madaemanon
asked on
Norton AntiVirus Difficulties
Hi. I had Norton AntiVirus 2004 Professional installed on my computer when I got it, and was running AdAware 6.0 Personal to keep on top of spyware, and one day I got an error with Norton. I clicked the 'more info' link and it took me to the norton site, where it listed a few different error codes, none of which matched mine. So I close the page and went back to Norton. It was still capable of scanning for viruses, but LiveUpdate was now disabled. I went on like this for maybe a week or two, and one day, my Norton was just Spontaneously dead. The icon in the system tray had a red X through it. So I attemtped to re-install it, and got 4 errors:
"Cannot find the file specified: C:\Documents and Settings\Admin\Local\Temp\ pft8.tmp\P roductRegC OM.dll" (pft8.tmp is a temporary directory, created during install, which is strange, because the install would have to put that file there)
"Error 1308. Source file not found:
E:\NAV\External\CommonFi\S YMSHARE\Sy mLTCOM.dll
"verify that file exists and that you have access to it." (received twice, but not consecutively / I checked, this file is infact on the CD)
"Error 1308. Source file not found:
E:\NAV\External\NORTON\APP \NAVlcom.d ll
"verify that file exists and that you have access to it." (I checked, and this file is also present)
My friend then sent me a .rar archive of the contents of the CD. I went to unzip it and had problems with the same files (they wouldn't unzip...)
Since I've lost Norton and haven't been able to fix it, I've been running 4 spyware/adware removal tools (AdAware 6, Spybot S&D 1.3, CWShredder, SpySweeper) and just this morning I downloaded and ran HiJack this. If it helps, here's the log:
Logfile of HijackThis v1.97.7
Scan saved at 5:47:20 AM, on 7/7/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.e xe
C:\WINDOWS\system32\winlog on.exe
C:\WINDOWS\system32\servic es.exe
C:\WINDOWS\system32\lsass. exe
C:\WINDOWS\System32\Ati2ev xx.exe
C:\WINDOWS\system32\svchos t.exe
C:\WINDOWS\System32\svchos t.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2ev xx.exe
C:\WINDOWS\system32\spools v.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\InterVideo\FastTVSyn c\FastTVSy nc.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\CTHELP ER.EXE
C:\Program Files\Creative\SBLive\Audi oHQ\AHQTBU .EXE
C:\Program Files\Common Files\Logitech\QCDriver3\L VCOMS.EXE
C:\Program Files\Common Files\Real\Update_OB\reals ched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\InterVideo\WinDVD4PR \SchSvr.ex e
C:\Program Files\InterVideo\Common\Bi n\WinCinem aMgr.exe
C:\WINDOWS\System32\CTsvcC DA.exe
C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
C:\Program Files\Executive Software\Diskeeper\DkServi ce.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTEC T.EXE
C:\WINDOWS\System32\svchos t.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.ex e
C:\WINDOWS\System32\MsPMSP Sv.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Documents and Settings\Admin\Desktop\Stu ff Left to Install\HijackThis.exe
R1 - HKCU\Software\Microsoft\In ternet Explorer\Main,Search Bar = file://C:\DOCUME~1\Admin\L OCALS~1\Te mp\sp.html
R1 - HKCU\Software\Microsoft\In ternet Explorer\Main,Search Page = file://C:\DOCUME~1\Admin\L OCALS~1\Te mp\sp.html
R1 - HKCU\Software\Microsoft\In ternet Explorer\Search,SearchAssi stant = file://C:\DOCUME~1\Admin\L OCALS~1\Te mp\sp.html
R1 - HKLM\Software\Microsoft\In ternet Explorer\Main,Search Bar = file://C:\DOCUME~1\Admin\L OCALS~1\Te mp\sp.html
R1 - HKLM\Software\Microsoft\In ternet Explorer\Main,Search Page = file://C:\DOCUME~1\Admin\L OCALS~1\Te mp\sp.html
R0 - HKLM\Software\Microsoft\In ternet Explorer\Search,SearchAssi stant = file://C:\DOCUME~1\Admin\L OCALS~1\Te mp\sp.html
R1 - HKCU\Software\Microsoft\In ternet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\In ternet Connection Wizard,Shellnext = http://www.yahoo.com/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-7 84B7D6BE0B 3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIE Helper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-2 06D7942484 F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-C F10577473F 7} - c:\program files\google\googletoolbar 2.dll
O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0 445EE16191 0} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClien t.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-F ADC6B08487 2} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-0 0A0C908246 7} - C:\WINDOWS\System32\msdxm. ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0 819E2EAAC9 3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClien t.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-0 09027A5CD4 F} - c:\program files\google\googletoolbar 2.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7 859DF00B1D 6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [FastTVSync] "C:\Program Files\Common Files\InterVideo\FastTVSyn c\FastTVSy nc.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROG RAM\ADGJDe t.exe"
O4 - HKLM\..\Run: [AudioHQU] C:\Program Files\Creative\SBLive\Audi oHQ\AHQTBU .EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCh eck.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\L VCOMS.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\reals ched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe " -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTo ols\ADVCHK .EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\Symantec\LIVEU P~1\SNDMon .EXE
O4 - Startup: Corel Registration.lnk = C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
O4 - Global Startup: InterVideo Scheduler server.lnk = C:\Program Files\InterVideo\WinDVD4PR \SchSvr.ex e
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bi n\WinCinem aMgr.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Ad obe Gamma Loader.exe
O4 - Global Startup: Corel Registration.lnk = C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ LDMConf.ex e
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar 2.dll/cmse arch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar 2.dll/cmba cklinks.ht ml
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar 2.dll/cmca che.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2 \OFFICE11\ EXCEL.EXE/ 3000
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar 2.dll/cmsi milar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar 2.dll/cmtr ans.html
O9 - Extra button: Research (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F 22972D723E A} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0 040963251E 5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\ms xml4.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-4 7A8489BB47 F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38118.8191319444
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-4 4455354000 0} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
So, what do you recommend that I do? I did find out from a friend at work that Norton can be kinda wonky to fix if you have problems with it, he said something about it doesn't fully uninstall from the registry?
Thanks for the help guys
"Cannot find the file specified: C:\Documents and Settings\Admin\Local\Temp\
"Error 1308. Source file not found:
E:\NAV\External\CommonFi\S
"verify that file exists and that you have access to it." (received twice, but not consecutively / I checked, this file is infact on the CD)
"Error 1308. Source file not found:
E:\NAV\External\NORTON\APP
"verify that file exists and that you have access to it." (I checked, and this file is also present)
My friend then sent me a .rar archive of the contents of the CD. I went to unzip it and had problems with the same files (they wouldn't unzip...)
