computer just reboots after running Malwarebytes

swetbak · July 16, 2008

Coming over from PC Help forum: http://www.malwarebytes.org/forums/index.php?showtopic=5205

Here are the Malwarebytes and HJT logs:

Malwarebytes' Anti-Malware 1.19

Database version: 938

Windows 5.1.2600 Service Pack 1

8:36:06 PM 7/16/2008

mbam-log-7-16-2008 (20-36-06).txt

Scan type: Quick Scan

Objects scanned: 42231

Time elapsed: 3 minute(s), 30 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 4

Registry Values Infected: 5

Registry Data Items Infected: 18

Folders Infected: 8

Files Infected: 17

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winnt32 (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0069830 (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c009DC24 (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\zangosa (Adware.Zango) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{07aa283a-43d7-4cbe-a064-32a21112d94d} (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.43 85.255.112.135 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{42E7B7E0-2272-4695-B7F6-A8B6A143859A}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.116.43,85.255.112.135 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{D7AD1C86-AB85-46FD-8B61-01BF20F0EFB1}\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.43,85.255.112.135 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{FA1EC96F-EFDB-4C2F-BB51-5F8EA029CBF4}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.116.43,85.255.112.135 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{FA1EC96F-EFDB-4C2F-BB51-5F8EA029CBF4}\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.43,85.255.112.135 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.43 85.255.112.135 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{42E7B7E0-2272-4695-B7F6-A8B6A143859A}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.116.43,85.255.112.135 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{D7AD1C86-AB85-46FD-8B61-01BF20F0EFB1}\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.43,85.255.112.135 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{FA1EC96F-EFDB-4C2F-BB51-5F8EA029CBF4}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.116.43,85.255.112.135 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{FA1EC96F-EFDB-4C2F-BB51-5F8EA029CBF4}\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.43,85.255.112.135 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.43 85.255.112.135 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{42E7B7E0-2272-4695-B7F6-A8B6A143859A}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.116.43,85.255.112.135 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{D7AD1C86-AB85-46FD-8B61-01BF20F0EFB1}\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.43,85.255.112.135 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{FA1EC96F-EFDB-4C2F-BB51-5F8EA029CBF4}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.116.43,85.255.112.135 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{FA1EC96F-EFDB-4C2F-BB51-5F8EA029CBF4}\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.43,85.255.112.135 -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.Homepage) -> Bad: (http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2) Good: (http://www.google.com/) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceActiveDesktopOn (Hijack.Desktop) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

H:\Documents and Settings\Owner\Application Data\ShoppingReport (Adware.Shopping.Report) -> Quarantined and deleted successfully.

H:\Documents and Settings\Owner\Application Data\ShoppingReport\cs (Adware.Shopping.Report) -> Quarantined and deleted successfully.

H:\Documents and Settings\Owner\Application Data\ShoppingReport\cs\db (Adware.Shopping.Report) -> Quarantined and deleted successfully.

H:\Documents and Settings\Owner\Application Data\ShoppingReport\cs\dwld (Adware.Shopping.Report) -> Quarantined and deleted successfully.

H:\Documents and Settings\Owner\Application Data\ShoppingReport\cs\report (Adware.Shopping.Report) -> Quarantined and deleted successfully.

H:\Documents and Settings\Owner\Application Data\ShoppingReport\cs\res1 (Adware.Shopping.Report) -> Quarantined and deleted successfully.

H:\Documents and Settings\All Users\Application Data\SalesMon (Rogue.Multiple) -> Quarantined and deleted successfully.

H:\Documents and Settings\All Users\Application Data\SalesMon\Data (Rogue.Multiple) -> Quarantined and deleted successfully.

Files Infected:

H:\Documents and Settings\Owner\Application Data\ShoppingReport\cs\Config.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully.

H:\Documents and Settings\Owner\Application Data\ShoppingReport\cs\db\Aliases.dbs (Adware.Shopping.Report) -> Quarantined and deleted successfully.

H:\Documents and Settings\Owner\Application Data\ShoppingReport\cs\db\Sites.dbs (Adware.Shopping.Report) -> Quarantined and deleted successfully.

