# Problem still exists, Virus or surge damage?

lotodig
12 years ago

Sorry to say that I still have the same problems with FF this morning as i did when i posted on the 4th.

hp pavillion vista 64

FF and other applications will not open from desktop or start menu.

If you can refer to my posting on the 4th you can see what I'v done to resolve my problem.

I did not do an uninstall or close down FF in the Task Manager but I did run a full Malwarebyte scan and a full ESET online scan and they were both clean.

I will post the Hijack this log and hope that it will be seen by zep or one of you guru's that can see if there is something there that can tell me what the problem is.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 8:21:00 AM, on 10/13/2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v8.00 (8.00.6001.18813)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\Orb Networks\Orb\bin\OrbTray.exe

C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files (x86)\Windows Sidebar\sidebar.exe

C:\Program Files (x86)\FastStone Capture\FSCapture.exe

C:\Program Files (x86)\Orb Networks\Orb\bin\Orb.exe

C:\hp\support\hpsysdrv.exe

C:\Windows\SysWOW64\rundll32.exe

C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe

C:\Program Files (x86)\AVG\AVG8\avgtray.exe

C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe

C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe

C:\Program Files (x86)\incredimail\bin\IMApp.exe

C:\Program Files (x86)\Internet Explorer\IELowutil.exe

C:\Program Files (x86)\Orb Networks\Orb\bin\xmltv.exe

C:\Program Files (x86)\Trend Micro\HijackThis\gabe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.google.com/nwshp?hl=en&tab=wn

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=84&bd=Pavilion&pf=cndt

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=84&bd=Pavilion&pf=cndt

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

O1 - Hosts: ::1 localhost

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - (3CA2F312-6F6E-4B53-A66E-4E65E497C8C0) - C:\Program Files (x86)\AVG\AVG8\avgssie.dll

O2 - BHO: SSVHelper Class - (761497BB-D6F0-462C-B6EB-D4DAF1D92D43) - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (file missing)

O2 - BHO: WOT Helper - (C920E44A-7F78-4E64-BDD7-A57026E7FEB7) - C:\Program Files (x86)\WOT\WOT.dll

O3 - Toolbar: WOT - (71576546-354D-41c9-AAE8-31F2EC22BF0D) - C:\Program Files (x86)\WOT\WOT.dll

O3 - Toolbar: FireShot - (6E6E744E-4D20-4ce3-9A7A-26DFFFE22F68) - C:\Users\gabe\AppData\Roaming\Mozilla\Firefox\Profiles\6bic73zo.default\extensions\(0b457cAA-602d-484a-8fe7-c1d894a011ba)\library\fsaddin-0.79.dll

O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe

O4 - HKLM\..\Run: [VolPanel] "C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r

O4 - HKLM\..\Run: [SPIRunE] Rundll32 SPIRunE.dll,RunDLLEntry

O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~2\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe

O4 - HKLM\..\Run: [SunJavaUpdateReg] "C:\Windows\system32\jureg.exe" -delete

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"

O4 - HKCU\..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\sidebar.exe

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [IncrediMail] C:\Program Files (x86)\incredimail\bin\IncMail.exe /c

O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O4 - Startup: FastStone Capture.lnk = C:\Program Files (x86)\FastStone Capture\FSCapture.exe

O8 - Extra context menu item: Edit in &Picnik - http://www.picnik.com/extensions/ie-import.html

O13 - Gopher Prefix:

O16 - DPF: (02BF25D5-8C17-4B23-BC80-D3488ABDDC6B) (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab

O16 - DPF: (1851174C-97BD-4217-A0CC-E908F60D5B7A) (Hewlett-Packard Online Support Services) - https://h20364.www2.hp.com/CSMWeb/Customer/cabs/HPISDataManager.CAB

O16 - DPF: (3860DD98-0549-4D50-AA72-5D17D200EE10) (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/en-us/wlscctrl2.cab

O16 - DPF: (56762DEC-6B0D-4AB4-A8AD-989993B5D08B) (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab

O16 - DPF: (E2883E8F-472F-4FB0-9522-AC9BF37916A7) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O18 - Protocol: linkscanner - (F274614C-63F8-47D5-A4D1-FBDDE494F8D1) - C:\Program Files (x86)\AVG\AVG8\avgpp.dll

O18 - Protocol: wot - (C2A44D6B-CB9F-4663-88A6-DF2F26E4D952) - C:\Program Files (x86)\WOT\WOT.dll

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~2\AVG\AVG8\avgemc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~2\AVG\AVG8\avgwdsvc.exe

O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe

O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files (x86)\HP Games\My HP Game Console\GameConsoleService.exe

O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe

O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

O24 - Desktop Component 0: (no name) - http://vortex.accuweather.com/topix/images/header.jpg

--

End of file - 10591 bytes

• ###### owbist
12 years ago

The log seems clean to me but far too many missing files are noted. If it were me I would be using SFC or system file checker looking for corrupt or missing files. Should you do this you will need to have your operating system CD available and afterwards you should look for Windows updates.

