On second thought, use this tool first,
Standalone bagle remover.
http://download.bleepingco
Main Topics
Browse All Topics
Loading Advertisement...
Question
Malware just won't stay out, can't find the trigger!!!
I'm trying to rid some malware from an XP laptop. I thought I had it all out last week, but got a call back, it came back with a vengeance! it keep replicating files with "j0e" in the middle of them. it disables (actually removes) some of the tabs from the display properties ( I know how to get them back). I have found the following files that I know are related: ".tt9.tmp.vbs" "eg783j.syz" "braviax.exe" "plphclo3j0ej79.scr" "plphclo3j0ej79.bmp" "asnfgy.syz"
I've taken these out of the windows/system32 folders, the windows/prefetch folder, the registry, and anywhere else I could find them, but they keep coming back. Windows Outlook has stopped working as a result of these malware's. Norton's is updated and finds some of the things, but not all. has anyone had experience with this particular infection? Below is the hijackthis logfile. thanks for any help you can offer.
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 11:10:01 PM, on 7/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Safe mode
Running processes:
C:\WINDOWS\System32\smss.e
C:\WINDOWS\system32\winlog
C:\WINDOWS\system32\servic
C:\WINDOWS\system32\lsass.
C:\WINDOWS\system32\svchos
C:\WINDOWS\System32\svchos
C:\Program Files\Citrix\ICA Client\ssonsvr.exe
C:\WINDOWS\Explorer.EXE
C:\HiJackThis_v2.exe
R1 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0
O4 - HKLM\..\Run: [WMDM PMSP Service] C:\WINDOWS\system32\cssrss
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTra
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\D
O4 - HKLM\..\Run: [ReminderApp] C:\Program Files\Nova Development\Greeting Card Factory Deluxe 7.0\ReminderApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTr
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [KADxMain] C:\WINDOWS\system32\KADxMa
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\Update
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTA
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Adobe Version Cue CS2] "C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCu
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [lphclo3j0ej79] C:\WINDOWS\system32\lphclo
O4 - HKLM\..\Run: [SMshcjo3j0ej79] C:\Program Files\shcjo3j0ej79\shcjo3j
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCt
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Ad
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digi
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Program Neighborhood Agent.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-0
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-0
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-0
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-0
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-0
O16 - DPF: {17492023-C23A-453E-A040-C
O16 - DPF: {9600F64D-755F-11D4-A47F-0
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-4
O17 - HKLM\System\CCS\Services\T
O17 - HKLM\Software\..\Telephony
O17 - HKLM\System\CS1\Services\T
O17 - HKLM\System\CS2\Services\T
O21 - SSODL: AlATdKGy - {D069857C-7AC3-2FD6-5C42-7
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-0
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.
O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
O23 - Service: Broadcom ASF IP and SMBIOS Mailbox Monitor (ASFIPmon) - Broadcom Corporation - C:\Program Files\Broadcom\ASFIPMon\As
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: CWShredder Service - Unknown owner - C:\Documents and Settings\jritcey\My Documents\Executables\CWSh
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingServ
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEU
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCON
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc3
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm
O23 - Service: PsExec (PSEXESVC) - Unknown owner - C:\WINDOWS\PSEXESVC.EXE (file missing)
O23 - Service: Reflection Line Printer Daemon - WRQ, Inc. - C:\Program Files\Reflection\lpdserv.e
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\StacSV
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYS
--
End of file - 8419 bytes
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Subscribe now for full access to Experts Exchange and get
Instant Access to this Solution
- Plus...
- 30 Day FREE access, no risk, no obligation
- Collaborate with the world's top tech experts
- Unlimited access to our exclusive solution database
- Never be left without tech help again
Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.
- "The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
- "Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
- "Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.
See what Experts Exchange can do for you.
Got a question?
We've got the answer.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
Need individual assistance?
Our experts are ready to help.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Want to learn from the best?
Read articles from industry experts.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Working on a long term project?
Store your work and research.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
What Makes Experts Exchange Unique?
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Trusted by the world's most respected brands.
Faithfully serving IT professionals since 1996.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Free Tech Articles
-
WARNING: 5 Reasons why you should NEVER fix a computer for free.
It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
-
SCCM OSD Basic troubleshooting
SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
-
Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
-
Create a Win7 Gadget
This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
-
Outlook continually prompting for username and password
There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
-
Backup Exchange 2010 Information Store using Windows Backup
There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...
Cloud Class Webinars
- Avoiding Bugs in Microsoft Access
Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
- Top 10 Best New Features in Visio 2010
Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
- IT Consultant Business Secrets Revealed
Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
- Disaster Recovery and Business Continuity
Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
- Organize Your Visio Diagrams with Containers and Lists
Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
- How to Us Objects, Properties, Events and Methods in Microsoft Access
Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...
Join the Community
Give a Little. Get a Lot.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Answers
After running Bagle remover, and SDFix, you might need to run Combofix as well.
Please download ComboFix by sUBs:
http://download.bleepingco
You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply along with a fresh HJT log
Re-enable all the programs that were disabled during the running of ComboFix..
Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
This is not the newest version of HJT you are using. You may want to rescan with the actual scanner.
Also, download SmitfraudFix.exe (http://siri.urz.free.fr/F
In order to get rid of the remote controlling psexesvc temporary service, do this:
sc.exe query psexesvc
sc.exe delete psexesvc
sc.exe query psexesvc
del %windir%\psexesvc.exe
The person/worm who is using Psexec against the infected machine (thus creating the temporary psexesvc service) must have admin rights. Check for suspicious user accounts and change administrator passwords.
The suspicious files in your log are:
O4 - HKLM\..\Run: [ReminderApp] C:\Program Files\Nova Development\Greeting Card Factory Deluxe 7.0\ReminderApp.exe
O4 - HKLM\..\Run: [lphclo3j0ej79] C:\WINDOWS\system32\lphclo
O4 - HKLM\..\Run: [SMshcjo3j0ej79] C:\Program Files\shcjo3j0ej79\shcjo3j
O
O23 - Service: PsExec (PSEXESVC) - Unknown owner - C:\WINDOWS\PSEXESVC.EXE (file missing)
Apart from SmitfraudFix you could try scans with Malwarebyte's Anti-Malware (http://www.malwarebytes.o
Good luck.
Hi torimar,
If you're picking all the bad entries, this one below is also bad belonging to an SDBot infection, which SDFix should take care of.
O4 - HKLM\..\Run: [WMDM PMSP Service] C:\WINDOWS\system32\cssrss
But, this one below is a legit program.
O4 - HKLM\..\Run: [ReminderApp] C:\Program Files\Nova Development\Greeting Card Factory Deluxe 7.0\ReminderApp.exe
This one below is legit as well, but only the user knows if the file is really gone or not as "file missing' in hijackthis 023 entries is not always true because of the hijackthis bug.
O23 - Service: PsExec (PSEXESVC) - Unknown owner - C:\WINDOWS\PSEXESVC.EXE (file missing)
Maybe the file really is missing because of the display name being not 'Sysinternal'. Or if the user never did use "PsExec" then that could be a bad entry.
Hi rpggamergirl,
yes, you are right. I mixed up those two entries: "cssrss.exe" should have been in for sure, "reminder.exe" should have been left out. I only added that list for the sake of completion, assuming that yellow1053 already knew about most of them.
As to the 'psexec' issue, I think this might be one possible explanation for the bad files' mysterious returning: a remote process is recreating them every once in a while.
I remember having read about the "Coreflood Trojan" using a similar method, and that trojan seems to be on the wild these days.
I had no time to search extensively, so I can not serve with any better page than this:
http://www.exterminat
I found some removal instructions, posted by a sysadmin whose network was infected a week ago:
--Quote--
Seeing there was very little information i could find on the time of the problem, these were the steps we took to clean up our affected PC's.
1. Implemented a GPO that enabled the windows firewall client with the nessasary exceptions. This definitely stopped the PC's from being re-infected.
3. We implemented a basic script to give us a list of PC's that had the psexec service installed on the logon script (we do not use this service at all)
2. We did a system restore on the affected PC, before the date that the network was affected and did not have the psexec service installed.
3. Win2003 servers/ PCs that wouldnt rollback - We had to manually remove the service using the "sc.exe delete psexesvc" from the command prompt.
4. Stopped service if running and deleted the psexesvc.exe for %windir%\
5. Deleted the prefetch file located in %windir%\prefetch
6. Ran a full AV scan on all our PC's and servers.
*only logon to the PC's on your network using the local admin account when sorting out this problem. Any domain admin accounts or such can cause your network to be reinfected when they logon to a PC thats infected with the Coreflood Trojan virus.
I'm not claiming this is the way to remove the problem, its just the method we used with limited info.
-- End quote--
Source: http://forum.sysinternals.
Hope this helps.
HI All, thanks for all your help. I ran all of the suggested programs, and three of them found and fixed things. the Beagle didn't. Now the computer is completely free of all that malware, however some of the damage they did is still apparent. Microsoft Outlook won't connect to get the mail anymore, and sometimes locks up the computer after trying. and Internet Explorer keeps freezing up in the middle of using it. sometimes it won't even open up. Here are three log files that were generated by my repairs. First is the ComboFix one, then the Mbam one, and lastly, the updated HJT program log.
ComboFix 08-07-10.1 - jritcey 2008-07-11 21:02:59.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.
Running from: C:\jim jr\ComboFix.exe
* Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((((
.
C:\Documents and Settings\All Users\Start Menu\Programs\Malware Protector 2008
C:\Documents and Settings\All Users\Start Menu\Programs\Malware Protector 2008.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Malware Protector 2008\How to Register Malware Protector 2008.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Malware Protector 2008\License Agreement.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Malware Protector 2008\Malware Protector 2008.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Malware Protector 2008\Register Malware Protector 2008.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Malware Protector 2008\Uninstall.lnk
C:\Documents and Settings\jritcey\Applicati
C:\Documents and Settings\jritcey\Applicati
C:\Documents and Settings\jritcey\Applicati
C:\Program Files\shcjo3j0ej79
C:\WINDOWS\system32\oeminf
.