H:\Documents and Settings\Owner\Application Data\ShoppingReport\cs\dwld\WhiteList.xip (Adware.Shopping.Report) -> Quarantined and deleted successfully.

H:\Documents and Settings\Owner\Application Data\ShoppingReport\cs\report\aggr_storage.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully.

H:\Documents and Settings\Owner\Application Data\ShoppingReport\cs\report\send_storage.xml (Adware.Shopping.Report) -> Quarantined and deleted successfully.

H:\Documents and Settings\Owner\Application Data\ShoppingReport\cs\res1\WhiteList.dbs (Adware.Shopping.Report) -> Quarantined and deleted successfully.

H:\WINDOWS\system32\WinNt32.dll (Trojan.Agent) -> Quarantined and deleted successfully.

H:\WINDOWS\BM6b36fd6c.xml (Trojan.Vundo) -> Quarantined and deleted successfully.

H:\WINDOWS\BM6b36fd6c.txt (Trojan.Vundo) -> Quarantined and deleted successfully.

H:\Documents and Settings\Owner\Application Data\TmpRecentIcons\Ultimate Cleaner.lnk (Rogue.Link) -> Quarantined and deleted successfully.

H:\Documents and Settings\Owner\Application Data\TmpRecentIcons\Ultimate Defender.lnk (Rogue.Link) -> Quarantined and deleted successfully.

H:\Documents and Settings\Owner\Desktop\WinIFixer.lnk (Rogue.WinIFixer) -> Quarantined and deleted successfully.

H:\Documents and Settings\Owner\Application Data\Install.dat (Trojan.Agent) -> Quarantined and deleted successfully.

H:\Documents and Settings\Owner\Favorites\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.

H:\Documents and Settings\Owner\Favorites\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.

H:\Documents and Settings\Owner\Favorites\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 8:37:31 PM, on 7/16/2008

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Boot mode: Normal

Running processes:

H:\WINDOWS\System32\smss.exe

H:\WINDOWS\system32\winlogon.exe

H:\WINDOWS\system32\services.exe

H:\WINDOWS\system32\lsass.exe

H:\WINDOWS\system32\svchost.exe

H:\WINDOWS\System32\svchost.exe

H:\WINDOWS\system32\spoolsv.exe

H:\WINDOWS\System32\nvsvc32.exe

H:\WINDOWS\System32\WgaTray.exe

H:\WINDOWS\Explorer.EXE

H:\WINDOWS\SOUNDMAN.EXE

H:\WINDOWS\System32\RUNDLL32.EXE

H:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - H:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: (no name) - {E4FFD1CB-D8A7-44BB-A3F1-C177AE513988} - H:\WINDOWS\system32\mljjj.dll (file missing)

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - h:\program files\google\googletoolbar1.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - H:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - H:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE H:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - H:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - H:\WINDOWS\web\related.htm

O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - H:\Documents and Settings\Owner\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} - http://imikimi.com/download/imikimi_plugin_0.5.1.cab

O20 - Winlogon Notify: mlJCTmKa - mlJCTmKa.dll (file missing)

O20 - Winlogon Notify: pgjrawnu - H:\WINDOWS\

O21 - SSODL: CheckAlrt - {5f7b7b43-7742-4f33-83ba-7952324a36d4} - H:\WINDOWS\Resources\CheckAlrt.dll (file missing)

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - H:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - H:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\System32\nvsvc32.exe

O24 - Desktop Component 0: (no name) - http://www.natureartists.com/art/resized/6...ush_snook-1.jpg

O24 - Desktop Component 1: (no name) - http://www.natureartists.com/art/resized/6...ngroveroots.jpg

O24 - Desktop Component 2: (no name) - http://myspace-271.vo.llnwd.net/00400/17/27/400557271_l.jpg

O24 - Desktop Component 3: Privacy Protection - file:///H:\WINDOWS\privacy_danger\index.htm

--

End of file - 3328 bytes

JeanInMontana · July 16, 2008

OK, first get MBAM updated, your definitions and the version of the program are way outdated. Do another quick scan with it and post that log and a new HJT.

