Home / Microsoft / Microsoft Windows / Windows XP / I got a major problem!
0 Members and 2 Guests are viewing this topic. « previous next »
Pages: 1 2 3 [All] - (Bottom) Print
Author Topic: I got a major problem!  (Read 9014 times)
--Dave.N--
Guest
« on: May 29, 2005, 12:46:12 PM »
When i try to access "add/remove preograms" from the
contol panel to delete some adware an error message is displayed:
 Parser Message
  Value creation failed"at line 427

sombody please help...This is a danger to my company
IP logged
dl65
R.I.P.
Prodigy



Thanked: 18
Posts: 7,029
« Reply #1 on: May 29, 2005, 01:05:33 PM »
--Dave.N--......Perhaps you could provide a wee bit more info ........for example ..........
Are you the system administrator for the Company ?
Which operating system is on that pc ?
What program are you trying to remove ........?
Usually adware removal apps will do the job ....which one are you using ?

In another one of your posts....you were complaining that no one was responding to you ..........well if this is another example of your posts ....I'm not surprised .

Please let us know

dl65  ::)
« Last Edit: May 29, 2005, 01:10:05 PM by dl65 » IP logged
If you don't know the answer, it isn't a dumb question.
--Dave.N--
Guest
« Reply #2 on: May 29, 2005, 01:19:46 PM »
ok, i'm the administrator of this computer,
i use windows xp (home edition)
i found viruses that are causing my computer to randomly turn off and norton told me to go to "add/remove programs" and eliminate them manually because norton couldn't delete them itself...
IP logged
Raptor
Guest
« Reply #3 on: May 29, 2005, 01:22:41 PM »
Suggestion:

1. Before loading Windows press F8
2. Select safe mode
3. Rerun Norton scanner

Additional:

I find it rather difficult to believe that any virus scanner would tell you to go to Add/Remove software/Windows components to remove a virus? Was the virus accompanied by a program you have installed?
IP logged
dl65
R.I.P.
Prodigy



Thanked: 18
Posts: 7,029
« Reply #4 on: May 29, 2005, 01:25:51 PM »
--Dave.N--   Hummmmm thats really odd .....usually viruses are not removed from add/remove programs ......
Do you have a name for this pest ....?
The more info you give us the easier it is to assist you .

dl65  ::)
IP logged
If you don't know the answer, it isn't a dumb question.
--Dave.N--
Guest
« Reply #5 on: May 29, 2005, 01:32:47 PM »
yer there were 4 adware things in the system:
Javexulm.vxd
Mqexdlm.srq
Msexreq.exe
NNEZTY638.exe
None of them could be removed by norton so i looked
on the site and it told me to remove them manually
"Go to Start Menu>Control Panel>ad/remove programs, then remove bullseye targeting from the list"
I think that's what it said
IP logged
Raptor
Guest
« Reply #6 on: May 29, 2005, 01:38:21 PM »
You should use a dedicated spyware remover.

I have two recommendations for you:

Windows AntiSpyware
-- Only available if you are using Windows XP
Spybot Search and Destroy
-- Works well on many Windows platforms.
IP logged
dl65
R.I.P.
Prodigy



Thanked: 18
Posts: 7,029
« Reply #7 on: May 29, 2005, 01:45:58 PM »
--Dave.N--......   Javexulm.vxd ,Mqexdlm.srq ,Msexreq.exe ,NNEZTY638.exe   .......are trojans , I think , not viruses .........and that possibly why Norton didnt remove them .........
I would be inclined to D/L ..... hijackthis from ... http://www.majorgeeks.com/download3155.html  and post the log it generates here ........  this app usually cleans out the trojans ......

Or you could d/l Ewido  http://downloads-zdnet.com.com/Ewido-Security-Suite/3000-8022_2-10326287.html

dl65  ::)
IP logged
If you don't know the answer, it isn't a dumb question.
--Dave.N--
Guest
« Reply #8 on: May 29, 2005, 02:16:59 PM »
no offence dl65 but i don't really understand those
terms(i'm a bit thick when computers are concerned) :-[
could you say that again but in a way that a person lime me would be able to understand... :)
IP logged
dl65
R.I.P.
Prodigy



Thanked: 18
Posts: 7,029
« Reply #9 on: May 29, 2005, 02:25:21 PM »
--Dave.N--  I was just suggesting why Norton didnt remove the pests ........ Then I suggested to D/L hijackthis ...... ( just click on the link I posted ....it will take you to the spot where you can D/L the program hijackthis V1.99.1 ......... ) Save it to your desktop and then once it downloaded .........open it and click on scan and save log ......... then highlite the log file , right click copy .......come back to your post here in Computer Hope and right click and paste .....and it will be here.

