I cant open any programs!!!

• lazy2

  19 Aug 06, 12:37

  This morning i switched on my pc and i cant open any programs... the only thing that was able to run (thank god) is my internet explorer!
  Anyone knows whats wrong??
  Thanks
• ndmmxiaomayi

  19 Aug 06, 12:59

  Can provide a more detailed description?
  
  Like what programs can't open?
  
  
• lazy2

  19 Aug 06, 13:12

  I tried opening anti spyware, AVG and stuff. They just appear for a spilt second and disappears...
• lazy2

  19 Aug 06, 14:24

  Anyone? My pc is paralysed!!
  Help!
• lazy2

  19 Aug 06, 15:33

  Please help me asap! Now my pc is infested with spyware and shit!!!
• StarPuppy

  19 Aug 06, 15:44

  Deleted.
  
  
• lazy2

  19 Aug 06, 15:51

  I tried but i cant open any programs...
  
  This is bad
• StarPuppy

  19 Aug 06, 17:26

  Deleted.
• R3SsH|n

  19 Aug 06, 17:31

  are the programs in your task manager process?
• lazy2

  19 Aug 06, 18:02

  I cant run by safe mode.. theres error! Oh my goodness...
• StarPuppy

  19 Aug 06, 18:03

  Originally posted by lazy2:

  I cant run by safe mode.. theres error! Oh my goodness...

  what error is it?
• manyu882

  19 Aug 06, 21:21

  maybe due to insufficient memory
• missqi

  19 Aug 06, 21:22

  use linux and try.
  
• ndmmxiaomayi

  19 Aug 06, 21:49

  Originally posted by lazy2:

  I tried opening anti spyware, AVG and stuff. They just appear for a spilt second and disappears...

  Try renaming HijackThis to stupid and run. If it still can't run, download this CoolWebSearch.SmartKiller removal tool first.
  
  Edit: After removing, download HijackThis again.
  
  Create a folder in C drive called HJT. Extract HijackThis to this folder. Run HijackThis. Select Do a system scan and save a log. Post that log here.
• ndmmxiaomayi

  19 Aug 06, 21:51

  Originally posted by manyu882:

  maybe due to insufficient memory

  That's not the reason.
• ndmmxiaomayi

  19 Aug 06, 21:52

  Originally posted by missqi:

  use linux and try.
  

  HijackThis only works for Windows. It will crash other OS.
• lazy2

  24 Aug 06, 23:15

  Heres the logsheet:
  
  Logfile of HijackThis v1.99.1
  Scan saved at 11:20:26 PM, on 8/24/2006
  Platform: Windows 2000 SP4 (WinNT 5.00.2195)
  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
  
