Hard drive was wiped and Windows re-installed, but problems returned

I was experiencing multiple problems with my PC running Windows XP (my Administrator privileges were lost, I kept losing internet connection, CD/DVD burner wouldn't burn, kept getting various error messages) and I felt I didn't have time to come here to try to resolve them, so I brought it in to a local computer repair place.

They replaced the CD/DVD drive completely, then wiped the hard drive and replaced Windows XP, but several of the problems have returned anyway: I still keep losing the internet (it comes back when I reboot), CD/DVD burner software keeps giving me errors and won't burn, firewall keeps turning itself off, and I keep getting a message that new software was installed even when I haven't installed anything.

So I ran through all the "Read & Run Me First" scans here and I am attaching them here in hopes someone can help me get to the bottom of this so I won't have to wipe the hard drive again.
Any help would be appreciated. Thanks!

 

Forgot to attach logs Re: Hard drive was wiped and problems returned

Sorry, I forgot; I am attaching the logs below.

 

Thanks very much for your quick response. I ran the 2 programs you recommended (I'll attach the log below).

I was a little unclear on your instruction here:
"Delete the below:
C:\WINDOWS\Tasks\TidyNetwork Update.job
C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\TidyNetwork.com

Please download Junkware Removal Tool to your desktop."

Did that mean I should delete the TidyNetwork files manually (or maybe with uninstall) or was the Junkware Removal Tool supposed to do that?
I interpreted it to mean that JRT was going to do it, but I didn't see a mention of TidyNetwork in the JRT log.

I asked an IT person at work to also take a quick look at the logs and she noticed "wkssvc.dll" was showing up in the TDSKiller log as "Suspicious file (forged)". I Googled it and it said it's a legitimate Windows file that had something to do with networking (might that explain my internet and firewall problems?), but that hackers sometimes disguised malware as it.
Do you think it's dangerous? Or is it just one of those situations where TDSKiller picks up something that isn't actually a threat at all? The JRT log didn't seem to mention it that I could see. If it is dangerous, is there a utility I can run that would delete the fake one and replace it with the original Windows file?

Thanks again!

 

Here you go.

 

I need further instruction. I have Windows XP and when I go to Microsoft Security Essentials, I can turn my firewall off, but there is nowhere to turn off the virus protection.
I thought I saw somewhere that Windows XP doesn't ship with virus protection, so I clicked "OK" in ComboFix, but it said virus protection was on.
So I Googled how to turn off virus protection in MSE, but all the instructions I could find were for Windows 7, so they were useless for XP.
Can you tell me where and how to turn it off in XP?
Thanks!

 

You seem to be going by a different version of Microsoft Security Essentials than XP. The only way I've found to get to MSE in XP is through the control panel Security section, and there are no tabs there.
I've looked for MSE in the Start menu under all programs, but I can't find a different MSE in there.
I'll post a screenshot of the MSE I'm dealing with; maybe you can describe how I can get to the tabs if you see it.

 

Sorry, the names are so similar, I thought they were the same thing. No, I don't remember installing MSE; I thought maybe it was included with XP. I don't think I would have installed it unless Windows gave me a prompt saying I should. I'll have another look at it when I get home and double check the name ComboFix gives and then see if I can uninstall MSE if I do have it.
Thanks again.

 

I did have Microsoft Security Essentials; I did a search for it (it wasn't in Program Files where I would expect), I tried to uncheck what you said, but it wouldn't uncheck. So I uninstalled it and ran ComboFix.

By the time ComboFix told me it needed to download something (Windows Restore Shield, I think) my internet access had been knocked out again, so it couldn't do it. But it said it would continue to scan for viruses anyway, so I clicked Okay, but the message window didn't go away.

I thought maybe it was scanning anyway, so I left it that way overnight.
This morning, that message window was still there and there was no log. So I thought maybe it got hung up.

So I rebooted so I would have internet access again (for awhile, anyway), and ran that ComboFix script again and I left to do other things.

That was this morning and it's still running. I'm starting to think I shouldn't have had my external drives connected when I started the scan.

It also made me wonder; When my monitor goes to sleep, would that be enough to make ComboFix stall? Or would it still be scanning despite my monitor's narcolepsy?

I'm starting to think I should change the monitor's sleep setting, disconnect the external hard drives, reboot, and run it again.

 

Safe Mode finally did the trick. The ComboFix log is attached below.

I ran TDS Killer again, but it didn't find anything or create a log for me to upload. I was able to view a report, but couldn't find any way to save it.

 

I ran TDS Killer again and this time thought to copy and paste the report into Notepad and saved it.
I did a search in Notepad for wkssvc.dll, but it couldn't find it mentioned in the document. But I'm attaching the file below so you can double check it since you probably understand what it says much better than I do.
Thanks!

 

Yes! So far so good!! Thanks very much!!!

 

I may have celebrated prematurely.
A variation on my internet problem is back. I was online and as long as I only went to other pages within the site I was already on, I was fine, but when I tried to go to another site, it couldn't connect.
So I tried rebooting, but no matter whether I selected Turn Off or Restart, nothing would happen. I had to turn off my surge protector and turn it on again to reboot.
My Firewall turned itself off again, too.
And I found a pop up that said new software was installed even though I just rebooted and haven't done anything else.

The IT person at work says some viruses survive wiping the hard drive and says I should let her wipe it again. I'd rather not have to do that if it can be helped because I've reinstalled so much, and I keep thinking if it could survive one wipe, what's to stop it from surviving two?