Edited July 16, 2008 by JeanInMontana
add instructions

swetbak · July 16, 2008

OK, first get MBAM updated, your definitions and the version of the program are way outdated. Do another quick scan with it and post that log and a new HJT.

I know that my previous thread in the PC Help forum is long, but there is pertinent info there. One is that I don't have Internet on the computer in question. Is there an update file I can download and get it to the computer via flash disk? I thought i was using version 1.20. I will reinstall and post a new scan, but still don't have any way to update.

swetbak · July 16, 2008

Here are my new logs. FYI, since my last log post I've installed and run Avira AV.

Malwarebytes' Anti-Malware 1.20

Database version: 930

Windows 5.1.2600 Service Pack 1

3:38:23 PM 7/16/2008

mbam-log-7-16-2008 (15-38-23).txt

Scan type: Quick Scan

Objects scanned: 42746

Time elapsed: 3 minute(s), 38 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WinNt32 (Rootkit.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

=========

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 3:39:19 PM, on 7/16/2008

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Boot mode: Normal

Running processes:

H:\WINDOWS\System32\smss.exe

H:\WINDOWS\system32\winlogon.exe

H:\WINDOWS\system32\services.exe

H:\WINDOWS\system32\lsass.exe

H:\WINDOWS\system32\svchost.exe

H:\WINDOWS\System32\svchost.exe

H:\WINDOWS\system32\spoolsv.exe

H:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

H:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

H:\WINDOWS\System32\nvsvc32.exe

H:\WINDOWS\System32\WgaTray.exe

H:\WINDOWS\Explorer.EXE

H:\WINDOWS\SOUNDMAN.EXE

H:\WINDOWS\System32\RUNDLL32.EXE

H:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

H:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - H:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: (no name) - {E4FFD1CB-D8A7-44BB-A3F1-C177AE513988} - H:\WINDOWS\system32\mljjj.dll (file missing)

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - h:\program files\google\googletoolbar1.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - H:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - H:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE H:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [avgnt] "H:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - H:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - H:\WINDOWS\web\related.htm

O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - H:\Documents and Settings\Owner\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} - http://imikimi.com/download/imikimi_plugin_0.5.1.cab

O20 - Winlogon Notify: mlJCTmKa - mlJCTmKa.dll (file missing)

O20 - Winlogon Notify: pgjrawnu - H:\WINDOWS\

O21 - SSODL: CheckAlrt - {5f7b7b43-7742-4f33-83ba-7952324a36d4} - H:\WINDOWS\Resources\CheckAlrt.dll (file missing)

O23 - Service: Microsoft DDE+ server (423b2bdf) - Unknown owner - H:\WINDOWS\system32\.423b2bdf\423b2bdf.exe (file missing)

O23 - Service: Avira AntiVir Personal

JeanInMontana · July 16, 2008

http://malwarebytes.gt500.org/database.jspI think that was posted in your thread. It's on the download page too. Let's do it all again please. Did you use LSPfix to try and get a connection?

Raid · July 16, 2008

http://malwarebytes.gt500.org/database.jspI think that was posted in your thread. It's on the download page too. Let's do it all again please. Did you use LSPfix to try and get a connection?

http://wiki.lunarsoft.net/wiki/Dial-a-fix

Please download Dial A fix as well.

Reboot from the bartpe disc and locate this file:

pgjrawnu - H:\WINDOWS\

it may have the hidden andor/system file attribute set, so do a dir /a

move this file to some other place, such as c:\hold

Next, restart the computer, login as you now can, and proceed with the instructions below.

I'd like you to have it do a policy scan, and remove any keys it finds.

Please let me know if after doing this, you are able to regain some functionality of the control panel, and various areas you seem to be locked out of.

swetbak · July 16, 2008

http://malwarebytes.gt500.org/database.jspI think that was posted in your thread. It's on the download page too. Let's do it all again please. Did you use LSPfix to try and get a connection?

Jean, I want to thank you and your fellow warriors for helping me and everyone else who comes here looking for help. The advice is priceless.

I tried lspfix and it found nothing. I think that particular problem is my nic driver. I replaced the motherboard and processor on this machine and they are slightly different than the original. There are two items in Device Manager that are not reconized; PCI bridge device, and SM Bus controller. I believe the former is the network card since there are no network devices listed. I'm in the process of looking for the drivers.

