HJT Log- Computer Worth Saving?

[Buzz1927]

Download and install xpfix.
http://www.visualtour.com/downloads/xp_fix.exe

Download and install Killbox.
http://www.downloads.subratam.org/KillBox.zip

Then boot into safemode.

Run Hijackthis and select "Do a system scan only", place a check by the following entries.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [FE8857EE] C:\WINDOWS\system32\ctl3wo.exe
O4 - HKLM\..\Run: [FBE85AE6] C:\WINDOWS\system32\egigen.exe
O4 - HKLM\..\Run: [F6CC080B] C:\WINDOWS\system32\1_0cmpsc.exe
O4 - HKLM\..\Run: [EE711B46] C:\WINDOWS\system32\t32r32.exe
O4 - HKLM\..\Run: [E08CFE83] C:\WINDOWS\system32\pmserakl.exe
O4 - HKLM\..\Run: [D47A3F53] C:\WINDOWS\system32\gehdi.exe
O4 - HKLM\..\Run: [CB58906E] C:\WINDOWS\system32\srvetl.exe
O4 - HKLM\..\Run: [B7DA56D6] C:\WINDOWS\system32\trucerse.exe
O4 - HKLM\..\Run: [B7831183] C:\WINDOWS\system32\le32ersi.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [AB185EEB] C:\WINDOWS\system32\apiegs.exe
O4 - HKLM\..\Run: [A85A4EF3] C:\WINDOWS\system32\intmsrvave.exe
O4 - HKLM\..\Run: [9EB9B153] C:\WINDOWS\system32\conpm.exe
O4 - HKLM\..\Run: [8885B063] C:\WINDOWS\system32\ptrnri32.exe
O4 - HKLM\..\Run: [84C157CE] C:\WINDOWS\system32\pt3sn1tr.exe
O4 - HKLM\..\Run: [81990AEB] C:\WINDOWS\system32\t32sgupap.exe
O4 - HKLM\..\Run: [1C003A6E] C:\WINDOWS\system32\srvsretms.exe
O4 - HKCU\..\Run: [MSTCPDLL] ssweeper.exe
O4 - HKCU\..\Run: [FFC955D3] C:\WINDOWS\system32\ptdlntpc.exe
O4 - HKCU\..\Run: [FC885B86] C:\WINDOWS\system32\dcr3msx.exe
O4 - HKCU\..\Run: [FAD84EEB] C:\WINDOWS\system32\tdllegnp.exe
O4 - HKCU\..\Run: [ED12D8D3] C:\WINDOWS\system32\srapi.exe
O4 - HKCU\..\Run: [E724F20E] C:\WINDOWS\system32\insrrtut.exe
O4 - HKCU\..\Run: [E2D88E63] C:\WINDOWS\system32\vision.exe
O4 - HKCU\..\Run: [E00CC186] C:\WINDOWS\system32\i32z3ndde.exe
O4 - HKCU\..\Run: [DA6F0D5B] C:\WINDOWS\system32\k32rt4api.exe
O4 - HKCU\..\Run: [D3FA3ECE] C:\WINDOWS\system32\srvdiven.exe
O4 - HKCU\..\Run: [CD753856] C:\WINDOWS\system32\tlctivi32.exe
O4 - HKCU\..\Run: [CB6C1476] C:\WINDOWS\system32\gehhsvapph.exe
O4 - HKCU\..\Run: [B704D9DB] C:\WINDOWS\system32\oleauhel.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [A4285676] C:\WINDOWS\system32\phlsvc.exe
O4 - HKCU\..\Run: [8B10B37B] C:\WINDOWS\system32\pmsgsrv.exe
O4 - HKCU\..\Run: [898D564E] C:\WINDOWS\system32\inenhens.exe
O4 - HKCU\..\Run: [886C4DE6] C:\WINDOWS\system32\v32int.exe
O4 - HKCU\..\Run: [5B2C40C6] C:\WINDOWS\system32\vcrprnr.exe
O4 - HKCU\..\Run: [4BE86CEE] C:\WINDOWS\system32\ootvses.exe
O4 - HKCU\..\Run: [4BBBD356] C:\WINDOWS\system32\pmsapi3.exe

Close all open windows and browsers, and hit "Fix Checked".

Highlight the following text and press Ctrl + C to copy it to the clipboard.


C:\WINDOWS\isrvs\ffisearch.exe
C:\WINDOWS\system32\ctl3wo.exe
C:\WINDOWS\system32\egigen.exe
C:\WINDOWS\system32\1_0cmpsc.exe
C:\WINDOWS\system32\t32r32.exe
C:\WINDOWS\system32\pmserakl.exe
C:\WINDOWS\system32\gehdi.exe
C:\WINDOWS\system32\srvetl.exe
C:\WINDOWS\system32\trucerse.exe
C:\WINDOWS\system32\le32ersi.exe
C:\WINDOWS\system32\apiegs.exe
C:\WINDOWS\system32\intmsrvave.exe
C:\WINDOWS\system32\conpm.exe
C:\WINDOWS\system32\ptrnri32.exe
C:\WINDOWS\system32\pt3sn1tr.exe
C:\WINDOWS\system32\t32sgupap.exe
C:\WINDOWS\system32\srvsretms.exe
C:\WINDOWS\system32\ptdlntpc.exe
C:\WINDOWS\system32\dcr3msx.exe
C:\WINDOWS\system32\tdllegnp.exe
C:\WINDOWS\system32\srapi.exe
C:\WINDOWS\system32\insrrtut.exe
C:\WINDOWS\system32\vision.exe
C:\WINDOWS\system32\i32z3ndde.exe
C:\WINDOWS\system32\k32rt4api.exe
C:\WINDOWS\system32\srvdiven.exe
C:\WINDOWS\system32\tlctivi32.exe
C:\WINDOWS\system32\gehhsvapph.exe
C:\WINDOWS\system32\oleauhel.exe
C:\WINDOWS\system32\phlsvc.exe
C:\WINDOWS\system32\pmsgsrv.exe
C:\WINDOWS\system32\inenhens.exe
C:\WINDOWS\system32\v32int.exe
C:\WINDOWS\system32\vcrprnr.exe
C:\WINDOWS\system32\ootvses.exe
C:\WINDOWS\system32\pmsapi3.exe

Run the Killbox and select "delete on reboot".
Then under "file" select "paste from clipboard".
Check the files are there using the drop-down box.
Hit the red button with the white X.
Don't reboot yet.

Search for and delete this file.

ssweeper.exe

Then reboot and post a new Hijackthis log.

 

[Verve]

I ran HijackThis and deleted the objects that you said.

The killbox will not let me paste the files. I see blue text that says it is loading the clipboard data, and the it disappears and there are no files on the dropdown menu. I have tried several different ways of getting it on, but it will not appear.

I could not locate ssweeper.exe

New log coming....

 

[Buzz1927]

That means the first file is already gone. Try from the second, then the third, until the list appears.

 

[Verve]

I tried it all the way down the list and it didn't work.

 

[Buzz1927]

If you fixed all the hijacktis entries, reboot and post a new log.