Can't open IE or Taskmanager. Can't download in Firefox.

[SSoG]

When I open taskmanager, the icon appears in the system tray, but it's static instead of animated, and the task manager window never opens. Same when I try to open IE. Firefox functions normally, but when I try to download or attach anything, it hangs and I'm forced to close it.

I have updated AVG, Ad-Aware, and Spybot S&D. I rebooted in safe made, scanned with all three, then scanned again with Trend Micro Housecall just for kicks. I rebooted once more in safe mode, opened HJT, scanned, and saved a log. I know standard forum etiquette is to include logs as an attachment, but as I said, if I try it, my firefox will freeze, so hopefully you'll forgive this one little breach.

Logfile of HijackThis v1.99.1
Scan saved at 9:27:42 PM, on 2/1/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Comp Health\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\COMPHE~1\SPYBOT~1\SDHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Comp Health\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: smtpsvc (smtp) - Unknown owner - C:\WINDOWS\stmp.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe



I know that smtpsvc is the culprit (or at least one of the culprits), but every time I fix it and scan again, it's back again. Any help would be greatly appreciated.

 

[C0d3Warr10r]

SMTP Service

The SMTP Service in Windows XP does not use smtp.exe, it uses inetinfo.exe by default is located in the C:\Windows\System32 folder. If you are using Windows 2000 Server or Windows 2003 Server the same is likely not true.

Are you using this computer as a mail server? If not, you should be able to boot into safe mode and run MSCONFIG to disable smtpsvc from the "Services" tab. Reboot, and see if that does the trick.

If the first attempt doesn't work, boot back into safe mode. Right click on "My Computer" and select Manage. Click the + next to Services and Applications, and select Services. Locate "Simple Mail Transfer Protocol (SMTP)", right click, and select Properties. Change Startup type to Disabled in the dropdown menu. Reboot.

Hopefully this works, if not post back on the board and I'll see what else I can dig up.

C0d3Warr10r

 

[SSoG]

The SMTP Service in Windows XP does not use smtp.exe, it uses inetinfo.exe by default is located in the C:\Windows\System32 folder. If you are using Windows 2000 Server or Windows 2003 Server the same is likely not true.

Are you using this computer as a mail server? If not, you should be able to boot into safe mode and run MSCONFIG to disable smtpsvc from the "Services" tab. Reboot, and see if that does the trick.

If the first attempt doesn't work, boot back into safe mode. Right click on "My Computer" and select Manage. Click the + next to Services and Applications, and select Services. Locate "Simple Mail Transfer Protocol (SMTP)", right click, and select Properties. Change Startup type to Disabled in the dropdown menu. Reboot.

Hopefully this works, if not post back on the board and I'll see what else I can dig up.

C0d3Warr10r

That definitely fixed the downloading/uploading problem, but I still am having trouble with Taskmanager and Internet Explorer.

If I open Taskmanager immediately upon booting up, it opens without a problem, and the icon in the system tray is animated to show computer usage (like it normally is). What's more, it's clickable. Taskmanager shows up on the taskbar, and the window opens, just like it's supposed to; however, if I don't open it up within the first couple of minutes, and then try to open it later, the icon shows up in the system tray, but it isn't animated or clickable, the window doesn't open, and taskmanager doesn't show up in the taskbar. If I later try to reboot, I still have to wait while Windows closes Taskmanager before it lets me shut down.

I'd repost the HJT log, but it's exactly the same as it was before, minus the smtpsvc.

 

[C0d3Warr10r]

Just for Giggles

I'd like to have you completely uninstall ZoneAlarm... I've scene this program cause some very odd behavior on a number of computers. Also, disable any programs on startup that are unnecessary (i.e. Apple Quicktime, Adobe Acrobat, MSN Messengar) This should help narrow down the culprit. Let me know what your findings are.

C0d3Warr10r

 

[SSoG]

I'd like to have you completely uninstall ZoneAlarm... I've scene this program cause some very odd behavior on a number of computers. Also, disable any programs on startup that are unnecessary (i.e. Apple Quicktime, Adobe Acrobat, MSN Messengar) This should help narrow down the culprit. Let me know what your findings are.

C0d3Warr10r

Okay, Zone Alarm has been completely uninstalled, but the problems still persist.

The only programs that are enabled at startup are AVGCC, AVGEMC, and ctfmon. I've tried disabling ctfmon several times, but every time I go back into MSCONFIG it's been enabled again.

 

[Vigilante]

ctfmon has to do with alternative input I believe, it will autoinsert itself as long as alternative input is NOT disabled. This is fine.

To see more startups then HJT can see, go to www.sysinternals.com and download Autoruns.
Run this from Safe Mode. As soon as it opens, hit ESC to stop the initial scan. Then click in one of the menus and select "Disable certified microsoft entries" or something like that. Once that is checked it will hide known-good startups. Then click the refresh button. It will show you all the startups in your system.
Look for any with odd or random names, that don't have a description or run from a "temp" folder. I believe there is a way to save a log, post that here. Or else post the ones you think may be odd.

If it is obvious you see a bad entry, you can delete it from the program. Also, I suppose you can run this from Normal mode just the same, but if there is a bad entry, you may not be able to get rid of it while the bad program is still running.

Anyhow, when all is said and done, that program will give you a larger look at your startups. Most will be good, don't be alarmed, drivers and services and such.

good luck