I did use the mbam-rules earlier, but it must not have taken. Perhaps because I was trying to update ver. 1.9. Anyway it looks like it updated now. I noticed that I had some items unchecked in the "startup" in msconfig, so I enabled everything and rebooted prior to running these latest scans.

Twice during the mb scan, Avira popped up with a warning that malware was found in H:\Windows\System32\WinNt32.dll. I ok'd the default action to "deny access".

Here are the logs:

Malwarebytes' Anti-Malware 1.20

Database version: 938

Windows 5.1.2600 Service Pack 1

5:35:22 PM 7/16/2008

mbam-log-7-16-2008 (17-35-22).txt

Scan type: Quick Scan

Objects scanned: 42407

Time elapsed: 4 minute(s), 4 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 3

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winnt32 (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iSecurity applet (Rouge.ISecurity) -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

H:\WINDOWS\system32\WinNt32.dll (Trojan.Agent) -> Quarantined and deleted successfully.

========

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 5:37:39 PM, on 7/16/2008

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Boot mode: Normal

Running processes:

H:\WINDOWS\System32\smss.exe

H:\WINDOWS\system32\winlogon.exe

H:\WINDOWS\system32\services.exe

H:\WINDOWS\system32\lsass.exe

H:\WINDOWS\system32\svchost.exe

H:\WINDOWS\System32\svchost.exe

H:\WINDOWS\system32\spoolsv.exe

H:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

H:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

H:\WINDOWS\System32\nvsvc32.exe

H:\WINDOWS\System32\WgaTray.exe

H:\WINDOWS\Explorer.EXE

H:\WINDOWS\SOUNDMAN.EXE

H:\WINDOWS\System32\RUNDLL32.EXE

H:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

H:\Program Files\Messenger\msmsgs.exe

H:\WINDOWS\system32\NOTEPAD.EXE

H:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - H:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: (no name) - {E4FFD1CB-D8A7-44BB-A3F1-C177AE513988} - H:\WINDOWS\system32\mljjj.dll (file missing)

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - h:\program files\google\googletoolbar1.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - H:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - H:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE H:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [avgnt] "H:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [MSMSGS] "H:\Program Files\Messenger\msmsgs.exe" /background

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - H:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - H:\WINDOWS\web\related.htm

O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - H:\Documents and Settings\Owner\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} - http://imikimi.com/download/imikimi_plugin_0.5.1.cab

O20 - Winlogon Notify: mlJCTmKa - mlJCTmKa.dll (file missing)

O20 - Winlogon Notify: pgjrawnu - H:\WINDOWS\

O21 - SSODL: CheckAlrt - {5f7b7b43-7742-4f33-83ba-7952324a36d4} - H:\WINDOWS\Resources\CheckAlrt.dll (file missing)

O23 - Service: Microsoft DDE+ server (423b2bdf) - Unknown owner - H:\WINDOWS\system32\.423b2bdf\423b2bdf.exe (file missing)

O23 - Service: Avira AntiVir Personal

JeanInMontana · July 16, 2008

http://malwarebytes.gt500.org/database.jsp Get the latest definitions for MBAM.

Raid · July 17, 2008

Jean, I want to thank you and your fellow warriors for helping me and everyone else who comes here looking for help. The advice is priceless.
I tried lspfix and it found nothing. I think that particular problem is my nic driver. I replaced the motherboard and processor on this machine and they are slightly different than the original. There are two items in Device Manager that are not reconized; PCI bridge device, and SM Bus controller. I believe the former is the network card since there are no network devices listed. I'm in the process of looking for the drivers.

The SM BUS controller is Intel, as is likely the pci bridge device... You said the new motherboard had an intel chipset? You might want to snag the intel chipset drivers. Then go in cmos, and double check to make sure ethernet is enabled.

Once the chipset drivers are loaded, the sm bus controller will disappear for you. If the nic card is a pci device card, installing the chipset drivers should allow the system to properly use it's pci bus, and it should detect the nic card. YOu might even luck out and it install compatable drivers for you.

