Question : Continual Trojans, Denial of Service, Unauthorized Access on standalone XP Home SP2.

Win XP Home Pro (legit software).
Single User with Cable High Speed
--------------------------------------------
I have been plagued with remote attacks since I bought this newly built computer from the store. Formatting; including low level reformat, resetting cmos jumper, and removing all components has been done by 6 different people but to no avail.  It seems like I am being  compromised when I do my windows update; sometimes right away and other times I haven't noticed the problems for a week. I do not use Internet Explorer.  I install anti-virus programs prior to accessing the internet for updates. I have tried every anti-virus, spyware, firewall, registry check and they are great for a few days (if even)
and then they become disable. Oh and just to show you how desperate I am for help, I purchased most of that software! LOL  Install logs look like I am installing fake updates so perhaps a browser hijack?

A couple of the problems I experience: Loss of Local Admin priviledges and eventually a complete D.O.S. (by NT AUTHORITY\NetworkService?).
Registry continues to change with added users and SID's.
My C: drive shows up as a file folder and no longer a system one.
Despite disabling remote/terminal apps from services.msc my registry
and logs become filled apps that appear to be remote access apps.
3 times now I have lost access to my CD-rom and DVD drives. I have CD-Rom this time but DVD and Floppy won't work.
Packet sending logs with reference to streaming.
Although my RUN ----> services.msc show apps as disabled, a ms-dos prompt shows them running with demand starts.  


It's like I don't have access to my real C: drive if that makes any sense.  I can't explain it any other way than to say that I feel like I only have access to and see a fake drive.
This is the same with anti-virus programs. They look llike they are doing their job but it appears they have been come compromised. Most of the time I am unable to access online scanners.

Weird things like this showed up today. Maybe it's normal?
PSEnumVariant
Inprocserver32
INTRO.EXE-00DE6C1B.pf

I installed Nortons 2005 and it worked long enough for it to detect

Spyware.WinKeyG
Hacktool.XScan
Bloodhound.Exploit.6 (Norton's stopped working shortly after this)

Firefox had a virus detected so I'm using Netscape for the immediate time. I dont' know if this is normal but my Netscape opened up to this url:

http://home.netscape.com/main3.adp|http://browser.netscape.com/ns8/security/trust_partners.jsp|http://browser.netscape.com/ns8/security/tr
ust_partners.jsp|http://browser.netscape.com/ns8/security/trust_partners.jsp|http://browser.netscape.com/ns8/security/trust_partners.jsp

-----------------  HIJACKTHIS log ----------------------------
Logfile of HijackThis v1.99.1
Scan saved at 5:49:12 AM, on 6/4/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\Program Files\Greatis\RegRunSuite\RegRunCenter.exe
C:\Program Files\Greatis\RegRunSuite\WatchDog.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wpabaln.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Greatis\RegRunSuite\fileext.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\svchost.exe
E:\CTRun\demo32.exe
E:\CTRun\CTLaunch.exe
E:\Audio\SETUP\SETUP.EXE
C:\PROGRA~1\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\IKernel.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Netscape\Netscape Browser\netscape.exe
C:\Program Files\Common Files\Symantec Shared\NMain.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\ccLgView.exe
C:\Program Files\Greatis\RegRunSuite\regrun2.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Angela\LOCALS~1\Temp\Rar$EX00.797\HijackThis.exe


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

http://ie.search.msn.com/{sub_rfc1766}/srchasst/srchasst.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.msn.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL
= http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://ie.search.msn.com/{sub_rfc1766}/srchasst/srchasst.htm

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

R3 - Default URLSearchHook is missing

N3 - Netscape 7: user_pref("browser.startup.homepage",
"http://www.google.ca/"); (C:\Documents and Settings\Angela\Application
Data\Mozilla\Profiles\default\6u4yplt1.slt\prefs.js)

N3 - Netscape 7: user_pref("browser.search.defaultengine",
"http://www.google.com/"); (C:\Documents and Settings\Angela\Application
Data\Mozilla\Profiles\default\6u4yplt1.slt\prefs.js)

O4 - HKLM\..\Run: [RegRun WinBait] C:\WINDOWS\winbait.exe

O4 - HKLM\..\Run: [@RegRunOnSecure]
C:\PROGRA~1\Greatis\REGRUN~1\OnSecure.exe

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
Shared\ccApp.exe"

O4 - HKCU\..\Run: [Regrun2] C:\PROGRA~1\Greatis\REGRUN~1\regrun2.exe /c 1

O4 - HKCU\..\Run: [HijackThis startup scan] C:\DOCUME~1\Angela\LOCALS~1\Temp\Rar$EX00.750\HijackThis.exe /startupscan

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O12 - Plugin for .xml: C:\Program Files\Netscape\Netscape
Browser\PLUGINS\npTrident.dll

O15 - Trusted Zone: http://free.aol.com

O15 - Trusted Zone: http://*.windowsupdate.microsoft.com

O15 - Trusted Zone: http://*.windowsupdate.com

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec
Corporation - C:\Program Files\Common Files\Symantec
Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec
Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec
Corporation - C:\Program Files\Common Files\Symantec
Shared\ccSetMgr.exe

O23 - Service: Creative Service for CDROM Access - Unknown owner -
C:\WINDOWS\system32\CTSvcCDA.EXE (file missing)

O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co.,
Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe

O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) -
Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe

O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) -
Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe

O23 - Service: SAVScan - Symantec Corporation - C:\Program
Files\Norton AntiVirus\SAVScan.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec
Corporation - C:\PROGRA~1\COMMON~1\Symantec Shared\Script Blocking\SBServ.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec
Corporation - C:\Program Files\Common Files\Symantec
Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation -
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program
Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: VJQT - Unknown owner -
C:\DOCUME~1\Angela\LOCALS~1\Temp\VJQT.exe (file missing)

--------------------- END ------------------

Thank you,

Angela

I gave this a difficult rating because I have taken this computer to different computer stores and they have not discovered the problem.

Answer : Continual Trojans, Denial of Service, Unauthorized Access on standalone XP Home SP2.

You have service pack two... is this XP home... no it can't be, no firewall on xp home....
to reset your firewall to the default, which is to block all incomming type the following in a command window (goto start>run>cmd.exe pressenter)
               netsh firewall reset
Ok. <--- this should be the response

Now type:
              netsh firewall show portopening
There should be a blank line. Go to grc.com and run the shields up test. You may do this prior to see if there is any difference. https://www.grc.com/x/ne.dll?bh0bkyd2

This site makes me document too much stuff.... now I'm adding a netsh page....
Just an FYI  (you need no open port's like this if your not running a web-server or some other listening server... do not use the "set" command if you do not need any open ports)
C:\>netsh firewall set portopening protocol = TCP port = 80 name = web-server ENABLE scope = ALL profile = ALL
Ok.
C:\>netsh firewall show portopening
Port configuration for Domain profile:
Port   Protocol  Mode     Name
-------------------------------------------------------------------
80     TCP       Enable   web-server
Port configuration for Standard profile:
Port   Protocol  Mode     Name
-------------------------------------------------------------------
80     TCP       Enable   web-server

-rich