  Running processes:
  D:\WINNT\System32\smss.exe
  D:\WINNT\system32\winlogon.exe
  D:\WINNT\system32\services.exe
  D:\WINNT\system32\lsass.exe
  D:\WINNT\system32\Ati2evxx.exe
  D:\WINNT\system32\svchost.exe
  D:\WINNT\system32\spoolsv.exe
  D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  D:\WINNT\system32\svchost.exe
  D:\Program Files\Ahead\InCD\InCDsrv.exe
  D:\WINNT\system32\MSTask.exe
  D:\Program Files\Spyware Doctor\sdhelp.exe
  D:\WINNT\System32\WBEM\WinMgmt.exe
  D:\WINNT\system32\Ati2evxx.exe
  D:\WINNT\system32\chh.exe
  D:\WINNT\Explorer.exe
  D:\Program Files\Common Files\Real\Update_OB\realsched.exe
  D:\WINNT\system32\soundmax.exe
  D:\WINNT\system32\rundll32.exe
  C:\nwnmff_12.exe
  C:\dfndrff_12.exe
  C:\kybrdff_12.exe
  D:\winnt\system32\stonedrv.exe
  D:\winnt\system32\taskmgn.exe
  D:\WINNT\system32\rpcc.exe
  D:\Program Files\MSN Messenger\MsnMsgr.Exe
  D:\Program Files\Internet Explorer\iexplore.exe
  D:\WINNT\system32\cmd.exe
  D:\WINNT\system32\cscript.exe
  D:\Stupid.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
  R3 - URLSearchHook: DeskbarBHO - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - D:\Program Files\Deskbar\deskbar.dll
  F2 - REG:system.ini: Shell=Explorer.exe chh.exe
  F2 - REG:system.ini: UserInit=D:\WINNT\system32\userinit.exe,chh.exe
  O1 - Hosts: 235.214.107.41 www.virustotal.com
  O1 - Hosts: 33.3.169.44 virusscan.jotti.org
  O1 - Hosts: 95.95.239.187 sandbox.norman.no
  O1 - Hosts: 236.16.252.76 www.symantec.com
  O1 - Hosts: 81.237.212.190 securityresponse.symantec.com
  O1 - Hosts: 153.77.69.6 symantec.com
  O1 - Hosts: 101.81.142.37 www.sophos.com
  O1 - Hosts: 51.92.5.83 sophos.com
  O1 - Hosts: 22.84.63.236 www.mcafee.com
  O1 - Hosts: 204.205.34.167 mcafee.com
  O1 - Hosts: 243.212.96.143 liveupdate.symantecliveupdate.com
  O1 - Hosts: 61.96.74.78 www.viruslist.com
  O1 - Hosts: 104.47.238.203 viruslist.com
  O1 - Hosts: 109.147.117.22 f-secure.com
  O1 - Hosts: 13.244.51.53 www.f-secure.com
  O1 - Hosts: 57.5.230.76 kaspersky.com
  O1 - Hosts: 17.115.16.33 www.avp.com
  O1 - Hosts: 90.161.208.139 www.kaspersky.com
  O1 - Hosts: 50.145.99.80 avp.com
  O1 - Hosts: 233.168.246.216 www.networkassociates.com
  O1 - Hosts: 64.114.128.249 www.ca.com
  O1 - Hosts: 236.121.110.141 ca.com
  O1 - Hosts: 54.114.43.161 mast.mcafee.com
  O1 - Hosts: 118.182.103.146 my-etrust.com
  O1 - Hosts: 221.234.42.53 www.my-etrust.com
  O1 - Hosts: 78.49.5.243 download.mcafee.com
  O1 - Hosts: 11.207.240.9 dispatch.mcafee.com
  O1 - Hosts: 185.176.201.53 secure.nai.com
  O1 - Hosts: 219.150.202.149 nai.com
  O1 - Hosts: 192.252.18.2 www.nai.com
  O1 - Hosts: 21.236.30.16 update.symantec.com
  O1 - Hosts: 19.195.32.170 updates.symantec.com
  O1 - Hosts: 130.65.67.206 us.mcafee.com
  O1 - Hosts: 115.196.49.111 liveupdate.symantec.com
  O1 - Hosts: 117.157.101.252 customer.symantec.com
  O1 - Hosts: 183.213.47.157 rads.mcafee.com
  O1 - Hosts: 68.79.239.155 trendmicro.com
  O1 - Hosts: 211.47.228.251 www.trendmicro.com
  O2 - BHO: (no name) - {61CD4101-FB0D-4316-8FFA-A1010BC677B3} - D:\WINNT\system32\awtqn.dll
  O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\system32\msdxm.ocx
  O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - D:\Program Files\Canon\Easy-WebPrint\Toolband.dll
  O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\zh-sg\msntb.dll
  O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - D:\Program Files\ToolBar888\MyToolBar.dll
  O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - D:\Program Files\TheSearchAccelerator\UCMTSAIE.dll
  O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
  O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [Soundmax Audio Drivers] soundmax.exe
  O4 - HKLM\..\Run: [WinDLL (nope.dll)] rundll32.exe D:\WINNT\system32\nope.dll,start
  O4 - HKLM\..\Run: [newname] C:\\nwnmff_12.exe
