I can not load or Uninstall any programs

Hello.
Did you remove what MBAM found? the log says no action was taken.

Yes i removed them and deleted them after.

I did a quick scan and it found 0 infected items. What should i do now?

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 5041

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

04/11/2010 11:13:11
mbam-log-2010-11-04 (11-13-11).txt

Scan type: Quick scan
Objects scanned: 170018
Time elapsed: 27 minute(s), 23 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Any more issues?

We need to know any other issues that are plaguing your computer. Kindly give a summary so we know how to continue from here.

Many of the things to note for us would be:

• Slow computer
  
• Error messages
  
• Fake antivirus alerts or the icon in the system tray
  
• svchost.exe running at 100%
  
• System crashes or blue screen of death

I get a few error messages as i stated above in my posts, my laptop is slow. Its takes maybe 5 minutes to completely load everything. The situation is still the same despite the actions i have taken above. Please help

Please download SINO by Artellos.

• Save SINO to a place you can remember and run SINO.exe. (If you downloaded the ZIP version you will need to extract it first)
  
• Then please check the following checkboxes:
  

  Code:

  System Info
Services
Boot Check
Tasklist
Startup Items
Event Log
Hosts file
Routing Table
  
  
• Once checked, hit the Run Scan! button and wait for the program to finish the scan.
  
  
• A notepad window will pop up. Please copy all of the content into your next reply.

Note: If you try to interact with the program once it’s started scanning it might appear to hang. The scan however will continue.

System Investigator by Olrik
Log Created On: 1300_12-11-2010
SINO Version: 3.1.0.0

Total RAM: 894 MB | Free RAM: 215 MB | Pagefile Size: 1273 MB
C: | 35705 MB out of 104227 MB Free | Local Fixed Disk
D: | None | CD-ROM Disc
E: | None | CD-ROM Disc
F: | None | Removable Disk

<<<< System Information >>>>

Computer Name: CLAIRE
Username: umm nabilah
Language Setting: ENG
Windows Directory: C:\Windows
Windows Version: Windows Vista Service Pack 1
UAC Status: On
Windows Mode: Normal

