Continuous MSI Installer errors, hlktmp file, and inability to install new software

Kathy,

I see that you were able to temporarily disable Windows Defender and also that TeaTimer is still disabled. Good work. Did you also check to see if Windows Live OneCare is present in the system tray (next to the system clock)? If it's there then go ahead and disable it as well.

Another thing that could keep HijackThis from being able to fix entries is being logged in under a non-Administrator account (also called a Limited account). If you have more than one User Account on your system, other than the Guest account, make sure that you are logging in under the Administrator account. You can check this by accessing User Accounts in the Control Panel.

After you've checked the above, run through the following instructions to see if you can remove those entries. They are similar to the instructions in my last post but I've altered them a bit as a check to see if HJT is doing what it should be doing.

Remove entries using HijackThis
Important! Please temporarily disable any anti-spyware programs you are using which are listed here so they will not interfere with the entries we will be fixing in HijackThis.
1.   Do not proceed until all other applications are closed.
2.   Open HijackThis and choose Do a system scan only.
3.   Click the box to the left of the following entries so that they show a checkmark. (Note: Be sure to check only the entries listed.):

O23 - Service: Debug Diagnostic Service (DbgSvc) - Unknown owner - C:\Program Files\DebugDiag\DbgSvc.exe (file missing)
O23 - Service: Windows Search (WSearch) - Unknown owner - C:\WINDOWS\system32\SearchIndexer.exe (file missing)

4.   Once you have all of the items checked, click Fix Checked. Answer Yes to the prompt that asks if you want to fix the 2 selected items.
5.   Choose No if you see a System Settings Change prompt that asks if you want to restart the computer. At this point the HijackThis window should clear itself.
6.   Click the Main Menu button and choose View the list of backups. The two entries that you've fixed should appear in the window.
6.   Exit HijackThis.
7.   Restart the computer.

Once the system has restarted, create a new HijackThis log and include it in your next reply.

If the above still does not work, reboot in safe mode (F8), fix those entries with HijackThis and then reboot normally.

Kathy,

First, we want to make sure that those files are in fact missing so check to see if they are. They will be located at the following locations if they are still there:

C:\Program Files\DebugDiag\DbgSvc.exe
C:\WINDOWS\system32\SearchIndexer.exe

If you uninstalled the Debug Diagnostic Tool then you shouldn't see the DebugDiag folder at all.

Next, check to see if either of them are listed in Services:
1. Click Start > Run, type in services.msc and click OK.
2. Check to see if either of the following are listed under the Name column:

Debug Diagnostic Service
Windows Search

3. If they are listed then right-click on their Name and choose Properties.
4. Change the Startup Type to Disabled for each of the entries if they exist. Be sure to do this only for the two entries listed in Step 2.
5. If they do not exist, close the Services window without making any changes.

Once you have completed the above then disable Symantec Auto-Protect using the icon in the System Tray. Also, verify that the programs that were mentioned in my previous post are still disabled. Then follow the steps from my last post to fix the HijackThis entries and post the updated log.

Our feeling is that Auto-Protect is replacing the fixed entries in the Registry so temporarily disabling it should allow the fixes to go through. Once the entries have been successfully fixed then it will be ok to reenable Auto-Protect.

Hi williamkidd,

The files are not in those locations but they are listed under the services. I disabled them and have included the updated log below:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:40:42 PM, on 15/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Tall Emu\Online Armor\OAcat.exe
C:\Program Files\Tall Emu\Online Armor\oasrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\DRIVERS\o2flash.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\WINDOWS\OEM13Mon.exe
C:\Program Files\Tall Emu\Online Armor\oaui.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Tall Emu\Online Armor\OAhlp.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
O4 - HKLM\..\Run: [OEM13Mon.exe] C:\WINDOWS\OEM13Mon.exe
O4 - HKLM\..\Run: [@OnlineArmor GUI] "C:\Program Files\Tall Emu\Online Armor\oaui.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://service1.symantec.com
O15 - Trusted Zone: http://www.symantec.com
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://pccheckup.dellfix.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1243215938944
O16 - DPF: {A796D216-2DE1-4EA8-BABB-FE6E7C959098} (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab57176.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: O2FLASH (o2flash) - O2Micro International - C:\WINDOWS\system32\DRIVERS\o2flash.exe
O23 - Service: Online Armor Helper Service (OAcat) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\OAcat.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\oasrv.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 9979 bytes

Thank you :)

Kathy

Kathy,

Your HijackThis log looks good but there does appear to be a possible software conflict that needs to be addressed and we can take a look at that in the Dell Microsoft OS forum if you would like to do that. Let me know if you want to do that and I'll create a thread over there where we can find out what is happening.