  O4 - HKLM\..\Run: [defender] C:\\dfndrff_12.exe
  O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_12.exe
  O4 - HKLM\..\Run: [stonedrv] d:\winnt\system32\stonedrv.exe
  O4 - HKLM\..\Run: [Windows Task Manager] d:\winnt\system32\taskmgn.exe
  O4 - HKLM\..\RunServices: [Ms Java for Windows NT] 86541_netapi.exe
  O4 - HKLM\..\RunServices: [Soundmax Audio Drivers] soundmax.exe
  O4 - HKLM\..\RunServices: [stonedrv] d:\winnt\system32\stonedrv.exe
  O4 - HKLM\..\RunServices: [Asus MotherBoard Utility] asus.exe
  O4 - HKLM\..\RunServices: [Windows firewall manager] chh.exe
  O4 - HKCU\..\Run: [Internet Explorer6.0] iexplore.exe
  O4 - HKCU\..\Run: [Spyware Doctor] "D:\Program Files\Spyware Doctor\swdoctor.exe" /Q
  O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [Soundmax Audio Drivers] soundmax.exe
  O4 - HKCU\..\Run: [stonedrv] d:\winnt\system32\stonedrv.exe
  O4 - HKCU\..\Run: [shell] "D:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00013.exe"
  O4 - HKCU\..\RunServices: [Ms Java for Windows NT] 17751_netapi.exe
  O4 - HKCU\..\RunServices: [Asus MotherBoard Utility] asus.exe
  O4 - HKCU\..\RunServices: [Windows firewall manager] chh.exe
  O4 - Global Startup: ATI CATALYST System Tray.lnk = D:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
  O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
  O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
  O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
  O8 - Extra context menu item: Easy-WebPrint Preview - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
  O8 - Extra context menu item: Easy-WebPrint Print - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - D:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1144774493781
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1145036379656
  O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://D:\TempEI4\EI40_\msxml4.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{63237AC7-4347-480A-BEF0-A947B53D157E}: NameServer = 165.21.100.88 165.21.83.88
  O20 - Winlogon Notify: awtqn - D:\WINNT\system32\awtqn.dll
  O20 - Winlogon Notify: Installer - D:\WINNT\system32\l44q0eh5eh4.dll
  O20 - Winlogon Notify: Internet Settings - D:\WINNT\system32\rwm.dll (file missing)
  O20 - Winlogon Notify: IPConfMSP - D:\WINNT\system32\gppml3711.dll (file missing)
  O20 - Winlogon Notify: Nls - D:\WINNT\system32\hwd.dll (file missing)
  O20 - Winlogon Notify: policies - D:\WINNT\system32\iocvid.dll (file missing)
  O20 - Winlogon Notify: Reliability - D:\WINNT\system32\mfdtcui.dll (file missing)
  O20 - Winlogon Notify: Syncmgr - D:\WINNT\system32\k0lq0a35ed.dll (file missing)
  O20 - Winlogon Notify: WindowsUpdate - D:\WINNT\system32\k0lq0a35ed.dll (file missing)
  O21 - SSODL: SysTray - {E61B5E20-DE35-11CF-9C87-1579005127ED} - D:\WINNT\system32\msc.cpl
  O21 - SSODL: msp.cpl - {E21B5E20-DE35-11CF-9C87-157900512701} - D:\WINNT\system32\msp.cpl
  O23 - Service: 62804 - Unknown owner - \\220.255.25.200\Admin$\eraseme_40880.exe (file missing)
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINNT\system32\Ati2evxx.exe
  O23 - Service: ATI Smart - Unknown owner - D:\WINNT\system32\ati2sgag.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - D:\WINNT\System32\dmadmin.exe
  O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - D:\Program Files\Ahead\InCD\InCDsrv.exe
  O23 - Service: iPodService - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Windows Vista/NT Runtime Compatibility Service (ntrcs) - Unknown owner - D:\WINNT\system32\7.tmp (file missing)
  O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - D:\Program Files\Spyware Doctor\sdhelp.exe
  O23 - Service: Windows Genuine Advantage Registration Service (wgareg) - Unknown owner - D:\WINNT\system32\wgareg.exe
  O23 - Service: Microsoft Windows Spooler Service (Windows Spooler Service) - Unknown owner - D:\WINNT\services.exe (file missing)
  