<<<< Tasklist >>>>

[System Idle Process] - Process ID: 0
[System] - Process ID: 4
[smss.exe] - Process ID: 428
[C:\Windows\system32\csrss.exe] - Process ID: 496
[C:\Windows\system32\wininit.exe] - Process ID: 540
[C:\Windows\system32\csrss.exe] - Process ID: 552
[C:\Windows\system32\services.exe] - Process ID: 596
[C:\Windows\system32\lsass.exe] - Process ID: 612
[C:\Windows\system32\lsm.exe] - Process ID: 620
[C:\Windows\system32\winlogon.exe] - Process ID: 800
[C:\Windows\system32\svchost.exe] - Process ID: 952
[C:\Windows\system32\svchost.exe] - Process ID: 1012
[C:\Windows\System32\svchost.exe] - Process ID: 1052
[C:\Windows\System32\svchost.exe] - Process ID: 1160
[C:\Windows\System32\svchost.exe] - Process ID: 1220
[C:\Windows\system32\svchost.exe] - Process ID: 1260
[audiodg.exe] - Process ID: 1336
[C:\Windows\system32\SLsvc.exe] - Process ID: 1364
[C:\Windows\system32\svchost.exe] - Process ID: 1392
[C:\Windows\system32\svchost.exe] - Process ID: 1560
[C:\Windows\System32\spoolsv.exe] - Process ID: 1764
[C:\Windows\system32\svchost.exe] - Process ID: 1788
[C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe] - Process ID: 1988
[C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe] - Process ID: 2008
[C:\Windows\system32\svchost.exe] - Process ID: 2020
[C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe] - Process ID: 276
[C:\Windows\system32\IoctlSvc.exe] - Process ID: 776
[C:\Windows\system32\svchost.exe] - Process ID: 892
[C:\PROGRA~1\AVG\AVG8\avgrsx.exe] - Process ID: 1108
[C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe] - Process ID: 1072
[C:\PROGRA~1\AVG\AVG8\avgnsx.exe] - Process ID: 1324
[C:\Windows\system32\svchost.exe] - Process ID: 1592
[C:\Windows\System32\StkCSrv.exe] - Process ID: 1716
[C:\Windows\System32\svchost.exe] - Process ID: 312
[C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe] - Process ID: 2096
[C:\PROGRA~1\AVG\AVG8\avgemc.exe] - Process ID: 2140
[C:\Program Files\AVG\AVG8\avgcsrvx.exe] - Process ID: 2260
[C:\Windows\system32\taskeng.exe] - Process ID: 2656
[C:\Windows\system32\Dwm.exe] - Process ID: 2748
[C:\Windows\Explorer.EXE] - Process ID: 2796
[C:\Program Files\Windows Defender\MSASCui.exe] - Process ID: 3168
[C:\Program Files\SiS VGA Utilities\SiSTray.exe] - Process ID: 3180
[C:\Program Files\Synaptics\SynTP\SynTPEnh.exe] - Process ID: 3460
[C:\Windows\RtHDVCpl.exe] - Process ID: 3536
[C:\Program Files\CyberLink\PowerCinema\PCMAgent.exe] - Process ID: 3648
[C:\Program Files\CyberLink\PowerCinema\Kernel\CLML\CLMLSvc.exe] - Process ID: 3700
[C:\Program Files\CyberLink\PlayMovie\PMVService.exe] - Process ID: 3716
[C:\Program Files\Athan\Athan.exe] - Process ID: 3820
[C:\Program Files\iTunes\iTunesHelper.exe] - Process ID: 3900
[C:\Program Files\AVG\AVG8\avgtray.exe] - Process ID: 3908
[C:\Program Files\Java\jre6\bin\jusched.exe] - Process ID: 3932
[C:\Program Files\Common Files\Real\Update_OB\realsched.exe] - Process ID: 4052
[C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe] - Process ID: 4060
[C:\Windows\system32\wbem\unsecapp.exe] - Process ID: 4068
[C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe] - Process ID: 680
[C:\Windows\system32\wbem\wmiprvse.exe] - Process ID: 648
[C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe] - Process ID: 1424
[C:\Program Files\Windows Live\Messenger\msnmsgr.exe] - Process ID: 2156
[C:\Program Files\DAEMON Tools Lite\daemon.exe] - Process ID: 756
[C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe] - Process ID: 2232
[C:\Program Files\Paltalk Messenger\paltalk.exe] - Process ID: 1960
[C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE] - Process ID: 532
[C:\Program Files\Etisalat USB modem\Etisalat USB modem.exe] - Process ID: 3028
[C:\Program Files\Mozilla Firefox\firefox.exe] - Process ID: 1236
[C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe] - Process ID: 1272
[C:\Program Files\iPod\bin\iPodService.exe] - Process ID: 3452
[C:\PROGRA~1\Raptr\raptr.exe] - Process ID: 1444
[C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe] - Process ID: 2528
[C:\PROGRA~1\Raptr\raptr_im.exe] - Process ID: 3504
[C:\Program Files\Windows Media Player\wmpnscfg.exe] - Process ID: 6132
[C:\Program Files\Windows Media Player\wmpnetwk.exe] - Process ID: 4112
[C:\Program Files\Mozilla Firefox\plugin-container.exe] - Process ID: 5816
[C:\Windows\system32\taskeng.exe] - Process ID: 5000
[C:\Program Files\Mozilla Firefox\plugin-container.exe] - Process ID: 876
[C:\Users\UMMNAB~1\AppData\Local\Temp\SINO\SINO.exe] - Process ID: 4900
[C:\Windows\system32\wuauclt.exe] - Process ID: 4696
[C:\Windows\system32\WUDFHost.exe] - Process ID: 884
[C:\Windows\System32\mobsync.exe] - Process ID: 4672
[C:\Windows\system32\wbem\wmiprvse.exe] - Process ID: 5332