Since I've lost Norton and haven't been able to fix it, I've been running 4 spyware/adware removal tools (AdAware 6, Spybot S&D 1.3, CWShredder, SpySweeper) and just this morning I downloaded and ran HiJack this. If it helps, here's the log:
Logfile of HijackThis v1.97.7
Scan saved at 5:47:20 AM, on 7/7/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.e
C:\WINDOWS\system32\winlog
C:\WINDOWS\system32\servic
C:\WINDOWS\system32\lsass.
C:\WINDOWS\System32\Ati2ev
C:\WINDOWS\system32\svchos
C:\WINDOWS\System32\svchos
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2ev
C:\WINDOWS\system32\spools
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\InterVideo\FastTVSyn
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\CTHELP
C:\Program Files\Creative\SBLive\Audi
C:\Program Files\Common Files\Logitech\QCDriver3\L
C:\Program Files\Common Files\Real\Update_OB\reals
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\InterVideo\WinDVD4PR
C:\Program Files\InterVideo\Common\Bi
C:\WINDOWS\System32\CTsvcC
C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
C:\Program Files\Executive Software\Diskeeper\DkServi
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTEC
C:\WINDOWS\System32\svchos
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.ex
C:\WINDOWS\System32\MsPMSP
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Documents and Settings\Admin\Desktop\Stu
R1 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-7
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-2
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-C
O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-F
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-0
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-0
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7
O4 - HKLM\..\Run: [FastTVSync] "C:\Program Files\Common Files\InterVideo\FastTVSyn
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROG
O4 - HKLM\..\Run: [AudioHQU] C:\Program Files\Creative\SBLive\Audi
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCh
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\L
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\reals
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTo
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\Symantec\LIVEU
O4 - Startup: Corel Registration.lnk = C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
O4 - Global Startup: InterVideo Scheduler server.lnk = C:\Program Files\InterVideo\WinDVD4PR
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bi
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Ad
O4 - Global Startup: Corel Registration.lnk = C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar
O9 - Extra button: Research (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F
O16 - DPF: {88D969C0-F192-11D4-A65F-0
O16 - DPF: {9F1C11AA-197B-4942-BA54-4
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-4
So, what do you recommend that I do? I did find out from a friend at work that Norton can be kinda wonky to fix if you have problems with it, he said something about it doesn't fully uninstall from the registry?
Thanks for the help guys
ASKER
Hey, I didn't mention this cause I didn't think it was that important, but that's what I've been using as an alternative to norton since I didn't want to go without anti-virus.
Although bit defender seems to be holding the fort for now, I would like to have local AV, especially since bit defender can't protect me from downloaded or email attachment viruses. It would be too little too late for those.
Although bit defender seems to be holding the fort for now, I would like to have local AV, especially since bit defender can't protect me from downloaded or email attachment viruses. It would be too little too late for those.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
As stated, I had AVG. It also was free and includes a scanner for the email. I still have them enabled and use Bitdefender as the main virus scanner.
ASKER
I just did another bitdefender scan, with some different options selected (originally only enable RTVR was selected, now everything but scan emails is selected), and it came up with something much different than all previous scans:
C:\WINDOWS\system32\djcm.d ll infected: Trojan.StartPage.IS
C:\WINDOWS\system32\djcm.d ll unable to disinfect
C:\Documents and Settings\Admin\Local Settings\Temp\Temporary Internet Files\Content.IE5\JHCBBLJ5 \HP2[1].CH M=>/hp2.ht m infected: VBS.Trojan.Psyme.W
I've gotten several Trojan.StartPage.IS's found by bitdefender and that's the first one it couldn't remove. And I have NO idea what VBS.Trojan.Psyme.W is... I'm currently downloading AVG, and some other spyware/AV stuff. I've been keeping mostly on top of spyware but I know there's still something on my computer messing around that I don't know about.
C:\WINDOWS\system32\djcm.d
C:\WINDOWS\system32\djcm.d
C:\Documents and Settings\Admin\Local Settings\Temp\Temporary Internet Files\Content.IE5\JHCBBLJ5
I've gotten several Trojan.StartPage.IS's found by bitdefender and that's the first one it couldn't remove. And I have NO idea what VBS.Trojan.Psyme.W is... I'm currently downloading AVG, and some other spyware/AV stuff. I've been keeping mostly on top of spyware but I know there's still something on my computer messing around that I don't know about.
Have you tried repairing your IE?
How to Reinstall or Repair Internet Explorer and Outlook Express in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;318378
Also a possibility, this registry patch:
http://mvps.org/winhelp2002/RepairDefaultPrefix.reg
Repairs the corrupted or altered (spyware) HTTP prefixes
How to Reinstall or Repair Internet Explorer and Outlook Express in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;318378
Also a possibility, this registry patch:
http://mvps.org/winhelp2002/RepairDefaultPrefix.reg
Repairs the corrupted or altered (spyware) HTTP prefixes
ASKER
C:\Documents and Settings\Admin\Local Settings\Temp\Temporary Internet Files\Content.IE5\JHCBBLJ5 \HP2[1].CH M=>/hp2.ht m Infected VBS.Trojan.Psyme.W
C:\Documents and Settings\Admin\Local Settings\Temp\Temporary Internet Files\Content.IE5\JHCBBLJ5 \HP2[1].CH M=>/hp2.ht m Disinfection failed
C:\Documents and Settings\Admin\Local Settings\Temp\Temporary Internet Files\Content.IE5\JHCBBLJ5 \HP2[1].CH M=>/hp2.ht m Move failed
Can I delete this file safely?
I'm currently downloading windows updates/security patches...
C:\Documents and Settings\Admin\Local Settings\Temp\Temporary Internet Files\Content.IE5\JHCBBLJ5
C:\Documents and Settings\Admin\Local Settings\Temp\Temporary Internet Files\Content.IE5\JHCBBLJ5
Can I delete this file safely?
I'm currently downloading windows updates/security patches...
You can and should. If you have the same experience I had with WINDOWS DOWNLOADER trojan, it will come back next time you start IE.
You should also delete temporary files and history within IE.
You should also delete temporary files and history within IE.
