Help with Popups and windows updates

[wackyf2j]

I recently build a great computer(or so I thought) with a computer friend of mine. I will admit it was a process getting everything to convert from ide to sata drive, and getting the operating system to follow that. Ever since I have been unable to install any windows updates and keep getting annoying popups. I have never had this problem before. I have read many post and tried many different sites to get rid of these problems, but I am now bowing out with my head held down. Any help would be great. I will include my hijack post since that seems to be the way. Please help. Great computer that works lousy, nothing more frustrating.
Jack
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 10:22:39 PM, on 2/16/2008
Platform: Windows XP SP3, v.3264 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\csrss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\windows\system32\devldr32.exe
C:\windows\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\windows\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\windows\system32\nvsvc32.exe
C:\windows\system32\svchost.exe
C:\Program Files\ThreatFire\TFService.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\windows\System32\alg.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\ThreatFire\TFTray.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Michelle Mosbacher\Desktop\HiJackThis_v2.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RAV8Tray] C:\Program Files\GeCAD\RAV8 Desktop\ravtray8.exe
O4 - HKLM\..\RunOnce: [SpybotDeletingA4602] command /c del "C:\WINDOWS\SYSTEM32\drivers\core.cache.dsk"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9649] cmd /c del "C:\WINDOWS\SYSTEM32\drivers\core.cache.dsk"
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: ravmon.exe.lnk = C:\Program Files\GeCAD\RAV8 Desktop\ravmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: APEX Weight Center 2.2.0.902 - http://application.bodybugg.com/files/static/install/bmapex_2_2_0_902.cab
O16 - DPF: BodyMedia Armband 2.5.0 - http://application.bodybugg.com/files/static/install/armband-applets-2.5.0-microsoft.cab
O16 - DPF: BodyMedia Armband 2.5.1 - http://application.bodybugg.com/files/static/install/armband-applets-2.5.1-microsoft.cab
O16 - DPF: BodyMedia Armband 2.6.0 - http://application.bodybugg.com/files/static/install/armband-applets-2.6.0-microsoft.cab
O16 - DPF: BodyMedia Armband 2.6.1 - http://application.bodybugg.com/files/static/install/armband-applets-2.6.1-microsoft.cab
O16 - DPF: BodyMedia Armband 2.6.3 - http://application.bodybugg.com/files/static/install/armband-applets-2.6.3-microsoft.cab
O16 - DPF: BodyMedia Armband 2.7.1 - http://application.bodybugg.com/files/static/install/armband-applets-2.7.1-microsoft.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxcccoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe
O23 - Service: RAV8 File Monitor (ravmon8) - GeCAD srl - C:\Program Files\GeCAD\RAV8 Desktop\ravmon.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe

--
End of file - 6828 bytes

[Thomas]

Hello wackyf2j,

Welcome to Icrontic. I am a new helper here, so although the title doesn't show yet I will be providing assistance for requests.

The log shows SpyBot trying to remove some serious rootkit infection. It isn't quite up to speed for these newer infection variants so likely the infection is still active there.

XP SP3 is still Beta, and as such no scan tools I use are upgraded for repairs with it. I will not be able to assist here unless you uninstall that to revert back to SP2. Normally I would not suggest any large changes like this on an infected machine, but as untested scans could seriously damage this one I can't see another way around that here.

If you do choose to uninstall SP3 and would like us to do the repairs reboot after, then run and post back a new HijackThis log please.


With that also Go Here (http://www.silentrunners.org/sr_download.html) and download Silent Runners to your desktop. Run it, and post back here the log it creates. If your protective software queries the script, allow it to run. It's not malicious. It will create a file named Startup Programs, and will notify when the scan is complete. Copy the log from the Startup Programs file back here. Here (http://www.silentrunners.org/sr_scriptuse.html) are guidelines for using Silent Runners if needed.

[wackyf2j]

Hello wackyf2j,

Welcome to Icrontic. I am a new helper here, so although the title doesn't show yet I will be providing assistance for requests.

The log shows SpyBot trying to remove some serious rootkit infection. It isn't quite up to speed for these newer infection variants so likely the infection is still active there.

XP SP3 is still Beta, and as such no scan tools I use are upgraded for repairs with it. I will not be able to assist here unless you uninstall that to revert back to SP2. Normally I would not suggest any large changes like this on an infected machine, but as untested scans could seriously damage this one I can't see another way around that here.

If you do choose to uninstall SP3 and would like us to do the repairs reboot after, then run and post back a new HijackThis log please.


With that also Go Here (http://www.silentrunners.org/sr_download.html) and download Silent Runners to your desktop. Run it, and post back here the log it creates. If your protective software queries the script, allow it to run. It's not malicious. It will create a file named Startup Programs, and will notify when the scan is complete. Copy the log from the Startup Programs file back here. Here (http://www.silentrunners.org/sr_scriptuse.html) are guidelines for using Silent Runners if needed.

[wackyf2j]

I just wanted to thank you for looking into it. Since then I have done a full clean wipe of the system and reinstall. Everything seems great now. Thanks for your time.

[Thomas]

That would have fixed it. Thanks for posting back the update.