|
My Drive does NOT detect my blank cd's. Nero caused it...
|
|
|
petjelly
Junior Member
|
19. July 2006 @ 21:24 |
Link to this message
|
|
wouldn't it just be easier if i pull out my windows reinstallation cd? someone told me that if i renstall windows my pc would be like brand new again without all the viruses.
|
|
Advertisement
|
 |
|
|
|
scorpNZ
AfterDawn Addict
4 product reviews
|
19. July 2006 @ 23:35 |
Link to this message
|
I was about to advise just wait a lttle longer for us to help out,then i looked at the date when this topic was started and i thnk it would be best to start over and there's more reasons to do so other than viruses etc but that's another story,any data you need will need to be saved to rom and before reinstall the disk must be opened and scanned with the virus scanner,i would advise not to save any software utility's unless you know for sure they're safe
once reformatted and before connecting to the net you'll need to make sure you have the firewall enabled(look in network connections to enable xp's firewalled connection untill you have time to get a zonalarm firewall or any othervfree two way software firewall if you don't already have such software saved),and then head straight to microsoft update site and do not leave untill all updates are installed,next you'll need antivirus if you have'nt managed to successfully download AVG or something similar,if you do have antivirus downloaded save it to rom and install after installing windows.
use xp's disk cleanup utility and defrag after xp is installed,and then again after each 3-4 software installs
AVG -free antivirus
ZoneAlarm or similar two way free software firewall
you'll need after above updates etc all are free for personal use
windows defender
adaware SE
Spybot
Do not install any toolbars other than or what is recommended at cnet
Yahoo
Google
Stumbleupon
Printme
etc
go get yourself a free safe registry cleaner called
easycleaner by toni arts
and
ccleaner -becareful this ones a bit more vigorous at deleting registry entries
You'll need to update AOL software if you reinstall it, as it's got as many holes in it as xp does
|
|
petjelly
Junior Member
|
20. July 2006 @ 12:18 |
Link to this message
|
|
ok^ Just to let you know. The wininet problem is gone. No more pop ups. My internet page is working fine now(had no problems trying to get online today to get here). Plus I was finally able to update my internet explorer 5 to internet explorer 6. I did the scans on safe mode in order :)
First...Ccleaner scan(safe mode)
Second...Cwshredder scan(safe mode)
Third...Ad-Aware scan(safe mode)
Fourth...Spybot Search scan(not in safe mode) Does that matteR? forgot about it and didn't feel like goin back to safe mode.
Fifth...House call scan froze on me during scan. Im gonna try to do it one more time since i updated my Internet explorer. By the way i cant do this in safe mode because for some odd reason safe mode does not allow me use the internet. I remember using the internet on safe mode before.
Sixth...AVG Free Scan(safe mode)It picked up 3,400 viruses! It removed every single one of them except for the 3 trojans that were still left. I search comp for the trojan files and deleted them. I did another scan it discovered 0 viruses. The trojan viruses were finally gone. But however...my Petition table(MBR) resulted in a error, Also my Boot Sector C: read an error during the scan. Im assuming that this is causing my driver problems.
Seventh...HiJack Scan(safe mode) Im not sure if your gonna want the log because i still havent done the housecall scan yet. Im gonna try one more time if it doesn't work i'll post up the HiJack Log after i do all the scan over again.
|
Senior Member
|
20. July 2006 @ 12:55 |
Link to this message
|
@ petjelly
You will not be able to use the internet in safe mode unless you chose that option. However, the reason for using safe mode is so that the start up programs won't run.
You said that you went in and deleted the Trojans yourself. Well, that is not necessarily going to get rid of them. Follow the previous instructions step by step in safe mode again. Tell me the files or Trojans that AVG recognized and could not get rid of. See most virus problem occur within your registry. Unless you remove them properly, they will still exist.
Go through it one more time. Don't worry about the HjT log yet. We will do that after we know the viruses are gone. This is step by step maintenance that should be done regularly, however, not in this great of detail!
|
|
mrbenz04
Newbie
|
20. July 2006 @ 12:55 |
Link to this message
|
can any one help. i have uninstalled and reinstalled and even updated it but still can not burn a dvd. Theses are the errors.