Please try the fix I posted above also, it removes the CoolWeb infection from your computer a lot faster in most cases :)
LucF
LucF
ASKER
I downloaded and ran the AVG AntiVirus, which supposedly found and cleaned (or deleted) what bitdefender couldn't...
LucF, you may have missed it in my first post but I have been running CWShredder almost from the beginning.
My latest problem is that I'm getting an error everytime I restart windows:
"xcommsvr.exe
The instruction at "0x00143a02" referenced memory at
"0x00000800". The memory could not be "written".
Click OK to terminate
Click Cancel to Debug"
I have been thinking about ditching Norton but if I can get it to work again, I'd like to try. Good news is I have reduced the amount of spyware I'm picking up a fair bit. I'd like to ask again, if I were to edit my registry to remove all traces of NAV2004, would you be able to help me find the right stuff to get rid of?
LucF, you may have missed it in my first post but I have been running CWShredder almost from the beginning.
My latest problem is that I'm getting an error everytime I restart windows:
"xcommsvr.exe
The instruction at "0x00143a02" referenced memory at
"0x00000800". The memory could not be "written".
Click OK to terminate
Click Cancel to Debug"
I have been thinking about ditching Norton but if I can get it to work again, I'd like to try. Good news is I have reduced the amount of spyware I'm picking up a fair bit. I'd like to ask again, if I were to edit my registry to remove all traces of NAV2004, would you be able to help me find the right stuff to get rid of?
This should solve that question - http://service1.symantec.com/SUPPORT/nav.nsf/docid/2004020909040706?OpenDocument&ExpandSection=1&Src=
>>LucF, you may have missed it in my first post but I have been running CWShredder almost from the beginning.<<
Ah, my bad :o(
If slink9's article doesn't help, please post a fresh logfile, as a lot has been removed allready.
LucF
Ah, my bad :o(
If slink9's article doesn't help, please post a fresh logfile, as a lot has been removed allready.
LucF
ASKER
I tried that link slink9, the link to download the .reg file didn't work. it wasn't dead, it just didn't ever connect.
New HiJack This (I assume that's what you wanted) Logfile:
Logfile of HijackThis v1.97.7
Scan saved at 2:16:59 PM, on 7/8/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.e xe
C:\WINDOWS\system32\winlog on.exe
C:\WINDOWS\system32\servic es.exe
C:\WINDOWS\system32\lsass. exe
C:\WINDOWS\System32\Ati2ev xx.exe
C:\WINDOWS\system32\svchos t.exe
C:\WINDOWS\System32\svchos t.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2ev xx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spools v.exe
C:\Program Files\Common Files\InterVideo\FastTVSyn c\FastTVSy nc.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\CTHELP ER.EXE
C:\Program Files\Creative\SBLive\Audi oHQ\AHQTBU .EXE
C:\Program Files\Common Files\Logitech\QCDriver3\L VCOMS.EXE
C:\Program Files\Common Files\Real\Update_OB\reals ched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Softwin\BitDefender Free Edition\bdmcon.exe
C:\PROGRA~1\Grisoft\AVG6\a vgcc32.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\InterVideo\WinDVD4PR \SchSvr.ex e
C:\PROGRA~1\Grisoft\AVG6\a vgserv.exe
C:\WINDOWS\System32\CTsvcC DA.exe
C:\Program Files\InterVideo\Common\Bi n\WinCinem aMgr.exe
C:\Program Files\Executive Software\Diskeeper\DkServi ce.exe
C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Documents and Settings\Admin\Start Menu\Programs\Startup\SpyS weeper.exe
C:\WINDOWS\System32\svchos t.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.ex e
C:\WINDOWS\System32\MsPMSP Sv.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Grisoft\AVG6\avgw.ex e
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Admin\Desktop\Stu ff Left to Install\HijackThis.exe
R1 - HKCU\Software\Microsoft\In ternet Explorer\Main,Search Bar = file://C:\DOCUME~1\Admin\L OCALS~1\Te mp\sp.html
R1 - HKCU\Software\Microsoft\In ternet Explorer\Main,Search Page = file://C:\DOCUME~1\Admin\L OCALS~1\Te mp\sp.html
R0 - HKCU\Software\Microsoft\In ternet Explorer\Main,Start Page = http://halo.bungie.org
R1 - HKCU\Software\Microsoft\In ternet Explorer\Search,SearchAssi stant = file://C:\DOCUME~1\Admin\L OCALS~1\Te mp\sp.html
R0 - HKLM\Software\Microsoft\In ternet Explorer\Main,Start Page = http://halo.bungie.org
R1 - HKLM\Software\Microsoft\In ternet Explorer\Main,Search Bar = file://C:\DOCUME~1\Admin\L OCALS~1\Te mp\sp.html
R1 - HKLM\Software\Microsoft\In ternet Explorer\Main,Search Page = file://C:\DOCUME~1\Admin\L OCALS~1\Te mp\sp.html
R0 - HKLM\Software\Microsoft\In ternet Explorer\Search,SearchAssi stant = file://C:\DOCUME~1\Admin\L OCALS~1\Te mp\sp.html
R1 - HKCU\Software\Microsoft\In ternet Connection Wizard,Shellnext = http://www.yahoo.com/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-7 84B7D6BE0B 3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIE Helper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-2 06D7942484 F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-C F10577473F 7} - c:\program files\google\googletoolbar 2.dll
O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0 445EE16191 0} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClien t.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-0 0A0C908246 7} - C:\WINDOWS\System32\msdxm. ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0 819E2EAAC9 3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClien t.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-0 09027A5CD4 F} - c:\program files\google\googletoolbar 2.dll
O4 - HKLM\..\Run: [FastTVSync] "C:\Program Files\Common Files\InterVideo\FastTVSyn c\FastTVSy nc.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROG RAM\ADGJDe t.exe"
O4 - HKLM\..\Run: [AudioHQU] C:\Program Files\Creative\SBLive\Audi oHQ\AHQTBU .EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCh eck.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\L VCOMS.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\reals ched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe " -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [BDMCon] C:\Program Files\Softwin\BitDefender Free Edition\\bdmcon.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\Program Files\Softwin\BitDefender Free Edition\\bdnagent.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\a vgcc32.exe /STARTUP
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\Symantec\LIVEU P~1\SNDMon .EXE
O4 - HKLM\..\RunOnce: [GrpConv] grpconv.exe -o
O4 - Startup: Corel Registration.lnk = C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
O4 - Startup: SpySweeper.exe
O4 - Global Startup: InterVideo Scheduler server.lnk = C:\Program Files\InterVideo\WinDVD4PR \SchSvr.ex e
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bi n\WinCinem aMgr.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Ad obe Gamma Loader.exe
O4 - Global Startup: Corel Registration.lnk = C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ LDMConf.ex e
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar 2.dll/cmse arch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar 2.dll/cmba cklinks.ht ml
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar 2.dll/cmca che.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2 \OFFICE11\ EXCEL.EXE/ 3000
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar 2.dll/cmsi milar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar 2.dll/cmtr ans.html
O9 - Extra button: Research (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F 22972D723E A} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0 040963251E 5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\ms xml4.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-4 7A8489BB47 F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38176.2612268519
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-4 4455354000 0} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
New HiJack This (I assume that's what you wanted) Logfile:
Logfile of HijackThis v1.97.7
Scan saved at 2:16:59 PM, on 7/8/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.e
C:\WINDOWS\system32\winlog
C:\WINDOWS\system32\servic
C:\WINDOWS\system32\lsass.
