agwellin

Hello, and thanks in advance for any help

Specs in my sig. Tell me if more are needed.

I turned on my laptop yesterday to find that my desktop appeared but no icons showed up, and no taskbar/ start menu. The icons and taskbar do appear in safemode, which is what I am using now. Also, Symantec Antivirus seems to be affected, as it states that enabling Auto-Protect is disabled (it says "disabled" in parentheses next to "Enable Auto-Protect")

I had a similar problem a few weeks ago, and the solution was to use ComboFix (as per a pre-existing thread on another forum, can't remember where). In light of that, the first thing I did was run ComboFix, with odd results: at two points during the scan, the icons on my desktop disappeared, the prompt came up asking if I wanted to continue in Safemode or use System Recovery (the exact same prompt that shows when you first startup in Safemode) and upon clicking "Continue" the icons appear again. Like I said, this occurs at two point during ComboFix's scan.

Another thing: ComboFix claims that my Symantec AV is still running, despite my manual disabling of all of its functions. I continued the scan anyway. The same thing occured when I had this problem a few weeks ago.

After ComboFix finishes, it does not restart my system and the problems persist.

Symantec Antivirus, Spybot, and Defender scans all turn up completely negative.

I hope I did the DDS and GMER scans correctly. Please tell me if I obviously did anything wrong:


DDS (Ver_09-05-14.01) - NTFSx86 NETWORK
Run by Alexander at 11:14:38.53 on Thu 06/25/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.1707 [GMT -4:00]

AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Alexander\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.uncc.edu/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyServer = http=
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: {2c23232e-c330-49c3-9ed6-2221affc072b} - No File
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: {CA6319C0-31B7-401E-A518-A07C3DB8F777} - No File
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [DW6] "c:\program files\the weather channel fw\desktop\DesktopWeather.exe"
uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [vptray] c:\progra~1\symant~1\VPTray.exe
mRun: [Symantec NetDriver Monitor] c:\progra~1\symnet~1\SNDMon.exe /Enterprise
mRun: [Dell QuickSet] c:\program files\dell\quickset\Quickset.exe
mRun: [AtiPTA] atiptaxx.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\runnin~1.lnk - c:\program files\wificonnector\NintendoWFCReg.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mri_di~1\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mri_di~1\runreg~1.lnk - c:\program files\wificonnector\NintendoWFCReg.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
Trusted Zone: nintendo.com\www
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.srtest.com/srl_bin/sysreqlab_srl.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://by112fd.bay112.hotmail.msn.com/resources/MsnPUpld.cab
DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader3.cab
DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1235239756343
DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - hxxp://webcam.salisbury.edu/activex/AxisCamControl.cab
DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} - hxxp://www.crucial.com/controls/cpcScanner.cab
DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Notify: AtiExtEvent - Ati2evxx.dll
Notify: NavLogon - c:\windows\system32\NavLogon.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\window~4\MpShHook.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\alexan~1\applic~1\mozilla\firefox\profiles\wbstbvl3.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.uncc.edu/
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&query=
FF - plugin: c:\documents and settings\all users\application data\id software\quakelive\npquakezero.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava11.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava12.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava13.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava14.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJava32.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPJPI142_03.dll
FF - plugin: c:\program files\java\j2re1.4.2_03\bin\NPOJI610.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll

============= SERVICES / DRIVERS ===============

R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
S1 atitray;atitray;c:\program files\radeon omega drivers\v4.8.442\ati tray tools\atitray.sys [2009-2-22 17952]
S1 SAVRT;SAVRT;c:\program files\symantec antivirus\savrt.sys [2006-9-6 337592]
S1 SAVRTPEL;SAVRTPEL;c:\program files\symantec antivirus\Savrtpel.sys [2006-9-6 54968]
S2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2006-7-19 192160]
S2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2006-7-19 169632]
S2 HIDKbFlt;HIDKbFlt.SvcDesc%;c:\windows\system32\drivers\hidkbflt.sys --> c:\windows\system32\drivers\HIDKbFlt.sys [?]
S2 IISAdminServ;IIS Admin Service Helper ; [x]
S2 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec antivirus\Rtvscan.exe [2006-10-24 1813184]
S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-3-1 24652]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-2-27 101936]
S3 MAUSBML;Service for M-Audio Micro (WDM);c:\windows\system32\drivers\mausbmr.sys --> c:\windows\system32\drivers\mausbmr.sys [?]
S3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20090621.006\naveng.sys [2009-6-21 89104]
S3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20090621.006\navex15.sys [2009-6-21 876144]
S3 SavRoam;SAVRoam;c:\program files\symantec antivirus\SavRoam.exe [2006-10-24 116416]