<<<< Startup Items >>>>

[OneNote 2007 Screen Clipper and Launcher.lnk] - - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
[McAfee Security Scan Plus.lnk] - - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
[PalTalk.lnk] - - C:\Program Files\Paltalk Messenger\paltalk.exe
[Windows Defender] - - %ProgramFiles%\Windows Defender\MSASCui.exe -hide
[SiSTray] - - %ProgramFiles%\SiS VGA Utilities\SiSTray.exe
[SynTPEnh] - - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
[RtHDVCpl] - - RtHDVCpl.exe
[Skytel] - - Skytel.exe
[CarboniteSetupLite] - - "C:\Program Files\Packard Bell\Carbonite\CarboniteSetupLitePBPreInstaller.exe" /preinstalled
[PCMAgent] - - "C:\Program Files\CyberLink\PowerCinema\PCMAgent.exe"
[CLMLServer] - - "C:\Program Files\CyberLink\PowerCinema\Kernel\CLML\CLMLSvc.exe"
[PlayMovie] - - "C:\Program Files\CyberLink\PlayMovie\PMVService.exe"
[toolbar_eula_launcher] - - C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
[Athan] - - C:\Program Files\Athan\Athan.exe
[QuickTime Task] - - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
[iTunesHelper] - - "C:\Program Files\iTunes\iTunesHelper.exe"
[AVG8_TRAY] - - C:\PROGRA~1\AVG\AVG8\avgtray.exe
[SunJavaUpdateSched] - - "C:\Program Files\Java\jre6\bin\jusched.exe"
[Adobe Reader Speed Launcher] - - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
[TkBellExe] - - "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
[Azkary] - - C:\Program Files\Azkary\Azkary
[SymLnch] - - "C:\Program Files\Common Files\Symantec Shared\SymSetup\{C1C185CA-C531-49F5-A6FA-B838405A049D}_15_5_0_23\Support\SymLnch\SymLnch.exe" "C:\PROGRA~1\COMMON~1\SYMANT~1\SymSetup\{C1C18~1\Setup.exe" " /X"
[GrooveMonitor] - - "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
[SmpcSys] - - C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
[IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] - - "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
[MsnMsgr] - - "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
[DAEMON Tools Lite] - - "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
[ggtkusk] - - rundll32.exe "C:\Users\umm nabilah\AppData\Roaming\ztvzb.dll",exefyl
[Messenger (Yahoo!)] - - "C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe" -quiet
[Raptr] - - C:\PROGRA~1\Raptr\raptrstub.exe --startup
[FlashPlayerUpdate] - - C:\Windows\system32\Macromed\Flash\FlashUtil10k_Plugin.exe -update plugin

