Can Anyone Help Please?

Sagz_2

Browntoa wrote: »

i really think you need to run combifix

Thanks, I will do. I'm loathed to stop Avast as it's the first time it's worked in days and it's found 2 nasties so far (fingers crossed!) it's at 70% now so I'll let it do it's thing then run the combifix and post a log.

It's certainly a different way to spend Boxing day

Sagz_2

ComboFix 08-12-25.04 - Buggrit Hall 2008-12-26 15:44:36.1 - NTFSx86
Running from: c:\users\Buggrit Hall\Desktop\ComboFix.exe
.
((((((((((((((((((((((((( Files Created from 2008-11-26 to 2008-12-26 )))))))))))))))))))))))))))))))
.
2008-12-25 21:53 . 2008-12-26 13:18 <DIR> d

---

c:\users\All Users\avg8
2008-12-25 21:53 . 2008-12-26 13:18 <DIR> d

---

c:\programdata\avg8
2008-12-25 21:53 . 2008-12-25 21:53 <DIR> d

---

c:\program files\AVG
2008-12-25 20:59 . 2008-12-25 20:59 <DIR> d

---

c:\users\Buggrit Hall\AppData\Roaming\Malwarebytes
2008-12-25 20:59 . 2008-12-25 20:59 <DIR> d

---

c:\users\All Users\Malwarebytes
2008-12-25 20:59 . 2008-12-25 20:59 <DIR> d

---

c:\programdata\Malwarebytes
2008-12-25 20:59 . 2008-12-26 14:06 <DIR> d

---

c:\program files\Malwarebytes' Anti-Malware
2008-12-25 20:59 . 2008-12-03 19:52 38,496 --a

---

c:\windows\System32\drivers\mbamswissarmy.sys
2008-12-25 20:59 . 2008-12-03 19:52 15,504 --a

---

c:\windows\System32\drivers\mbam.sys
2008-12-25 14:06 . 2006-11-28 21:46 28,224 --a

---

c:\windows\System32\drivers\PCAMp50.sys
2008-12-25 14:06 . 2006-11-28 21:46 27,072 --a

---

c:\windows\System32\drivers\PCASp50.sys
2008-12-25 14:03 . 2007-11-13 22:29 51,968 --a

---

c:\windows\System32\drivers\gt72ubus.sys
2008-12-25 14:02 . 2007-11-13 22:29 95,744 --a

---

c:\windows\System32\drivers\Gt51Ip.sys
2008-12-25 14:02 . 2007-11-13 22:29 8,064 --a

---

c:\windows\System32\drivers\gtptser.sys
2008-12-25 13:31 . 2008-12-25 13:31 <DIR> d

---

c:\windows\Downloaded Installations
2008-12-20 12:31 . 2008-12-20 12:30 410,984 --a

---

c:\windows\System32\deploytk.dll
2008-12-12 21:05 . 2008-11-01 01:21 4,240,384 --a

---

c:\windows\System32\GameUXLegacyGDFs.dll
2008-12-12 21:05 . 2008-11-01 03:44 28,672 --a

---

c:\windows\System32\Apphlpdm.dll
2008-12-12 11:46 . 2008-06-23 01:59 2,868,736 --a

---

c:\windows\System32\mf.dll
2008-12-12 11:46 . 2008-06-23 01:59 996,352 --a

---

c:\windows\System32\WMNetMgr.dll
2008-12-12 11:46 . 2008-06-23 01:58 94,720 --a

---

c:\windows\System32\logagent.exe
2008-12-11 13:52 . 2008-10-22 01:22 2,048 --a

---

c:\windows\System32\tzres.dll
2008-12-11 13:27 . 2008-10-16 04:47 827,392 --a

---

c:\windows\System32\wininet.dll
2008-12-10 12:54 . 2008-10-21 05:25 296,960 --a

---

c:\windows\System32\gdi32.dll
2008-12-10 11:38 . 2008-10-29 06:29 2,927,104 --a

---

c:\windows\explorer.exe
2008-12-04 00:02 . 2008-12-04 00:05 5 --a

---

c:\windows\sbacknt.bin
2008-12-04 00:01 . 2008-12-04 03:22 <DIR> d

---

c:\program files\vghd
2008-11-30 11:54 . 2008-10-16 21:13 1,809,944 --a

---

c:\windows\System32\wuaueng.dll
2008-11-30 11:54 . 2008-10-16 20:56 1,524,736 --a