=============== Created Last 30 ================

2009-06-25 09:55 <DIR> --d----- c:\program files\Trend Micro
2009-06-25 03:26 <DIR> --ds---- C:\ComboFix
2009-06-24 15:18 <DIR> -cd----- c:\windows\system32\dllcache\cache
2009-06-13 02:23 <DIR> a-dshr-- C:\cmdcons
2009-06-13 02:20 161,792 a------- c:\windows\SWREG.exe
2009-06-13 02:20 155,136 a------- c:\windows\PEV.exe
2009-06-13 02:20 98,816 a------- c:\windows\sed.exe
2009-06-13 01:12 <DIR> --d----- c:\windows\system32\wbem\Repository
2009-06-11 16:47 246,272 -c------ c:\windows\system32\dllcache\ieproxy.dll
2009-06-11 16:47 12,800 -c------ c:\windows\system32\dllcache\xpshims.dll
2009-06-10 15:21 6,784 ac------ c:\windows\system32\dllcache\serscan.sys
2009-06-10 15:21 6,784 a------- c:\windows\system32\drivers\serscan.sys
2009-06-10 14:26 <DIR> --d----- c:\program files\common files\HP
2009-06-10 14:26 <DIR> --d----- c:\program files\common files\Hewlett-Packard
2009-06-10 14:25 1,373,528 a----r-- c:\windows\hpzshl01.exe
2009-06-10 14:25 1,140,056 a----r-- c:\windows\hpzmsi01.exe
2009-06-10 14:25 12,717 a----r-- c:\windows\hpwscr14.dat
2009-06-10 14:25 <DIR> --d----- c:\windows\braveheart
2009-06-10 14:24 <DIR> --d----- c:\program files\HP
2009-06-10 14:21 16,496 a----r-- c:\windows\system32\drivers\HPZipr12.sys
2009-06-10 14:21 49,920 a----r-- c:\windows\system32\drivers\HPZid412.sys
2009-06-10 14:21 1,108 a----r-- c:\windows\hpwmdl14.dat
2009-06-10 14:21 179,692 a------- c:\windows\hpwins14.dat
2009-06-10 14:20 118,272 a------- c:\windows\system32\hpz3l5jy.dll
2009-06-10 14:20 271,704 a----r-- c:\windows\system32\hpzids01.dll
2009-06-10 14:20 21,568 a----r-- c:\windows\system32\drivers\HPZius12.sys
2009-06-10 14:19 309,760 a----r-- c:\windows\system32\difxapi.dll
2009-06-10 14:19 364,544 a----r-- c:\windows\system32\hppldcoi.dll
2009-06-10 14:19 294,912 a----r-- c:\windows\system32\hpovst11.dll
2009-06-10 14:19 970,752 a----r-- c:\windows\system32\hpwtiop3.dll
2009-06-10 14:19 729,088 a----r-- c:\windows\system32\hpwwiax3.dll
2009-06-10 14:19 15,104 ac------ c:\windows\system32\dllcache\usbscan.sys
2009-06-10 14:19 15,104 a------- c:\windows\system32\drivers\usbscan.sys
2009-06-03 19:14 2,558,274 a------- c:\program files\bshift_unlocked_v1.1.exe
2009-06-02 20:29 <DIR> --d----- c:\program files\iPod
2009-06-02 20:29 <DIR> --d----- c:\program files\iTunes
2009-05-31 19:41 413,696 a------- c:\windows\system32\wrap_oal.dll
2009-05-31 19:41 110,592 a------- c:\windows\system32\OpenAL32.dll
2009-05-31 19:41 <DIR> --d----- c:\program files\OpenAL
2009-05-26 17:18 90,112 a------- c:\windows\system32\QuickTimeVR.qtx
2009-05-26 17:18 57,344 a------- c:\windows\system32\QuickTime.qts