<<<< MS Services >>>>

Windows Audio (Audiosrv) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Background Intelligent Transfer Service (BITS) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k netsvcs
Computer Browser (Browser) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k netsvcs
Bluetooth Support Service (BthServ) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k bthsvcs
Cryptographic Services (CryptSvc) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k NetworkService
DCOM Server Process Launcher (DcomLaunch) - Running [Auto | Not_Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k DcomLaunch
DHCP Client (Dhcp) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
DNS Client (Dnscache) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k NetworkService
Extensible Authentication Protocol (EapHost) - Running [Manual | Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k netsvcs
Windows Event Log (Eventlog) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
COM+ Event System (EventSystem) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalService
Server (LanmanServer) - Running [Auto | Stoppable | Pausable] - C:\Windows\system32\svchost.exe -k netsvcs
Workstation (LanmanWorkstation) - Running [Auto | Stoppable | Pausable] - C:\Windows\System32\svchost.exe -k LocalService
TCP/IP NetBIOS Helper (lmhosts) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
Network Connections (Netman) - Running [Manual | Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
Plug and Play (PlugPlay) - Running [Auto | Not_Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k DcomLaunch
IPsec Policy Agent (PolicyAgent) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
Remote Access Connection Manager (RasMan) - Running [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k netsvcs
Remote Procedure Call (RPC) (RpcSs) - Running [Auto | Not_Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k rpcss
Security Accounts Manager (SamSs) - Running [Auto | Not_Stoppable | Not_Pausable] - C:\Windows\system32\lsass.exe
Task Scheduler (Schedule) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k netsvcs
Secondary Logon (seclogon) - Running [Auto | Stoppable | Pausable] - C:\Windows\system32\svchost.exe -k netsvcs
System Event Notification Service (SENS) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k netsvcs
Shell Hardware Detection (ShellHWDetection) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k netsvcs
Print Spooler (Spooler) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\System32\spoolsv.exe
SSDP Discovery (SSDPSRV) - Running [Manual | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalService
Windows Image Acquisition (WIA) (stisvc) - Running [Auto | Stoppable | Pausable] - C:\Windows\system32\svchost.exe -k imgsvc
Telephony (TapiSrv) - Running [Manual | Stoppable | Pausable] - C:\Windows\System32\svchost.exe -k NetworkService
Terminal Services (TermService) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k NetworkService
Themes (Themes) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k netsvcs
Distributed Link Tracking Client (TrkWks) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
UPnP Device Host (upnphost) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalService
Windows Time (W32Time) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalService
WebClient (WebClient) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalService
Windows Management Instrumentation (Winmgmt) - Running [Auto | Stoppable | Pausable] - C:\Windows\system32\svchost.exe -k netsvcs
Windows Media Player Network Sharing Service (WMPNetworkSvc) - Running [Manual | Stoppable | Not_Pausable] - "C:\Program Files\Windows Media Player\wmpnetwk.exe"
Security Center (wscsvc) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Windows Update (wuauserv) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k netsvcs
Windows Driver Foundation - User-mode Driver Framework (wudfsvc) - Running [Auto | Not_Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Application Layer Gateway Service (ALG) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\System32\alg.exe
Microsoft .NET Framework NGEN v2.0.50727_X86 (clr_optimization_v2.0.50727_32) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
COM+ System Application (COMSysApp) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
Wired AutoConfig (dot3svc) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Windows Presentation Foundation Font Cache 3.0.0.0 (FontCache3.0.0.0) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
Human Interface Device Access (hidserv) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Health Key and Certificate Management (hkmsvc) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k netsvcs
Windows CardSpace (idsvc) - Stopped [Manual | Not_Stoppable | Not_Pausable] - "C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe"
Microsoft Office Groove Audit Service (Microsoft Office Groove Audit Service) - Stopped [Manual | Not_Stoppable | Not_Pausable] - "C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe"
Distributed Transaction Coordinator (MSDTC) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\System32\msdtc.exe
Windows Installer (msiserver) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\msiexec /V
Network Access Protection Agent (napagent) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k NetworkService
Netlogon (Netlogon) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\lsass.exe
Net.Tcp Port Sharing Service (NetTcpPortSharing) - Stopped [Disabled | Not_Stoppable | Not_Pausable] - "C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe"
Microsoft Office Diagnostics Service (odserv) - Stopped [Manual | Not_Stoppable | Not_Pausable] - "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE"
Office Source Engine (ose) - Stopped [Manual | Not_Stoppable | Not_Pausable] - "C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
Pml Driver HPZ12 (Pml Driver HPZ12) - Stopped [Auto | Not_Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k HPZ12
Protected Storage (ProtectedStorage) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\lsass.exe
Remote Access Auto Connection Manager (RasAuto) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k netsvcs
Routing and Remote Access (RemoteAccess) - Stopped [Disabled | Not_Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k netsvcs
Remote Registry (RemoteRegistry) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k regsvc
Remote Procedure Call (RPC) Locator (RpcLocator) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\locator.exe
Smart Card (SCardSvr) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalService
Internet Connection Sharing (ICS) (SharedAccess) - Stopped [Disabled | Not_Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k netsvcs
Microsoft Software Shadow Copy Provider (swprv) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k swprv
Volume Shadow Copy (VSS) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\vssvc.exe
WMI Performance Adapter (wmiApSrv) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\wbem\WmiApSrv.exe

