Or better still....first do what Yrag requests ....

Stop trying to install anything. The malware will not allow it.

Open msconfig/ Startup and post snapshots (scroll). Open Taskmanager/ Processes, click Show processess for all users, expand and post a snap of that.

i recommend you get a program called autorunz, it's like msconfig but it goes even further into the system and gives more detailed info on whats loading. you may be able to then locate the trojans location. if you can locate it try and delete it, it will probably say unable to delete file access denied or it's in use by another program etc etc, if so get a little program called unlocker and once thats installed right click on the trojan file and then choose the unlocker option in the menu, this should open the unlocker main window and enable you to unlock it from any files that may be in use. then try and delete it again, hopefully this might work. other wise see below

the reason you are having so much trouble trying to install programs to fix the problem is that the trojan is stopping them being able to install. bite the bullet, take the computer to a computer shop, get them to back up any of your important (UNINFECTED) files and then have them completely wipe the hard drive, and reinstall windows. If you keep going the way you are then it's just going to get worse. Once you have a freshly installed windows back install some good antivirus software, get yourself malwarebytes antimalware and maybe some of the other programs suggested here.good luck

I have had success with hijackthis. There is a function in hijacthis for deleting a file on reboot and its a great help when I manually kill the buggers. Have done this 4-5 times on different comps.

YRAG wrote: November 21, 2010 11:57:13 PM from WinCustomize Forums

Stop trying to install anything. The malware will not allow it.
Open msconfig/ Startup and post snapshots (scroll). paint doesn't work (deleted it last night), manual copy via notepad:


NvCpl        RUNDLL32.EXE               C:\WINDOWS\system32\NvCpl.dll,NvStartup HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Run
jusched   "C:\program files\Java\jre6\bin\jusched.exe"    HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Run
RTHDCPL RTHDCPL.EXE HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Run
PDVDServ "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Run
qttask "C:\Program Files\Quicktime|qttask.exe" -atboottime HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Run
nwiz nwiz.exe /install HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Run
NvmcTray RUNDLL32.EXE C:\C:WINDOWS\system32\NvmcTray.dll,NvtaskbarInit HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Run
iTuneshelper "C:\Program Files\iTunes\iTunesHelper.exe HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Run
avgtray C:\PROGRA~1\AVG\AVG8\avgtray.exe HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Run
ALCMTR ALCMTR.EXE HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Run
reader_sl "C:\Program Files\Adobe\reader 8.0\Reader\reader_sl.exe" HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Run
ClearwireCM "C:\Program Files\Clearwir\Connection Manager\ClearwireCM.exe" -a HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Run
avgnt "C:\program Files\Avira\AntiVir Desktop\avgnt.exe"/min HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Run
ctfmon C:\WINDOWS\system32\ctfmon.exe HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Run
SUPERAntiSpyware C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Run
DLM C:\Program Files\Download manager\DLM.exe/windowsstart /startifwork HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Run
Windows Search C:\PROGRA~1\wi459E~1\WINDOW~1.EXE /startup Common Startup
Impulse Now C:\PROGRA~1\Stardock\Impulse\Now\IMPULS~1.EXE Startup







Open Taskmanager/ Processes, click Show processess for all users,


expand and post a snap of that. next post....

November 21, 2010 11:57:13 PM from WinCustomize Forums
Stop trying to install anything. The malware will not allow it

Open Taskmanager/ Processes, click Show processess for all users,

expand and post a snap of that. paint deleted last night. Typed copy of taskmanager follows...