1A23-OD06-7130-1345-9533-245B
Windows XP 5.1
IA32
WinAspi: File 'Wnaspi32.dll': Ver=4.60 (1021), size=45056 bytes, created 9/10/1999 12:06:00 PM
ahead WinASPI: File 'C:\Program Files\Ahead\Nero\Wnaspi32.dll': Ver=2.0.1.74, size=164112 bytes, created 11/2/2004 12:54:32 PM
NT-SPTI used
Nero API version: 6.6.1.4
Using interface version: 6.3.1.4
Installed in: C:\Program Files\Ahead\Nero\
Application: ahead\Nero - Burning Rom
Internal Version: 6, 6, 1, 4d
Recorder: <_NEC DVD+RW ND-1100A> Version: 10GE - HA 1 TA 1 - 6.6.1.4
Adapter driver: <IDE> HA 1
Drive buffer : 2048kB
Bus Type : default (0) -> ATAPI, detected: ?
=== Scsi-Device-Map ===
DiskPeripheral : WDC WD1200JB-75CRA0 atapi Port 0 ID 0 DMA: On
CdRomPeripheral : SAMSUNG DVD-ROM SD-616T atapi Port 1 ID 0 DMA: On
CdRomPeripheral : _NEC DVD+RW ND-1100A atapi Port 1 ID 1 DMA: On
=== CDRom-Device-Map ===
SAMSUNG DVD-ROM SD-616T D: CDRom0
_NEC DVD+RW ND-1100A E: CDRom1
=======================
AutoRun : 1
Excluded drive IDs:
WriteBufferSize: 83886080 (0) Byte
ShowDrvBufStat : 0
BUFE : 0
Physical memory : 766MB (785388kB)
Free physical memory: 402MB (412556kB)
Memory in use : 47
Uncached PFiles: 0x0
Use Inquiry : 1
Global Bus Type: default (0)
Check supported media : Disabled (0)
20.7.2006
NeroAPI
3:29:15 PM #1 Phase 112 File APIProgress.cpp, Line 275
DVD-Video files reallocation started
3:29:15 PM #2 Phase 114 File APIProgress.cpp, Line 275
DVD-Video files reallocation completed (no file modified)
3:29:15 PM #3 Phase 111 File APIProgress.cpp, Line 275
DVD-Video files sorted
3:29:15 PM #4 SPTI -1065 File SCSIPassThrough.cpp, Line 289
E: CdRom1: SCSIStatus(x02) WinError(0) NeroError(-1065)
Sense Key: 0x05 (KEY_ILLEGAL_REQUEST)
Sense Code: 0x20
Sense Qual: 0x00
CDB Data: 0xFA 10 00 00 00 00 00 00 06 00 00 00
Sense Area: 0x70 00 05 00 00 00 00 0A 00 00 00 00 20
Buffer x08325000: Len x6
3:29:15 PM #5 NEROAPI 7 File Burncd.cpp, Line 3095
Error:\nCannot connect TRF.
3:29:15 PM #6 Text 0 File AudioCompilationImpl.cpp, Line 867
DRM: DRM burn session terminated.
3:29:15 PM #7 Text 0 File AudioCompilationImpl.cpp, Line 896
DRM: Closing entire DRM handling. Bye.
Existing drivers:
File 'Drivers\CDRALW2K.SYS': Ver=5.3.2.34, size=23420 bytes, created 7/20/2006 5:47:53 AM
File 'Drivers\ASPI32.SYS': Ver=4.60 (1021), size=25244 bytes, created 9/10/1999 12:06:00 PM
File 'Drivers\PXHELP20.SYS': Ver=2.02.62a, size=20016 bytes, created 5/31/2006 4:25:10 PM (Prassi/Veritas driver for win 2K)
Registry Keys:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\AllocateCDROMs : 0 (Security Option)
|
Moderator
|
20. July 2006 @ 14:48 |
Link to this message
|
@mrbenz04
This thread has nothing to do with that error - your error is due to Nero 6.6.1.4 'breaking' the autoburn w/ Shrink. So see this thread w/ instructions and downloads to correct the problem:
http://forums.afterdawn.com/thread_view.cfm/325848
If you are still having a problem you'll need to start a new thread.
@petjelly
Glad to see these guys are getting you straight!
(oh and you may want to rethink about where you get your dl's even once the av & firewall are installed & running - some are worse than others for the crap you get from them)
|
|
dolphin2
Suspended due to non-functional email address
|
20. July 2006 @ 14:55 |
Link to this message
|
@mrbenz04
Also edit out your Nero serial number! It starts with 1A23 and is at the top of the log file. Pirates will steal it!
@binkie7
Glad to see your staying with the thread!