I accidently posted this information to Jean, but I had intended it for yourself:

http://wiki.lunarsoft.net/wiki/Dial-a-fix

Please download Dial A fix as well.

Reboot from the bartpe disc and locate this file:

pgjrawnu - H:\WINDOWS\

it may have the hidden andor/system file attribute set, so do a dir /a smile.gif

move this file to some other place, such as c:\hold

Next, restart the computer, login as you now can, and proceed with the instructions below.

I'd like you to have it do a policy scan, and remove any keys it finds.

Please let me know if after doing this, you are able to regain some functionality of the control panel, and various areas you seem to be locked out of.

swetbak · July 17, 2008

The SM BUS controller is Intel, as is likely the pci bridge device... You said the new motherboard had an intel chipset? You might want to snag the intel chipset drivers. Then go in cmos, and double check to make sure ethernet is enabled.
Once the chipset drivers are loaded, the sm bus controller will disappear for you. If the nic card is a pci device card, installing the chipset drivers should allow the system to properly use it's pci bus, and it should detect the nic card. YOu might even luck out and it install compatable drivers for you.
I accidently posted this information to Jean, but I had intended it for yourself:
http://wiki.lunarsoft.net/wiki/Dial-a-fix
Please download Dial A fix as well.
Reboot from the bartpe disc and locate this file:
pgjrawnu - H:\WINDOWS\
it may have the hidden andor/system file attribute set, so do a dir /a smile.gif
move this file to some other place, such as c:\hold
Next, restart the computer, login as you now can, and proceed with the instructions below.
I'd like you to have it do a policy scan, and remove any keys it finds.
Please let me know if after doing this, you are able to regain some functionality of the control panel, and various areas you seem to be locked out of.

I got the chipset drivers straightened out. It was Nvidia. Internet ok and able to update everything.

I couldn't find the pgrawnu file either in the Windows directory or doing a dir /a smile.gif from the command line.

Dial a fix found and fixed two reg entries, but I didn't keep a log file.

All my Control Panel applets are working. I think that ended up being a safe mode thing. Other than my background which I can't change (although I see the problem in HJT), I think I have only a virus issue left. Well maybe; I haven't tried Windows Updates yet.

Here are my latest Avira, MB's, and HJT logs:

Avira AntiVir Personal

Report file date: Thursday, July 17, 2008 14:07

Scanning for 1468484 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 1) [5.1.2600]

Boot mode: Normally booted

Username: SYSTEM

Computer name: OWNER-JO3GFNRDH

Version information:

