Svchost.exe

[Kenney]

Hi!

I hope all is well. I'm having some issues with my computer and was wondering if someone can help.

Currently my computer is running 100% svchost.exe and I can do nothing. It's also using up a great deal of my memory. I really don't know what to do. Does anyone have any suggestions.

Thanks in advance.

[Techi]

it sounds like your computer is infected. many a virus loves to piggyback SVCHOST.EXE because of its nature. if u terminate the offending process, it'll just re-spawn another one. also u may or may not be able to restore to a previous restore point (as some of them will just re-install itself).

r u able to get into offline SafeMode? u might want to back up personal files first. (if u r unable to do so then u can use another computer to access this hard drive to back up, via a cable e.g. do not back up the system as well as u'd be backing up the virus also).

if u know what virus it is, just search for its removal instructions. Though, i personally prefer to start over from scratch (to re-install the Operating System).

[jholland1964]

Don't follow the advice of the previous poster.
Begin by following the steps given in our Read Me First sticky and post back with all the requested logs and we will see what else needs to be done.

http://www.daniweb.com/forums/thread134865.html

[Techi]

@jholland1964 : hmm ... I'm baffled by your hostiltiy. I do not get paid helping others. I have fixed countless computers (I'm also a qualified programmer) so I do not think your attitude was appropriate.

[jholland1964]

@jholland1964 : hmm ... I'm baffled by your hostiltiy. I do not get paid helping others. I have fixed countless computers (I'm also a qualified programmer) so I do not think your attitude was appropriate.

Sorry you feel I was hostile or you don't like my attitude, I was just obeying the rules followed here by all helpers and that was making it plain to the poster that your suggestions should not be followed but to begin with the steps in the Read Me sticky. Same thing we tell anyone posting here.

I don't get paid here either, nobody does. All helpers are volunteers and do not get paid. If you are willing to volunteer, without pay like the rest of us to assist posters that is great but it is requested that all helpers follow the steps we all use here and that is to begin with the steps found on our Read Me sticky.

http://www.daniweb.com/forums/thread134865.html

We never, ever advise that people just search for removal instructions as you have advised,it is likely they are here because they DID search and were led to this site. We also never advise the use system restore to fix or remove an infection. System Restore will not fix or remove something, it will only make it harder to remove. You also advised a reinstall of the operating system, something we also don't recommend at the beginning but only after it is clear that clean up steps will not work. We don't know that yet. We don't even know if the computer has infection on it because we haven't seen any logs. Any number of things can cause "100% svchost.exe" and not only infections.

[Kenney]

Hello!

As soon as I'm able to connected (with the computer having the problems) to the Internet I'll commence with the read me sticky steps.

Hopefully I'll have the logs posted shortly.

Thanks in advance for your assistance.

[jholland1964]

Great Kenney, Try connecting using Safe Mode with Networking. This should bypass anything that may be blocking access and hopefully you can get these tools and run them.
If you have to run them in Safe mode to start with that is fine, we can at least see what may be causing the problem and be able to offer a remedy that will then allow you to go online in normal mode.
I'll be waiting for your logs.

You also can download the tools, using another computer, to a flash drive or burn them to a CDR, take them to the infected computer and run them that way too if you can't even use safe mode with networking
Judy

[Techi]

@jholland1964 : Speaking from experience, I find that the most effective way to dis-infect a computer is to do it manually. You are assuming that others would just search any instructions without thinking for themselves (in which case how do they know if following your instructions would not lead them into a worse situation?) You obviously think that your way of dis-infecting a computer by downloading tools is the only way, that is fine. I do not have a problem with that. I respect other people who hold different views. To twist and undermine someone else's advice is however totally uncalled for.

Perhaps you would like to remove my posts, you can carry on as you wish.

