\Free Ram Optimizer\fro.exe"
O4 - HKCU\..\Run: [ClearHistory] "C:\Program Files\Clear History\ClearHistory.exe" -hidden
O4 - HKCU\..\RunOnce: [PGhist] "C:\Program Files\Desktop Maestro\PgHist.exe" WinguidesPG
O4 - HKCU\..\RunOnce: [PrivacyGuardianIndex] "C:\Program Files\Desktop Maestro\PgIndex.exe"
O4 - HKUS\S-1-5-21-2739028754-3283239616-2792533712-500\..\Run: [NVIEW] "rundll32.exe" nview.dll,nViewLoadHook (User 'Administrator')
O4 - HKUS\S-1-5-21-2739028754-3283239616-2792533712-500\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Administrator')
O4 - Startup: WCAntiSpy.lnk = C:\Program Files\blcorp\WinCleaner AntiSpyware\WCAntiSpy.exe
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Add to Windows &Live Favorites - Add to Windows Live Favorites
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {32305793-C19A-48E7-AD2F-D87FF7B264A4} - http://download.tenebril.com/pub/bin...areScanner.ocx
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...20/mcfscan.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: AntiVir PersonalEdition Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe
O23 - Service: AntiVir PersonalEdition Premium Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
O23 - Service: AntiVir PersonalEdition Premium Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe
O23 - Service: Avira AntiVir Premium WebGuard (antivirwebservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE
O23 - Service: AntiVir PersonalEdition Premium MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6261\SAService.exe
O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - C:\Program Files\SPAMfighter\sfus.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

--
End of file - 7774 bytes

ShiningRay · 06-29-2008, 03:17 AM

Desktop Maestro and Super antispyware is malicious. Maybe they don't work with SP3. Try disabling such that item.

ksaari · 06-29-2008, 05:35 PM

Quote:

Originally Posted by ShiningRay

Desktop Maestro and Super antispyware is malicious. Maybe they don't work with SP3. Try disabling such that item.

Parden me for my lingo but that really SUCKS.

I say this because I already purchased these products. My Computer completly crashed right after I was able to sumit that thread yesterday. So that's why I couldn't reply back right away. Maybe once I run scans to sure my computer is clean I'll then try to avoid installing Microsoft Update SP3 and go back to SP2 If that's possible. So now I'm I'm in the beginning of some thing I REALLY REALLY hate with a passion. ( RESTORING MY COMPUTER. ) Maybe you can suggest a good FREE Firewall. I was using COMOMDO Pro ( FREE VERSION ) which I thought was pretty good but I'm sure thiers got to be a better FREE Firewall out their. I was thinking of trying FREEWARE Avast or Zone Alarm. What woud be your suggestion.?

I'll wait to hear from you.
Ksaari

**Lyte** · 06-29-2008, 06:06 PM

Howdy!

Where'd ya read that Desktop Maestro and Super anti spyware were malicious?

It could be that something isn't working with SP3. I haven't taken a look at your HJT file yet and wanted to know if you already reinstalled your stuff before I do.

I'd go with Zone Alarm as it's always gotten good reviews and I've never heard anything bad about it.

Keep us posted on your situation!

Lyte

ksaari · 06-29-2008, 07:33 PM

Lyte,

I didn't do any thing yet. I just downloaded a Norton removal tool for the version 2003 Antivirus only V-2003. I was just getting ready to remove it when figured I better check to see if you responded. My Anti Virus Program that I was using is the PAID version of Avira Antivira Antivirus. Should I reinstall Avira or do you got something better. Preferably FREE. The only thing is I still 9 Months remaining on Avira before it expires.

I hope you can reply back in the next 10 minutes or so to let me know what you thinkI should do.

ksaari

**Lyte** · 06-30-2008, 05:57 AM

Hey ksaari,

Honestly, I've never heard of Avira Antivirus... if you mean this one... Avira AntiVir I've not heard of it but I don't see anywhere on the web where it's a bad product.

If you're still not sure, there's always AVG which gets good reviews and is also free.

Lyte

racknrail · 06-30-2008, 02:36 PM

I have heard of Avira. The full, paid version is not bad, but their free version is seriously lacking. I would definitely use AVG or Avast, if you're going for free AV.

As for a firewall, I would trust Zonealarm without a doubt. Comodo is suppose to be better, since version 3's release. I did not like version 2 whatsoever. It actually crashed my computer. I also highly doubt SP3 was to blame.

Desktop Maestro and Super antispyware are not malicious. I do not have enough time to go through your HJT post. You could try running housecall's free online virus scan. It's pretty good at picking up stuff your AV may have missed.

ksaari · 06-30-2008, 03:39 PM

Quote:

Originally Posted by racknrail

I have heard of Avira. The full, paid version is not bad, but their free version is seriously lacking. I would definitely use AVG or Avast, if you're going for free AV.

As for a firewall, I would trust Zonealarm without a doubt. Comodo is suppose to be better, since version 3's release. I did not like version 2 whatsoever. It actually crashed my computer. I also highly doubt SP3 was to blame.

Desktop Maestro and Super antispyware are not malicious. I do not have enough time to go through your HJT post. You could try running housecall's free online virus scan. It's pretty good at picking up stuff your AV may have missed.

--------------------------------------------------------------------------
Lyte,

Well I'm still doing the restore. I do it off and on otherwise it's just too much.
I'll probably be done in a week or so. I tried the FREE VERSION of Zonealarm and I had to remove it mega problems with it so I went back to COMODO Pro and also went back with Avira PAID VERSION they caused the least amount of problems. Like your saying Desktop Maestro and Super antispyware are not malicious. These are two of my favorite programs. Thanks alot for all your help. If I have any more issues I'll create another thread.

Thanks again!!

CHEERS
ksaari

dr911 · 06-30-2008, 04:56 PM

Hey ksaari,

If all else fails, try this:

Starting System Restore Tool from Command Prompt

1.. Start your computer to Safe Mode with Command Prompt.

NOTE: You must log on as the administrator or a user that has
administrator rights.

2.. At the command prompt, type %systemroot%\system32\restore\rstrui.exe,
and then press ENTER.

3.. Follow the instructions on the screen to begin restoring your computer to a previous, functional state.

If all else fails, time to reformat and reinstall your operating system !!