This message has been edited since posting. Last time this message was edited on 20. July 2006 @ 15:00
|
Moderator
|
20. July 2006 @ 15:01 |
Link to this message
|
|
@dolphin2
Oops missed that major one - txs for catching it :)
|
|
petjelly
Junior Member
|
20. July 2006 @ 15:06 |
Link to this message
|
The list of viruses that i had to delete myself.
Logfile of HijackThis v1.99.1
Scan saved at 6:51:57 PM, on 7/20/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\devldr32.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\Documents and Settings\tami\Local Settings\Temp\Temporary Directory 1 for HijackThis.zip\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search-system.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr6/*...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr6/*...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr7/*http://www...
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://www...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by CenturyTel
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = 221.10.124.34:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 221.10.124.34:8080:0
O1 - Hosts: nu.com
O1 - Hosts: nu.com
O1 - Hosts: .whenu.com
O1 - Hosts: .whenu.com
O1 - Hosts: c.whenu.com
O1 - Hosts: c.whenu.com
O1 - Hosts: nc.whenu.com
O1 - Hosts: nc.whenu.com
O1 - Hosts: inc.whenu.com
O1 - Hosts: inc.whenu.com
O1 - Hosts: m
O1 - Hosts: m
O1 - Hosts: m
O1 - Hosts: m
O1 - Hosts: om
O1 - Hosts: om
O1 - Hosts: com
O1 - Hosts: com
O1 - Hosts: m
O1 - Hosts: m
O1 - Hosts: .com
O1 - Hosts: .com
O1 - Hosts: .com
O1 - Hosts: .com
O1 - Hosts: d.com
O1 - Hosts: d.com
O1 - Hosts: nd.com
O1 - Hosts: nd.com
O1 - Hosts: ind.com
O1 - Hosts: ind.com
O1 - Hosts: find.com
O1 - Hosts: find.com
O1 - Hosts: yfind.com
O1 - Hosts: yfind.com
O1 - Hosts: tyfind.com
O1 - Hosts: tyfind.com
O1 - Hosts: styfind.com
O1 - Hosts: styfind.com
O1 - Hosts: estyfind.com
O1 - Hosts: estyfind.com
O1 - Hosts: styfind.com
O1 - Hosts: styfind.com
O1 - Hosts: .zestyfind.com
O1 - Hosts: .zestyfind.com
O1 - Hosts: .offeroptimizer.com
O1 - Hosts: so.offeroptimizer.com
O1 - Hosts: 1
O1 - Hosts: 127.0.0.
O1 - Hosts: 1 www.z
O1 - Hosts: .com
O1 - Hosts: ar.com
O1 - Hosts: lbar.com
O1 - Hosts: oolbar.com
O1 - Hosts: rtoolbar.com
O1 - Hosts: 127.0.
O1 - Hosts: sertoolbar.com
O1 - Hosts: owsertoolbar.com
O1 - Hosts: 127
O1 - Hosts: 2.browsertoolbar.com
O1 - Hosts: ww2.browsertoolbar.com
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [*tcpiis] C:\WINDOWS\system32\1028\tcpiis.exe
O4 - HKLM\..\Run: [*jpegdb] C:\WINDOWS\Driver Cache\jpegdb.exe
O4 - HKLM\..\Run: [*utilvss] C:\WINDOWS\AppPatch\utilvss.exe
O4 - HKLM\..\Run: [*crbak] C:\WINDOWS\Tasks\crbak.exe
O4 - HKLM\..\Run: [*expdrv] C:\WINDOWS\system32\Microsoft\expdrv.exe
O4 - HKLM\..\Run: [*urlsvc] C:\WINDOWS\security\Database\urlsvc.exe
O4 - HKLM\..\Run: [*mckey] C:\WINDOWS\Config\mckey.exe
O4 - HKLM\..\Run: [*urljava] C:\WINDOWS\addins\urljava.exe
O4 - HKLM\..\Run: [*logbas] C:\WINDOWS\Windows Update Setup Files\logbas.exe
O4 - HKLM\..\Run: [*psvss] C:\WINDOWS\Config\psvss.exe
O4 - HKLM\..\Run: [*xmltask] C:\WINDOWS\msagent\xmltask.exe
O4 - HKLM\..\Run: [*mfcac] C:\WINDOWS\Web\mfcac.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [tcpiis] C:\WINDOWS\system32\1028\tcpiis.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [STOPzilla] "C:\Program Files\STOPzilla!\Stopzilla.exe" /autorun
O4 - HKLM\..\Run: [Speed racer] C:\Program Files\Creative\PlayCenter\CTSRReg.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Ink Monitor] C:\PROGRA~1\EPSON\INKMON~1\InkMonitor.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1138331230\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O15 - Trusted Zone: http://*.windupdates.com
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/cl...
