Virus challenge for a professional

I need professional help with a virus.

I am running WinXP Pro, Version 2002, SP3 on a HPCompaq dc7700, E4400@2.0Ghz, 3.50GB Ram, Avira version 10.0.0.592 with current updates, and Stopzilla.

The symptom is a system tray blackout which causes a computer freeze and the only way I can restart is pressing the "on" button for 6 seconds.

This problem began after midnight 11/02/2010 (actually 11/03/2010). I was working late when the HPMediaServer began its backup. I noticed some screen blips, closed the programs and retired for the evening.

The next morning I was greeted with the message: "WHSTrayApp.exe has encountered an Application Error. Windows cannot continue from this exception (0xc0000025) has occurred in the application at location 0x01025319. Click continue to terminate."

Clicking continue brought up more error messages. Trying to shut down the computer, I encountered partial message boxes with partial command options that did not work when clicked. The only way for complete shutdown was to press the "on" button for 6 seconds (is this called a hard boot? cold boot?).

I tried the various virus/spyware/malware checkers in your READ ME FIRST instructions without finding any problems. I thought my computer was fixed!

The next morning another system tray freeze occurred. Frustrated, I rebooted the computer from the PCRestore disc that came with the media server to restore to another point, 10/01/2010. I thought that would be back far enough to avoid any virus, and I was told that the hard drive would be restored sector by sector--so I would be returning to a time when things worked smoothly. I proceeded with Stopzilla as usual upon startup.

The next morning I was greeted with the original message: "WHSTrayApp.exe Application Error..."

I uninstalled the WHSConnect program and the HPMediaServer and Stopzilla. This time I went step by step through the READ ME FIRST instructions in Normal Mode. No problems found.
The next morning, another system tray freeze occurred.

I am at wit's end and ready for any suggestions anyone has out there for a solution. I can provide logs as necessary. I copied the READ ME FIRST programs onto a USB thumb drive from another computer, so the ComboFix program ran from the thumb drive instead of from the desktop. If that causes a complication, please advise.

I am eager to hear any solutions!!!

 

THANK YOU, THANK YOU, FOR YOUR PROMPT REPLY.

The logs you have requested are attached.

 

ComboFix run from desktop, file attached.

 

MGTools log attached.

 

Thank you so much for your help....

Since I am being redirected to the software forum, this means my issue is due to software conflict(s) somewhere??

I will subscribe as advised to SuperAntiSpyware and Malwarebytes, leaving Stopzilla deleted and removing Avira Antivirus.

I have followed the cleanup procedures...my system restore box was already checked to turn off restore points, but I unchecked and rechecked the box and restarted the computer to begin new restore points.

I am not sure that my problem has been solved...this morning when I checked the computer at 4:55 a.m., the system tray time read 3:13 a.m., the screen was frozen and the computer was making no humming noise. I was unable to use task manager to shutdown the computer, and once again did the cold boot method of holding the "on" button for 6 seconds to get the computer to shut down.

I will now visit the software forum to see if they have any suggestions.
I may be forced to go back to the beginning system discs and wipe the drives clean; unfortunately I do not have many of the program install discs for the programs I have used.
If so, can I use the data files on the HPMediaServer without risking bringing the "virus" back into the machine, or is the Server data a candidate for infection also?

Once again, I appreciate your time and energy--what amazing challenges this forum brings to your talented brain!!

 

p.s.
Just read the "How to protect yourself from malware."
Now know the answer, do not use data from compromised HD...
Thanks again!

 

Continuing to investigate virus problem....

I have noticed several *.szcpf files (61 total) mostly in my Quicken directory; are these files necessary? Could they be viral related? Can I delete them safely?

Thank you again.