C:\WINDOWS\System32\Ati2ev
C:\WINDOWS\system32\svchos
C:\WINDOWS\System32\svchos
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2ev
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spools
C:\Program Files\Common Files\InterVideo\FastTVSyn
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\CTHELP
C:\Program Files\Creative\SBLive\Audi
C:\Program Files\Common Files\Logitech\QCDriver3\L
C:\Program Files\Common Files\Real\Update_OB\reals
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Softwin\BitDefender Free Edition\bdmcon.exe
C:\PROGRA~1\Grisoft\AVG6\a
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\InterVideo\WinDVD4PR
C:\PROGRA~1\Grisoft\AVG6\a
C:\WINDOWS\System32\CTsvcC
C:\Program Files\InterVideo\Common\Bi
C:\Program Files\Executive Software\Diskeeper\DkServi
C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Documents and Settings\Admin\Start Menu\Programs\Startup\SpyS
C:\WINDOWS\System32\svchos
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.ex
C:\WINDOWS\System32\MsPMSP
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Grisoft\AVG6\avgw.ex
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Admin\Desktop\Stu
R1 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R0 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-7
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-2
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-C
O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-0
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-0
O4 - HKLM\..\Run: [FastTVSync] "C:\Program Files\Common Files\InterVideo\FastTVSyn
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROG
O4 - HKLM\..\Run: [AudioHQU] C:\Program Files\Creative\SBLive\Audi
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCh
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\L
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\reals
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [BDMCon] C:\Program Files\Softwin\BitDefender Free Edition\\bdmcon.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\Program Files\Softwin\BitDefender Free Edition\\bdnagent.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\a
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\Symantec\LIVEU
O4 - HKLM\..\RunOnce: [GrpConv] grpconv.exe -o
O4 - Startup: Corel Registration.lnk = C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
O4 - Startup: SpySweeper.exe
O4 - Global Startup: InterVideo Scheduler server.lnk = C:\Program Files\InterVideo\WinDVD4PR
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bi
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Ad
O4 - Global Startup: Corel Registration.lnk = C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar
O9 - Extra button: Research (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F
O16 - DPF: {88D969C0-F192-11D4-A65F-0
O16 - DPF: {9F1C11AA-197B-4942-BA54-4
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-4
Ok, that's what I meant, so let's see if we can clean it up a little:
Close all browser windows, clear out your temporary internet files
Tick the following lines and click "fix checked":
R1 - HKCU\Software\Microsoft\In ternet Explorer\Main,Search Bar = file://C:\DOCUME~1\Admin\L OCALS~1\Te mp\sp.html
R1 - HKCU\Software\Microsoft\In ternet Explorer\Main,Search Page = file://C:\DOCUME~1\Admin\L OCALS~1\Te mp\sp.html
R0 - HKCU\Software\Microsoft\In ternet Explorer\Main,Start Page = http://halo.bungie.org
R1 - HKCU\Software\Microsoft\In ternet Explorer\Search,SearchAssi stant = file://C:\DOCUME~1\Admin\L OCALS~1\Te mp\sp.html
R0 - HKLM\Software\Microsoft\In ternet Explorer\Main,Start Page = http://halo.bungie.org
R1 - HKLM\Software\Microsoft\In ternet Explorer\Main,Search Bar = file://C:\DOCUME~1\Admin\L OCALS~1\Te mp\sp.html
R1 - HKLM\Software\Microsoft\In ternet Explorer\Main,Search Page = file://C:\DOCUME~1\Admin\L OCALS~1\Te mp\sp.html
R0 - HKLM\Software\Microsoft\In ternet Explorer\Search,SearchAssi stant = file://C:\DOCUME~1\Admin\L OCALS~1\Te mp\sp.html
R1 - HKCU\Software\Microsoft\In ternet Connection Wizard,Shellnext = http://www.yahoo.com/
Yes, all of them, after fixing you can set it back to what you want again.
O4 - HKLM\..\RunOnce: [GrpConv] grpconv.exe -o <= I don't trust this line, unless you've upgraded from win3.11 to winXP (very unlikely) and exactly this file might be the culprit to your problems.
After a reboot, delete the offending files.
LucF
Close all browser windows, clear out your temporary internet files
Tick the following lines and click "fix checked":
R1 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R0 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
Yes, all of them, after fixing you can set it back to what you want again.
O4 - HKLM\..\RunOnce: [GrpConv] grpconv.exe -o <= I don't trust this line, unless you've upgraded from win3.11 to winXP (very unlikely) and exactly this file might be the culprit to your problems.
After a reboot, delete the offending files.
LucF
ASKER
I'm concerned about this, I have done 2 AVG anti virus scans now, and both have come up with this:
"C:\WINDOWS\SYSTEM32\CONFI G\SYSTEM.L OG Cannot open; not checked!
C:\WINDOWS\SYSTEM32\CATROO T2\EDBTMP. LOG Cannot open; not checked!
C:\WINDOWS\SYSTEM32\CATROO T2\TMP.EDB Cannot open; not checked!
C:\WINDOWS\SYSTEM32\CATROO T2\EDB.LOG Cannot open; not checked!
C:\Documents and Settings\All Users\Application Data\Microsoft\NETWORK\Dow nloader\QM GR0.DAT Cannot open; not checked!
C:\Documents and Settings\All Users\Application Data\Microsoft\NETWORK\Dow nloader\QM GR1.DAT Cannot open; not checked!
