Internet connection keeps dropping & other problems

Minerva69

aliEnRIK wrote: »

Try running superanti in SAFE MODE

Hi again, thanks for all your help with this but I still can't get Superantispyware to run without crashing. I've tried safe mode twice and it's still crashing in the same place

aliEnRIK

Clearly somethings not quite right

Use revo to uninstall superantispyware
Download REVO UNINSTALLER (Make sure you click 'DOWNLOAD NOW')
http://www.download.com/Revo-Uninstaller/3000-2096_4-10687648.html

Download CCLEANER (Top right)
http://www.filehippo.com/download_ccleaner/
Run the top 2 scans (Backup the registry when it asks)


Download GLARY UTILITIES (Make sure you click 'DOWNLOAD NOW')
http://www.download.com/Glary-Utilities/3000-2094_4-10508531.html
Run the ONE CLICK scan

reboot and reinstall superanti and try again

Minerva69

Hi again, still no luck I'm afraid! I did all you suggested above (thanks for the Revo Uninstaller & Glary Utilities links - seem v. useful) but I still can't get Superantispyware to run without crashing when it gets to the c:\windows\Prefetch\WUAUCLT.EXE-5D573F0E.pf file (have tried in normal and safe mode).

A further development was on one occasion when I was rebooting, the PC wouldn't restart and Vista's Startup Repair ran automatically, I've never had this happen before. It didn't seem to find anything and just shut down the PC and then I was able to start it again normally. With all this rebooting I don't know if my original problem has been solved, will have to leave the PC on for a couple of hours to find out!

aliEnRIK

Run COMBOFIX instead

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Banacek

My vostro 400 had a similar problem following a Malware infection. After cleaning it off I kept dropping broadband connection I finally fixed it by running Winsock XP fix you can download it here http://majorgeeks.com/download4372.html.
Not sure if it works with vista it rebuilds your TCP/IP stack.
Hope it sorts yours like it did mine.

Banacek

If the Winsock XP fix program isn't compatable try googling winsockfix for vista or try these instructions I found
http://www.pc-panic.com/blog/winsock-fix-windows-xp-sp2-vista/

GunJack

I'll third this suggestion.....had similar issues with kid's lappys, had to reset winsock stack to stop them from doing it..

Minerva69

aliEnRIK wrote: »

Run COMBOFIX instead

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

I've run Combofix, please could you decipher the log for me?! Thanks!

ComboFix 09-02-12.03 - Cathy 2009-02-13 14:51:09.1 - NTFSx86
Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1252.1.1033.18.2045.1048 [GMT 0:00]
Running from: c:\users\Cathy\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated)
FW: ZoneAlarm Firewall *disabled*
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2009-01-13 to 2009-02-13 )))))))))))))))))))))))))))))))
.
2009-02-11 14:19 . 2009-01-15 03:36 1,383,424 --a

---

c:\windows\System32\mshtml.tlb
2009-02-11 14:19 . 2009-01-15 06:11 827,392 --a

---

c:\windows\System32\wininet.dll
2009-02-08 10:19 . 2009-02-09 09:15 <DIR> d

---

c:\users\Cathy\AppData\Roaming\GlarySoft
2009-02-08 10:12 . 2009-02-08 10:12 <DIR> d

---

c:\program files\Glary Utilities
2009-02-08 09:58 . 2009-02-08 09:58 <DIR> d

---

c:\program files\VS Revo Group
2009-02-07 10:20 . 2009-02-07 10:20 <DIR> d

---

c:\program files\Trend Micro
2009-01-26 15:00 . 2009-01-26 15:00 <DIR> d

---

c:\users\All Users\WindowsSearch
2009-01-26 15:00 . 2009-01-26 15:00 <DIR> d

---

c:\programdata\WindowsSearch
2009-01-22 11:17 . 2009-01-22 11:17 <DIR> d

---

c:\program files\QuickTime
2009-01-14 14:00 . 2008-12-16 02:42 288,768 --a

---

c:\windows\System32\drivers\srv.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-13 14:53

---

d

---

w c:\programdata\Kontiki
2009-02-13 13:45 348,371 ---ha-w c:\windows\system32\drivers\vsconfig.xml
2009-02-11 17:24

---

d

---

w c:\programdata\Microsoft Help
2009-02-11 17:23

---

d

---

w c:\program files\Windows Mail
2009-02-09 17:07

---

d

---

w c:\users\Cathy\AppData\Roaming\SUPERAntiSpyware.com
2009-02-07 13:51

---

d---a-w c:\programdata\TEMP
2009-02-07 13:14 9,909,415 ----a-w c:\windows\Internet Logs\tvDebug.zip
2009-02-06 09:03

---

d

---

w c:\program files\Spyware Doctor
2009-02-02 11:25

---

d

---

w c:\program files\CCleaner
2009-01-26 13:07

---

d

---

w c:\program files\Malwarebytes' Anti-Malware
2009-01-14 16:11 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-14 16:11 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-01-02 16:13