<<<< Non-MS Services >>>>

Application Experience (AeLookupSvc) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k netsvcs
Application Information (Appinfo) - Running [Manual | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k netsvcs
Apple Mobile Device (Apple Mobile Device) - Running [Auto | Stoppable | Not_Pausable] - "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"
Windows Audio Endpoint Builder (AudioEndpointBuilder) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
AVG Free8 E-mail Scanner (avg8emc) - Running [Auto | Stoppable | Not_Pausable] - C:\PROGRA~1\AVG\AVG8\avgemc.exe
AVG Free8 WatchDog (avg8wd) - Running [Auto | Not_Stoppable | Not_Pausable] - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
Base Filtering Engine (BFE) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
Diagnostic Policy Service (DPS) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
ReadyBoost (EMDMgmt) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Easybits Shared Services for Windows (ezSharedSvc) - Running [Auto | Not_Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k netsvcs
Function Discovery Resource Publication (FDResPub) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalService
Group Policy Client (gpsvc) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k netsvcs
IKE and AuthIP IPsec Keying Modules (IKEEXT) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k netsvcs
IP Helper (iphlpsvc) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k NetSvcs
iPod Service (iPod Service) - Running [Manual | Stoppable | Not_Pausable] - "C:\Program Files\iPod\bin\iPodService.exe"
CNG Key Isolation (KeyIso) - Running [Manual | Stoppable | Not_Pausable] - C:\Windows\system32\lsass.exe
KtmRm for Distributed Transaction Coordinator (KtmRm) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k NetworkService
Multimedia Class Scheduler (MMCSS) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k netsvcs
Windows Firewall (MpsSvc) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
Nero BackItUp Scheduler 3 (Nero BackItUp Scheduler 3) - Running [Auto | Stoppable | Not_Pausable] - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
Network List Service (netprofm) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k LocalService
Network Location Awareness (NlaSvc) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k NetworkService
NMIndexingService (NMIndexingService) - Running [Manual | Stoppable | Not_Pausable] - "C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe"
Network Store Interface Service (nsi) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalService
Program Compatibility Assistant Service (PcaSvc) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
PLFlash DeviceIoControl Service (PLFlash DeviceIoControl Service) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\IoctlSvc.exe
User Profile Service (ProfSvc) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k netsvcs
SeaPort (SeaPort) - Running [Auto | Stoppable | Not_Pausable] - "C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe"
Software Licensing (slsvc) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\SLsvc.exe
Secure Socket Tunneling Protocol Service (SstpSvc) - Running [Manual | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalService
Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\System32\StkCSrv.exe
Superfetch (SysMain) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Tablet PC Input Service (TabletInputService) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
Desktop Window Manager Session Manager (UxSms) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
Diagnostic System Host (WdiSystemHost) - Running [Manual | Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
Windows Error Reporting Service (WerSvc) - Running [Auto | Stoppable | Pausable] - C:\Windows\System32\svchost.exe -k WerSvcGroup
Windows Defender (WinDefend) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k secsvcs
WinHTTP Web Proxy Auto-Discovery Service (WinHttpAutoProxySvc) - Running [Manual | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalService
WLAN AutoConfig (Wlansvc) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Portable Device Enumerator Service (WPDBusEnum) - Running [Auto | Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Yahoo! Updater (YahooAUService) - Running [Auto | Stoppable | Not_Pausable] - "C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe"
Certificate Propagation (CertPropSvc) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k netsvcs
DFS Replication (DFSR) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\DFSR.exe
Function Discovery Provider Host (fdPHost) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalService
FLEXnet Licensing Service (FLEXnet Licensing Service) - Stopped [Manual | Not_Stoppable | Not_Pausable] - "C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe"
hpqcxs08 (hpqcxs08) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k hpdevmgmt
PnP-X IP Bus Enumerator (IPBusEnum) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Link-Layer Topology Discovery Mapper (lltdsvc) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k LocalService
McAfee Security Scan Component Host Service (McComponentHostService) - Stopped [Manual | Not_Stoppable | Not_Pausable] - "C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe"
Microsoft iSCSI Initiator Service (MSiSCSI) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k netsvcs
Net Driver HPZ12 (Net Driver HPZ12) - Stopped [Auto | Not_Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k HPZ12
Peer Networking Identity Manager (p2pimsvc) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Peer Networking Grouping (p2psvc) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Performance Logs & Alerts (pla) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
PNRP Machine Name Publication Service (PNRPAutoReg) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Peer Name Resolution Protocol (PNRPsvc) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Quality Windows Audio Video Experience (QWAVE) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalService
Smart Card Removal Policy (SCPolicySvc) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k netsvcs
Windows Backup (SDRSVC) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k SDRSVC
Terminal Services Configuration (SessionEnv) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k netsvcs
SL UI Notification Service (SLUINotify) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalService
SNMP Trap (SNMPTRAP) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\System32\snmptrap.exe
TPM Base Services (TBS) - Stopped [Auto | Not_Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k LocalService
Thread Ordering Server (THREADORDER) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalService
Windows Modules Installer (TrustedInstaller) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\servicing\TrustedInstaller.exe
Interactive Services Detection (UI0Detect) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\UI0Detect.exe
Virtual Disk (vds) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\System32\vds.exe
Windows Connect Now - Config Registrar (wcncsvc) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k LocalService
Windows Color System (WcsPlugInService) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k wcssvc
Diagnostic Service Host (WdiServiceHost) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k wdisvc
Windows Event Collector (Wecsvc) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k NetworkService
Problem Reports and Solutions Control Panel Support (wercplsupport) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k netsvcs
Windows Remote Management (WS-Management) (WinRM) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\System32\svchost.exe -k NetworkService
Parental Controls (WPCSvc) - Stopped [Manual | Not_Stoppable | Not_Pausable] - C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
Windows Search (WSearch) - Stopped [Auto | Not_Stoppable | Not_Pausable] - C:\Windows\system32\SearchIndexer.exe /Embedding

