Some Kind of Mess

[lagmywagon]

Hi. I have not had any problems with my computer for the last year or so. I have been solely using firefox as my browser and keeping all my spyware and virus protection up to date. I recently encountered a problem that Im betting is due to a combination of issues. This is how it came about.

I have a netflix account and wanted to watch movies over the internest via the netflix site, but he site requires the use of ie7. I updated my old unused ie and tried to watch again. The problem I encountered was that firefox would constantly open anytime I typed a url into the address bar. Firefox was also preventing the movie from playing. Netflix costomer service advised me to uninstall firefox and try it. I did, and it worked. I decided to update to firefox 3 and hoped that maybe it would not interfere with ie7 and fix any problems I was having. It didn't. At the same time as this is happening, I noticed there were several updates available for my computer via microsoft windows update, including SP3. I installed the updates. I was still having problems with firefox and ie7 interfering, so I uninstalled firefox again, but there was a problem with the uninstall. There was also a problem with my adaware update, so neither work. Firefox is still uninstalled and is still interfering with ie7, and I can't even re-install it to fix this problem. I get a few error messeges now too. I will list those in a bit.

Here is a Hijack This file log. How does it look?

Logfile of HijackThis v1.99.1
Scan saved at 15:06:56, on 7/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\SMART Board Software\SMARTBoardService.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\ie7\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
G:\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.weather.com/partnerships/dwuninstall/dw4uninstall.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxy.nycboe.org/proxy.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SMART Notebook Download Plugin - {67BCF957-85FC-4036-8DC4-D4D80E00A77B} - C:\Program Files\SMART Board Software\NotebookPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: zPlanner.lnk = C:\Program Files\zPlanner\zPlanner.exe
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver - HP - C:\WINDOWS\system32\HPHipm09.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SMART Board Service - SMART Technologies Inc. - C:\Program Files\SMART Board Software\SMARTBoardService.exe

[lagmywagon]

I posted this in hopes that some one might be able to help me decide my next course of action. My first decision was to check for malware, and thats why I posted my hijack this log here. Any help, or point in the right direction would be much appriciated.

[PhilliePhan]

I posted this in hopes that some one might be able to help me decide my next course of action. My first decision was to check for malware, and thats why I posted my hijack this log here. Any help, or point in the right direction would be much appriciated.

Nothing jumps out at me from your HJT Log other that an outdated Java. That could leave you vulnerable to a baddie such as Vundo.
You should uninstall ALL older versions of Java and install new version from here ----> http://www.java.com/en/

-- Probably not malware behind your problems.
-- If you can do a System Restore back to just before problems started, I'd try that. Essentially, take a few steps back and start again....
That will cause problems with some Added/Removed programs, but will probably be easier to deal with than where you are now.

-- Update the Java after restoring, rather than before, if you choose the System Restore route.

Best Luck :)
PP

[lagmywagon]

Hey,
I forgot to mention that I tried system restore this morning and it didnt help. I tried a few different points as far as I could go back. I will update my java too.

My error message reads:

Windows - No Disk
Exception Processing Message c0000013 Paremeters 75b6bf9c

[PhilliePhan]

My error message reads:
Windows - No Disk
Exception Processing Message c0000013 Paremeters 75b6bf9c

Lots of possible causes for this error. The obvious being the recent addition and removal of software. Probably something you'll have to dope out through trial and error.
This link might help: http://www.consumingexperience.com/2007/11/windows-no-disk-exception-processing.html

Also, for help removing what you couldn't uninstall properly ---> http://www.ursoftware.com/
Can't remember if free trial or not. I think it is, just not the "full featured" version.

Cheers :)
PP

[lagmywagon]

Ok, I have tried a few things, and Im sure that my problems stem from recently upgrading XP to SP3. I can not unistall a bunch of programs now, such as Java (tried unistalling it before upgrading) adaware (same thing), Firefox etc. I get an error message that reads: Error 1325 Document is not a valid short file name. This is all very annoying. Im still getting the other message at start up. I can not use the internet properly, which makes searching for a solution difficult. I can only type websites into the yahoo search engine on their home page. If I type it in any where else, Firefox, which was supposed to be removed continues to try to open, but instead I get a warning message that reads: application not found. I would think that it would be illegal for firefox to interfere with ie7. Another problem is that I can not click on a page link, because once again, it tries to open in firefox and I get the same application not found. I am very frustrated and feel like throwing my laptop at the wall and replacing it with a mac. The only thing keeping me from it, is the cost of a new laptop. Im trying to not reformat and start fresh, and rather fix the problem, but every thing Ive done so far either causes more problems or is unsuccessful. System restore did not help, removing programs does not work, niether does re-installing programs. What should be my next step?

[PhilliePhan]

I am very frustrated and feel like throwing my laptop at the wall and replacing it with a mac.

The "sledgehammer option" can be very cathartic! ;)

-- Without sitting in front of the machine and having gone through all of the steps you have, it is difficult for me to advise you.... Frankly, at this point it might be easier to back up your important data and do a clean install.
Also, you might look at this: XP's No-Reformat, Nondestructive Total-Rebuild Option

-- Did you try "your uninstaller" to remove Firefox, etc...? What about making sure IE is set as your "default browser"?

These might help with the latest issues:
http://download.microsoft.com/download/e/9/d/e9d80355-7ab4-45b8-80e8-983a48d5e1bd/msicuu2.exe
http://support.microsoft.com/kb/328162
http://support.microsoft.com/kb/290301

Sorry I can't be of more assistance!

PP :)

[lagmywagon]

After 3 days going through this thing I was finally able to straighten out the mess completely. Every thing is up to date and working with out a problem. I did another system restore and it got rid of my first error warning. I then did a windows update and reinstalled firefox. I checked the default browser options, and even got ie7 and firefox to not interfere with each other so I can use netflix's instant viewer. Thank you.

[PhilliePhan]

After 3 days going through this thing I was finally able to straighten out the mess completely. Thank you.

You're welcome!
Happy to hear all is well and you did not have to take more drastic measures (the satisfaction of the "sledgehammer method" notwithstanding).

PP :)