Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

« previous next »
Pages: [1] 2  All   Go Down

Author Topic: Still having problems. Here's my HJT log.  (Read 9694 times)

0 Members and 1 Guest are viewing this topic.

anthx86

  • Guest
Still having problems. Here's my HJT log.
« on: March 05, 2007, 09:15:01 AM »
As previously stated my computer likes to shut off at random. Luckily it has only done that one since Saturday. But it is still happening so whatever is wrong is not fixed still. My desktop is still disappearing as well. Usually after downloading something to the desktop like an program .exe. Also my instant messenger gives me an error when it loads. With the red "x" and some error number. IN ADDITION to that my bittorrent program falls to load certain aspects of the program like the "file complete" button. I get an error that it could not load.

When my desktop disappears I cannot access ANY files on my computer until I restart. And sometimes I have to try to restart 3 or 4 times before Windows runs properly so I believe this is a windows problem. HOWEVER here is my HJT log if someone sees something fishy.

Logfile of HijackThis v1.99.1
Scan saved at 11:12:49 AM, on 3/5/2007
Platform: Windows XP SP2
MSIE: Internet Explorer v6.00 SP2

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\zHotkey.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\hphmon05.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\BigFix\BigFix.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\ntvdm.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hotmail.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gatewaybiz.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IntelAudioStudio] "C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" TRAY
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exe
O4 - HKLM\..\Run: [HP Software Update] "c:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\
Logged

unlovedwarrior



    Guru

  • someday this name will be known
    • Thanked: 13
    Re: Still having problems. Here's my HJT log.
    « Reply #1 on: March 05, 2007, 09:23:33 AM »
    first torrent downloaders are a greater way to get infected.

    i'd  remove that if i were you

    what anti-virus/spyware programs do you have??


    unlovedwarrior
    Logged

    anthx86

    • Guest
    Re: Still having problems. Here's my HJT log.
    « Reply #2 on: March 05, 2007, 09:36:14 AM »
    Quote
    first torrent downloaders are a greater way to get infected.

    i'd  remove that if i were you

    what anti-virus/spyware programs do you have??


    unlovedwarrior

    I have AVG and Ad-Aware on here. Norton and McAfee came with it but I don't use them.
    Logged

    oddjob



      Hopeful

      Thanked: 4
      • Experience: Beginner
      • OS: Windows 7
      Re: Still having problems. Here's my HJT log.
      « Reply #3 on: March 05, 2007, 09:55:25 AM »
      You have only posted the first half of your HJT log (approximately). The full log goes down to entries beginning with "023".

      ************

      One thing I can see immediately is that your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

      Updating Java:
      • Download the latest version of  Java Runtime Environment (JRE) 6.
      • Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications"…..

      • Click the "Download" button to the right.
      • Check the box that says: "Accept License Agreement".
      • The page will refresh.
      • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
      • Close any programs you may have running - especially your web browser.
      • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
      • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
      • Click the Remove or Change/Remove button.
      • Repeat as many times as necessary to remove each Java versions.
      • Reboot your computer once all Java components are removed.
      • Then from your desktop double-click on jre-6-windowsi586-p.exe to install the newest version.
      ************

      When this is done download Ewido/AVG Anti Spyware from here ….

      http://www.ewido.net/en/

      It has a fully working 30 day trial period.

      Install it and update it to the latest definitions.

      Do NOT use it yet.


      Now boot to safe mode. Here’s a “how to” if you’re not sure ..

      http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406


      When in safe mode run a full system scan with AVGAS and let it fix what it wants to.

      REMEMBER TO SAVE THE SCAN REPORT and also remember where you saved it.

      [FOOTNOTE > this is a good program to use as an “on demand” scanner even after the trial period is over. Keep it updated and use it to scan your computer from time to time].

      ************

      If this doesn’t succeed in fixing the problem reboot to normal mode and scan again with HJT.

       
      Copy and paste both the AVG AS scan report and a FULL HJT logfile to this thread. You will probably need to use more than one post to get it all on the boards.

      More specific removal instructions will follow for whatever it is that's causing the problem.