BUILD.DAT : 8.1.00.295 16479 Bytes 4/9/2008 16:24:00

AVSCAN.EXE : 8.1.2.12 311553 Bytes 3/18/2008 15:02:56

AVSCAN.DLL : 8.1.1.0 53505 Bytes 2/7/2008 14:43:37

LUKE.DLL : 8.1.2.9 151809 Bytes 2/28/2008 14:41:23

LUKERES.DLL : 8.1.2.1 12033 Bytes 2/21/2008 14:28:40

ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 7/18/2007 16:33:34

ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 6/24/2008 14:36:33

ANTIVIR2.VDF : 7.0.5.119 1264128 Bytes 7/15/2008 14:37:22

ANTIVIR3.VDF : 7.0.5.133 209408 Bytes 7/17/2008 14:37:30

Engineversion : 8.1.1.9

AEVDF.DLL : 8.1.0.5 102772 Bytes 2/25/2008 15:58:21

AESCRIPT.DLL : 8.1.0.54 303482 Bytes 7/17/2008 14:39:00

AESCN.DLL : 8.1.0.23 119156 Bytes 7/17/2008 14:38:56

AERDL.DLL : 8.1.0.20 418165 Bytes 7/17/2008 14:38:53

AEPACK.DLL : 8.1.2.1 364917 Bytes 7/17/2008 14:38:43

AEOFFICE.DLL : 8.1.0.20 192891 Bytes 7/17/2008 14:38:36

AEHEUR.DLL : 8.1.0.42 1339766 Bytes 7/17/2008 14:38:30

AEHELP.DLL : 8.1.0.15 115063 Bytes 7/17/2008 14:38:04

AEGEN.DLL : 8.1.0.29 307573 Bytes 7/17/2008 14:38:01

AEEMU.DLL : 8.1.0.6 430451 Bytes 7/17/2008 14:37:41

AECORE.DLL : 8.1.1.6 172405 Bytes 7/17/2008 14:37:36

AEBB.DLL : 8.1.0.1 53617 Bytes 7/17/2008 14:37:31

AVWINLL.DLL : 1.0.0.7 14593 Bytes 1/23/2008 23:07:53

AVPREF.DLL : 8.0.0.1 25857 Bytes 2/18/2008 16:37:50

AVREP.DLL : 7.0.0.1 155688 Bytes 4/16/2007 19:26:47

AVREG.DLL : 8.0.0.0 30977 Bytes 1/23/2008 23:07:49

AVARKT.DLL : 1.0.0.23 307457 Bytes 2/12/2008 14:29:23

AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 2/28/2008 14:31:31

SQLITE3.DLL : 3.3.17.1 339968 Bytes 1/22/2008 23:28:02

SMTPLIB.DLL : 1.2.0.19 28929 Bytes 1/23/2008 23:08:39

NETNT.DLL : 8.0.0.1 7937 Bytes 1/25/2008 18:05:10

RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 3/10/2008 20:37:25

RCTEXT.DLL : 8.0.32.0 86273 Bytes 3/6/2008 18:02:11

Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: h:\program files\avira\antivir personaledition classic\sysscan.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: on

Scan boot sector.................: on

Boot sectors.....................: C:, H:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: on

Scan all files...................: Intelligent file selection

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

Start of the scan: Thursday, July 17, 2008 14:07

Starting search for hidden objects.

'35629' objects were checked, '0' hidden objects were found.

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'msmsgs.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'rundll32.exe' - '1' Module(s) have been scanned

Scan process 'soundman.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'WgaTray.exe' - '1' Module(s) have been scanned

Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

23 processes with 23 modules were scanned

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

Master boot sector HD1

[iNFO] No virus was found!

[WARNING] The device is not ready.

Master boot sector HD2

[iNFO] No virus was found!

[WARNING] The device is not ready.

Master boot sector HD3

[iNFO] No virus was found!

[WARNING] The device is not ready.

Master boot sector HD4

[iNFO] No virus was found!

[WARNING] The device is not ready.

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

Boot sector 'H:\'

[iNFO] No virus was found!

Starting to scan the registry.

H:\WINDOWS\system32\WinNt32.dll

[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen

[NOTE] The file was moved to '48ed8ff1.qua'!

The registry was scanned ( '27' files ).

Starting the file scan:

Begin scan in 'C:\' <RECOVERY>

Begin scan in 'H:\'

H:\pagefile.sys

[WARNING] The file could not be opened!

H:\Documents and Settings\Administrator\Desktop\SmitfraudFix.exe

[0] Archive type: RAR SFX (self extracting)

--> SmitfraudFix\404Fix.exe

[DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/IRC.Chazz.41 Backdoor server programs

[DETECTION] Contains detection pattern of the dropper DR/Tool.Reboot.F.108

--> SmitfraudFix\IEDFix.exe

[DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/IRC.Chazz.42 Backdoor server programs

[NOTE] The file was moved to '48e890dc.qua'!

H:\Documents and Settings\Administrator\Desktop\SmitfraudFix\404Fix.exe

[DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/IRC.Chazz.41 Backdoor server programs

[NOTE] The file was moved to '48b3909f.qua'!

H:\Documents and Settings\Administrator\Desktop\SmitfraudFix\IEDFix.exe

[DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/IRC.Chazz.42 Backdoor server programs

[NOTE] The file was moved to '48c390b5.qua'!

H:\Documents and Settings\Owner\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\QUAR1.40598

[DETECTION] Is the Trojan horse TR/Dldr.Agent.NRU.13

[NOTE] The file was moved to '48c09166.qua'!

H:\Documents and Settings\Owner\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\QUAR1.91901

[DETECTION] Is the Trojan horse TR/Emgr.AI

[NOTE] The file was moved to '48c09168.qua'!

