# My computer has the HIV... **URL:** \ **Category:** PittSpeed Off Topic\ **Created:** [January 7, 2009, 1:59pm UTC](https://forums.speedlife.net/t/my-computer-has-the-hiv/201390 "2009-01-07T13:59:41Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![4doors5gears](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/4doors5gears/32/6006_2.png) [@4doors5gears](https://forums.speedlife.net/u/4doors5gears)\ **Post date:** [January 7, 2009, 1:59pm UTC](https://forums.speedlife.net/t/my-computer-has-the-hiv/201390/1 "2009-01-07T13:59:41Z")
Maybe one of you guys can help me out with this. A couple of days ago I was in the midst of downloading a torrent and I picked up a popup… I know I know, shame on me… Anyways, a few days progress and I’ve been getting more. So I downloaded AdAware again and this Malwarebytes Anti-Malware. Run it and it seems like it picked up some shit, and I deleted everything. I’m still getting popups after this. Then all of a sudden, my AIM pops up, all my screens close and my computer restarts on it’s own. Ever since it started back up, I haven’t been able to get online. When my comp. first starts up, the NIC is enabled:firewalled. There is also a lock icon on it as well. I’m pulling a DHCP address but cannot ping out anywhere. When I try and disable the NIC, it disables, but does not enable again. When I click enable, it will say enabling, then it goes to Connection Failed! I’ve run a few scans in safe mode and it hasn’t picked anything up. My next thought was to reinstall the NIC drivers (Marvell Yukon onboard). However I am unable to uninstall the drivers in normal mode or safe mode. My next step is to get HijackThis and run a scan, but I am kinda stumped because I have no symptoms on the PC and nothing I can follow. Since then the computer has also been freezing on shutdown, which it never has done until this started. Any of you guys have any ideas or tips? Thanks in advance. ---
**Author:** ![noahTHEpurdy](https://avatars.discourse-cdn.com/v4/letter/n/87869e/32.png) [@noahTHEpurdy](https://forums.speedlife.net/u/noahTHEpurdy)\ **Post date:** [January 7, 2009, 2:11pm UTC](https://forums.speedlife.net/t/my-computer-has-the-hiv/201390/2 "2009-01-07T14:11:23Z")
Run HijackThis and post the results up here. ---
**Author:** ![imported\_Sleeper](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/imported_sleeper/32/5939_2.png) [@imported\_Sleeper](https://forums.speedlife.net/u/imported_Sleeper)\ **Post date:** [January 7, 2009, 2:12pm UTC](https://forums.speedlife.net/t/my-computer-has-the-hiv/201390/3 "2009-01-07T14:12:38Z")
12 gauge ---
**Author:** ![4doors5gears](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/4doors5gears/32/6006_2.png) [@4doors5gears](https://forums.speedlife.net/u/4doors5gears)\ **Post date:** [January 7, 2009, 2:30pm UTC](https://forums.speedlife.net/t/my-computer-has-the-hiv/201390/4 "2009-01-07T14:30:31Z")
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 5:20:57 PM, on 1/7/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\WgaTray.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\Program Files\Java\jre1.6.0\_03\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\WINDOWS\system32\CTHELPER.EXE C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\Program Files\Symantec\pcAnywhere\awhost32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DNA\btdna.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32 vsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\regedit.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [http://www.comcast.net/](http://www.comcast.net/) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default\_Page\_URL = [http://go.microsoft.com/fwlink/?LinkId=69157](http://go.microsoft.com/fwlink/?LinkId=69157) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default\_Search\_URL = [http://go.microsoft.com/fwlink/?LinkId=54896](http://go.microsoft.com/fwlink/?LinkId=54896) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [http://go.microsoft.com/fwlink/?LinkId=54896](http://go.microsoft.com/fwlink/?LinkId=54896) R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [http://www.comcast.net/](http://www.comcast.net/) R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = [http://getfirefox.com/](http://getfirefox.com/) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Comcast R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0 O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\_03\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM…\Run: [SunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0\_03\bin\jusched.exe” O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [iTunesHelper] “C:\Program Files\iTunes\iTunesHelper.exe” O4 - HKLM…\Run: [AVG7\_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM…\Run: [CTHelper] CTHELPER.EXE O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\QTTask.exe” -atboottime O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [BitTorrent DNA] “C:\Program Files\DNA\btdna.exe” O4 - HKCU…\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKUS\S-1-5-19…\Run: [AVG7\_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User ‘LOCAL SERVICE’) O4 - HKUS\S-1-5-20…\Run: [AVG7\_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User ‘NETWORK SERVICE’) O4 - HKUS\S-1-5-18…\Run: [AVG7\_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [AVG7\_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User ‘Default user’) O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\_03\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\_03\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - AppInit\_DLLs: vrvpff.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: Symantec pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe O23 - Service: ##Id\_String1.6844F930\_1628\_4223\_B5CC\_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32 vsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe – End of file - 6684 bytes Oh and now I get a popup stating my Windows did not pass genuine Windows validation, but it’s not getting online and I have been using this XP for 2 years now. ---
**Author:** ![noahTHEpurdy](https://avatars.discourse-cdn.com/v4/letter/n/87869e/32.png) [@noahTHEpurdy](https://forums.speedlife.net/u/noahTHEpurdy)\ **Post date:** [January 7, 2009, 3:45pm UTC](https://forums.speedlife.net/t/my-computer-has-the-hiv/201390/5 "2009-01-07T15:45:06Z")
The only thing I would be wary of after skimming through that would be: O20 - AppInit\_DLLs: vrvpff.dll I’d remove that. Also I’d suggest that if you’re using AVG for anti-virus to update to [AVG 8](http://www.filehippo.com/download_avg_antivirus/). Install that, scan, and see if it takes care of anything for ya. Also I’d suggest running [Spybot Search & Destroy](http://www.filehippo.com/download_spybot_search_destroy/) through a scan. You can never be too thorough. Do you use IE7 as your default browser? ---
**Author:** ![4doors5gears](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/4doors5gears/32/6006_2.png) [@4doors5gears](https://forums.speedlife.net/u/4doors5gears)\ **Post date:** [January 7, 2009, 3:47pm UTC](https://forums.speedlife.net/t/my-computer-has-the-hiv/201390/6 "2009-01-07T15:47:45Z")
Yeah I just got the popup saying AVG 7.5 is no longer active, so somethign is screwing all my shit up. By default I use firefox 3. Both browsers don’t work either. Spybot will be next. What is that .dll file? I didn’t recognize it… Last option is a reformat/reinstall. ---
**Author:** ![noahTHEpurdy](https://avatars.discourse-cdn.com/v4/letter/n/87869e/32.png) [@noahTHEpurdy](https://forums.speedlife.net/u/noahTHEpurdy)\ **Post date:** [January 7, 2009, 4:42pm UTC](https://forums.speedlife.net/t/my-computer-has-the-hiv/201390/7 "2009-01-07T16:42:52Z")
I didn’t either, which is why I’d remove it with Hijack This. It doesn’t belong there. A fresh install never hurt anyone. _shrugs_ Hard to really tell anything more without being there. ---
**Author:** ![4doors5gears](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/4doors5gears/32/6006_2.png) [@4doors5gears](https://forums.speedlife.net/u/4doors5gears)\ **Post date:** [January 7, 2009, 4:48pm UTC](https://forums.speedlife.net/t/my-computer-has-the-hiv/201390/8 "2009-01-07T16:48:19Z")
Yeah I dunno. I copped a version of Xp 64-bit and I’ve been looking for a reason to install it. I’m gonna set up a dual-boot for now and play with it a little. :dunno: Thanks for the help anyways.