---

d

---

w c:\program files\Google
2008-12-27 14:28 520,192 ----a-w c:\windows\System32\Magic Star Screensaver.scr
2008-12-09 10:38 410,984 ----a-w c:\windows\System32\deploytk.dll
2008-11-29 15:32 31,351,266 ----a-w c:\windows\Internet Logs\vsmon_on_demand_2008_11_28_15_44_40_full.dmp.zip
2008-11-21 16:15 28,613,202 ----a-w c:\windows\Internet Logs\vsmon_on_demand_2008_11_20_16_58_35_full.dmp.zip
2008-11-17 20:04 2,306,113 ----a-w c:\windows\System32\GPhotos.scr
2008-11-13 16:47 28,660,906 ----a-w c:\windows\Internet Logs\vsmon_on_demand_2008_11_13_16_41_14_full.dmp.zip
2008-11-13 16:01 28,554,941 ----a-w c:\windows\Internet Logs\vsmon_on_demand_2008_11_13_15_11_49_full.dmp.zip
2008-11-13 15:18 1,221,008 ----a-w c:\windows\System32\zpeng25.dll
2008-05-28 16:02 174 --sha-w c:\program files\desktop.ini
2008-04-15 17:27 468 ----a-w c:\users\Cathy\AppData\Roaming\wklnhst.dat
2007-10-09 00:09 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2007-10-09 00:09 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2007-10-09 00:09 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
2007-11-23 11:13 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2007-11-23 11:13 32,768 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2007-11-23 11:13 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 221184]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-06-13 528384]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-08-18 1447168]
"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2008-05-02 307200]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-11-13 981904]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0\bin\jusched.exe" [2007-10-04 77824]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"RtHDVCpl"="RtHDVCpl.exe" [2007-05-14 c:\windows\RtHDVCpl.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\windows\KHALMNPR.Exe]
c:\users\Cathy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Picture Motion Browser Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2008-06-06 344064]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-04-20 91440]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-08-17 805392]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"!!2C39B272-4719-4F5F-8752-2A784F6F7223}"= UDP:c:\program files\Kontiki\KService.exe: Delivery Manager Service
"!!60DEC2ED-E328-4160-9877-AF71410D4513}"= TCP:c:\program files\Kontiki\KService.exe: Delivery Manager Service
"!!4F1C0487-0597-4BAB-B2F0-5149564DF521}"= UDP:c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{B99773D7-AB58-4E07-9E84-902ABDECE219}"= TCP:c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"{F1DBA886-F014-49D2-A954-B95E5CBCC127}"= UDP:c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"!!3BE05CFC-6349-475E-9A5A-3C40E4F7EA65}"= TCP:c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"!!98ACCE05-84F2-488F-AD2C-DC9466FB04C0}"= UDP:c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"!!9F48898F-4CC2-4176-9498-2F5FD9F5C193}"= TCP:c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger
"!!284BBA50-7B5C-466E-9BCD-21E00E8BAA0C}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"!!1971D685-92F0-4093-853E-92D2C4A193B1}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"!!089075B9-1863-424C-8319-8D82E35BF4C3}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"!!76E9BDA9-961A-4A45-9E58-DFB275B98626}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"!!6B0CF1DB-B5FE-4CDE-A2E8-53DCE7C36D2A}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{C2D2A6D6-9BB3-4A28-B06A-8F0F55CEEEDF}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"!!2416D452-F5B2-464F-BB3B-8886D79E5FF6}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R1 epfwtdir;epfwtdir;c:\windows\System32\drivers\epfwtdir.sys [2008-08-18 34312]
R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-08-18 468224]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\System32\drivers\ggflt.sys [2008-08-29 13352]
S3 s125bus;Sony Ericsson Device 125 driver (WDM);c:\windows\System32\drivers\s125bus.sys [2007-10-09 83336]
S3 s125mdfl;Sony Ericsson Device 125 USB WMC Modem Filter;c:\windows\System32\drivers\s125mdfl.sys [2007-10-09 15112]
S3 s125mdm;Sony Ericsson Device 125 USB WMC Modem Driver;c:\windows\System32\drivers\s125mdm.sys [2007-10-09 108680]
S3 s125mgmt;Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM);c:\windows\System32\drivers\s125mgmt.sys [2007-10-09 100488]
S3 s125obex;Sony Ericsson Device 125 USB WMC OBEX Interface;c:\windows\System32\drivers\s125obex.sys [2007-10-09 98696]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-12-10 356920]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8078e31-3ae9-11dd-8ade-001aa094fb84}]
\shell\AutoRun\command - J:\AutoTransfer.exe
.
Contents of the 'Scheduled Tasks' folder
2009-02-13 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2009-01-10 17:02]
2009-02-13 c:\windows\Tasks\User_Feed_Synchronization-!!60118DEA-07CA-4567-AE51-95B6D8EF4872}.job
- c:\windows\system32\msfeedssync.exe [2008-01-19 07:33]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.bbc.co.uk/
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Handler: bwfile-8876480 - !!9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath -
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-13 14:53:03
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.

---

DLLs Loaded Under Running Processes

---

- - - - - - - > 'Explorer.exe'(2776)
c:\program files\Logitech\SetPoint\lgscroll.dll
.
Completion time: 2009-02-13 14:55:09
ComboFix-quarantined-files.txt 2009-02-13 14:55:06
Pre-Run: 103,552,143,360 bytes free
Post-Run: 103,529,132,032 bytes free
Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4,74
161 --- E O F --- 2009-02-13 09:25:53

Minerva69

Bump! Could somebody have a look at the log above ^ ^ ^ for me and see if I need to do anything else, as I don't understand it! Thanks!

aliEnRIK

Nothing of note in the combo log