Below I've listed some advice for keeping your online experience safer and more enjoyable.

1.   Browsers - You have IE 8 installed so that's good when it comes to using that browser. You might also want to consider using Mozilla Firefox instead of Internet Explorer as it is a more secure browser and is not targeted as heavily as IE by malware writers.

2.   E-mail attachments and safety - Use extreme caution when dealing with e-mail attachments as they may contain malware. The following articles explain how to handle attachments and also provide other information about e-mail safety:

Help avoid computer viruses that spread through e-mail attachments
E-mail safety (from wiredsafety.org)

3.   Anti-Malware - You have both MBAM and Spybot S&D installed so you're covered when it comes to anti-malware programs. With each of these programs it would be a good idea to do a thorough scan once a month and use quick scans as necessary in between. Another program that we've found very useful is SuperAntispyware (SAS).

4.   Firewalls - You are now covered when it comes to having a software firewall since you now have Online Armor installed. Be sure to check for updates every once in a while if it doesn't do so automatically.

5.   Anti-Virus - Since you have Symantec Anti-Virus installed on your system be sure that it remains active and updated. Keep in mind that you should only have one anti-virus program installed as having more than one can cause conflicts.

6.   Risky sites/programs - Avoid warez sites, pirated software, cracking tools (such as keygens), and peer-to-peer (P2P) file sharing programs. Use extreme caution when visiting gaming sites such as World of Warcraft, Battle.Net and Steam. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

7.   Use a website evaluator - Website evaluators are browser plug-ins and are used to give you an idea on how safe a site is to visit. There are a few choices here which include Web of Trust (WoT), McAfee SiteAdvisor and TrendMicro TrendProtect. Note: The plug-ins listed may not work with all browsers.

8.   Keep Java updated - As I mentioned earlier you should keep Java up-to-date and can do so by checking Sun's Java website. Using an outdated version of Java can lead to security vulnerabilities on your system. Visit the Java download site on a regular basis and be sure to remove old versions of the software from your system using Add/Remove Programs.

9.   Backup your data - It is a good idea to make a backup of your data (e.g. documents, spreadsheets, music, pictures, etc.) so that you have a copy available in case something goes wrong. It is not necessary to backup your applications if you have the installation CDs or DVDs available. You can backup downloaded install programs so that you do not have to download them again. Do NOT backup to your internal hard drive. Instead use external media such as CDs, DVDs, USB flash drives or an external hard drive.

10.   Make use of plug-ins - Firefox has a nice set of plug-ins that can add security and functionality to your browser. Two of the most popular are Adblock Plus (which blocks unwanted ads) and NoScript (which keeps malicious scripts from running). Firefox plug-ins can be found at the official Firefox Add-ons site as well as at mozdev.org.

11.   Disable Autorun - Keeping Autorun enabled on USB (pen, thumb, jump) and other removable drives has become a significant security risk due to the increasing number of malware variants that can infect them and transfer the infection to your computer. To learn more about this risk, please read:

• USB-Based Malware Attacks
• When is AUTORUN.INF really an AUTORUN.INF?
• Please disable Autorun asap!

Many security experts recommend disabling this feature as a method of prevention. Microsoft recommends doing the same.

Microsoft Security Advisory (967940): Update for Windows Autorun

Additional References

• So how did I get infected in the first place? by Tony Klein
• Hardening Windows Security - Part 1 & Part 2
• IE Recommended Minimal Security Settings
• How to Secure Your Web Browser
• Use Task Manager to close pop-up messages to safely exit malware attacks

Thank you for visiting the Dell Malware Removal forum. :emotion-1:

Hi williamkidd,

Thank you so much for all of your help! I actually have Firefox downloaded as well and it's the browser that I typically use.

If you could create the thread in the Microsoft forum that would be great since I'm not sure what conflict might be present. Also, I was wondering how I would go about closing this thread? Is that something that's done from my end or your end?

Thank you :emotion-1:

Kathy

Kathy,

You're welcome. :emotion-1:  I've started a new thread in the Microsoft OS forum HERE.

NOTE: The issue has been resolved, so this thread is now closed.
Everyone else who is having a similar issue, please begin a New Message at the top of the forum.

That sounds like a good idea, Kathy. It will give the regular helpers on the Microsoft forum a chance to take over, so williamkidd can continue on this forum with those needing help in malware removal.