[jholland1964]

You have to realize that most people posting here do not have the experience to manually do removals, if they did they would not be here asking for assistance. Using the commonly accepted removal tools is the way we do things here. How do they know that what is recommended here will not make things worse, they don't but they trust that this website, which has a top notch reputation, will do all that is possible to help them clean their machines.
I don't believe I "twisted" your advice,

As a Moderator here I stated what we at daniweb request anyone posting for help follow and ask that our helpers follow those steps also, that isn't twisting or undermining anything, it is a statement of facts. That is all I can say.

[Kenney]

Hello!

It's looking more and more like I'm going to be forced to get the tools via another computer because each time I try to connect to the Internet in safemode with networking, firefox and/or ie starts up then crashes. I'm scanning the computer with malwarebytes in safemode...we'll see if it finds anything that's preventing me from getting online. I'll also scan via scan via spyware doctor.

The only problem right now is, I won't have access to another computer until Wen. I'm currently using my iPhone to post this.

We'll see what happens. If you have any further suggestions, please let me know.

Thanks again!

[jholland1964]

Leave the spyware doctor alone, it's not really doing to do anything. If you can post the log with mba-m do it ok? Know that would be hard from your phone. If you can't post the log just try to post what is found, names especially and location. Then maybe we will have an idea of what we are looking for.

[Kenney]

Ok...I just completed a full scan via mba-m and no malicious items were found. I was sure it would find something but it didn't.
I won't scan via spyware doctor.

Now, i just thought of something, earlier today, before my computer started acting up I got a message from comodo Internet security saying that it had detected a virus by the name of, Trojan.Win32.Trojan.XPack.~gen1@107336679. I don't know if this helps, but I currently have it quarantined in comodo.

Any thoughts?
Thanks!

[Kenney]

FYI...the location of the virus according to comodo is: C:\Windows\ajicoysikunose.dll.
Again, not sure if that'll help but just wanted to post just in case.

[jholland1964]

You can empty that Comodo quarantine, not that it matters. There is most definitely more infection on the computer, that actually is an older infection and most programs protect against it today. MBA-M certainly must be damaged if it found nothing. What version of that program do you have on there?

[Kenney]

I have Malwarebytes Anti-Malware 1.41.

[jholland1964]

No wonder it didn't find anything, that version was released before this infection was released. Current version is 1.50.1

[Kenney]

Ok, mysteriously, I clicked on malwarebytes.org and it came up and it didn't crash. I was able to update mba-m to the latest version. I'm now running a full scan again. I'll let you know the results shortly.

Thanks!

[jholland1964]

It went through the FULL update to version 1.50 and an up to date database? For heavens sake! Progress maybe!

[Kenney]

Tell me about it! Well it said it updated and I'm guessing it's to1.50 because it's already found 14 infections...and that's 14 more than before. Hopefully we'll get something going here once it finishes scanning.

[Kenney]

Ok! I'm able to get on the internet in safe mode with networking now. Thank goodness! I tried to get on the internet in the regular mode but nothing happens, i.e. when I click on firefox nothing boots up.

Nevertheless, my log is below.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5833

Windows 5.1.2600 Service Pack 2 (Safe Mode)
Internet Explorer 7.0.5730.13

2/21/2011 8:09:54 PM
mbam-log-2011-02-21 (20-09-54).txt

Scan type: Full scan (A:\|C:\|D:\|)
Objects scanned: 201367
Time elapsed: 40 minute(s), 22 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 2
Files Infected: 18

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUP.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\g043oqxanu (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\ineufbr1v (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\mBt (Backdoor.Bot) -> Value: mBt -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
c:\WINDOWS\system32\config\systemprofile\start menu\Programs\windows antivirus pro (Rogue.WindowsAntiVirus) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\config\systemprofile\start menu\Programs\windows police pro (Rogue.WindowsPolicePro) -> Quarantined and deleted successfully.