H:\Documents and Settings\Owner\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

[DETECTION] Contains detection pattern of the Java script virus JS/Dldr.Agent.KO

[NOTE] The file was moved to '48b29149.qua'!

H:\Documents and Settings\Owner\Desktop\SmitfraudFix.exe

[0] Archive type: RAR SFX (self extracting)

--> SmitfraudFix\404Fix.exe

[DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/IRC.Chazz.41 Backdoor server programs

[DETECTION] Contains detection pattern of the dropper DR/Tool.Reboot.F.108

--> SmitfraudFix\IEDFix.exe

[DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/IRC.Chazz.42 Backdoor server programs

[NOTE] The file was moved to '48e8918a.qua'!

H:\Documents and Settings\Owner\Desktop\SmitfraudFix\404Fix.exe

[DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/IRC.Chazz.41 Backdoor server programs

[NOTE] The file was moved to '48b39153.qua'!

H:\Documents and Settings\Owner\Desktop\SmitfraudFix\IEDFix.exe

[DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/IRC.Chazz.42 Backdoor server programs

[NOTE] The file was moved to '48c39168.qua'!

H:\oldreg\systemprofile\cftmon.exe

[DETECTION] Is the Trojan horse TR/Dldr.Small.vzw

[NOTE] The file was moved to '48f391bb.qua'!

H:\oldreg\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\K9AZO1E3\1[1].exe

[DETECTION] Is the Trojan horse TR/Dldr.Small.vzw

[NOTE] The file was moved to '48b091b2.qua'!

H:\oldreg\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\ODERS5U7\update[1].upd

[DETECTION] Is the Trojan horse TR/Agent.49152.117

[NOTE] The file was moved to '48e391c8.qua'!

H:\WINDOWS\system32\404Fix.exe

[DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/IRC.Chazz.41 Backdoor server programs

[NOTE] The file was moved to '48b392a0.qua'!

H:\WINDOWS\system32\IEDFix.exe

[DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/IRC.Chazz.42 Backdoor server programs

[NOTE] The file was moved to '48c392c9.qua'!

H:\WINDOWS\system32\config\systemprofile\cftmon.exeold

[DETECTION] Is the Trojan horse TR/Dldr.Small.vzw

[NOTE] The file was moved to '48f39320.qua'!

H:\WINDOWS\system32\drivers\Owe75.sys

[WARNING] The file could not be opened!

End of the scan: Thursday, July 17, 2008 14:44

Used time: 36:18 min

The scan has been done completely.

3291 Scanning directories

138755 Files were scanned

20 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

16 files were moved to quarantine

0 files were renamed

2 Files cannot be scanned

138735 Files not concerned

1308 Archives were scanned

6 Warnings

16 Notes

35629 Objects were scanned with rootkit scan

0 Hidden objects were found

I tried File Assassin on the Owe75.sys file, but it could not delete it.

============

Malwarebytes' Anti-Malware 1.20

Database version: 962

Windows 5.1.2600 Service Pack 1

3:21:01 PM 7/17/2008

mbam-log-7-17-2008 (15-21-01).txt

Scan type: Quick Scan

Objects scanned: 42861

Time elapsed: 4 minute(s), 18 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WinNt32 (Rootkit.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

=========

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 3:22:09 PM, on 7/17/2008

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Boot mode: Normal

Running processes:

H:\WINDOWS\System32\smss.exe

H:\WINDOWS\system32\winlogon.exe

H:\WINDOWS\system32\services.exe

H:\WINDOWS\system32\lsass.exe

H:\WINDOWS\system32\svchost.exe

H:\WINDOWS\System32\svchost.exe

H:\WINDOWS\system32\spoolsv.exe

H:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

H:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

H:\WINDOWS\System32\nvsvc32.exe

H:\WINDOWS\System32\WgaTray.exe

H:\WINDOWS\Explorer.EXE

H:\WINDOWS\SOUNDMAN.EXE

H:\WINDOWS\System32\RUNDLL32.EXE

H:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

H:\Program Files\Messenger\msmsgs.exe

H:\Program Files\Internet Explorer\iexplore.exe

H:\WINDOWS\System32\wuauclt.exe