==================== Find3M ====================

2009-05-13 01:15 915,456 a------- c:\windows\system32\wininet.dll
2009-05-07 11:32 345,600 a------- c:\windows\system32\localspl.dll
2009-05-03 02:22 1,127,792 a------- c:\program files\ActiveSetupN.exe
2009-04-27 13:08 555,554 a------- c:\program files\chocolate-doom-1.2.1-win32.zip
2009-04-26 18:20 138,944 a------- c:\windows\system32\drivers\PnkBstrK.sys
2009-04-26 18:20 75,064 a------- c:\windows\system32\PnkBstrA.exe
2009-04-26 18:19 189,784 a------- c:\windows\system32\PnkBstrB.exe
2009-04-26 17:36 22,328 a------- c:\docume~1\alexan~1\applic~1\PnkBstrK.sys
2009-04-26 17:36 2,246,144 a------- c:\windows\system32\pbsvc.exe
2009-04-17 08:26 1,847,168 a------- c:\windows\system32\win32k.sys
2009-04-15 10:51 585,216 a------- c:\windows\system32\rpcrt4.dll
2009-03-01 01:18 13,440,584 a------- c:\program files\Install_AIM.exe
2009-03-01 00:17 8,506,408 a------- c:\program files\Install_AIM59.exe
2009-02-28 12:33 298,096 a------- c:\program files\desktopsp2_StubInstaller.exe
2009-02-28 01:15 10,102,348 a------- c:\program files\wav-converter.exe
2009-02-22 05:02 18,849,057 a------- c:\program files\ati_omega_xp2k_48442.exe
2009-02-21 22:45 33,195,520 a------- c:\program files\nav.exe
2009-02-17 06:05 69,076,264 a------- c:\program files\iTunesSetup.exe
2009-02-13 23:29 46,542,146 a------- c:\program files\thiefd.zip
2009-02-08 00:59 7,936,232 a------- c:\program files\WinterWonders_110_FreeTrial.exe
2009-01-20 19:02 991,021 a------- c:\program files\WinPDrums.zip
2008-12-17 23:04 7,518,240 a------- c:\program files\Firefox Setup 3.0.5.exe
2008-12-17 00:52 1,784,670 a------- c:\program files\Nintendo_WFC_USB.zip
2008-12-14 00:57 15,083,520 a------- c:\program files\spybotsd160.exe
2008-12-13 22:09 5,154,304 a------- c:\program files\WindowsDefender.msi
2008-12-01 22:07 156,028 a------- c:\program files\libmp3lame-win-3.97.zip
2008-12-01 10:13 8,375,456 a------- c:\program files\R122667.EXE
2008-12-01 02:07 544,169,535 a------- c:\program files\ShotOnlineClient_Global_GamesCampus.exe
2008-11-09 22:53 1,234,120 a------- c:\program files\wrar380.exe
2008-10-20 22:43 329,877 a------- c:\program files\CamStudioCodec14.exe
2008-10-20 22:41 1,364,995 a------- c:\program files\CamStudio20.exe
2008-10-20 00:41 2,228,534 a------- c:\program files\audacity-win-1.2.6.exe
2008-10-18 02:13 7,462,224 a------- c:\program files\freedoom-iwad-0.6.2.zip
2008-10-15 13:29 1,473,781 a------- c:\program files\zdoom-2.2.0.zip
2008-09-23 02:06 3,479,707 a------- c:\program files\AlephOne-20080913.zip
2008-09-23 02:00 39,545,293 a------- c:\program files\M1A1.zip
2008-09-20 00:24 39,193,429 a------- c:\program files\systemshock2demo.exe
2008-09-18 21:57 28,868,320 a------- c:\program files\FileFormatConverters.exe
2008-09-12 04:07 215,659,728 a------- c:\program files\792248d6ad421d577132c2b648bbed45_scc_trial_na.exe
2008-09-11 00:19 111,758,656 a------- c:\program files\jdmu-doom-20080802.zip
2008-09-11 00:14 2,589,419 a------- c:\program files\abbspack_5.05_se.zip
2008-09-08 21:41 23,222,876 a------- c:\program files\jdrp-packaged-20070404.zip
2008-09-08 20:47 6,969,819 a------- c:\program files\deng-1.9.0-beta5-setup.exe
2008-08-27 19:09 7,499,056 a------- c:\program files\Firefox Setup 3.0.1.exe
2008-04-03 19:44 2,607,862 a------- c:\program files\Phun_beta_3_5.exe
2008-03-20 04:32 50,724,155 a------- c:\program files\hitman2demo.zip
2008-02-18 04:04 78,856,015 a------- c:\program files\finale songwriter demo.zip
2008-01-28 04:04 23,510,720 a------- c:\program files\dotnetfx.exe
2008-01-27 21:53 2,940,716 a------- c:\program files\Setupex_QuartzAudioMasterFreewareE.exe
2008-01-12 17:02 239,983,571 a------- c:\program files\GoldeneyeSource_0.1.0_Full.zip
2008-01-11 00:48 26,853,453 a------- c:\program files\narbacular_drop.exe
2007-11-17 01:22 2,539,374 a------- c:\program files\artoftheft.zip
2007-10-21 19:58 2,146,214 a------- c:\program files\6days.zip
2007-10-20 22:48 2,111,030 a------- c:\program files\trilbys notes.zip
2007-10-16 18:00 1,207,296 a------- c:\program files\bwgen31.exe
2007-09-30 09:33 524,065 a------- c:\program files\citrus_setup.exe
2007-09-23 17:10 1,567,232 a------- c:\program files\SteamInstall.msi
2007-08-31 01:46 30,918,809 a------- c:\program files\Crystalex.zip
2007-06-11 16:04 25,755,448 a------- c:\program files\wmp11-windowsxp-x86-enu.exe
2007-02-23 03:56 3,574,424 a------- c:\program files\WinASO reg opt.exe
2006-11-14 21:33 328,704 a------- c:\program files\AIMFix.exe
2006-08-29 15:05 11,817,800 a------- c:\program files\GoogleEarth.exe
2006-08-22 14:04 5,037,072 a------- c:\documents and settings\alexander\spybotsd14.exe
2007-11-07 04:48 88 a--shr-- c:\windows\system32\816FF848CB.sys
2007-11-07 04:48 3,558 a--sh--- c:\windows\system32\KGyGaAvL.sys

============= FINISH: 11:14:56.64 ===============

Attached Files

ark.zip (5.1 KB, 0 views)

agwellin

Well, I don't understand it, but everything seems better now...

I booted up in normal mode, and although the icons and taskbar didn't come up immediately, they came up after a minute or two. I restarted again a few times and now everything comes right up just as it should. Maybe ComboFix did its job, but I was just being a bit impatient.

Well anyway, if anyone can help me understand what happened or how to prevent this in the future, it would be appreciated. Thanks!