O20 - Winlogon Notify: dbcab - C:\DOCUME~1\tami\LOCALS~1\Temp\bacbd.dat
O20 - Winlogon Notify: dosreg - C:\DOCUME~1\tami\LOCALS~1\Temp\gersod.dat
O20 - Winlogon Notify: hardcat - C:\DOCUME~1\tami\LOCALS~1\Temp\tacdrah.dat
O20 - Winlogon Notify: liburl - C:\DOCUME~1\tami\LOCALS~1\Temp\lrubil.dat
O20 - Winlogon Notify: msvcabr - C:\DOCUME~1\tami\LOCALS~1\Temp\rbacvsm.dat
O20 - Winlogon Notify: runun - C:\DOCUME~1\tami\LOCALS~1\Temp\nunur.dat
O20 - Winlogon Notify: svcjava - C:\DOCUME~1\tami\LOCALS~1\Temp\avajcvs.dat
O20 - Winlogon Notify: svrvss - C:\DOCUME~1\tami\LOCALS~1\Temp\ssvrvs.dat
O20 - Winlogon Notify: wintask - C:\DOCUME~1\tami\LOCALS~1\Temp\ksatniw.dat
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
|
|
dolphin2
Suspended due to non-functional email address
|
20. July 2006 @ 15:19 |
Link to this message
|
|
@binkie7
No problem!
|
|
dolphin2
Suspended due to non-functional email address
|
20. July 2006 @ 15:35 |
Link to this message
|
Click the check boxes for the following lines in HiJack This! then click Fix:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = 221.10.124.34:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 221.10.124.34:8080:0
O1 - Hosts: nu.com
O1 - Hosts: nu.com
O1 - Hosts: .whenu.com
O1 - Hosts: .whenu.com
O1 - Hosts: c.whenu.com
O1 - Hosts: c.whenu.com
O1 - Hosts: nc.whenu.com
O1 - Hosts: nc.whenu.com
O1 - Hosts: inc.whenu.com
O1 - Hosts: inc.whenu.com
O1 - Hosts: m
O1 - Hosts: m
O1 - Hosts: m
O1 - Hosts: m
O1 - Hosts: om
O1 - Hosts: om
O1 - Hosts: com
O1 - Hosts: com
O1 - Hosts: m
O1 - Hosts: m
O1 - Hosts: .com
O1 - Hosts: .com
O1 - Hosts: .com
O1 - Hosts: .com
O1 - Hosts: d.com
O1 - Hosts: d.com
O1 - Hosts: nd.com
O1 - Hosts: nd.com
O1 - Hosts: ind.com
O1 - Hosts: ind.com
O1 - Hosts: find.com
O1 - Hosts: find.com
O1 - Hosts: yfind.com
O1 - Hosts: yfind.com
O1 - Hosts: tyfind.com
O1 - Hosts: tyfind.com
O1 - Hosts: styfind.com
O1 - Hosts: styfind.com
O1 - Hosts: estyfind.com
O1 - Hosts: estyfind.com
O1 - Hosts: styfind.com
O1 - Hosts: styfind.com
O1 - Hosts: .zestyfind.com
O1 - Hosts: .zestyfind.com
O1 - Hosts: .offeroptimizer.com
O1 - Hosts: so.offeroptimizer.com
O1 - Hosts: 1
O1 - Hosts: 127.0.0.
O1 - Hosts: 1 www.z
O1 - Hosts: .com
O1 - Hosts: ar.com
O1 - Hosts: lbar.com
O1 - Hosts: oolbar.com
O1 - Hosts: rtoolbar.com
O1 - Hosts: 127.0.
O1 - Hosts: sertoolbar.com
O1 - Hosts: owsertoolbar.com
O1 - Hosts: 127
O1 - Hosts: 2.browsertoolbar.com
O1 - Hosts: ww2.browsertoolbar.com
Download, install and run this
http://www.ewido.net/en/
Post another HiJack log when completed.
|
Senior Member
|
20. July 2006 @ 17:32 |
Link to this message
|
|
dolphin2-
Is ewido better than Lavasoft?
|
|
scorpNZ
AfterDawn Addict
4 product reviews
|
20. July 2006 @ 17:36 |
Link to this message
|
|
I would recommend removal of the file sharing program bearshare,i just googled and it's flagged as a spyware installer and cnet also no longer have it for download,the good news is it looks like your getting there *woot*
|
|
dolphin2
Suspended due to non-functional email address
|
20. July 2006 @ 17:44 |
Link to this message
|
Ewido, Ad-Aware and Spybot all catch different things. So is it any better, no, but just as good and should be used also.