notepad.exe user CPU=00 (all are 00 except system idle process which is "99" MemUsage=3.704 K
taskmgr.exe user 5,044 K
impulseNow.exe user 19,288 K
WindowsSearch.exe 10.420K
iPodService.exe SYSTEM 3,932 K
SUPERANTISPYWARE.EXE 640K
avgnt.exe user 1,632K
iTunesHelper.exe user 4276K
rundll32.exe user 3,624K
qttask.exe user 2596K
PDVDServ.exe user 3,336K
RTHDCPL.exe user 22,472K
Jusched.exe user 2,896K
WINWORD.EXE user 2,896K
alg.exe LOCAL SERVICE 3,668K
dllhost.exe SYSTEM 8,516K
LSSrvc.exe SYSTEM 2,580K
ctfmon.exe SYSTEM 3,944K
avshadow.exe SYSTEM 2,580K
jqs.exe SYSTEM 4,436K
avgwdsvc.exe SYSTEM 1,844K
avguard.exe SYSTEM 1,900K
svchost.exe LOCAL SERVICE 3,780K
sched.exe SYSTEM 736K
spoolsv.exe SYSTEM 5,100K
Opera.exe user 15,964K
avgrsx.exe SYSTEM 112,621K
svchost.exe LOCAL SERVICE 3,928k ((eLANA'S NOTE: THIS IS EXACT SAME NAME AS EXE PROGRAM FIVE LINES UP, BUT WITH DIFFERENT memory SIZE. several 'svchost'exe programs are repeated...))
svchost.exe NETWORK SERVICE 5,840K
Explorer.exe user 52,308K
svchost.exe SYSTEM 27,484K
svchost.exe NETWORK SERVICE 4,748K
svchost.exe SYSTEM 5,428K
msdtc.exe NETWORK SERVICE 5,100K
lsass.exe SYSTEM 1,272k
services.exe SYSTEM 1,292 K
winlogon.exe SYSTEM 1,020K
csrss.exe SYSTEM 4,640K
RcAppSvc.exe SYSTEM 2,820K
Mylocal.exe user 25,160K
smss.exe SYSTEM 416K
searchindexer.exe SYSTEM 416K
DeviceLaunchSvc.exe SYSTEM 5,880K
ClearwireCM.exe user 28,020K
nvsvc32.exc SYSTEM 4,160K
MDM.EXE SYSTEM 3,336k
System SYSTEM 344k
System Idle Process SYSTEM cpu=99 28K

i have snaps made with paint, but still trying to figure out how to get them uploaded here.  the 'inseret image wants a url...and i don't know url of paint snaps on my desktop - and no brouse fuinction is there to 'find' it.  maybe i will try uploading to email yahoo account

also tried ubuntou with a 2Gb stick drive, but kept getting error messages.

i really am lousy at all this web/Internet stuff.  Should have not bothered with impulse, EWoM, etc., and stayed with stand alone PC games that come on CD and don't need live Internet access.. lol.  Never had problems with my PC or with MS office, then.



I like MS office, worked fine before this bug hit my PC.  i have disc for windows, and certificate.  i never burned the service packs....

I thought MS stopped supporting XP.  They still have serv pak 1 and 2 available on line?

Crystal shake, I have been hoping yrag will post with his response to my msconfig, and task manager info.  Hoping he sees something we all are missing.

OK, say I do the reinstall windows xp route.  what are the steps/order of things i must do?

When do i reformat hard drive?  do in put win disk in cd drive, restart PC, or reformat first?  etc.

I suspect, after getting new windows install done, i have to:

1) reinstall Internet connectivity stuff,

2) THEN get win serv packs 1 and 2 (or t3?), down load, install.

3) then get malwarbytes, alvira, shreeder downloaded and installed and running.

4) then go to stardock, and get impulse again, etc, yes?

5) thenb take dosbox and MoM off my stickdrive and hop it copies back to PC.

6) reinstall MS office (legal copy), and hope the MS wizards and MS police haven't done overkill on their anti-pirate efforts.

would you modify sequence of doing these?

Elana,

As I have tried to indicate the best and most thorough source for pc assistance I've found is bleeping computers.  If any people can get your pc back to being fully functional without having to re-install your system it is they who can do it.  It's up to you, please read through the forums at the link and you will see what i mean.  Bleeping Computer Forums.

Just came from bleep computer.  My request for help is missing, or i just cant find it.  my profile says i only have one post, the intro post. yesterday, at that site, i also started a topic asking for help... and posted the data as i have here.  and now i cannot find that post on bleep comp site.  how i love complicated, convoluted sites...  search of my name there showed only one post, the intro post.  LOL.

many people who posted earlier today, after my post, have already been answered.  LOL.

Well Bleeping Computer has many forums but only one for posting requests for assistance with virus problems that would be here.  I looked through there and did not find anything posted by anyone named Elana so.. I don't know what happened.  In any case good luck solving this.

If you do decide to post there, follow their instructions for posting, etc and bookmark your post.