<<<< bcdedit >>>>


Windows Boot Manager
--------------------
identifier {bootmgr}
device partition=C:
description Windows Boot Manager
locale en-US
inherit {globalsettings}
default {current}
resumeobject {06c1e3f2-495e-11dd-95ee-b4c0930ca3ad}
displayorder {current}
toolsdisplayorder {memdiag}
timeout 30

Windows Boot Loader
-------------------
identifier {current}
device partition=C:
path \Windows\system32\winload.exe
description Microsoft Windows Vista
locale en-US
inherit {bootloadersettings}
recoverysequence {572bcd56-ffa7-11d9-aae0-0007e994107d}
recoveryenabled Yes
osdevice partition=C:
systemroot \Windows
resumeobject {06c1e3f2-495e-11dd-95ee-b4c0930ca3ad}
nx OptIn

<<<< Routing Table >>>>

===========================================================================
Interface List
46 ........................... Etisalat Internet
11 ...00 15 af c5 1c 2b ...... Atheros AR5007EG Wireless Network Adapter
10 ...00 22 15 47 98 0a ...... SiS191 Ethernet Controller
1 ........................... Software Loopback Interface 1
24 ...00 00 00 00 00 00 00 e0 isatap.{5F71DA2A-0FC3-462D-9568-6A76C8BB4604}
13 ...02 00 54 55 4e 01 ...... Teredo Tunneling Pseudo-Interface
12 ...00 00 00 00 00 00 00 e0 isatap.{5E49B5B1-AD25-4AEE-91E2-571DDF34DDBE}
14 ...00 00 00 00 00 00 00 e0 isatap.{47E19914-539C-40F3-8220-C083A2938802}
16 ...00 00 00 00 00 00 00 e0 isatap.{47E19914-539C-40F3-8220-C083A2938802}
25 ...00 00 00 00 00 00 00 e0 isatap.{5F71DA2A-0FC3-462D-9568-6A76C8BB4604}
26 ...00 00 00 00 00 00 00 e0 isatap.{BE8BC94A-FD0C-4CBE-B85F-C8876DECE0B8}
27 ...00 00 00 00 00 00 00 e0 isatap.{BE8BC94A-FD0C-4CBE-B85F-C8876DECE0B8}
29 ...00 00 00 00 00 00 00 e0 isatap.{BE8BC94A-FD0C-4CBE-B85F-C8876DECE0B8}
32 ...00 00 00 00 00 00 00 e0 isatap.{BE8BC94A-FD0C-4CBE-B85F-C8876DECE0B8}
40 ...00 00 00 00 00 00 00 e0 isatap.{BE8BC94A-FD0C-4CBE-B85F-C8876DECE0B8}
44 ...00 00 00 00 00 00 00 e0 isatap.{BE8BC94A-FD0C-4CBE-B85F-C8876DECE0B8}
53 ...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #22
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 On-link 10.69.111.236 41
10.69.111.236 255.255.255.255 On-link 10.69.111.236 296
127.0.0.0 255.0.0.0 On-link 127.0.0.1 4531
127.0.0.1 255.255.255.255 On-link 127.0.0.1 4531
127.255.255.255 255.255.255.255 On-link 127.0.0.1 4531
224.0.0.0 240.0.0.0 On-link 127.0.0.1 4531
224.0.0.0 240.0.0.0 On-link 10.69.111.236 41
255.255.255.255 255.255.255.255 On-link 127.0.0.1 4531
255.255.255.255 255.255.255.255 On-link 10.69.111.236 296
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
1 306 ff00::/8 On-link
===========================================================================
Persistent Routes:
None

<<<< Hosts File >>>>

The HOSTS file is 736 Bytes in size.

There were 0 lines which refer to an external IP address.



------ End of File ------

what should i do?

ESET Online Scan