|
|
petjelly
Junior Member
|
20. July 2006 @ 19:28 |
Link to this message
|
Logfile of HijackThis v1.99.1
Scan saved at 11:26:17 PM, on 7/20/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Common Files\AOL\1138331230\ee\AOLSoftware.exe
C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
C:\WINDOWS\System32\devldr32.exe
C:\WINDOWS\System32\devldr32.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
c:\program files\common files\aol\1138331230\ee\aim6.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Documents and Settings\tami\Local Settings\Temp\Temporary Directory 3 for HijackThis.zip\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search-system.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr6/*...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr6/*...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr7/*http://www...
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://www...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by CenturyTel
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [*tcpiis] C:\WINDOWS\system32\1028\tcpiis.exe
O4 - HKLM\..\Run: [*jpegdb] C:\WINDOWS\Driver Cache\jpegdb.exe
O4 - HKLM\..\Run: [*utilvss] C:\WINDOWS\AppPatch\utilvss.exe
O4 - HKLM\..\Run: [*crbak] C:\WINDOWS\Tasks\crbak.exe
O4 - HKLM\..\Run: [*expdrv] C:\WINDOWS\system32\Microsoft\expdrv.exe
O4 - HKLM\..\Run: [*urlsvc] C:\WINDOWS\security\Database\urlsvc.exe
O4 - HKLM\..\Run: [*mckey] C:\WINDOWS\Config\mckey.exe
O4 - HKLM\..\Run: [*urljava] C:\WINDOWS\addins\urljava.exe
O4 - HKLM\..\Run: [*logbas] C:\WINDOWS\Windows Update Setup Files\logbas.exe
O4 - HKLM\..\Run: [*psvss] C:\WINDOWS\Config\psvss.exe
O4 - HKLM\..\Run: [*xmltask] C:\WINDOWS\msagent\xmltask.exe
O4 - HKLM\..\Run: [*mfcac] C:\WINDOWS\Web\mfcac.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [tcpiis] C:\WINDOWS\system32\1028\tcpiis.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [STOPzilla] "C:\Program Files\STOPzilla!\Stopzilla.exe" /autorun
O4 - HKLM\..\Run: [Speed racer] C:\Program Files\Creative\PlayCenter\CTSRReg.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Ink Monitor] C:\PROGRA~1\EPSON\INKMON~1\InkMonitor.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1138331230\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O15 - Trusted Zone: http://*.windupdates.com
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/cl...
O20 - Winlogon Notify: dbcab - C:\DOCUME~1\tami\LOCALS~1\Temp\bacbd.dat
O20 - Winlogon Notify: dosreg - C:\DOCUME~1\tami\LOCALS~1\Temp\gersod.dat
O20 - Winlogon Notify: hardcat - C:\DOCUME~1\tami\LOCALS~1\Temp\tacdrah.dat
O20 - Winlogon Notify: liburl - C:\DOCUME~1\tami\LOCALS~1\Temp\lrubil.dat
O20 - Winlogon Notify: msvcabr - C:\DOCUME~1\tami\LOCALS~1\Temp\rbacvsm.dat
O20 - Winlogon Notify: runun - C:\DOCUME~1\tami\LOCALS~1\Temp\nunur.dat
O20 - Winlogon Notify: svcjava - C:\DOCUME~1\tami\LOCALS~1\Temp\avajcvs.dat
O20 - Winlogon Notify: svrvss - C:\DOCUME~1\tami\LOCALS~1\Temp\ssvrvs.dat
O20 - Winlogon Notify: wintask - C:\DOCUME~1\tami\LOCALS~1\Temp\ksatniw.dat
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
|
Moderator
|
20. July 2006 @ 19:41 |
Link to this message
|
@dolphin2
Yep staying up w/ this thread (missed that early).
Learning a thing or 2 from you guys :)
Nero logs are 1 thing - Hijack This is another!
Quite a good learning thread actually.
From the little I can see petjelly it's cleaner but you'll need to wait for the others for better advice :)
|
|
petjelly
Junior Member
|
20. July 2006 @ 19:42 |
Link to this message
|
|
^im learning too lol
|
|
dolphin2
Suspended due to non-functional email address
|
21. July 2006 @ 00:15 |
Link to this message
|
Quote:
Yep staying up w/ this thread (missed that early).