Having ran Malwarebytes and ESET you seem to be free of any malware.

• ###### ravencajun Zone 8b TX
12 years ago

did you by any chance, back when it was coming up with the notice that firefox was already running, create another profile? It will offer you an option when that box comes up saying that firefox is already running. If you did that and created another profile that could be the problem. That would entail going into your profile area and seeing if there is more than one profile and deleting the second one. This would also have firefox show up with out your normal settings and faves since it is a totally new profile with out any info in it.
Which version of firefox are you using?

in xp this is where the profiles are located not sure if it is different in 7
C:\Documents and Settings\\Application Data\Mozilla\Firefox\Profiles\\

this link to lifehacker is an article that explains using mulitple profiles but in it you learn how to create and also delete profiles, this may help you understand profiles and how to create and delete them.
Master Multiple Firefox Profiles for More Productive Browsing

I always only keep one profile.

• ###### ravencajun Zone 8b TX
12 years ago

thought the link to the firefox info page might be helpful also
Profiles

and this one
Firefox Profile Tutorial

If you find once you open your firefox profile manager that only your default profile is listed then it may be that the profile has been corrupted.
Re-installing firefox may help

• ###### lotodigOriginal Author
12 years ago

raven, to tell the truth I'm not sure if I did another profile or not. When I was trying to uninstall FF the first time I was working with the problem, I did not get it uninstalled because it was running. Since I did not get it uninstalled I did not try to reinstall FF and from there I did the task manager 'stop process' then did a system restore.

I just checked the Task mgr. processes window again and there is only one FF in the list that is showing running.

Can you tell me how to find the profile for FF in Vista? I think it's Vista 6.3, anyway I believe it's the latest version.

I'll have to get back to the 'too many missing files' situation after i get this other stuff fixed, at least I hope I can get it fixed.

• ###### owbist
12 years ago

But how do you know that it is not the missing files causing the problem?

You have three threads in the last 3 days trying to get the computer corrected so why not return the machine to factory defaults and start over? So simple and efficient as long as you take the precaution of saving all your personal data.

• ###### lotodigOriginal Author
12 years ago

owbist, of course you're right, I don't know if that is any or all of the problem or not.

But here is where I am now....I finally just went ahead and closed down FF in the Task mgr. processes and uninstalled it. Then i rebooted and re-installed FF. Once again, everything seems to be working correctly and all tabs are opening in a flash. Again I'll keep my fingers crossed.

What should I do about the missing files, if I follow the instructions on the link you provided will that be too technical for a non-geek like me. I have the cd's of my operating system, but that sounds pretty scary.

What causes the files to be missing like that, especially that many. Am I doing something that I shouldn't be doing?

• ###### owbist
12 years ago

Hmm, I had not read the whole MS page but basically you only need to follow the first 2 instructions. I have never had to use those other instructions myself. Remember that if you get flustered just click the Cancel button to get out of where you are.

There is nothing to be afraid of when using System File Checker. You It simply goes through your computer checking all the operating system files and replaces those which are corrupt or missing. The need for the CD is so it can get the needed files to install for you.

The slight downside is that it takes the computer back to when your particular CD was created which means you will be behind on security updates and possibly a service pack. No big deal there either, you simply go to the windows update site and the computer grabs whatever it needs.

You are doing nothing wrong. Who knows why those files went missing. Perhaps/probably it was due to the power outage.

You can of course extract and install each of those files if you wish to avoid using SFC. Follow the instructions here to do that for each file. You do not have to do them all at one time. Try one, see how it goes then do others as you feel up to the task.

• ###### lotodigOriginal Author
12 years ago

Owbist, thanks for that info, I will try the slow approach. If I don't get the missing files replaced will it make a difference? In other words, does it have to be done if everything is working ok, which it seems to be doing.

Raven, I did the studying on the FF profile, now i'm just a wee bit smarter. :>) At least if someone were to ask me, I could tell them what a FF profile was. Live and learn.

• ###### owbist
12 years ago

If I don't get the missing files replaced will it make a difference?>

Somewhere along the line you might find a task difficult or impossible due to a missing file. If things appear normal now then continue along but keep in mind the missing files if an issue arises a week or month from now.

Just try extracting a single file so you know how it all works. Then you can gradually work through the rest of them perhaps.

• ###### zep516
12 years ago

That's a 64Bit System. Those files are not missing! Hijackthis has a hard time listing services in 64Bit.

• ###### owbist
12 years ago

Thank you for that Zep, I was not aware of it having not owned a 64 bit machine.

So Lotodig should use Windows Explorer and drilled down to C:/Windows/System64/Drivers to verify that perhaps?

• ###### zep516
12 years ago

Yeah I had no clue the first time I saw all the file missings, so we just ignore it.

It almost sounds like Lotodig may have a file association error(Not sure here) not only does Firefox not open, but other applications as the user said don't open either so that's a clue that it's not entirely related to Firefox.

Need to know exactly what error word for word the user gets when opening troubled Applications.

There are file association fixes you can download, but need to know error user gets to see if it's it.

Sort of got lost here with posts..

12 years ago