As previously advised ...........
"**Post your log to
> http://aumha.net/viewforum.php?f=30,
> http://forums.spybot.info/forumdisplay.php?f=22,
> http://castlecops.com/forum67.html, or other appropriate forums for review
> by an expert in such matters, not here.**"
--
TaurArian [MVP] 2005-2009 - Update Services
http://taurarian.mvps.org
======================================
How to ask a question:
http://support.microsoft.com/kb/555375
Computer Maintenance: Acronis / Diskeeper / Paragon / Raxco
"jugglajr" <> wrote in message
news:A0AF8F0B-BD41-4DC8-BCC3-...
|I keep getting this error so I took your advice and ran Hijackthis. Here is
| my log if you could be so kind as to point out my flaws.
|
| C:\WINDOWS.0\System32\alg.exe
| c:\7339d640b6067c990f978f6a\setup.exe
| C:\WINDOWS.0\Microsoft.NET\Framework\v2.0.50727\ms corsvw.exe
| C:\WINDOWS.0\system32\spoolsv.exe
| C:\Program Files\Internet Explorer\IEXPLORE.EXE
| C:\WINDOWS.0\system32\mmc.exe
| C:\WINDOWS.0\system32\wbem\wmiprvse.exe
| C:\Documents and Settings\Your Pc\Desktop\hijackthis.exe
|
| R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
| C:\windows\system32\blank.htm
| R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
| C:\windows\system32\blank.htm
| O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
| O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17}
| - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
| O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
| O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
| O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program
| Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
| O4 - HKLM\..\Run: [C:\WINDOWS.0\system32\kdhct.exe]
| C:\WINDOWS.0\system32\kdhct.exe
| O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe"
| -atboottime
| O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
| C:\WINDOWS.0\system32\NvCpl.dll,NvStartup
| O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
| O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE
| C:\WINDOWS.0\system32\NvMcTray.dll,NvTaskbarInit
| O4 - HKLM\..\Run: [LaunchAntiSpy] C:\Program Files\DefenderPro\TSAntiSpy.exe
| /startup
| O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
| O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink
| Advisor\LinksysAgent.exe" /startup
| O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
| O4 - HKCU\..\Run: [Somefox] C:\DOCUME~1\YOURPC~1\LOCALS~1\Temp\setup91.exe
| O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools
| Lite\daemon.exe" -autorun
| O4 - HKCU\..\Run: [Performance Center] C:\Program
| Files\Ascentive\Performance Center\ApcMain.exe -m
| O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS.0\system32\ctfmon.exe
| O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\Download Manager\DLM.exe
| /windowsstart /startifwork
| O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org
| 2.3\program\quickstart.exe
| O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} -
| C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe
| O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -
| {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network
| Diagnostic\xpnetdiag.exe
| O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
| C:\Program Files\Messenger\msmsgs.exe (file missing)
| O9 - Extra 'Tools' menuitem: Windows Messenger -
| {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
| Files\Messenger\msmsgs.exe (file missing)
| O9 - Extra button: Absolute Poker Basic -
| {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\Your
| Pc\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk (HKCU)
| O9 - Extra 'Tools' menuitem: Absolute Poker Basic -
| {5E72AD5A-20DF-4ca4-9B7B-D9717FFDE0C5} - C:\Documents and Settings\Your
| Pc\Start Menu\Programs\Absolute Poker Basic\Absolute Poker Basic.lnk (HKCU)
| O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
| O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab)
| -
http://www.srtest.com/srl_bin/sysreqlab3.cab
| O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan
| Agent 6.6) -
|
http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
| O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) -
|
http://www.fileplanet.com/fpdlmgr/ca..._2.3.6.108.cab
| O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
|
http://www.update.microsoft.com/wind...?1211489755140
| O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab)
| -
http://www.nvidia.com/content/Driver...sysreqlab2.cab
| O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} -
|
http://download.divx.com/player/DivXBrowserPlugin.cab
| O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) -
|
http://www.acclaim.com/cabs/acclaim_v5.cab
| O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
|
http://www.update.microsoft.com/micr...?1216442179714
| O17 -
| HKLM\System\CCS\Services\Tcpip\..\{0944A9EC-25A3-424A-9337-91CC486C1C55}:
| NameServer = 192.168.1.1,192.168.1.10
| O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
| C:\WINDOWS.0\system32\nvsvc32.exe
| O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools -
| C:\Program Files\Spyware Doctor\pctsAuxs.exe
| O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools -
| C:\Program Files\Spyware Doctor\pctsSvc.exe
|
| "PA Bear [MS MVP]" wrote:
|
| > Most likely cause: A rootkit-protected hijackware infection (i.e., Vundo &
| > ZLOB & SDBot-variant). You will need the assistance of an expert to clean
| > the machine.