---

c:\windows\System32\wucltux.dll
2008-11-30 11:54 . 2008-10-16 21:12 561,688 --a

---

c:\windows\System32\wuapi.dll
2008-11-30 11:54 . 2008-10-16 14:08 162,064 --a

---

c:\windows\System32\wuwebv.dll
2008-11-30 11:54 . 2008-10-16 20:55 83,456 --a

---

c:\windows\System32\wudriver.dll
2008-11-30 11:54 . 2008-10-16 21:09 51,224 --a

---

c:\windows\System32\wuauclt.exe
2008-11-30 11:54 . 2008-10-16 21:09 43,544 --a

---

c:\windows\System32\wups2.dll
2008-11-30 11:54 . 2008-10-16 21:08 34,328 --a

---

c:\windows\System32\wups.dll
2008-11-30 11:54 . 2008-10-16 13:56 31,232 --a

---

c:\windows\System32\wuapp.exe
2008-11-26 13:24 . 2008-08-28 03:40 712,704 --a

---

c:\windows\System32\WindowsCodecs.dll
2008-11-26 13:24 . 2008-08-28 03:40 425,472 --a

---

c:\windows\System32\PhotoMetadataHandler.dll
2008-11-26 13:24 . 2008-08-28 03:40 347,136 --a

---

c:\windows\System32\WindowsCodecsExt.dll
2008-11-26 13:16 . 2008-10-22 03:57 241,152 --a

---

c:\windows\System32\PortableDeviceApi.dll
2008-11-26 13:08 . 2008-10-21 05:25 1,645,568 --a

---

c:\windows\System32\connect.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-25 22:06

---

d

---

w c:\program files\Sports Interactive
2008-12-25 13:26

---

d

---

w c:\program files\Google
2008-12-25 12:12

---

d

---

w c:\program files\Yahoo!
2008-12-20 11:49

---

d

---

w c:\program files\Java
2008-12-15 13:47

---

d

---

w c:\programdata\Microsoft Help
2008-12-14 20:24

---

d

---

w c:\users\Buggrit Hall\AppData\Roaming\LimeWire
2008-12-13 06:00

---

d

---

w c:\program files\Windows Mail
2008-12-12 20:37

---

d

---

w c:\program files\Thief2
2008-12-04 00:06

---

d

---

w c:\users\Buggrit Hall\AppData\Roaming\vghd
2008-12-04 00:01 152,904 ----a-w c:\windows\System32\vghd.scr
2008-11-26 17:17 51,792 ----a-w c:\windows\system32\drivers\aswMonFlt.sys
2008-11-16 01:29

---

d

---

w c:\program files\MSXML 4.0
2008-11-10 22:26

---

d

---

w c:\program files\LG PC Suite II
2008-11-07 10:40

---

d

---

w c:\programdata\NVIDIA
2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-09-30 16:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll
2008-08-25 21:50 174 --sha-w c:\program files\desktop.ini
2007-11-03 22:21 774,144 ----a-w c:\program files\RngInterstitial.dll
2008-02-27 08:57 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-02-27 08:57 32,768 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-02-27 08:57 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-02-16 151552]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.iv32"= c:\windows\system32\ir32_32.dll
"vidc.iv31"= c:\windows\system32\ir32_32.dll
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Empowering Technology Launcher.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Empowering Technology Launcher.lnk
backup=c:\windows\pss\Empowering Technology Launcher.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^Users^Buggrit Hall^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\users\Buggrit Hall\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Empowering Technology Monitor]
--a

---

2007-01-24 17:27 319488 c:\acer\Empowering Technology\SysMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Tour Reminder]
--a

---

2007-02-16 01:39 151552 c:\acer\AcerTour\Reminder.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eDataSecurity Loader]
--a

---

2007-02-07 07:04 464168 c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a

---

2008-03-30 09:36 267048 c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a

---

2007-01-19 11:54 5674352 c:\program files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a

---

2008-06-20 00:04 13535776 c:\windows\System32\nvcpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a

---

2008-06-20 00:04 92704 c:\windows\System32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a

---

2008-03-28 22:37 413696 c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
--a

---

2008-01-19 07:33 1233920 c:\program files\Windows Sidebar\sidebar.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a

---

2008-12-20 12:30 136600 c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a

---

2008-05-28 23:23 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
-ra

---

2006-03-30 16:45 313472 c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WarReg_PopUp]
--a

---

2006-11-05 20:48 57344 c:\acer\WR_PopUp\WarReg_PopUp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
--a