C:\Documents and Settings\NetworkService\NT USER.DAT Cannot open; not checked!
C:\Documents and Settings\NetworkService\nt user.dat.L OG Cannot open; not checked!
C:\Documents and Settings\NetworkService\Lo cal Settings\Application Data\Microsoft\WINDOWS\USR CLASS.DAT Cannot open; not checked!
C:\Documents and Settings\NetworkService\Lo cal Settings\Application Data\Microsoft\WINDOWS\Usr Class.dat. LOG Cannot open; not checked!
C:\Documents and Settings\LocalService\NTUS ER.DAT Cannot open; not checked!
C:\Documents and Settings\LocalService\ntus er.dat.LOG Cannot open; not checked!
C:\Documents and Settings\LocalService\Loca l Settings\Application Data\Microsoft\WINDOWS\USR CLASS.DAT Cannot open; not checked!
C:\Documents and Settings\LocalService\Loca l Settings\Application Data\Microsoft\WINDOWS\Usr Class.dat. LOG Cannot open; not checked!
C:\Documents and Settings\ADMIN\NTUSER.DAT Cannot open; not checked!
C:\Documents and Settings\ADMIN\ntuser.dat. LOG Cannot open; not checked!
C:\Documents and Settings\ADMIN\Local Settings\Application Data\Microsoft\WINDOWS\USR CLASS.DAT Cannot open; not checked!
C:\Documents and Settings\ADMIN\Local Settings\Application Data\Microsoft\WINDOWS\Usr Class.dat. LOG Cannot open; not checked!
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\SYMLCSYS.DL L Cannot open; not checked!"
Should I be worried that these files cannot be checked for viruses? I used to think the reason I couldn't properly re-install norton was because a virus wasn't letting me, I've since decided that's not the case, but is it possible here?
"C:\WINDOWS\SYSTEM32\CONFI
C:\WINDOWS\SYSTEM32\CATROO
C:\WINDOWS\SYSTEM32\CATROO
C:\WINDOWS\SYSTEM32\CATROO
C:\Documents and Settings\All Users\Application Data\Microsoft\NETWORK\Dow
C:\Documents and Settings\All Users\Application Data\Microsoft\NETWORK\Dow
C:\Documents and Settings\NetworkService\NT
C:\Documents and Settings\NetworkService\nt
C:\Documents and Settings\NetworkService\Lo
C:\Documents and Settings\NetworkService\Lo
C:\Documents and Settings\LocalService\NTUS
C:\Documents and Settings\LocalService\ntus
C:\Documents and Settings\LocalService\Loca
C:\Documents and Settings\LocalService\Loca
C:\Documents and Settings\ADMIN\NTUSER.DAT Cannot open; not checked!
C:\Documents and Settings\ADMIN\ntuser.dat.
C:\Documents and Settings\ADMIN\Local Settings\Application Data\Microsoft\WINDOWS\USR
C:\Documents and Settings\ADMIN\Local Settings\Application Data\Microsoft\WINDOWS\Usr
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\SYMLCSYS.DL
Should I be worried that these files cannot be checked for viruses? I used to think the reason I couldn't properly re-install norton was because a virus wasn't letting me, I've since decided that's not the case, but is it possible here?
All of these files are safe :) They're needed for windows to run and will always be in use and can't be openen, don't worry about them.
I have downloaded the reg file and didn't have a problem with it. If you will post your email address I will send it to you.
Have you tried an IE reinstall as I had posted in a previos response?
Have you tried an IE reinstall as I had posted in a previos response?
ASKER
I downloaded well over a design windows updates (including internet explorer updates and security patches) they've been installed and I've rebooted.
I both clicked that reg file link like it said (nothing happened) and did the right-click-save-as thing, and it came up with the little screen that said 'connecting to:' and had the animation of the paper file flying from the earth to a folder, and I waited for several minutes and nothing happened.
I would really appreciate the email actually, thanks :)
peeph01e@yahoo.com (it's my dummy account specifically for this sort of thing ;)
I was very pleased to see AVG tell me it had detected when I acquired a trojan.startpage.is virus, norton never did and bitdefender hasn't. Seems to be doing a fine job thus far. Maybe I can actually stop being afraid to leave me internet plugged in 24/7.
I both clicked that reg file link like it said (nothing happened) and did the right-click-save-as thing, and it came up with the little screen that said 'connecting to:' and had the animation of the paper file flying from the earth to a folder, and I waited for several minutes and nothing happened.
I would really appreciate the email actually, thanks :)
peeph01e@yahoo.com (it's my dummy account specifically for this sort of thing ;)
I was very pleased to see AVG tell me it had detected when I acquired a trojan.startpage.is virus, norton never did and bitdefender hasn't. Seems to be doing a fine job thus far. Maybe I can actually stop being afraid to leave me internet plugged in 24/7.
It is on the way. The IE repair and the reg fix that I posted are completely separate from an update.