Please run a free online scan with the ESET Online Scanner

• Tick the box next to YES, I accept the Terms of Use
  
• Click Start
  
• When asked, allow the ActiveX control to install
  
• Click Start
  
• Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  
• Click Scan (This scan can take several hours, so please be patient)
  
• Once the scan is completed, you may close the window
  
• Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  
• Copy and paste that log as a reply to this topic

I let the Eset scan run over night as it took a very long time and it found 6 threats,

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.url Win32/Adware.ADON application cleaned by deleting - quarantined
C:\Users\Fathima Nabilah\Downloads\Guffins.exe a variant of Win32/AdInstaller application cleaned by deleting - quarantined
C:\Users\Public\Desktop\eBay.url Win32/Adware.ADON application cleaned by deleting - quarantined
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6MSZ1M1G\upgrade[1].cab multiple threats deleted - quarantined
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6MSZ1M1G\upgrade[2].cab multiple threats deleted - quarantined
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NEDMLGSU\upgrade[1].cab multiple threats deleted - quarantined


However my laptop is still the same, The box still pops up and most of my applications are not working, i.e skype, microsoft word etc etc

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=56fe2804a535664e848d0063301efa7f
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-11-20 01:52:40
# local_time=2010-11-20 03:52:40 (+0200, Egypt Standard Time)
# country="United Kingdom"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=768 16777215 100 0 50757138 50757138 0 0
# compatibility_mode=1028 16777213 100 95 7855905 54091875 0 0
# compatibility_mode=5892 16776573 100 95 36104 127717929 0 0
# compatibility_mode=8192 67108863 100 0 4434 4434 0 0
# compatibility_mode=9217 16777214 0 9 50740303 50743903 0 0
# scanned=181883
# found=6
# cleaned=6
# scan_time=32873
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.url Win32/Adware.ADON application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Users\Fathima Nabilah\Downloads\Guffins.exe a variant of Win32/AdInstaller application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Users\Public\Desktop\eBay.url Win32/Adware.ADON application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6MSZ1M1G\upgrade[1].cab multiple threats (deleted - quarantined) 00000000000000000000000000000000 C
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6MSZ1M1G\upgrade[2].cab multiple threats (deleted - quarantined) 00000000000000000000000000000000 C
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NEDMLGSU\upgrade[1].cab multiple threats (deleted - quarantined) 00000000000000000000000000000000 C

