WinHound

Sounds to me like you may have had a Smitfraud or SpyAxe problem. Your log is clean but since you still have problems, it would be worth running thru the below procedure to make sure. Not you will probably not find any of the entries show in the sample HJT lines. That's OK. Just work thru all steps and posts the requested logs. Also indicate if problems have been resolved.

Smitfraud and PSGuard Removal

 

Re: WinHound- Update/Firewall DisableNotify

First it would be better if you only did whatever we ask you to do and nothing more. If you would like to work your problem elsewhere that is your choice, but it is much easier for us if you would only do what we request.

At the current time I now have no idea what your status really is so it would be good if you just provided a list of all know problems.

Please note that notices from Spybot about "Windows Security Center (AntiVirus, Firewall + Windows update DisableNotify + overrides) " are not problems. They are just notices to tell you that you have changed the default Windows settings. This will happen anytime you install a program like McAfee (and others) that provide the same services. If Spybot is still showing other problems (other then these Disable notify messages), please attach a current log from Spybot.

One item that you can delete from the PandaScan is: C:\WINDOWS\deskbar.ini

Also I have no idea what you expect you desktop to look like, all you said was that it is blue but you did not say that this was unexpected. If it is unexpected, first just disable active Desktop. Now if you are having problems where you cannot change your Desktop (i.e., it is locked), do the below:

Fixing Locked Desktop
Also you should right click on your Desktop and select Properties. Then click the Desktop tab and then the Customize Desktop button. Now in the next window that comes up click the Web tab. Make sure at the bottom that Lock desktop items is unchecked. Then in the Web pages: box delete all items but My Current Home Page and make sure it is unchecked too. Then click OK. Apply. OK.

Now also attach a new HijackThis log from normal boot mode if you can get into normal boot mode. If you cannot boot in normal mode, I would suggest that you uninstall McAfee and leave it uninstalled for now. And then look for your CDs that contain the drivers for your system and find a replace for the usrshuta.exe file you deleted and anything else you may have deleted that we did not request. Even in your first message you said you "remove a few objectionable entries" with HJT. What were they? If you had HJT installed properly, you should be able to restore from the backups it creates (that is anything that should not have been removed).

 

You view HJT Backups by using HJT and going to Misc Tools and then Backups. You can see what has been backed up.

Let's try something:

Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixadt.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixadt.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

Now reboot your system and check to see how things are working.

 

Are you sure you made sure at the bottom that Lock desktop items is unchecked?


If it is uncheck and you cannot unlock the Desktop, first uninstall MS Antispyware and then try the fixes (the Fixing Locked Desktop and the registry patch). We may have to fix the below first too.

I still see a bunch of McAfee stuff running. Make sure nothing else shows for it in Add/Remove programs. We may have to uninstall manually.

Run HijackThis and select the below lines and Fix it after closin all browsers:
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [CleanUp] C:\DOCUME~1\MCD\LOCALS~1\Temp\20051213195646_mcappins.exe /v=3 /cleanup

Then reboot in safe mode and delete:
C:\Documents and Settings\MCD\Local Settings\Temp\20051213195646_mcappins.exe <--- Actually delete everything that it allows you to delete in the Temp folder.

Now run Ccleaner!

Now reboot and post a new HJT log and tell me what your status is.

 

Well now that you unlocked your Desktop you should have repeated what I gave you in message # 6 (Fixing Locked Desktop) and possible the registry patch from message # 8. It should have been unlock the first time in message # 6.

Let's see what the status of Windows Installer is.

Click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'. On the page that opens, scroll down to Windows Installer. Then right click the entry, select 'Properties' and tell me what you see for Path to executable, Startup type and for Service status.

Here is what they should be when nothing is in the process of being installed:
Path to executable: C:\WINDOWS\System32\msiexec.exe /V
Startup type: Manual
Service status: Stopped

While we have services.msc opened, let's fix the problems with McAfee not being completely uninstalled:

In the Services window, scroll down to McAfee WSC Integration (or if not found look for the short name McDetect.exe) ... then right click the entry, select 'Properties' and press 'Stop Service'. When it shows that it is stopped, next please set the 'Start-up Type' to 'Disabled'. Press 'OK' until you get back to Windows.

Now repeat the above for the below two services (or short names which are in parenthesis):
McAfee Task Scheduler (McTskshd.exe)
McAfee SecurityCenter Update Manager (mcupdmgr.exe)

Next, run HJT, but instead of scanning, click on the "None of the above, just start the program" button at the bottom of the choices. At the lower right, click on the 'Config" button, and then the Misc tools' button ... select 'Delete an NT Service" ... copy/paste the following into the box that opens, and press "OK":

McAfee WSC Integration

If that does not work try entering the short name: McDetect.exe

Now repeat the above steps with HijackThis for the below two services (or short names which are in parenthesis):
McAfee Task Scheduler (McTskshd.exe)
McAfee SecurityCenter Update Manager (mcupdmgr.exe)

Then exit HijackThis and reboot.

