Recommended Tests

I have been having problems with my pc for 2 days now, Out of nowhere some programs by the name of "WinAntiSpyware 2007" just popped up out of nowhere and installed on the pc and it was very hard to get rid off, I can only access my programs thru task manager because my desktop has disappeared and I dont even see the icons or the start menu button or the taskbar. I used Spybot, Spysweeper, Ad-Aware 2007, XoftSpy, NOD32 and even the latest Norton to get rid of this and I still have the desktop problem where I cant see the icons or anything so I scanned with Hijack This so heres the log and I hope someone can help me out with this.

Logfile of HijackThis v1.99.1
Scan saved at 3:23:16 AM, on 8/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS.0\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\cFosSpeed\spd.exe
C:\WINDOWS.0\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
C:\WINDOWS.0\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS.0\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS.0\system32\taskmgr.exe
C:\Documents and Settings\Jason\Desktop\Downloads\HijackThis.exe
C:\WINDOWS.0\system32\wuauclt.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE

O2 - BHO: 0 - {0E2012EC-769A-448B-E2B8-CD3CDB583A51} - (no file)
O2 - BHO: (no name) - {3BF62938-1095-4102-910E-1F1810FFAC30} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {9ECCCF62-677A-4BF5-857F-5BF16051098D} - C:\Program Files\Online Services\mepowycym4444.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O4 - HKLM\..\Run: [HostManager] "C:\Program Files\Common Files\AOL\1184792712\ee\AOLSoftware.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS.0\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0a\AOL.EXE" -b
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html
O8 - Extra context menu item: Add to Media Manager... - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS.0\system32\Shdocvw.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1185335563859
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1185335477406
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
O20 - Winlogon Notify: geebb - C:\WINDOWS.0\system32\geebb.dll (file missing)
O20 - Winlogon Notify: qomkkjk - qomkkjk.dll (file missing)
O20 - Winlogon Notify: qomnmml - qomnmml.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS.0\
O20 - Winlogon Notify: wintuh32 - wintuh32.dll (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS.0\SYSTEM32\WRLogonNTF.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: cFosSpeed System Service (cFosSpeedS) - Unknown owner - C:\Program Files\cFosSpeed\spd.exe" -service (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

JKO, Go here and paste your log, it will tell you what it says.


http://www.hijackthis.de/

Have tried to do a system restore?

Is there a space before the forward slash?

Thanks!

I've already put into my little book of tricks. I'm having problems with Firefox excepting the 2.0.0.6 update. Do you think it will help with that?

I should say this though , it takes quite some time, you may think your system has frozen , but don't worry, I have not had it lock up on me during this process. Just quit all apps before you proceed.

Hey guys I tried the SFC scan and it doesnt work when I type it out on cmd it gives me this message

"Windows File Protection could not initiate a scan of protected system files."

The Specific error code is 0x000006ba [The RPC Server is not available]

Man this is so frustrating for me I think nothing is going to work, I would like to back up my data at least but it doesnt even let me do that so if I reformat I will lose everything.

Not sure what programs you are utilizing for clean up. But try this on line one if you can. And are you using Norton anti-virus?

http://www.ewido.net/en/onlinescan/

Windows File Protection could not initiate a scan of protected system files."

The Specific error code is 0x000006ba [The RPC Server is not available]

Is there any way to fix that so I can do the SFC scan? I still have my Windows XP OS CD so that wouldn't be a problem, Any help is appreciated

 Well,  you must have been in safe mode, you have to start the service manually to get it to run .As safe mode runs required system services only.  Sorry I didn't get back sooner, hope you have your issues fixed . Let us know.

Well everything is fine now I reformatted and everything is running smoothly.

To answer mudmanc4, Its quite alright that you did not get back at me sooner, And yes I did do it in safe mode and thats the message it gave me.

And  bryanlautt I really dont remember turning off any services maybe I did while doing some XP tweaks I found here on the forum. And this is the processor I have I dont know if its any good.

AMD Athlon (tm) XP 3000+ 2166 MHz

 I just felt the need to clarify something, for those who may not be aware. When you start your computer in safe mode, the system does not initiate any services that it does not need to run basic system functions. Therefor , in this case, the RPC service was not started. There are many services that have the dependency of the service.  It's really insane how developers stand on the shoulders of this service to avoid working through there issues.

BTW, awesome processer, I have one,  I have it running at 2200~  And a 3200+ that runs 2400~

 Short definition of dependency's.

http://technet2.microsoft.com/windowsserver/en/library/e5677c57-3182-497a-b53b-a536580b542b1033.mspx?mfr=true