dl65  ::)
IP logged
If you don't know the answer, it isn't a dumb question.
--Dave.N--
Guest
« Reply #10 on: May 29, 2005, 02:34:24 PM »
ok here it is dl65 (in chunks):

Logfile of HijackThis v1.99.1
Scan saved at 21:30:43, on 29/05/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
IP logged
--Dave.N--
Guest
« Reply #11 on: May 29, 2005, 02:35:10 PM »
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\UStorSrv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\Explorer.EXE
IP logged
--Dave.N--
Guest
« Reply #12 on: May 29, 2005, 02:35:43 PM »
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Wireless 11Mbps Network\XPFix.exe
C:\WINDOWS\System32\am772cfg.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\WINDOWS\System32\hphmon04.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
IP logged
--Dave.N--
Guest
« Reply #13 on: May 29, 2005, 02:36:22 PM »
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\jan\Desktop\HijackThis.exe
IP logged
--Dave.N--
Guest
« Reply #14 on: May 29, 2005, 02:37:00 PM »
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.qsrch.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet6_38.dll
O2 - BHO: Quick! - {4E7BD74F-2B8D-469E-C0FF-FD67B79CAF2C} - C:\PROGRA~1\quickbar\quickbar.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll (file missing)
IP logged
--Dave.N--
Guest
« Reply #15 on: May 29, 2005, 02:37:44 PM »
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\Ipswitch\WS_FTP Home\wsbho2k0.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Hotbar - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - C:\Program Files\Hotbar\bin\4.5.1.0\HbHostIE.dll (file missing)
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-
IP logged
--Dave.N--
Guest
« Reply #16 on: May 29, 2005, 02:38:33 PM »
FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Hotbar - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - C:\Program Files\Hotbar\bin\4.5.1.0\HbHostIE.dll (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN
IP logged
--Dave.N--
Guest
« Reply #17 on: May 29, 2005, 02:39:13 PM »
Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: Quick! - {4E7BD74F-2B8D-469E-C0FF-FD67B79CAF2C} - C:\PROGRA~1\quickbar\quickbar.dll
O4 - HKLM\..\Run: [OemReset] %systemroot%\OPTIONS\OEMRESET.EXE /AUDIT
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Alice] C:\Program Files\Wireless 11Mbps Network\XPFix.exe
O4 - HKLM\..\Run: [AMD Wireless Network Configuration] "C:\WINDOWS\System32\am772cfg.exe"
IP logged
--Dave.N--
Guest
« Reply #18 on: May 29, 2005, 02:39:48 PM »
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exe
O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WeatherOnTray] C:\Program
IP logged
--Dave.N--
Guest
« Reply #19 on: May 29, 2005, 02:40:32 PM »
Files\Hotbar\bin\4.5.1.0\WeatherOnTray.exe
O4 - HKLM\..\Run: [Spam Blocker for Outlook Express] C:\PROGRA~1\Hotbar\bin\451~1.0\SBInst.exe
O4 - HKLM\..\Run: [uvanqlor] C:\WINDOWS\uvanqlor.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Hotbar] C:\Program Files\Hotbar\bin\4.5.1.0\HbInst.exe /Upgrade
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN
IP logged
--Dave.N--
Guest
« Reply #20 on: May 29, 2005, 02:41:08 PM »
Apps\Updater\01.02.3000.1001\en-us\msnappau.exe"
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
IP logged
--Dave.N--
Guest
« Reply #21 on: May 29, 2005, 02:41:43 PM »
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-
IP logged
--Dave.N--
Guest
« Reply #22 on: May 29, 2005, 02:42:14 PM »
595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B9356F86-560E-4BC0-8C8A-6E195F108554}: NameServer = 158.152.1.58,158.152.1.43
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common
IP logged
--Dave.N--
Guest
« Reply #23 on: May 29, 2005, 02:43:00 PM »
Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISEXEng - Unknown owner - C:\WINDOWS\System32\angelex.exe (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\System32\HPHipm11.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: UStorage Server Service - OTi - C:\WINDOWS\system32\UStorSrv.exe
IP logged
--Dave.N--
Guest
« Reply #24 on: May 29, 2005, 02:43:28 PM »
that's all of it...
IP logged
dl65
R.I.P.
Prodigy