---

2007-02-15 09:07 4390912 c:\windows\RtHDVCpl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"!!3E929F58-B38F-491F-A66F-C8B0E353B13B}"= UDP:c:\program files\Acer Zone\Acer Zone Main Page\MCE Deluxe Suite.exe:CyberLink MCE Deluxe Suite
"{AB5B5F73-0A18-4286-8E99-E999F366319E}"= TCP:c:\program files\Acer Zone\Acer Zone Main Page\MCE Deluxe Suite.exe:CyberLink MCE Deluxe Suite
"!!2B04156E-1C6A-4DB0-97F6-82C7EAFA0E5C}"= c:\program files\Acer Zone\Acer Picture Slide DVD\component\CLSLDVD.exe:Cyberlink Picture Slide DVD workprocess
"!!6CEEEB28-93A0-4763-A52E-60ED0672E029}"= c:\program files\Acer Zone\Acer Plug and Record\component\ARAWP.exe:Cyberlink Plug and Record ARA workprocess
"!!33568BFC-3DE3-43EC-944A-C00B1A145A03}"= c:\program files\Acer Zone\Acer Plug and Record\component\DVAX2Process.exe:Cyberlink Plug and Record AVAX workprocess
"{DDF887FC-749F-4EC7-9EA4-15CA67DFAC76}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"!!5CE4335C-48D9-4848-B832-15CE6BDF78DE}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"!!2EBF2A0C-4432-4027-9FC9-97F4B132C92A}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"TCP Query User{C54DCE49-C1DE-4F16-9F65-5B2B3C05BE7A}c:\\program files\\microsoft games\\age of empires ii\\empires2.icd"= UDP:c:\program files\microsoft games\age of empires ii\empires2.icd:Age of Empires II
"UDP Query User{3C641E1F-451F-4F26-9FF4-F8A5A3C6E06F}c:\\program files\\microsoft games\\age of empires ii\\empires2.icd"= TCP:c:\program files\microsoft games\age of empires ii\empires2.icd:Age of Empires II
"TCP Query User{02DE9FD6-D169-4F23-A77D-DA91A7B71E7A}c:\\program files\\microsoft games\\age of empires ii\\age2_x1\\age2_x1.icd"= UDP:c:\program files\microsoft games\age of empires ii\age2_x1\age2_x1.icd:Age of Empires II Expansion
"UDP Query User{2C753964-CB74-4E91-9B03-349A44F8619F}c:\\program files\\microsoft games\\age of empires ii\\age2_x1\\age2_x1.icd"= TCP:c:\program files\microsoft games\age of empires ii\age2_x1\age2_x1.icd:Age of Empires II Expansion
"TCP Query User{10DAFEE0-773D-4441-97BE-FBCEDE7CB444}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{6FEFB68A-854A-4B7D-960C-5D549064CDC2}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{43F2D9C2-F944-40EB-9489-963C12D35090}c:\\program files\\microsoft games\\age of empires\\empires.exe"= UDP:c:\program files\microsoft games\age of empires\empires.exe:Age of Empires
"UDP Query User{AFCC9E8F-4229-4A1B-827F-1296366D3F25}c:\\program files\\microsoft games\\age of empires\\empires.exe"= TCP:c:\program files\microsoft games\age of empires\empires.exe:Age of Empires
"TCP Query User{672DB315-5F70-41FA-B965-2F83B8C3C468}c:\\program files\\tvants\\tvants.exe"= UDP:c:\program files\tvants\tvants.exe:TVAnts
"UDP Query User{8B8E1119-8F40-471F-A9E3-3E45F209BE07}c:\\program files\\tvants\\tvants.exe"= TCP:c:\program files\tvants\tvants.exe:TVAnts
"TCP Query User{966F3908-F08A-41B6-922E-232B845392C7}c:\\program files\\real\\realplayer\\realplay.exe"= UDP:c:\program files\real\realplayer\realplay.exe:RealPlayer
"UDP Query User{F6A51330-4260-459D-9EB0-4B25FE8FE049}c:\\program files\\real\\realplayer\\realplay.exe"= TCP:c:\program files\real\realplayer\realplay.exe:RealPlayer
"TCP Query User{17DDBBA5-8D13-471B-8DC0-F7181C279539}c:\\program files\\morpheus\\morpheus.exe"= UDP:c:\program files\morpheus\morpheus.exe:Morpheus
"UDP Query User{23241145-7C7A-4D51-8B62-A6C29B1B46A0}c:\\program files\\morpheus\\morpheus.exe"= TCP:c:\program files\morpheus\morpheus.exe:Morpheus
"TCP Query User{F6E91166-0680-4099-B579-94E1D0B93F23}c:\\program files\\microsoft games\\age of empires\\empiresx.exe"= UDP:c:\program files\microsoft games\age of empires\empiresx.exe:Age of Empires, the Rise of Rome
"UDP Query User{94C2233D-A442-4696-922E-3D2F0D80844D}c:\\program files\\microsoft games\\age of empires\\empiresx.exe"= TCP:c:\program files\microsoft games\age of empires\empiresx.exe:Age of Empires, the Rise of Rome
"{C4251182-4E2F-4B99-9969-9842FA5517E3}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"!!22684D81-9B6D-40F0-B01F-FE6361D65FF5}"= UDP:c:\program files\Kontiki\KService.exe:Delivery Manager Service
"!!91CC5BE7-6AE4-4198-B991-9BD6838AC7B2}"= TCP:c:\program files\Kontiki\KService.exe:Delivery Manager Service
"!!38AACF6B-AED9-43EA-A4A3-C1206FFD1980}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"!!362B478D-4427-406F-86CE-3D1FB50D5853}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{CB950A3E-BFC2-498C-A4CE-988DFDCD85D0}"= Disabled:UDP:c:\program files\Sports Interactive\Football Manager 2008\fm.exe:Football Manager 2008
"{D5980916-0834-4097-A2BE-BDB2975019BC}"= Disabled:TCP:c:\program files\Sports Interactive\Football Manager 2008\fm.exe:Football Manager 2008
"TCP Query User{4504D2ED-8EFE-422A-8CAB-ABF4E8DCC632}c:\\program files\\sopcast\\adv\\sopadver.exe"= UDP:c:\program files\sopcast\adv\sopadver.exe:SopCast Adver
"UDP Query User{AF106715-3569-4715-833E-5CD6DA823020}c:\\program files\\sopcast\\adv\\sopadver.exe"= TCP:c:\program files\sopcast\adv\sopadver.exe:SopCast Adver
"TCP Query User{7E197AD9-8EBD-4769-9B47-4F2BAEACC590}c:\\program files\\sopcast\\sopcast.exe"= UDP:c:\program files\sopcast\sopcast.exe:SopCast Main Application
"UDP Query User{30EF2BC2-DCCF-4BEA-BB85-E6B094DB7FB8}c:\\program files\\sopcast\\sopcast.exe"= TCP:c:\program files\sopcast\sopcast.exe:SopCast Main Application
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Acer\\Empowering Technology\\eDataSecurity\\eDSfsu.exe"= c:\acer\Empowering Technology\eDataSecurity\eDSfsu.exe:*:Enabled:eDSfsu
"c:\\Acer\\Empowering Technology\\eDataSecurity\\encryption.exe"= c:\acer\Empowering Technology\eDataSecurity\encryption.exe:*:Enabled:encryption
"c:\\Acer\\Empowering Technology\\eDataSecurity\\decryption.exe"= c:\acer\Empowering Technology\eDataSecurity\decryption.exe:*:Enabled:decryption