      OJ
      « Last Edit: March 05, 2007, 10:11:02 AM by oddjob »
      Logged

      anthx86

      • Guest
      Re: Still having problems. Here's my HJT log.
      « Reply #4 on: March 05, 2007, 12:49:54 PM »
      Logfile of HijackThis v1.99.1
      Scan saved at 2:08:25 PM, on 3/5/2007
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Sygate\SPF\smc.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\ehome\ehtray.exe
      C:\Program Files\Digital Media Reader\shwiconem.exe
      C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
      C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe
      C:\WINDOWS\system32\igfxtray.exe
      C:\WINDOWS\system32\hkcmd.exe
      C:\WINDOWS\system32\igfxpers.exe
      C:\WINDOWS\zHotkey.exe
      C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
      C:\PROGRA~1\mcafee.com\agent\mcagent.exe
      C:\Program Files\Common Files\Real\Update_OB\realsched.exe
      C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
      C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
      C:\WINDOWS\system32\hphmon05.exe
      C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
      C:\Program Files\PowerISO\PWRISOVM.EXE
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
      C:\Program Files\Java\jre1.6.0\bin\jusched.exe
      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\AIM\aim.exe
      C:\Program Files\MSN Messenger\MsnMsgr.Exe
      C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
      C:\Program Files\BigFix\BigFix.exe
      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      C:\Program Files\WinZip\WZQKPICK.EXE
      C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
      C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
      C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
      C:\WINDOWS\eHome\ehRecvr.exe
      C:\WINDOWS\eHome\ehSched.exe
      C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
      C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\WINDOWS\system32\HPZipm12.exe
      C:\WINDOWS\system32\dllhost.exe
      C:\WINDOWS\eHome\ehmsas.exe
      C:\WINDOWS\system32\wscntfy.exe
      C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
      C:\WINDOWS\system32\ntvdm.exe
      C:\Program Files\BitTornado\btdownloadgui.exe
      C:\Documents and Settings\Owner\Desktop\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hotmail.com/
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gatewaybiz.com
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
      O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
      O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
      O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
      O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
      O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
      O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [IntelAudioStudio] "C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" TRAY
      O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
      O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
      O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
      O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exe
      O4 - HKLM\..\Run: [HP Software Update] "c:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
      O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
      O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
      O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
      O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe
      O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
      O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
      O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
      O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
      O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
      O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
      Logged

      anthx86

      • Guest
      Re: Still having problems. Here's my HJT log.
      « Reply #5 on: March 05, 2007, 12:50:33 PM »
      O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
      O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
      O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
      O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
      O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
      O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
      O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
      O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
      O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
      O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
      O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
      O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
      O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
      O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
      O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
      O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
      O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
      O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
      O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
      O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
      O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
      O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
      O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
      O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://www.activation.rr.com/install/downloads/tgctlcm.cab
      O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
      O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
      O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/4058/ftp.coupons.com/r3302/Blockbuster/Coupons.cab
      O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://messenger.zone.msn.com/binary/ZAxRcMgr.cab
      O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
      O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
      O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
      O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
      O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.7) - http://gameadvisor.futuremark.com/global/msc37.cab
      O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
      O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
      O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
      Logged

      anthx86

      • Guest
      Re: Still having problems. Here's my HJT log.
      « Reply #6 on: March 05, 2007, 12:51:10 PM »
      O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
      O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
      O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
      O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
      O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
      O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
      O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
      O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
      O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

      Logged

      anthx86

      • Guest
      Re: Still having problems. Here's my HJT log.
      « Reply #7 on: March 05, 2007, 12:51:38 PM »
      Still having issues after updating Java and running AVG in safemode.
      Logged

      dl65

      • R.I.P.


        • Prodigy

        Thanked: 18
        Re: Still having problems. Here's my HJT log.
        « Reply #8 on: March 05, 2007, 03:51:46 PM »
        Anth..... I would mark the entries listed below for removal with hijackthis  ........ Make sure you close up any open windows before removing these items...

        O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exe

        O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/4058/ftp.coupons.com/r3302/Blockbuster/Coupons .cab


        Let us know if that improves things.

        dl65  ::)
        Logged
        If you don't know the answer, it isn't a dumb question.

        anthx86

        • Guest
        Re: Still having problems. Here's my HJT log.
        « Reply #9 on: March 05, 2007, 05:27:23 PM »
        Is ShowWnd.exe something i need? I googled it and read it comes with most Gateway computers. Hopefully it's not. haha. I just uninstalled Itunes because it was screwing up and when I downloaded Itunes again my desktop disappeared. So downloading things to my desktop seems to have something to do with it. But I don't know what. Still seems to have problems. Not cool.
        Logged

        oddjob



          Hopeful

          Thanked: 4
          • Experience: Beginner
          • OS: Windows 7
          Re: Still having problems. Here's my HJT log.
          « Reply #10 on: March 06, 2007, 03:38:35 AM »
          One thing at a time.

          You might like to print this out to help you follow my advice.

          Update your AVG AS to the latest definitions and scan your computer again in safe mode. As before let the program fix what it wants to.

          ***************

          You indicate trouble downloading programs to your desktop. Have you tried downloading them to somewhere else, say, your “My Documents” folder? Did that work?

          ***************

          This folder …

          C:\windows\ehome

          Right click the folder, go to Properties and check to see of it’s a genuine folder you want (e.g. it’s from Microsoft).

          If it isn’t from a source you recognise post the information back here for more comment.

          ***************

          BigFix …. Differing opinions on this but it is definitely a massive resource hog. I used this some time ago but it slowed everything down almost to a crawl.

          Further I thought it was not as good as it could be because it doesn’t have any cleaning or troubleshooting tools

          If you continue using it I recommend you don’t have it running all the time. Start it manually.