  
• lazy2

  24 Aug 06, 23:22

  Heres the log file for my C drive just in case
  But My D Drive is the main one which is the first log file.
  Please help.
  
  Logfile of HijackThis v1.99.1
  Scan saved at 11:22:10 PM, on 8/24/2006
  Platform: Windows 2000 SP4 (WinNT 5.00.2195)
  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
  
  Running processes:
  D:\WINNT\System32\smss.exe
  D:\WINNT\system32\winlogon.exe
  D:\WINNT\system32\services.exe
  D:\WINNT\system32\lsass.exe
  D:\WINNT\system32\Ati2evxx.exe
  D:\WINNT\system32\svchost.exe
  D:\WINNT\system32\spoolsv.exe
  D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  D:\WINNT\system32\svchost.exe
  D:\Program Files\Ahead\InCD\InCDsrv.exe
  D:\WINNT\system32\MSTask.exe
  D:\Program Files\Spyware Doctor\sdhelp.exe
  D:\WINNT\System32\WBEM\WinMgmt.exe
  D:\WINNT\system32\Ati2evxx.exe
  D:\WINNT\system32\chh.exe
  D:\WINNT\Explorer.exe
  D:\Program Files\Common Files\Real\Update_OB\realsched.exe
  D:\WINNT\system32\soundmax.exe
  D:\WINNT\system32\rundll32.exe
  C:\nwnmff_12.exe
  C:\dfndrff_12.exe
  C:\kybrdff_12.exe
  D:\winnt\system32\stonedrv.exe
  D:\winnt\system32\taskmgn.exe
  D:\WINNT\system32\rpcc.exe
  D:\Program Files\MSN Messenger\MsnMsgr.Exe
  D:\Program Files\Internet Explorer\iexplore.exe
  D:\WINNT\system32\cmd.exe
  D:\WINNT\system32\cscript.exe
  C:\Stupid.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
  R3 - URLSearchHook: DeskbarBHO - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - D:\Program Files\Deskbar\deskbar.dll
  F2 - REG:system.ini: Shell=Explorer.exe chh.exe
  F2 - REG:system.ini: UserInit=D:\WINNT\system32\userinit.exe,chh.exe
  O1 - Hosts: 235.214.107.41 www.virustotal.com
  O1 - Hosts: 33.3.169.44 virusscan.jotti.org
  O1 - Hosts: 95.95.239.187 sandbox.norman.no
  O1 - Hosts: 236.16.252.76 www.symantec.com
  O1 - Hosts: 81.237.212.190 securityresponse.symantec.com
  O1 - Hosts: 153.77.69.6 symantec.com
  O1 - Hosts: 101.81.142.37 www.sophos.com
  O1 - Hosts: 51.92.5.83 sophos.com
  O1 - Hosts: 22.84.63.236 www.mcafee.com
  O1 - Hosts: 204.205.34.167 mcafee.com
  O1 - Hosts: 243.212.96.143 liveupdate.symantecliveupdate.com
  O1 - Hosts: 61.96.74.78 www.viruslist.com
  O1 - Hosts: 104.47.238.203 viruslist.com
  O1 - Hosts: 109.147.117.22 f-secure.com
  O1 - Hosts: 13.244.51.53 www.f-secure.com
  O1 - Hosts: 57.5.230.76 kaspersky.com
  O1 - Hosts: 17.115.16.33 www.avp.com
  O1 - Hosts: 90.161.208.139 www.kaspersky.com
  O1 - Hosts: 50.145.99.80 avp.com
  O1 - Hosts: 233.168.246.216 www.networkassociates.com
  O1 - Hosts: 64.114.128.249 www.ca.com
  O1 - Hosts: 236.121.110.141 ca.com
  O1 - Hosts: 54.114.43.161 mast.mcafee.com
  O1 - Hosts: 118.182.103.146 my-etrust.com
  O1 - Hosts: 221.234.42.53 www.my-etrust.com
  O1 - Hosts: 78.49.5.243 download.mcafee.com
  O1 - Hosts: 11.207.240.9 dispatch.mcafee.com
  O1 - Hosts: 185.176.201.53 secure.nai.com
  O1 - Hosts: 219.150.202.149 nai.com
  O1 - Hosts: 192.252.18.2 www.nai.com
  O1 - Hosts: 21.236.30.16 update.symantec.com
  O1 - Hosts: 19.195.32.170 updates.symantec.com
  O1 - Hosts: 130.65.67.206 us.mcafee.com
  O1 - Hosts: 115.196.49.111 liveupdate.symantec.com
  O1 - Hosts: 117.157.101.252 customer.symantec.com
  O1 - Hosts: 183.213.47.157 rads.mcafee.com
  O1 - Hosts: 68.79.239.155 trendmicro.com
  O1 - Hosts: 211.47.228.251 www.trendmicro.com
  O2 - BHO: (no name) - {61CD4101-FB0D-4316-8FFA-A1010BC677B3} - D:\WINNT\system32\awtqn.dll
  O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\system32\msdxm.ocx
  O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - D:\Program Files\Canon\Easy-WebPrint\Toolband.dll
  O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\zh-sg\msntb.dll
  O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - D:\Program Files\ToolBar888\MyToolBar.dll
  O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - D:\Program Files\TheSearchAccelerator\UCMTSAIE.dll
  O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
  O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [Soundmax Audio Drivers] soundmax.exe