Thanked: 18
Posts: 7,029
« Reply #25 on: May 29, 2005, 02:47:26 PM »
--Dave.N--  Ok ...give me a few minutes to check it out .....


dl65  ::)
IP logged
If you don't know the answer, it isn't a dumb question.
--Dave.N--
Guest
« Reply #26 on: May 29, 2005, 02:54:12 PM »
good luck ;D
IP logged
dl65
R.I.P.
Prodigy



Thanked: 18
Posts: 7,029
« Reply #27 on: May 29, 2005, 03:30:21 PM »
--Dave.N-- ......Ok .......there are a number of bad things here ...so ....first thing to do is ..... Click on do system scan and save logfile.... next click the config button ......when the new windowopens .....in the 4 URL boxes .....type in  http://www.msn.com     then click the back button .....and mark for removal the following :


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.qsrch.com/

O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet6_38.dll

O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll (file missing)

O2 - BHO: Hotbar - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - C:\Program Files\Hotbar\bin\4.5.1.0\HbHostIE.dll (file missing)

O3 - Toolbar: &Hotbar - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - C:\Program Files\Hotbar\bin\4.5.1.0\HbHostIE.dll (file missing)

O4 - HKLM\..\Run: [WeatherOnTray] C:\Program Files\Hotbar\bin\4.5.1.0\weatherontray.exe

O4 - HKLM\..\Run: [Hotbar] C:\Program Files\Hotbar\bin\4.5.1.0\hbinst.exe /Upgrade

O4 - HKLM\..\Run: [New.net Startup] rundll32
C:\PROGRA~1\NEWDOT~1\newdot~1.dll,NewDotNetStartup -s

O4 - HKCU\..\Run: [Ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe

O10 - Hijacked Internet access by New.Net

O10 - Hijacked Internet access by New.Net

O10 - Hijacked Internet access by New.Net

O10 - Hijacked Internet access by New.Net

O10 - Hijacked Internet access by New.Net

O23 - Service: ISEXEng - Unknown owner - C:\WINDOWS\System32\angelex.exe (file missing)

Now click fix marked .......   Reboot and see how things are .

I also notice you have not updated your System to SP2 .....is there some reason you havent ? It provides additional security ........  And if you havent updated that , there are probably other updates you don't have installed .........

Let us know ,

dl65  ::)
IP logged
If you don't know the answer, it isn't a dumb question.
--Dave.N--
Guest
« Reply #28 on: May 29, 2005, 03:48:19 PM »
firstly you are amazing!!! ;D ;D ;D
secondly, thank you so much for your help!!! ;D ;D ;D
Thirdly, there was one file hijacker couldn't delete
but it dosen't matter...
fourthly can i have your e-mail address in case i have any more problems?
fithly, my name is joe and i'm 13 i don't own a company...
i just said i did so someone would take me seriously
sixthly, i am updating now
seventhly, Thank you so much for your help again,
you are amazing!!!
eightly... sorry about lying to you, i hope you'll understand, you still helped me fix a serious problem.

yours sincerely or whatever,
   Joe.T    email me:
and reply to this message so i know you got it...
IP logged
dl65
R.I.P.
Prodigy



Thanked: 18
Posts: 7,029
« Reply #29 on: May 29, 2005, 04:07:47 PM »
--Dave.N--.....Glad to hear we were able to help you .
Also glad to hear your updating your system ......As far as my E mail address ......its there just below my avitar ( under the pic of Elmer Fudd )
It's always a good idea to tell it the way it is instead of making up a story.

dl65  ::)
« Last Edit: May 29, 2005, 04:09:00 PM by dl65 » IP logged
If you don't know the answer, it isn't a dumb question.
--joe.t--
Guest
« Reply #30 on: May 29, 2005, 04:19:48 PM »
cheers again,
i'll email you sometime
i'm joeguitar04@yahoo.co.uk
bye
IP logged
merlin_2
Guest
« Reply #31 on: May 30, 2005, 09:18:26 AM »
info before you go around in circles>>http://www.spyany.com/program/article_ad_rm_NewDotNet.html
IP logged
Pages: 1 2 3 [All] - (Top) Print 
Home / Microsoft / Microsoft Windows / Windows XP / I got a major problem! « previous next »
 


Login with username, password and session length

Old Forum Search | Forum Rules
Copyright © 2010 Computer Hope ® All rights reserved.
Powered by SMF 2.0 RC3 | SMF © 2006–2010, Simple Machines LLC
Page created in 0.192 seconds with 20 queries.