Everything is messed up!!!

[chriscool]

Hi guys its me again! Having same trouble again when booting up, also my pc had a few bad patches. While writing this post i tried to do it before but my keyboard was playing up. For example when i pressed "caps locks" it does non capitals, then when its not on capitals it did capitals! Weired eh? Also my full stops wernt were they should be. I couldnt find them. So i exetied the computer hope web page. Typed it in again and it suddelny worked. Confusing. Also i looked at my computer and the red light wich shows if it is prossesing something is on continuesly. I checked in Controll manager and then processes and i have nothing updating or scanning. However i did find this little thing running.
rundll32.exe
To me that looks suspicious, my friend also thinks it is. Any ideas? Hellp would be really apprcaieted!!!
  Thanks

[Fed]

C'mon Chris, run the scans, you know the drill.
http://www.pandasoftware.com/activescan/
xp & w2k http://www.microsoft.com/athome/security/spyware/software/default.mspx
Others http://www.safer-networking.org/en/index.html

[Fed]

Another way to go...
http://forum.grisoft.cz/freeforum/read.php?4,27725,backpage=

[chriscool]

Ive run a virus test with Avg. Picked up nothing

[Fed]

It would have been better to try & eliminate all other malware with the other scanners but if you wish to proceed without knowing your computer is clean then download & run 'Autoruns' from http://www.sysinternals.com
Set the options to "Hide Signed Microsoft Entries", refresh the screen & see if your rundll32.exe shows up.

[chriscool]

Im just trying that Panda scanner u put a link for, ill try this first. Great link thanks. Ill see results of this panda scan first

And what do you mean "without knowing your pc is clean" Are you saying Avg isnt very good.

[Fed]

OK, just remember, Panda & AVG scan for viruses and a few little extras.
There is lots of malware, worms, trojans out there too.
If you have xp or w2k the Microsoft Antispyware scanner is a must do too.
I'm off to bed but when you come back with a clean bill of health it will give the night shift a good base to start from. Back in 6 hours or so unless sleep evades me.

[Raptor]

Virus scanners
AVG Free
-- Anti virus scanner
Trend Micro Housecall
-- Online anti virus scanner.

Anti spy/malware
Microsoft Antispyware
-- Anti spyware scanner. Windows XP Home and Professional only.
Spybot Search & Destroy
-- Anti spyware scanner
Adaware SE Personal
-- Anti spyware scanner

Firewalls
Use both a hardware and software firewall.
Be advised as dual software firewalls may cause problems

ZoneAlarm Free
-- Free firewall - more user friendly
Sygate Personal
-- Free firewall - more configuration options

Removal tools
The following files are not substitutes for the ones described above.
They are either diagnostic tools or removal tools for malware of a certain kind

HijackThis
-- Manual malware remover. Post the HijackThis log generated only if requested!
McAfee Stinger
-- Virus removal tool. No substitute for a fully functional virus scanner!
CWshredder
-- CoolWebSearch removal tool. Widely known and persistant Hijacker.

[chriscool]

Ok FED first of all. 6 HOURS SLEEP?? Is that all. Second test on that other web scan came back with no infection.

[Fed]

One last thing to run, don't let the name fool you, Hijackthis is good for detecting many different bugs.
Download & run Hijackthis from http://www.hijackthis.de/index.php?langselect=english save the log file & post it at the same site.
It will analyse your logfile & show you what to delete to solve your problem.
Let us know the result.  

[chriscool]

Logfile of HijackThis v1.99.1
Scan saved at 09:10:18, on 23/08/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\PCI Audio Applications\Bin\EchoCtrl.exe
C:\WINDOWS\Mixer.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
F:\iHPDetect.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\CTSvcCDA.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\AOL 9.0\waol.exe
C:\Program Files\AOL 9.0\shellmon.exe
C:\Program Files\Common Files\AOL\aoltpspd.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Documents and Settings\chris\My Documents\New Folder\hijackthis_199\HijackThis.exe

[chriscool]

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.computerhope.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.computerhope.com
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [C-Media Echo Control] C:\Program Files\PCI Audio Applications\Bin\EchoCtrl.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [iHP-100] F:\iHPDetect.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Voiceglo directory - {C9B8ABB6-1CC3-4957-9CA3-053036B2EE3A} - C:\Documents and Settings\All Users\Desktop\Glophone.lnk (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab

[chriscool]

O16 - DPF: {01234567-1234-1234-1234-012345678921} - http://images.neopets.com/glophone/neopets4.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc.aol.co.uk/computercheckup/qdiagcc.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://sib1.od2.com/common/Member/ClientInstall/10.01.0004/OCI/setup.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.av.aolsvc.co.uk/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - https://mysupport.nai.com/amiuptodate/bin/1,0,0,7/McUpdatePortal.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.av.aolsvc.co.uk/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {E123BED4-B8C7-42BB-958F-F13CA77EF95D} - http://install.anark.com/client/version2/windows-ie/en/AMClient.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4415/mcfscan.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O16 - DPF: {FD18DD5E-B398-452A-B22A-B54636BA9F0D} (Aurigma Image Uploader 2.5) - http://www.blinkz.com/test/ImageUploader2.cab
O16 - DPF: {FFFFFFFF-CACE-BABE-BABE-00AA0055595A} - http://www.trueswitch.com/hotmail-uk/TrueInstallHotmailUK.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{3F91F2E9-F5EB-498D-8A37-BE30B47DE1D1}: NameServer = 205.188.146.145
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - F:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.EXE
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Unknown owner - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

[chriscool]

Ok thanks for reasurance merlin. I have always had hijack  this on my pc for ages. Good program

[chriscool]

Guys?

[Fed]

Did you delete any entries after getting your Hijack log analysed?

Having same trouble again when booting up

my pc had a few bad patches.

my keyboard was playing up

the red light is on continuesly

Pick your problem from above & give us a little more detail on it.

[chriscool]

I did not deleate anything from the log.

The thing that is the only main problem is my disk drives.  Its completely wereid becuase in Device Manager it detects both of them, my computer neither, a program that came with nero couldnt find either but on boot up it now only says my Cd-Rw is in-compatable. It tell me to press F1 to continue and everyother application and program works fine. If you look back on the topic you will see i had it working. So i went on a game taht required a Cd and it was great. Untill it randomly cut me off to the desktop saying "Please insert correct cd and try again" But the cd was in there because i was just playing the game, Thats when i lost the drives again. I checked my Bios and it says it can detect my DVD RW but says my Cd-Rw is not installed. But why isnt it? Been working before!


Thanks guys!

[Raptor]

I checked my Bios and it says it can detect my DVD RW but says my Cd-Rw is not installed. But why isnt it? Been working before!

The BIOS would never say a device is detected but not installed..

[chriscool]

Maybe i didnt say it right. It says sec slave not installed.

I know its the CDRW though becuase that is my sec slave

[Raptor]

Make certain the jumpers are properly connected and that the IDE cable is inserted correctly.

[chriscool]

Checked, everything is in place. Its just confusing me how it just worked one week then didnt another :S

[Raptor]

Try testing the drive on another PC.

[chriscool]

Were going to see if motherboard is currupt, buy a new one. Maybe a metal thing has as we say "Given Up The Ghost"

[Raptor]

You are going to buy a new mainboard when only the CD-ROM drive does not work?

Can you do me a favour and send me the allegedbroken mainboard?

Maybe a metal thing has as we say "Given Up The Ghost"

Just like our waterchip.  By Dharma, that was a nightmare..

[Raptor]

Is this a pc chips motherboard.

No, not those kind of chips. Have you by any chance seen a waterchip so that I can rescue my people?

[chriscool]

I get the feeling your taking me seriously. We think that one of the connectors has gone. For example were the Cd drive connects into the motherboard.

[Raptor]

We think that one of the connectors has gone. For example were the Cd drive connects into the motherboard.

And you base this thought on what? Metal parts do not dissapear overnight.

You should first test the CD-ROM drive on another PC to see if it shows the same behaviour.

[chriscool]

If you check the post  I didnt say they had dissapeared, i meerly hinted that that it might be corrupt. Maybe if it had been knocked it might have damadged it. And ill try your idea

[chriscool]

Everything is working now

[Raptor]

Good. What have you done to resolve the situation?

[chriscool]

Nothing really, i just rebooted and they came back, so i rebooted again, and they came back. Weired eh? They have been back now for about 2 days but i didnt want to say again in case they went. Also you might remeber that i said the red LED that told you if the computer was thinking was on constantly, well that stopped about a week ago. Puzzeling really!

[Raptor]

Did you remove all spyware and viruses if present?