  O4 - HKLM\..\Run: [WinDLL (nope.dll)] rundll32.exe D:\WINNT\system32\nope.dll,start
  O4 - HKLM\..\Run: [newname] C:\\nwnmff_12.exe
  O4 - HKLM\..\Run: [defender] C:\\dfndrff_12.exe
  O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_12.exe
  O4 - HKLM\..\Run: [stonedrv] d:\winnt\system32\stonedrv.exe
  O4 - HKLM\..\Run: [Windows Task Manager] d:\winnt\system32\taskmgn.exe
  O4 - HKLM\..\RunServices: [Ms Java for Windows NT] 86541_netapi.exe
  O4 - HKLM\..\RunServices: [Soundmax Audio Drivers] soundmax.exe
  O4 - HKLM\..\RunServices: [stonedrv] d:\winnt\system32\stonedrv.exe
  O4 - HKLM\..\RunServices: [Asus MotherBoard Utility] asus.exe
  O4 - HKLM\..\RunServices: [Windows firewall manager] chh.exe
  O4 - HKCU\..\Run: [Internet Explorer6.0] iexplore.exe
  O4 - HKCU\..\Run: [Spyware Doctor] "D:\Program Files\Spyware Doctor\swdoctor.exe" /Q
  O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [Soundmax Audio Drivers] soundmax.exe
  O4 - HKCU\..\Run: [stonedrv] d:\winnt\system32\stonedrv.exe
  O4 - HKCU\..\Run: [shell] "D:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00013.exe"
  O4 - HKCU\..\RunServices: [Ms Java for Windows NT] 17751_netapi.exe
  O4 - HKCU\..\RunServices: [Asus MotherBoard Utility] asus.exe
  O4 - HKCU\..\RunServices: [Windows firewall manager] chh.exe
  O4 - Global Startup: ATI CATALYST System Tray.lnk = D:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
  O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
  O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
  O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
  O8 - Extra context menu item: Easy-WebPrint Preview - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
  O8 - Extra context menu item: Easy-WebPrint Print - res://D:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - D:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1144774493781
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1145036379656
  O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://D:\TempEI4\EI40_\msxml4.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{63237AC7-4347-480A-BEF0-A947B53D157E}: NameServer = 165.21.100.88 165.21.83.88
  O20 - Winlogon Notify: awtqn - D:\WINNT\system32\awtqn.dll
  O20 - Winlogon Notify: Installer - D:\WINNT\system32\l44q0eh5eh4.dll
  O20 - Winlogon Notify: Internet Settings - D:\WINNT\system32\rwm.dll (file missing)
  O20 - Winlogon Notify: IPConfMSP - D:\WINNT\system32\gppml3711.dll (file missing)
  O20 - Winlogon Notify: Nls - D:\WINNT\system32\hwd.dll (file missing)
  O20 - Winlogon Notify: policies - D:\WINNT\system32\iocvid.dll (file missing)
  O20 - Winlogon Notify: Reliability - D:\WINNT\system32\mfdtcui.dll (file missing)
  O20 - Winlogon Notify: Syncmgr - D:\WINNT\system32\k0lq0a35ed.dll (file missing)
  O20 - Winlogon Notify: WindowsUpdate - D:\WINNT\system32\k0lq0a35ed.dll (file missing)
  O21 - SSODL: SysTray - {E61B5E20-DE35-11CF-9C87-1579005127ED} - D:\WINNT\system32\msc.cpl
  O21 - SSODL: msp.cpl - {E21B5E20-DE35-11CF-9C87-157900512701} - D:\WINNT\system32\msp.cpl
  O23 - Service: 62804 - Unknown owner - \\220.255.25.200\Admin$\eraseme_40880.exe (file missing)
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINNT\system32\Ati2evxx.exe
  O23 - Service: ATI Smart - Unknown owner - D:\WINNT\system32\ati2sgag.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - D:\WINNT\System32\dmadmin.exe
  O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - D:\Program Files\Ahead\InCD\InCDsrv.exe
  O23 - Service: iPodService - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Windows Vista/NT Runtime Compatibility Service (ntrcs) - Unknown owner - D:\WINNT\system32\7.tmp (file missing)
  O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - D:\Program Files\Spyware Doctor\sdhelp.exe
  O23 - Service: Windows Genuine Advantage Registration Service (wgareg) - Unknown owner - D:\WINNT\system32\wgareg.exe
  O23 - Service: Microsoft Windows Spooler Service (Windows Spooler Service) - Unknown owner - D:\WINNT\services.exe (file missing)
  