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\shell\AutoRun\command - E:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\!!7b8b5c30-7822-11dc-919c-806e6f6e6963}]
\shell\AutoRun\command - E:\Setup.now.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b2ddfff6-d28a-11dd-bbe4-001921ee2f93}]
\shell\AutoRun\command - J:\AutoRunCardDetector.exe
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-Acer Tour - (no file)
HKLM-Run-eRecoveryService - (no file)
MSConfigStartUp-CardDetectorICON225 - c:\program files\CardDetector\ICON225\CardDetector.exe
MSConfigStartUp-eDSMSNfix - c:\acer\Empowering Technology\eDSMSNfix.exe

Browntoa

jeez , no wonder it got infected, file sharing software , dodgy software for watching football streams illegally

did it not delete anything then ??

you seem to have AVG 8 on the PC as well as Avast ??

if you are using avast the uninstall AVG

Sagz_2

I tried to add AVG when Avast was not working.

Avast only seemed to delete 2 things taht came in with a SunJava update.

I've jsut rebooted and nothing fixed

Browntoa

I cannot see an install for the 24th December , unless its a hidden process

do you have the Vista DVD so we can attempt a repair of Vista to fix the internet problem ??

http://www.bleepingcomputer.com/tutorials/tutorial148.html

Browntoa

its also possible that go to add/remove programs and removing vista Service pack 1 may enable system restore again and allow you to roll back to an earlier time

Sagz_2

Not sure, OH should be home from work by 5:30 so will grill him then.
Thanks for your help Browntoa xx

Sagz_2

Browntoa wrote: »

its also possible that go to add/remove programs and removing vista Service pack 1 may enable system restore again and allow you to roll back to an earlier time

I'll give that a go - cheers xx

Can't find anything called Vista Service Pack 1

Browntoa

Service Pack for Microsoft Windows (KB936330), and then click Uninstall

Sagz_2

Well.... found myself in something called 'services' and most things were disabled (about 50 items) so switched them all to 'automatic' and the internet started working!

Have updated Malwarebytes and hijackthis and will post next.