After reboot run HijackThis and fix any of the below lines that are still found:
O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\program files\mcafee.com\mps\mcbrhlpr.dll (file missing)
O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll (file missing)
O23 - Service: McAfee WSC Integration (McDetect.exe) - Unknown owner - c:\program files\mcafee.com\agent\mcdetect.exe (file missing)
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - Unknown owner - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe (file missing)
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Unknown owner - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe (file missing)

Then get a new HJT log and attach it here.

Do you have a Windows XP SP2 CD?

 

Yes it was unclear. Your previous message said:

which meant it was not unchecked. Thus it was checked. At least that is how I understood it.

At anyrate I now understand that it is not checked. So in the Web pages: box. It just says "Warning homepage" ? Is that exactly what it says? Is it checked? If so, unchecked it and then try to Delete it. Do you also see a My Current Home Page choice?


Download the attach GRKey.zip to your PC someplace you can locate it. Then extract the getrunkeys.bat file from the ZIP. Locate the grkey.bat file and double click on it to run it. It will create a file named runkeys.txt in the root of drive C: (C:\runkeys.txt) . This log will also popup in a notepad window which your can just close. Upload the runkeys.txt file here are an attachment.

 

Sorry! That was my fault! I forgot to add grep to the ZIP. Download the same file and run it again.

 

Please run msconfig and tell me if Normal Startup is selected. It looks to me like it is not set for normal startup.

Also while msconfig is open, click on the BOOT.INI tab and tell me what Boot Options (in the box at the bottom) are checked if any. If /SAFEBOOT is checked, uncheck it and see if you can boot in normal mode.

Now Download the Registry Search Tool

Unzip to your Desktop and double click on regsrch.vbs
(if you have script protection, please allow this to run)

In the dialog that opens enter the following:

Warning homepage

Press 'OK'

The search will run for a while then alert you when it is finished. Press 'OK' and copy the contents of the WordPad window and post in this thread. If it is very long, an attachment would be better.

 

Set msconfig for Normal Startup!

Also download the below new version of GRkey2.zip and get a new log to post here. I changed it for your registry key found with RegSrch and also changed it to create a new output file named runkeys2.txt. Attach runkeys2.txt. Since you have grep.exe from the previous version, I did not put it in the ZIP. Just extract this new version whereever you extracted the previous one.

 

Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixwp.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixwp.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

Then reboot into safe mode and delete the below:
C:\WINDOWS\warnhp.html

Now reboot in normal mode (if possible) and either way tell me the status of your Wallpaper. Also post a new HJT log.

 

Click Search and the Select "All files and folders"
Enter warnhp.html in the "All or part of the file name:" box
Now select "More advanced options"
Make sure the following check boxes are checked:

• Search system folders
• Search hidden files and folders
• Search subfolders

Then click the Search button. If you find it, delete it and let me know where it was. If not found, just continue with the other instructions.

 

Okay! Some small progress. Now repeat the Fixing Locked Desktop fix from message number 6 and also do the registry patch from message number 8 again. We have to repeat them now that we removed the bad entry. See if there is any change.

Also do the below:

Click Start, Run, and enter cmd into the box and click OK. This will open a command prompt window. At the command prompt type the below and hit the enter key:
sfc /scannow

It may ask you for a Windows CD at some point if it needs any files that it cannot find on your hard disk. Let me know the results.


Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CleanUp] C:\DOCUME~1\MCD\LOCALS~1\Temp\20056121103_mcappins.exe /v=3 /cleanup

After clicking Fix, exit HJT.
Use Windows Explorer to find and delete:
C:\Documents and Settings\MCD\Local Settings\Temp\20056121103_mcappins.exe <--- in fact it would be even better to delete all files found in this Temp folder. Some items you may not be allow to delete. Let me know the names of the files you cannot delete.

Now reboot and post a new HJT log.

 

Run services.msc like we did in previous messages and look for the following service name:
Remote Procedure Call (RPC)

If found, tell me what the Startup type and Status boxes contain.

 

Now get the same info for the below service:

Remote Procedure Call (RPC) Locator

 

Re: WinHound- Update/Firewall DisableNotify

Well at this point you may be looking at need to do a repair install or total reinstall of Windows. This problem is not malware and it all seem to start when you deleted some files in message number 5 that should not have been deleted. I would suggest you attempt to put those files back and see what happens! Otherwise you may want to start a thread in the Software Forum where some one can help you do a repair install or a reinstall of Windows (unless you already know how to do this).

It may be possible that a reinstall of Windows XP SP2 that you download will fix this but I really do not know if that will fix the problem.

 

Re: WinHound- Update/Firewall DisableNotify

Do you have any other user accounts on this PC?

If so, can they boot in normal mode?

If not, create a new account and see if you can then login with the new account in normal mode.

 

You're welcome! In the meantime while waiting for your SP2 CD to arrive you should backup any important information of your own and then could either reinstall from whatever current Win XP CD you do have or you could try a repair install. I forget....do you have a Win XP boot CD? If you want to try this you would be better off working this in the Software Forum. You can always point them to this thread as to what has been going on.

You can also find info on the Web about this. Like:
http://www.michaelstevenstech.com/XPrepairinstall.htm
http://www.webtree.ca/windowsxp/repair_xp.htm