ASKER
New Log:
Logfile of HijackThis v1.97.7
Scan saved at 5:07:32 PM, on 7/8/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.e xe
C:\WINDOWS\system32\winlog on.exe
C:\WINDOWS\system32\servic es.exe
C:\WINDOWS\system32\lsass. exe
C:\WINDOWS\System32\Ati2ev xx.exe
C:\WINDOWS\system32\svchos t.exe
C:\WINDOWS\System32\svchos t.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2ev xx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spools v.exe
C:\Program Files\Common Files\InterVideo\FastTVSyn c\FastTVSy nc.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\CTHELP ER.EXE
C:\Program Files\Creative\SBLive\Audi oHQ\AHQTBU .EXE
C:\Program Files\Common Files\Logitech\QCDriver3\L VCOMS.EXE
C:\Program Files\Common Files\Real\Update_OB\reals ched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Softwin\BitDefender Free Edition\bdmcon.exe
C:\PROGRA~1\Grisoft\AVG6\a vgcc32.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\InterVideo\WinDVD4PR \SchSvr.ex e
C:\Program Files\InterVideo\Common\Bi n\WinCinem aMgr.exe
C:\PROGRA~1\Grisoft\AVG6\a vgserv.exe
C:\WINDOWS\System32\CTsvcC DA.exe
C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
C:\Program Files\Executive Software\Diskeeper\DkServi ce.exe
C:\Documents and Settings\Admin\Start Menu\Programs\Startup\SpyS weeper.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchos t.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.ex e
C:\WINDOWS\System32\MsPMSP Sv.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Documents and Settings\Admin\Desktop\Stu ff Left to Install\HijackThis.exe
R0 - HKCU\Software\Microsoft\In ternet Explorer\Main,Start Page = http://halo.bungie.org
R0 - HKLM\Software\Microsoft\In ternet Explorer\Main,Start Page = http://halo.bungie.org
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-7 84B7D6BE0B 3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIE Helper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-2 06D7942484 F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-C F10577473F 7} - c:\program files\google\googletoolbar 2.dll
O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0 445EE16191 0} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClien t.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-0 0A0C908246 7} - C:\WINDOWS\System32\msdxm. ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0 819E2EAAC9 3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClien t.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-0 09027A5CD4 F} - c:\program files\google\googletoolbar 2.dll
O4 - HKLM\..\Run: [FastTVSync] "C:\Program Files\Common Files\InterVideo\FastTVSyn c\FastTVSy nc.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROG RAM\ADGJDe t.exe"
O4 - HKLM\..\Run: [AudioHQU] C:\Program Files\Creative\SBLive\Audi oHQ\AHQTBU .EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCh eck.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\L VCOMS.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\reals ched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe " -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [BDMCon] C:\Program Files\Softwin\BitDefender Free Edition\\bdmcon.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\Program Files\Softwin\BitDefender Free Edition\\bdnagent.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\a vgcc32.exe /STARTUP
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\Symantec\LIVEU P~1\SNDMon .EXE
O4 - Startup: Corel Registration.lnk = C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
O4 - Startup: SpySweeper.exe
O4 - Global Startup: InterVideo Scheduler server.lnk = C:\Program Files\InterVideo\WinDVD4PR \SchSvr.ex e
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bi n\WinCinem aMgr.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Ad obe Gamma Loader.exe
O4 - Global Startup: Corel Registration.lnk = C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ LDMConf.ex e
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar 2.dll/cmse arch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar 2.dll/cmba cklinks.ht ml
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar 2.dll/cmca che.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2 \OFFICE11\ EXCEL.EXE/ 3000
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar 2.dll/cmsi milar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar 2.dll/cmtr ans.html
O9 - Extra button: Research (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F 22972D723E A} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0 040963251E 5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\ms xml4.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-4 7A8489BB47 F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38176.2612268519
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-4 4455354000 0} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
I deleted the first batch of stuff (Spy Sweeper Reset 2 of them for me) I rebooted without deleting the last thing, and now I can't find it.
"O4 - HKLM\..\RunOnce: [GrpConv] grpconv.exe -o <= I don't trust this line, unless you've upgraded from win3.11 to winXP (very unlikely) and exactly this file might be the culprit to your problems"
-You're right, I never had 3.1 but this file is no longer showing... and I didn't remove it yet... *confused*
Logfile of HijackThis v1.97.7
Scan saved at 5:07:32 PM, on 7/8/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.e
C:\WINDOWS\system32\winlog
C:\WINDOWS\system32\servic
C:\WINDOWS\system32\lsass.
C:\WINDOWS\System32\Ati2ev
C:\WINDOWS\system32\svchos
C:\WINDOWS\System32\svchos
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2ev
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spools
C:\Program Files\Common Files\InterVideo\FastTVSyn
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\CTHELP
C:\Program Files\Creative\SBLive\Audi
C:\Program Files\Common Files\Logitech\QCDriver3\L
C:\Program Files\Common Files\Real\Update_OB\reals
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Softwin\BitDefender Free Edition\bdmcon.exe
C:\PROGRA~1\Grisoft\AVG6\a
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\InterVideo\WinDVD4PR
C:\Program Files\InterVideo\Common\Bi
C:\PROGRA~1\Grisoft\AVG6\a
C:\WINDOWS\System32\CTsvcC
C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
C:\Program Files\Executive Software\Diskeeper\DkServi
C:\Documents and Settings\Admin\Start Menu\Programs\Startup\SpyS
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchos
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.ex
C:\WINDOWS\System32\MsPMSP
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Documents and Settings\Admin\Desktop\Stu
R0 - HKCU\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-7
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-2
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-C
O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-0
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-0
O4 - HKLM\..\Run: [FastTVSync] "C:\Program Files\Common Files\InterVideo\FastTVSyn
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROG
O4 - HKLM\..\Run: [AudioHQU] C:\Program Files\Creative\SBLive\Audi
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCh
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\L
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\reals
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [BDMCon] C:\Program Files\Softwin\BitDefender Free Edition\\bdmcon.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\Program Files\Softwin\BitDefender Free Edition\\bdnagent.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\a
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\Symantec\LIVEU
O4 - Startup: Corel Registration.lnk = C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
O4 - Startup: SpySweeper.exe
O4 - Global Startup: InterVideo Scheduler server.lnk = C:\Program Files\InterVideo\WinDVD4PR
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bi
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Ad
O4 - Global Startup: Corel Registration.lnk = C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar
O9 - Extra button: Research (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F
O16 - DPF: {88D969C0-F192-11D4-A65F-0
O16 - DPF: {9F1C11AA-197B-4942-BA54-4
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-4
I deleted the first batch of stuff (Spy Sweeper Reset 2 of them for me) I rebooted without deleting the last thing, and now I can't find it.
"O4 - HKLM\..\RunOnce: [GrpConv] grpconv.exe -o <= I don't trust this line, unless you've upgraded from win3.11 to winXP (very unlikely) and exactly this file might be the culprit to your problems"
-You're right, I never had 3.1 but this file is no longer showing... and I didn't remove it yet... *confused*
no go. That address is disabled.
Hmm... looks like a clean logfile to me
>>-You're right, I never had 3.1 but this file is no longer showing... and I didn't remove it yet... *confused*<<
It was a runonce entry, try another reboot, and see if it shows up again :)
LucF
>>-You're right, I never had 3.1 but this file is no longer showing... and I didn't remove it yet... *confused*<<
It was a runonce entry, try another reboot, and see if it shows up again :)
LucF
ASKER
Sorry slink9, haven't used it in a while, guess it got cancelled. Oh well, it was free.
Here, this will work: madaemanon@yahoo.com
LucF, the last few reboots have resulted in me being informed windows didn't start properly, I initiated normal startup mode anyways to which it went to the XP version of scandisk... and I'm still getting that darn error seconds after the desktop loads. I'm now gonna reboot and check again for that file.