Learning a thing or 2 from you guys :)
Nero logs are 1 thing - Hijack This is another!
Quite a good learning thread actually.
From the little I can see petjelly it's cleaner but you'll need to wait for the others for better advice :)
Glad to hear your both learning! I've been taking things slow as others are learning from this thread also.
Nero logs and HijackThis! logs are not so hard once you learn the things to look for.
@petjelly
I need to know if you ever completed one of the on-line scans. It's important that you do one of those.
|
|
petjelly
Junior Member
|
21. July 2006 @ 07:57 |
Link to this message
|
|
i was not able to complete the online house call scan. it was SLOOOW... a scan shouldnt take 4 hours. after 4 hours it said approximate time left was 2 hours 1/2. when i started the san it said 1 hour. i have comcast internet. it shouldnt take that long.
|
|
petjelly
Junior Member
|
21. July 2006 @ 11:27 |
Link to this message
|
|
just to let you know. my drive still does not detect cd's. :)
|
Senior Member
|
21. July 2006 @ 11:30 |
Link to this message
|
petjelly
1) Okay run HjT again and select the following items in the list.
R0 - HKCU\Software\Microsoft\Internet Explorer\Main Start Page = http://search-system.com/
O15 - Trusted Zone: http://*.windupdates.com
O4 - HKLM\..\Run: [tcpiis] C:\WINDOWS\system32\1028\tcpiis.exe
O4 - HKLM\..\Run: [*tcpiis] C:\WINDOWS\system32\1028\tcpiis.exe
O4 - HKLM\..\Run: [*jpegdb] C:\WINDOWS\Driver Cache\jpegdb.exe
O4 - HKLM\..\Run: [*utilvss] C:\WINDOWS\AppPatch\utilvss.exe
O4 - HKLM\..\Run: [*crbak] C:\WINDOWS\Tasks\crbak.exe
O4 - HKLM\..\Run: [*expdrv] C:\WINDOWS\system32\Microsoft\expdrv.exe
O4 - HKLM\..\Run: [*urlsvc] C:\WINDOWS\security\Database\urlsvc.exe
O4 - HKLM\..\Run: [*mckey] C:\WINDOWS\Config\mckey.exe
O4 - HKLM\..\Run: [*urljava] C:\WINDOWS\addins\urljava.exe
O4 - HKLM\..\Run: [*logbas] C:\WINDOWS\Windows Update Setup Files\logbas.exe
O4 - HKLM\..\Run: [*psvss] C:\WINDOWS\Config\psvss.exe
O4 - HKLM\..\Run: [*xmltask] C:\WINDOWS\msagent\xmltask.exe
O4 - HKLM\..\Run: [*mfcac] C:\WINDOWS\Web\mfcac.exe
After the following items are selected hit the fix items button.
2) You need to complete your updates for IE.
3) You need to delete all file that show up in the following folder. C:\DOCUMENT AND SETTINGS\tami\LOCAL SETTINGS\Temp\
There may be an item or two that will not delete, however that is okay.
After you have completed the following reboot and run another HjT log for us to look at.
Thanks!
|
Senior Member
|
21. July 2006 @ 11:32 |
Link to this message
|
|
Don't worry about your drive right now. We still need to get your system cleaned out. After that we will go back to the original problem at hand!
|
|
dolphin2
Suspended due to non-functional email address
|
21. July 2006 @ 12:03 |
Link to this message
|
|
@petjelly
Retry the other on-line scan I gave you. If that one doesn't work also, we'll try another or go a different route.
|
|
petjelly
Junior Member
|
21. July 2006 @ 13:56 |
Link to this message
|
|
C:\DOCUMENT AND SETTINGS\tami\LOCAL SETTINGS\Temp\
pasted it in run. it says windows cannot find????
|
|
Advertisement
|
|
|
Senior Member
|
21. July 2006 @ 14:07 |
Link to this message
|
|
Petjelly where are you at? Look me up in pm if your in Ne Pennsylavania. I can fix that comp right up for you. I do repairs for people here now and then.
epox mobo EP-9NPAJ
amd 3700+ san diego core oc to 2.50
antec true power 430 watt dual +12 volt rails @ 18 amps each
bfg geforce 6800 gt oc edition
dragon case
2 x 512 DUAL CHANNEL ELIXOR RAM
Ibm P260 dvi & vga 21 inch crt monitor 1600 x 1200 @ 85 htz Oh yeah!!
This message has been edited since posting. Last time this message was edited on 21. July 2006 @ 14:33
|