Files Infected:
c:\documents and settings\administrator\local settings\temp\0.6742790571735747.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\administrator\local settings\temp\1.4792217601225732e7.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\administrator\local settings\temp\3.0812304491826147e8.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
c:\documents and settings\administrator\local settings\temp\3.603850219979995e7.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\administrator\local settings\temp\3248cd72.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
c:\documents and settings\administrator\local settings\temp\5.1805862144687533e8.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\administrator\local settings\temp\80536002.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\administrator\local settings\temp\c6b83cc4.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\documents and settings\administrator\local settings\temp\dxfh.exe (Adware.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\administrator\local settings\temp\uegsg.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.
c:\documents and settings\administrator\local settings\temp\nse2B.tmp\drdd.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\program files\COMODO\comodo internet security\quarantine\ajicoyusikunose.dll (Trojan.Hiloti) -> Quarantined and deleted successfully.
c:\program files\COMODO\comodo internet security\quarantine\setup.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\temp\0.8277263189650321.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\WINDOWS\temp\11D.tmp (PUP.BHO) -> Not selected for removal.
c:\WINDOWS\temp\jar_cache3088116719332892137.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\WINDOWS\temp\wsjgmvmoa\lsjprxisikk.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\WINDOWS\temp\0.9161741219511103.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

[jholland1964]

Whoa! Quite a log!!! Try this to get on the internet in normal mode. Go to the Control Panel and Go to Internet Options, Go to the Connections Tab and Click LAN Settings. Make sure there is NO check mark in Use Proxy Server.
Then try to access Firefox through the Programs rather than using the shortcut Icon. See if you can get on the internet in Normal mode that way without things crashing. If you can follow the steps in the Read Me sticky, and post back with the logs, especially that DDS scanner.

[Kenney]

Ok, I was able to get online in normal mode once I uninstalled spyware doctor.

[Kenney]

DDS Logs are pretty long. Are you ok with me just copying and pasting them?

[jholland1964]

We prefer that both be copy/pasted. No post length limit.
Spyware doctor..hmmmm

[Kenney]

Am I doing something wrong because every time I try to post the logs I get an timed out error from firefox. I'll keep trying.

[Kenney]

Ok, I continue to get a connection timed out message each time I try to copy and paste. Not sure why this is. Are you totally against attaching them because I can try that?

[Kenney]

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-12-12.02)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 3/18/2008 9:39:06 AM
System Uptime: 2/21/2011 9:02:37 PM (1 hours ago)

Motherboard: Dell Computer Corp. | |
Processor: Intel(R) Pentium(R) 4 CPU 2.40GHz | Microprocessor | 2391/533mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 37 GiB total, 1.175 GiB free.
D: is CDROM (CDFS)

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP315: 2/21/2011 10:18:03 AM - System Checkpoint

==== Installed Programs ======================

Acrobat.com
Adobe AIR
Adobe Connect Add-in
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.3
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Bonjour
CA eTrust Antivirus
Comodo HopSurf
COMODO Internet Security
Compatibility Pack for the 2007 Office system
Critical Update for Windows Media Player 11 (KB959772)
Dell ResourceCD
Easy CD Creator 5 Basic
Google Toolbar for Internet Explorer
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.0 (KB932471)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB896344)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
Intel(R) Extreme Graphics Driver
Intel(R) PRO Ethernet Adapter and Software
iTunes
Java(TM) 6 Update 15
Java(TM) 6 Update 5
K-Lite Codec Pack 3.2.5 Standard
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Mozilla Firefox (3.5.4)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 and SOAP Toolkit 3.0
MSXML 6 Service Pack 2 (KB973686)
QuickTime
Registry Mechanic 8.0
Right Picture Download Manager 2.3.1
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Internet Explorer 7 (KB982381)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937894)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944533)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165-v2)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB981349)
SoundMAX
Unlocker 1.8.7
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows Internet Explorer 7 (KB980182)
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920342)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB925720)
Update for Windows XP (KB925876)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB942840)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VLC media player 0.9.2
WebFldrs XP
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 11
Windows Media Player Firefox Plugin
Windows Presentation Foundation
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
WinRAR archiver
XML Paper Specification Shared Components Pack 1.0
XP Codec Pack