Here, this will work: madaemanon@yahoo.com
LucF, the last few reboots have resulted in me being informed windows didn't start properly, I initiated normal startup mode anyways to which it went to the XP version of scandisk... and I'm still getting that darn error seconds after the desktop loads. I'm now gonna reboot and check again for that file.
ASKER
Alright, rebooted, re-scanned with HiJack this, results turned up the same as last time.
Had I removed that runonce thing before it disappeared, would it have made any difference?
Had I removed that runonce thing before it disappeared, would it have made any difference?
You did turn off system restore before doing this, right?
It is on the way again.
It is on the way again.
ASKER
No, I didn't, I thought it was off, but it wasn't... ugh... there's so many settings in Windows to worry about/play with when you're fixing stuff.
If I get things back to normal without having to format, I'll be happy! So far I'm doing Ok I think.
If I get things back to normal without having to format, I'll be happy! So far I'm doing Ok I think.
Without it turned off the virus can be restored every time you reset your computer. I just ran AVG on a computer that was brought to me and found 159 and could not clean 2. I did that with system restore on and quite a few were in the System32 directory. I installed Bitdefender and rebooted. Now system restore is off and it has found 2 but I don't believe it has hit the System and System32 directories as of yet.
Yep, I agree, turn off system restore.
What I just noticed is that you have an older version of hijackthis, so if that doesn't help, use this version and post another logfile if it reveals other entries than the ones above:
http://aumha.org/downloads/hijackthis.zip
What I just noticed is that you have an older version of hijackthis, so if that doesn't help, use this version and post another logfile if it reveals other entries than the ones above:
http://aumha.org/downloads/hijackthis.zip
ASKER
Logfile of HijackThis v1.98.0
Scan saved at 9:11:48 AM, on 7/9/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.e xe
C:\WINDOWS\system32\winlog on.exe
C:\WINDOWS\system32\servic es.exe
C:\WINDOWS\system32\lsass. exe
C:\WINDOWS\System32\Ati2ev xx.exe
C:\WINDOWS\system32\svchos t.exe
C:\WINDOWS\System32\svchos t.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2ev xx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spools v.exe
C:\Program Files\Common Files\InterVideo\FastTVSyn c\FastTVSy nc.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\CTHELP ER.EXE
C:\Program Files\Creative\SBLive\Audi oHQ\AHQTBU .EXE
C:\Program Files\Common Files\Logitech\QCDriver3\L VCOMS.EXE
C:\Program Files\Common Files\Real\Update_OB\reals ched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Softwin\BitDefender Free Edition\bdmcon.exe
C:\PROGRA~1\Grisoft\AVG6\a vgcc32.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\InterVideo\WinDVD4PR \SchSvr.ex e
C:\Program Files\InterVideo\Common\Bi n\WinCinem aMgr.exe
C:\PROGRA~1\Grisoft\AVG6\a vgserv.exe
C:\WINDOWS\System32\CTsvcC DA.exe
C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
C:\Program Files\Executive Software\Diskeeper\DkServi ce.exe
C:\Documents and Settings\Admin\Start Menu\Programs\Startup\SpyS weeper.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchos t.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.ex e
C:\WINDOWS\System32\MsPMSP Sv.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Admin\Desktop\Stu ff Left to Install\HijackThis.exe
R0 - HKCU\Software\Microsoft\In ternet Explorer\Main,Start Page = http://halo.bungie.org
R0 - HKLM\Software\Microsoft\In ternet Explorer\Main,Start Page = http://halo.bungie.org
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-7 84B7D6BE0B 3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIE Helper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-2 06D7942484 F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-C F10577473F 7} - c:\program files\google\googletoolbar 2.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0 445EE16191 0} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClien t.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-0 0A0C908246 7} - C:\WINDOWS\System32\msdxm. ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0 819E2EAAC9 3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClien t.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-0 09027A5CD4 F} - c:\program files\google\googletoolbar 2.dll
O4 - HKLM\..\Run: [FastTVSync] "C:\Program Files\Common Files\InterVideo\FastTVSyn c\FastTVSy nc.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROG RAM\ADGJDe t.exe"
O4 - HKLM\..\Run: [AudioHQU] C:\Program Files\Creative\SBLive\Audi oHQ\AHQTBU .EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCh eck.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\L VCOMS.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\reals ched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe " -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [BDMCon] C:\Program Files\Softwin\BitDefender Free Edition\\bdmcon.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\Program Files\Softwin\BitDefender Free Edition\\bdnagent.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\a vgcc32.exe /STARTUP
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\Symantec\LIVEU P~1\SNDMon .EXE
O4 - Startup: Corel Registration.lnk = C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
O4 - Startup: SpySweeper.exe
O4 - Global Startup: InterVideo Scheduler server.lnk = C:\Program Files\InterVideo\WinDVD4PR \SchSvr.ex e
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bi n\WinCinem aMgr.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Ad obe Gamma Loader.exe
O4 - Global Startup: Corel Registration.lnk = C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\ LDMConf.ex e
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar 2.dll/cmse arch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar 2.dll/cmba cklinks.ht ml
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar 2.dll/cmca che.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2 \OFFICE11\ EXCEL.EXE/ 3000
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar 2.dll/cmsi milar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar 2.dll/cmtr ans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3 C9C571A826 3} - C:\PROGRA~1\MICROS~2\OFFIC E11\REFIEB AR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-0 0C04F79568 3} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-0 0C04F79568 3} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F 22972D723E A} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0 040963251E 5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\ms xml4.cab
System restore is off. Strangely enough, as I was opening control panel, I got that xcommsvr.exe error again, but before I had gotten rid of it, bitdefender popped up (I had just downloaded an update). Which leads me to believe that error is from bitdefender. I know it';s working cause I just did a scan with it...
Good news is I just scanned with AVG and then right after with bitdefender and both came up 100% clean. Spysweeper also came up clean but now I'm gonna run ad aware and spybot.
PS. LucF, Ad Aware is finding registry stuff labelled as CoolWebSearch that CWShredder isn't finding... CWShredder has found a few things in past, but it seems every program out there will find stuff others won't.
Scan saved at 9:11:48 AM, on 7/9/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.e
C:\WINDOWS\system32\winlog
C:\WINDOWS\system32\servic
C:\WINDOWS\system32\lsass.