Please download and run this file: ftp://ftp.GeekPolice.net/GPUser/DragonMasterJay/fixthis.reg

Merge it to the Registry. Then, let me know if you can run programs.

Note: if downloading it via Firefox, right click on the download link and select "Save link as..." and choose to save it to your Desktop.

How to i merge to the registry?

When you double click on it, it will ask you to Merge. Proceed with the merging.

It asks me to run the file the it informs me that i am about to add some information and it can unintentionally change components of the computer........, do you want to continue?


Then i click yes, then it says "ERROR: Cannot import "c://////Destination, fixthis", Not all data was written into the registry. Some keys are open by the system or other processes.

Theres nothing i can do!

Please reboot to Safe Mode (tap the F8 key just before Windows starts to load and select the Safe Mode option from the menu).

Then, please try again.

I started up inn safe mode and the same thing came up. The same error box

Please download DragonFix by DragonMaster Jay, and save it to your Desktop. Right click and Extract All, and save the files to your Desktop.

• Please disable realtime protection. The only realtime protection that gets in the way and need to be disabled: Windows Defender, Microsoft Security Essentials, Spybot TeaTimer, WinPatrol, and Ad-Aware AdWatch. If you have anyone of those, please disable them.
  
• Double-click DragonFix.reg, and follow the prompt(s).
  
• Please reboot your computer.

Let me know if it worked.

How do i disable windows defender?

I disabled it, it says error accessing registry when i run your file

Go to Start > Run, type in cmd and hit OK.

Type this in exactly and post the log:

reg query="HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" > log.txt && log.txt

Error invalid argument, i copied and pasted it and pressed enter and it says its invalid, no log.
Thank you for trying! Its giving me some hope. No programs work now. Skype, word, paltalk etc

Note: the following tool is to only be used under the guidance of a malware helper. In the event you already have the tool, please delete the old copy and download a new copy.

Please download ComboFix from BleepingComputer.com

Alternate link: Forospyware.com (Click the green button on the page to download it).


Rename ComboFix.exe to combo-fix.exe before you save it to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools A guide to do this can be found here
  
• Click Start then copy paste the following command into the search box & hit enter: "%userprofile%\desktop\combo-fix.exe" /killall
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. This will not install in Vista, so it will just continue scanning, and skip the console install.
  
• When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply.

I tried to uninstall superspyware but it would not allow me like adobe, word and skype hence i can not run this program! One thing after another

We are going to be using a Windows Recovery Environment to help disinfect the system so it may boot again.

Download the OTLPE Standard REATOGO Windows Recovery Environment.

• Place a blank CD-R disc in to your CD burning drive.
• Download OTLPEStd.exe and double-click on it to burn to a CD using ISO Burner.
• Reboot your system using the boot CD you just created.
  
  Note : If you do not know how to set your computer to boot from CD follow the steps here
  
• Your system should now display a REATOGO-X-PE desktop.
  
• Double-click on the OTLPE icon.
  
• When asked "Do you wish to load the remote registry", select Yes
  
• When asked "Do you wish to load remote user profile(s) for scanning", select Yes
  
• Ensure the box "Automatically Load All Remaining Users" is checked and press OK
  
• OTL should now start. Change the following settings
  • Change Drivers to Non-Microsoft
    
  • Press Run Scan to start the scan.
    
  • When finished, the file will be saved in drive C:\_OTL\MovedFiles
    
  • Copy this file to your USB drive if you do not have internet connection on this system
    
  • Please post the contents of the OTL.txt file in your reply.

Still with us?