  
• ndmmxiaomayi

  25 Aug 06, 10:20

  lazy2:
  
  You got too many infections that I can't handle.
  
  Go to Malware Removal Forum and the experts will be able to help you. Copy and paste this log to the forum and wait for replies.
  
  Don't quote my nick in the forum, thanks.
• zanadu

  31 Aug 06, 13:42

  Why not learn to fix your own PC problems? Save repair and maintenance cost. Help your friends with their PC problems. (They will love you)
  You will learn to troubleshoot, repair, maintain, and upgrade PCs and home-networks.
• CHoCo^LaTcH

  31 Aug 06, 13:47

  Originally posted by lazy2:

  I tried opening anti spyware, AVG and stuff. They just appear for a spilt second and disappears...

  I'm having the same thing...
  no use opening them now...the virus will close it..
  if u wan try reformat your com...the virus will go away...
• V_Rossi

  16 Sep 06, 14:00

  hi all my computer is extremely slow... the browser takes forever 2 load. i have tried running anti spyware scans using spybot but there's only a slight improvement.. my computer knowledge is elementry and i was told by a friend 2 download "hijack this" and paste the logfile in this forum. So if anyone out there could giv me a hand, it would be greatly appreciated.. Coz i have no idea wat 2 do!... Thankz in advance!..
• V_Rossi

  16 Sep 06, 14:15

  Logfile of HijackThis v1.99.1
  Scan saved at 1:08:53 PM, on 9/16/2006
  Platform: Windows XP SP1 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\LEXBCES.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\LEXPPS.EXE
  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
  C:\WINDOWS\System32\ctfmon.exe
  C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
  C:\Program Files\Spyware Doctor\swdoctor.exe
  C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
  C:\Program Files\Spyware Doctor\sdhelp.exe
  C:\Documents and Settings\user\Desktop\LimeWire\LimeWire.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\WINDOWS\System32\wdfmgr.exe
  C:\WINDOWS\system32\UStorSrv.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\DOCUME~1\user\LOCALS~1\Temp\~e5.0001
  C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
  C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\WINDOWS\System32\svchost.exe
  C:\PROGRA~1\WINZIP\winzip32.exe
  C:\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
  O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
  O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
  O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
  O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
  O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
  O4 - Startup: LimeWire On Startup.lnk = C:\Documents and Settings\user\Desktop\LimeWire\LimeWire.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
  O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
  O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
  O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
  O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
  O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
  O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
  O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O16 - DPF: Yahoo! Bingo - http://download.games.yahoo.com/games/clients/y/xt0_x.cab
  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
  O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://C:\foo.mht!http://dl.ad-ware.cc/qtpr7edJk-uCYvJZkloZ.chm::/on.exe
  O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab_adult/180solutions/ie/bridge-c9.cab
  O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
  O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - http://www.miniclip.com/supergerball/miniclipGameLoader.dll
  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by7fd.bay7.hotmail.msn.com/resources/MsnPUpld.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1119937379000
  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
  O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
  O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
  O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
  O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
  O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
  O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  O23 - Service: UStorage Server Service - OTi - C:\WINDOWS\system32\UStorSrv.exe
  