C:\WINDOWS\System32\Ati2ev
C:\WINDOWS\system32\svchos
C:\WINDOWS\System32\svchos
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2ev
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spools
C:\Program Files\Common Files\InterVideo\FastTVSyn
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\CTHELP
C:\Program Files\Creative\SBLive\Audi
C:\Program Files\Common Files\Logitech\QCDriver3\L
C:\Program Files\Common Files\Real\Update_OB\reals
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Softwin\BitDefender Free Edition\bdmcon.exe
C:\PROGRA~1\Grisoft\AVG6\a
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\InterVideo\WinDVD4PR
C:\Program Files\InterVideo\Common\Bi
C:\PROGRA~1\Grisoft\AVG6\a
C:\WINDOWS\System32\CTsvcC
C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
C:\Program Files\Executive Software\Diskeeper\DkServi
C:\Documents and Settings\Admin\Start Menu\Programs\Startup\SpyS
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchos
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.ex
C:\WINDOWS\System32\MsPMSP
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Admin\Desktop\Stu
R0 - HKCU\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-7
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-2
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-C
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-0
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-0
O4 - HKLM\..\Run: [FastTVSync] "C:\Program Files\Common Files\InterVideo\FastTVSyn
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROG
O4 - HKLM\..\Run: [AudioHQU] C:\Program Files\Creative\SBLive\Audi
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCh
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\L
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\reals
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [BDMCon] C:\Program Files\Softwin\BitDefender Free Edition\\bdmcon.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\Program Files\Softwin\BitDefender Free Edition\\bdnagent.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\a
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\Symantec\LIVEU
O4 - Startup: Corel Registration.lnk = C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
O4 - Startup: SpySweeper.exe
O4 - Global Startup: InterVideo Scheduler server.lnk = C:\Program Files\InterVideo\WinDVD4PR
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bi
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Ad
O4 - Global Startup: Corel Registration.lnk = C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-0
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-0
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F
O16 - DPF: {88D969C0-F192-11D4-A65F-0
System restore is off. Strangely enough, as I was opening control panel, I got that xcommsvr.exe error again, but before I had gotten rid of it, bitdefender popped up (I had just downloaded an update). Which leads me to believe that error is from bitdefender. I know it';s working cause I just did a scan with it...
Good news is I just scanned with AVG and then right after with bitdefender and both came up 100% clean. Spysweeper also came up clean but now I'm gonna run ad aware and spybot.
PS. LucF, Ad Aware is finding registry stuff labelled as CoolWebSearch that CWShredder isn't finding... CWShredder has found a few things in past, but it seems every program out there will find stuff others won't.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Hey Warturtle, you were right, I did have that before, but I have gotten rid of it, and am having other problems.
Although it looks like for the most part I'm clean and staying that way. I'm still picking up a tiny bit of spyware, but regular runs of ad aware and spybot will take care of that.
slink9, I think I agree with you. I don't think I'm going to go back to Norton. I do however think the error I've been getting at startup is related to bit defender... I'd like to figure that out, and then I should be good to go.
Although it looks like for the most part I'm clean and staying that way. I'm still picking up a tiny bit of spyware, but regular runs of ad aware and spybot will take care of that.
slink9, I think I agree with you. I don't think I'm going to go back to Norton. I do however think the error I've been getting at startup is related to bit defender... I'd like to figure that out, and then I should be good to go.
I run Bitdefender along with AVG and have not come across that error. You could always uninstall Bitdefender and see if that error message goes away. I don't think it is related to Bitdefender, though.
ASKER
I just picked up Broderbund's ZoneAlarm Pro 4, it's supposed to be the best firewall type program available right now. Do you guys know anything about it? It seems to be pretty good so far... and I'm about 90% decided not to go back to Norton, so I suppose I can soon close this thread.
I'll try re-installing bitdefender, but so far I've only seen that error in conjunction with loading, running or closing the program.
I'll try re-installing bitdefender, but so far I've only seen that error in conjunction with loading, running or closing the program.
My experience with ZoneAlarm was not so good since it has to be manually configured to accept everything. Of course, since I am not on broadband I don't really need a firewall. Because of that, I haven't given it a whole lot of effort.
In threads here it has gotten good reviews and recommendations.
In threads here it has gotten good reviews and recommendations.
ASKER
Could you possible direct me to those threads? I'm pretty happy with it so far, but I'd love to read what others have said about it. I did alot of research today and found out alot of good information. Surprisingly I've read on a couple sites that Norton isn't all it's cracked up to be, relies too much on it's name, like Nike.
Hi,
You should keep the highest possible security on ZoneAlarm Pro, that is what I have. Mine is on Stealth capabilities and is totally hidden from the internet. I also got my machine checked for security from Shields Up - Internet Port Authority on this website:
https://www.grc.com/x/ne.dll?bh0bkyd2
Warturtle
You should keep the highest possible security on ZoneAlarm Pro, that is what I have. Mine is on Stealth capabilities and is totally hidden from the internet. I also got my machine checked for security from Shields Up - Internet Port Authority on this website:
https://www.grc.com/x/ne.dll?bh0bkyd2
Warturtle
Ah, one more thing, try and keep a watch on what programs try and access the internet(from Zone AlarmPro control panel). That is how I caught the about:blank virus.
Warturtle
Warturtle
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Hey, thanks alot. Good to know.
Like I said, so far I'm quite pleased with it though... actually AVG has popped up twice and told me it has detected that I've been infected with a trojan.startpage.aq, but says I have to run the program to disinfect. Aren't AV progs supposed to stop the viruses from getting on my computer in the first place? otherwise it's no better than a firewall.
And the error I'm getting is infact from bitdefender, I tried to repair it and then tried to re-install and I'm still getting the error. I have no idea what's wrong with it...
Like I said, so far I'm quite pleased with it though... actually AVG has popped up twice and told me it has detected that I've been infected with a trojan.startpage.aq, but says I have to run the program to disinfect. Aren't AV progs supposed to stop the viruses from getting on my computer in the first place? otherwise it's no better than a firewall.
And the error I'm getting is infact from bitdefender, I tried to repair it and then tried to re-install and I'm still getting the error. I have no idea what's wrong with it...
Viruses and trojans are different things. AVG will keep you from getting infected with viruses through email and will scan for trojans (as it has). there are some interesting links at http://www.thefreecountry.com/security/spywareremoval.shtml
ASKER
Well I guess then I'm set now. Thanks for all the help guys, you may now have your points :)
Why a B?
It is the most reliable I have found so far. I had AVG but Bitdefender found and removed viruses and spyware missed by AVG. It is also more reliable when you add a second virus scanner to most likely catch whatever is missed by the first. Use http://www.housecall.com for that second scan. It is online and free.