          ***************

          Showwnd … this always causes confusion. It appears on many manufacturers’ equipment, including your Gateway, BUT it can also be a Trojan. We will check first.


          You will probably have trouble finding the file(s) so do this …

          Click Start > Search > For Files and Folders

          Expand Search Options:
          > Check - Advanced Options
          > Check - Search system folders, Search hidden files and folders, and Search Subfolders.
          Paste this into the "Search for files and folders" named box ……

          ShowWnd.exe

          Have the computer search the whole system and make a note of where the file(s) is/are.

          Go to this site …

          http://www.virustotal.com/en/indexf.html

          “Browse” to the file(s) you found and upload them one at a time. Have Virustotal scan the file(s) and post the results back here.

          ***************

          dl65 is right on the 016 entry. Open HijackThis …. click on scan … put a tick/check mark next to this IF it’s still present …

          O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) -http://a19.g.akamai.net/7/19/7125/4058/ftp.coupons.com/r3302/Blockbuster/Coupons .cab

          Close all open browser windows – including this one - before clicking on Fix Checked at the foot of the HijackThis window.

          This 016 is an IESPYADS restricted site. If you install that program (free) it will help to protect you by blocking around 5000 known bad sites.

          You can download IESpyAds from here ….
          http://www.spywarewarrior.com/uiuc/resource.htm#IESPYAD


          If you want to know how IESpyAds work you can take a look at it here ……
          http://www.bleepingcomputer.com/tutorials/tutorial53.html

          Note that IESpyAds only works with Internet Explorer.

          ***************

          NOTE >> I see you are starting the computer in “selective” startup mode. Please ensure your Msconfig has ALL items enabled at startup before scanning with HijackThis. If files are hiding then your problem may not reveal itself.

          ***************

          In your next post please include a fresh HijackThis log and an update on how things are working now.


          OJ
          « Last Edit: March 06, 2007, 03:41:10 AM by oddjob »
          Logged

          CBMatt

          • Mod & Malware Specialist


            • Prodigy

          • Sad and lonely...and loving every minute of it.
            • Thanked: 167
            • Yes
          • Experience: Experienced
          • OS: Windows 7
          Re: Still having problems. Here's my HJT log.
          « Reply #11 on: March 06, 2007, 07:32:23 AM »
          Quote
          This 016 is an IESPYADS restricted site. If you install that program (free) it will help to protect you by blocking around 5000 known bad sites.

          You can download IESpyAds from here ….
          http://www.spywarewarrior.com/uiuc/resource.htm#IESPYAD


          If you want to know how IESpyAds work you can take a look at it here ……
          http://www.bleepingcomputer.com/tutorials/tutorial53.html

          Note that IESpyAds only works with Internet Explorer.

          oddjob...this may just be a coincidence, but I downloaded this program out of curiosity.  When I tried installing it, my processor started working like crazy and making a lot of noise (like it was struggling to work).  As soon as I tried uninstalling it, AOL Spyware (it's surprisingly effective) auto-detected the Dialer.HC and Trojan.Regfish.A trojans.  My AOL was then disabled and whenever I tried to log on, it stopped responding.  I cleared out the trojans, but it didn't fix my AOL problem, so I did a System Restore.  Everything went back to normal, but my McAfee Anti-Virus was corrupted.  So, I had to download the update and reinstall it.  Thankfully, everything seems to be in working order again.  Sheesh.  It's possible that all of this is completely unrelated to IESpyAd and only happened at the same time due to coincidence, but maybe it's worth investigating?
          Logged
          Quote
          An undefined problem has an infinite number of solutions.
          —Robert A. Humphrey

          oddjob



            Hopeful

            Thanked: 4
            • Experience: Beginner
            • OS: Windows 7
            Re: Still having problems. Here's my HJT log.
            « Reply #12 on: March 06, 2007, 07:54:25 AM »
            CBMatt ... IESpyAds is an excellent program recommended everywhere. It should not cause the problems you are finding. I think we should discuss your problem via PM instead of this thread to avoid hijacking Anth's problems.

            I'll PM you.

            Anth .... please continue posting here.


            OJ
            Logged

            anthx86

            • Guest
            Re: Still having problems. Here's my HJT log.
            « Reply #13 on: March 06, 2007, 07:59:22 AM »
            Thanks for all the help. I would also like to note that Windows said it was a "driver error". How would I check to see what driver it was? No problems so far but I have made sure to only use the internet and nothing else. That seems to be when problems arise.
            Logged

            unlovedwarrior



              Guru

            • someday this name will be known
              • Thanked: 13
              Re: Still having problems. Here's my HJT log.
              « Reply #14 on: March 06, 2007, 08:17:49 AM »
              then check the device manager

              right click my computer>properties>hardware

              make sure there are no red X or yellow ? anywhere


              unlovedwarrior
              Logged
              Pages: [1] 2  All   Go Up
              « previous next »