Problem with PC

[slowdp]

MS Explorer and Chrome will open. Firefox will not open. Spybot will not open. Both Firefox and Spybot open task that can be seen in task manager but they will not come to the user interface. Outlook locks up when an address is entered in a new email.

Here are the requested logs. Can anyone help?

[S Templar]

Hi - I am not a HJt log expert but as no one has replied to your post, I offer these suggestions.
MalwareBytes - show a clean system.
I can see no infection in your Hjt log - but as said I am no expert.

As a test..
I'd disable 'TeaTimer' in Spybot Search and Destroy.
It can cause some problem, in some Pc's
Run SpyBotSearch and Destroy in Normal Mode.

In fact it was once the best Spyware Scanner, but no longer.
I'd try disabling it all together and see if there is a change to your problem.

SuperAntiSpywre is a better Spyware program.
http://www.superantispyware.com

What are your system specs
Hard drive size - free space?
Installed Ram etc?

[slowdp]

I cannot run Spybot to disable it. All of the programs were run in safe mode. I'll see if Spybot can be disabled in safe mode. Superantispyware was not tried, i'll try it. Firefox will not run. Chrome runs but some sites i go to get blocked with a message about the site being unsafe. One of the blocked sites is the Spyware Removal page of Networktechs.com.

This started after an email forwarded from another person's mailbox. the link in the email was not opened but when the email was opened there was strange behavior (according to the user) and the computer started acting weird.

The machine has 1 gig of memory. I don't now how much disk space is available. I'll check it later today.

[S Templar]

Does the Pc start in normal mode?
Can you not Disable SpyBot in Task Manager?
Then..
Click>start>run>type
msconfig

Click on startup tab>disable [untick] any refrerence to Spybot.
Restart yor Pc.

If you can get online..
Run an online virus scan.
http://housecall.trendmicro.com

Do you have a program linked to = Unknown owner - C:\ICVERIFY\ICWin403\PCVXWinServiceManager.exe

[slowdp]

The PC will run in normal mode. The logs posted were from normal mode. All of the programs were run in safe mode as well.

I will disable Spybot in the startup. Did not think of that. Taskmgr program names are so confusing i often do not know what i am disabling. Spybot and Firefox load the task in taskmgr but the programs do not continue to the display.

I'll get back to the office in a little bit and the suggestions.

[S Templar]

Process Explorer - will identify all that is running.
1.75Mb - so a small program to download and run.
You right click said programs and shut them down.

http://technet.microsoft.com/en-us/s...rnals/bb896653

[slowdp]

Chrome, Spybot and firefox have been removed. Regedit has been searched and all references to the programs removed. The unit still starts up indication an instruction at 0x017ff975 is trying to write memory at 0x00000000 that cannot be written.

Spooler subsystem is coming up with an error and is shutting down on startup.

ICV and the card program are known good programs. They are running on other machines we have without any problems.

Superantispyware was run. 17 spyware items found and deleted.

Spybot reinstalled without teatimer and helper. It still will not open.

Firefox redownloaded and it still will not open. Same problem as before.

[S Templar]

Is your Trend Micro\OfficeScan up to date and have you scanned your Pc with it?
Did you just untick SpyBot in msconfig?
Did SuperAntiSpyware find Spyware or just tracking cookies?

From your Hjt log file - have you added or do you recognize these.
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = FloridaIndustrialScaleCo.local
O17 - HKLM\Software\..\Telephony: DomainName = FloridaIndustrialScaleCo.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = FloridaIndustrialScaleCo.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = FloridaIndustrialScaleCo.local

[slowdp]

I did not pay close enough attention to what superantispyware found. It did indicate all was cleaned. The items you found are ok. Those are used by some inhouse software.

Trend is maintained up to date and comes from the inhouse server. The server updates daily and then propagates the update to the desktops. I did an update manually from the desktop yesterday.