| >
| > Run a thorough check for hijackware, including posting your hijackthis log
| > to an appropriate forum.
| >
| > Checking for/Help with Hijackware
| >
http://aumha.org/a/parasite.htm
| >
http://aumha.org/a/quickfix.htm
| >
http://aumha.net/viewtopic.php?t=5878
| >
http://wiki.castlecops.com/Malware_R...:_Introduction
| >
http://mvps.org/winhelp2002/unwanted.htm
| >
http://inetexplorer.mvps.org/data/prevention.htm
| >
http://inetexplorer.mvps.org/tshoot.html
| >
http://www.mvps.org/sramesh2k/Malware_Defence.htm
| >
http://defendingyourmachine2.blogspot.com/
| >
http://www.elephantboycomputers.com/...moving_Malware
| >
| > When all else fails, HijackThis v2.0.2
| > (
http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
| > It will help you to both identify and remove any hijackware/spyware with
| > assistance from an expert. **Post your log to
| >
http://aumha.net/viewforum.php?f=30,
| >
http://forums.spybot.info/forumdisplay.php?f=22,
| >
http://castlecops.com/forum67.html, or other appropriate forums for review
| > by an expert in such matters, not here.**
| >
| > If the procedures look too complex - and there is no shame in admitting this
| > isn't your cup of tea - take the machine to a local, reputable and
| > independent (i.e., not BigBoxStoreUSA) computer repair shop.
| > --
| > ~Robear Dyer (PA Bear)
| > MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
| > AumHa VSOP & Admin
http://aumha.net
| > DTS-L
http://dts-l.net/
| >
| >
| > ArthurRW wrote:
| > > Norton Antivirus quarrentined "Vundo" but I still can't access Automatic
| > > Update, don't know if it's related but I can't use my printer program
| > > either
| > >
| > > "TaurArian" wrote:
| > >
| > >> Considerations:-
| > >>
| > >> The system may be infected with malware "Vundo"
| > >>
http://www.microsoft.com/security/po...=Win32%2fVundo
| > >>
| > >> or
| > >>
| > >> Service does not start and displays "Error 1058"
| > >>
http://support.microsoft.com/kb/241584
| > >>
| > >> or
| > >>
| > >> You cannot manually start the Automatic Updates service and you receive
| > >> an
| > >> "Error 1058" error message on a computer that is running Windows XP or
| > >> Windows XP Tablet PC Edition 2005
| > >>
http://support.microsoft.com/kb/896224
| > >>
| > >>
| > >> --
| > >>
| > >> --------------------------------
| > >> TaurArian [MVP] 2005-2008
| > >> Update Services
| > >>
http://taurarian.mvps.org
| > >>
| > >>
| > >> "ArthurRW" wrote:
| > >>
| > >>> I had a mini crash, every time I enable Automatic Updates it disables
| > >>> and
| > >>> gives me an error msg and says I have no enabled devices associated with
| > >>> it. What devices do I need and how do I associate them?
| >
| >