==== Event Viewer Messages From Past Week ========

2/21/2011 9:42:18 AM, error: Service Control Manager [7000] - The Application Layer Gateway Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
2/21/2011 9:42:17 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Application Layer Gateway Service service to connect.
2/21/2011 8:57:28 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
2/21/2011 8:37:37 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
2/21/2011 8:16:03 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: IntelIde Lbd
2/21/2011 5:25:58 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: cmdGuard Fips intelppm Lbd OMCI SASKUTIL
2/21/2011 2:23:53 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the PC Tools Security Service service to connect.
2/21/2011 2:23:53 PM, error: Service Control Manager [7000] - The PC Tools Security Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
2/21/2011 2:16:42 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
2/21/2011 1:11:45 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Google Software Updater service to connect.
2/21/2011 1:11:45 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service gusvc with arguments "" in order to run the server: {89DAE4CD-9F17-4980-902A-99BA84A8F5C8}
2/20/2011 5:26:55 AM, error: SideBySide [59] - Generate Activation Context failed for C:\WINDOWS\system32\wuauclt.exe. Reference error message: Error Message is unavailable .
2/20/2011 5:13:51 AM, error: SideBySide [59] - Generate Activation Context failed for C:\WINDOWS\system32\WININET.dll. Reference error message: Error Message is unavailable .
2/20/2011 3:23:40 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Windows Image Acquisition (WIA) service to connect.
2/20/2011 3:23:40 PM, error: Service Control Manager [7000] - The Windows Image Acquisition (WIA) service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
2/19/2011 9:13:58 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the cmdAgent service.
2/17/2011 9:38:48 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Java Quick Starter service to connect.
2/17/2011 9:38:48 AM, error: Service Control Manager [7000] - The Java Quick Starter service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
2/17/2011 11:57:29 AM, error: Service Control Manager [7022] - The Telephony service hung on starting.
2/17/2011 11:57:29 AM, error: Service Control Manager [7001] - The Remote Access Connection Manager service depends on the Telephony service which failed to start because of the following error: After starting, the service hung in a start-pending state.
2/17/2011 11:49:42 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the PC Tools Auxiliary Service service to connect.
2/17/2011 11:49:42 AM, error: Service Control Manager [7000] - The PC Tools Auxiliary Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
2/17/2011 11:32:31 AM, error: Service Control Manager [7034] - The Wireless Zero Configuration service terminated unexpectedly. It has done this 1 time(s).
2/17/2011 11:32:31 AM, error: Service Control Manager [7034] - The Windows Time service terminated unexpectedly. It has done this 1 time(s).
2/17/2011 11:32:31 AM, error: Service Control Manager [7034] - The Windows Firewall/Internet Connection Sharing (ICS) service terminated unexpectedly. It has done this 1 time(s).
2/17/2011 11:32:31 AM, error: Service Control Manager [7034] - The Telephony service terminated unexpectedly. It has done this 1 time(s).
2/17/2011 11:32:31 AM, error: Service Control Manager [7034] - The System Restore Service service terminated unexpectedly. It has done this 1 time(s).
2/17/2011 11:32:31 AM, error: Service Control Manager [7034] - The System Event Notification service terminated unexpectedly. It has done this 1 time(s).
2/17/2011 11:32:31 AM, error: Service Control Manager [7034] - The Shell Hardware Detection service terminated unexpectedly. It has done this 1 time(s).
2/17/2011 11:32:31 AM, error: Service Control Manager [7034] - The Security Center service terminated unexpectedly. It has done this 1 time(s).
2/17/2011 11:32:31 AM, error: Service Control Manager [7034] - The Secondary Logon service terminated unexpectedly. It has done this 1 time(s).
2/17/2011 11:32:31 AM, error: Service Control Manager [7034] - The Distributed Link Tracking Client service terminated unexpectedly. It has done this 1 time(s).
2/17/2011 11:32:31 AM, error: Service Control Manager [7034] - The Automatic Updates service terminated unexpectedly. It has done this 1 time(s).
2/17/2011 11:32:31 AM, error: Service Control Manager [7031] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
2/17/2011 11:32:31 AM, error: Service Control Manager [7031] - The Themes service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
2/17/2011 11:32:31 AM, error: Service Control Manager [7031] - The Task Scheduler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 6000 milliseconds: Restart the service.
2/16/2011 8:15:06 PM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly. It has done this 1 time(s).
2/16/2011 8:09:14 PM, error: Service Control Manager [7022] - The PC Tools Security Service service hung on starting.
2/14/2011 9:06:06 PM, error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error: An instance of the service is already running.
2/14/2011 9:06:04 PM, error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Background Intelligent Transfer Service service, but this action failed with the following error: An instance of the service is already running.
2/14/2011 9:03:29 AM, error: SideBySide [59] - Generate Activation Context failed for C:\WINDOWS\WindowsShell.Manifest. Reference error message: The operation completed successfully. .
2/14/2011 9:03:27 AM, error: SideBySide [59] - Generate Activation Context failed for C:\WINDOWS\system32\WININET.dll. Reference error message: The operation completed successfully. .
2/14/2011 8:39:53 PM, error: Service Control Manager [7034] - The COMODO Internet Security Helper Service service terminated unexpectedly. It has done this 1 time(s).
2/14/2011 8:37:29 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the iPod Service service to connect.
2/14/2011 8:37:29 PM, error: Service Control Manager [7000] - The iPod Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
2/14/2011 8:37:23 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service iPod Service with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
2/14/2011 8:37:12 PM, error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: This operation returned because the timeout period expired.
2/14/2011 8:36:25 PM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
2/14/2011 8:36:24 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.
2/14/2011 8:35:43 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Lbd
2/14/2011 8:14:36 AM, error: Service Control Manager [7034] - The PC Tools Auxiliary Service service terminated unexpectedly. It has done this 1 time(s).
2/14/2011 8:04:31 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
2/14/2011 8:04:01 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service winmgmt with arguments "" in order to run the server: {8BC3F05E-D86B-11D0-A075-00C04FB68820}
2/14/2011 8:02:59 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