  
• davidche

  16 Sep 06, 15:32

  Originally posted by V_Rossi:

  Logfile of HijackThis v1.99.1
  Scan saved at 1:08:53 PM, on 9/16/2006
  Platform: Windows XP SP1 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\LEXBCES.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\LEXPPS.EXE
  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
  C:\WINDOWS\System32\ctfmon.exe
  C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
  C:\Program Files\Spyware Doctor\swdoctor.exe
  C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
  C:\Program Files\Spyware Doctor\sdhelp.exe
  C:\Documents and Settings\user\Desktop\LimeWire\LimeWire.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\WINDOWS\System32\wdfmgr.exe
  C:\WINDOWS\system32\UStorSrv.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\DOCUME~1\user\LOCALS~1\Temp\~e5.0001
  C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
  C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\WINDOWS\System32\svchost.exe
  C:\PROGRA~1\WINZIP\winzip32.exe
  C:\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
  O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
  O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
  O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
  O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
  O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
  O4 - Startup: LimeWire On Startup.lnk = C:\Documents and Settings\user\Desktop\LimeWire\LimeWire.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
  O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
  O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
  O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
  O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
  O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
  O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
  O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O16 - DPF: Yahoo! Bingo - http://download.games.yahoo.com/games/clients/y/xt0_x.cab
  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
  O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://C:\foo.mht!http://dl.ad-ware.cc/qtpr7edJk-uCYvJZkloZ.chm::/on.exe
  O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab_adult/180solutions/ie/bridge-c9.cab
  O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
  O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - http://www.miniclip.com/supergerball/miniclipGameLoader.dll
  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by7fd.bay7.hotmail.msn.com/resources/MsnPUpld.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1119937379000
  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
  O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
  O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
  O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
  O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
  O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
  O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  O23 - Service: UStorage Server Service - OTi - C:\WINDOWS\system32\UStorSrv.exe
  
  

  im a com idiot.
  
  your com is clean
  
  
• ndmmxiaomayi

  16 Sep 06, 21:51

  Originally posted by V_Rossi:

  hi all my computer is extremely slow... the browser takes forever 2 load. i have tried running anti spyware scans using spybot but there's only a slight improvement.. my computer knowledge is elementry and i was told by a friend 2 download "hijack this" and paste the logfile in this forum. So if anyone out there could giv me a hand, it would be greatly appreciated.. Coz i have no idea wat 2 do!... Thankz in advance!..

  Uninstall one of the antivirus. Use either Symantec or AVG.
  
  Open HijackThis. Select Do a system scan.
  
  Tick these:
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
  
  O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://C:\foo.mht!http://dl.ad-ware.cc/qtpr7edJk-uCYvJZkloZ.chm::/on.exe
  
  O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab_adult/180solutions/ie/bridge-c9.cab
  
  O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
  
  Click Fix Checked.
  
  Update your Windows here.
  
  Restart when prompted. Go back to Windows Update until there are no more updates to be done.
  
  Uninstall your Adobe Acrobat Reader and download the latest version here.
  
  Update your Java here. Scroll down to Java Runtime Environment (JRE) 5.0 Update 8. Download the update and follow the instructions.
  
  Update your Spybot and do a scan. Remove anything found. Restart and post back a new log.