==== End Of File ===========================

[Kenney]

Got the attach.txt log to paste but I'm still getting that timeout message when I try to paste the DDS.txt log.

[jholland1964]

Can you split it into sections? I DO see part of your problem..you are running TWO security programs. Comodo Internet Security which contains both an anti-virus and firewall and CA eTrust Antivirus.
Uninstall both of them please. I'll give you a new one shortly, we have to get this thing running well enough to work.
Spyware Doctor also now contains an anti-virus program. So you had three running, no wonder you got infected and then couldn't even get online! The only thing they did was fight each other and let infection onto the computer while they battled "which one was in charge".

[Kenney]

Ok, below is the first portion of the DDS.text log

DDS (Ver_10-12-12.02) - NTFSx86
Run by Administrator at 22:06:27.92 on Mon 02/21/2011
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_15
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.510.156 [GMT -5:00]

AV: COMODO Antivirus *Enabled/Updated* {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
FW: COMODO Firewall *Enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
C:\Program Files\CA\eTrust Antivirus\InoRT.exe
C:\Program Files\CA\eTrust Antivirus\InoTask.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Registry Mechanic\RegMech.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\My Documents\Downloads\ATF-Cleaner(2).exe
C:\Documents and Settings\Administrator\My Documents\Downloads\r0vepht5.exe
C:\Documents and Settings\Administrator\My Documents\Downloads\dds(2).scr