((((((((((((((((((((((((( Files Created from 2008-06-12 to 2008-07-12 ))))))))))))))))))))))))))
.
2008-07-11 20:40 . 2008-07-11 20:40 <DIR> d-------- C:\WINDOWS\ERUNT
2008-07-10 22:07 . 2008-07-10 22:07 197 --a------ C:\WINDOWS\system32\MRT.IN
2008-06-30 23:20 . 2008-06-30 23:28 <DIR> d-------- C:\Documents and Settings\jritcey\Applicati
2008-06-29 22:29 . 2004-10-07 21:16 35,840 --a------ C:\WINDOWS\system32\driver
2008-06-29 22:27 . 2003-03-09 16:31 233,528 -ra------ C:\WINDOWS\system32\HPZidr
2008-06-29 22:27 . 2003-03-09 16:31 167,936 -ra------ C:\WINDOWS\system32\HPZipr
2008-06-29 22:27 . 2003-03-09 16:31 94,208 -ra------ C:\WINDOWS\system32\HPZipt
2008-06-29 22:27 . 2003-03-09 16:31 65,795 -ra------ C:\WINDOWS\system32\HPZipm
2008-06-29 22:27 . 2003-03-09 16:31 61,699 -ra------ C:\WINDOWS\system32\HPZinw
2008-06-29 22:27 . 2003-03-09 16:31 57,344 -ra------ C:\WINDOWS\system32\HPZisn
2008-06-29 22:27 . 2003-03-09 16:31 51,024 -ra------ C:\WINDOWS\system32\driver
2008-06-29 22:27 . 2003-03-09 16:31 16,080 -ra------ C:\WINDOWS\system32\driver
2008-06-29 22:26 . 2003-03-09 16:31 21,456 -ra------ C:\WINDOWS\system32\driver
2008-06-29 22:25 . 2003-03-09 16:31 561,152 -ra------ C:\WINDOWS\system32\hpotsc
2008-06-29 22:25 . 2003-03-09 16:30 237,568 -ra------ C:\WINDOWS\system32\HPZc32
2008-06-29 22:25 . 2003-03-09 16:31 81,920 -ra------ C:\WINDOWS\system32\hpovst
2008-06-29 22:25 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\driver
2008-06-29 22:25 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\dllcac
2008-06-29 22:21 . 2008-06-29 22:29 20,454 --a------ C:\WINDOWS\hpoins01.dat
2008-06-29 22:21 . 2003-04-05 23:24 16,618 --------- C:\WINDOWS\hpomdl01.dat
2008-06-29 22:15 . 2008-06-29 22:15 <DIR> d-------- C:\WINDOWS\system32\NtmsDa
2008-06-29 22:11 . 2008-06-29 22:11 <DIR> d-------- C:\Documents and Settings\jritcey\Applicati
2008-06-29 21:58 . 2008-06-29 21:58 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2008-06-29 21:56 . 2008-06-29 22:29 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-06-29 09:44 . 2008-06-29 09:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-06-28 22:30 . 2008-07-11 20:32 <DIR> d-------- C:\jim jr
2008-06-27 08:46 . 2008-07-06 09:40 156 --a------ C:\WINDOWS\delself.bat
2008-06-23 14:28 . 2008-06-23 14:28 1,039,521 --a------ C:\WINDOWS\system32\Ikeban
2008-06-23 14:27 . 2008-06-23 14:27 3,821,357 --a------ C:\WINDOWS\system32\Alegri
2008-06-23 01:07 . 2008-06-23 01:07 <DIR> d-------- C:\Program Files\Plus!
2008-06-23 01:07 . 2008-06-23 01:07 1,067,647 --a------ C:\WINDOWS\system32\Tsukub
2008-06-22 23:10 . 2008-06-22 23:10 <DIR> d-------- C:\Documents and Settings\Administrator\App
2008-06-22 22:23 . 2003-06-25 16:05 266,360 --a------ C:\WINDOWS\system32\TweakU
2008-06-22 22:23 . 2002-06-21 15:09 160,217 --a------ C:\WINDOWS\system32\PowerT
2008-06-22 22:23 . 2008-06-22 22:23 150,192 --a------ C:\TweakUiPowertoySetup.ex
2008-06-22 21:43 . 2008-06-22 21:43 4,752 --a------ C:\WINDOWS\system32\tmp.re
2008-06-22 21:42 . 2008-06-22 21:45 <DIR> d-------- C:\SmitfraudFix
2008-06-22 21:32 . 2008-01-12 03:12 1,308,216 --a------ C:\HiJackThis_v2.exe
2008-06-22 21:32 . 2008-01-12 21:19 1,129,580 --a------ C:\SmitfraudFix.exe
2008-06-22 20:50 . 2008-06-22 20:50 <DIR> d--hs---- C:\found.000
2008-06-20 13:41 . 2008-06-20 13:41 245,248 --------- C:\WINDOWS\system32\dllcac
2008-06-20 09:31 . 2008-06-21 23:16 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-20 09:25 . 2008-06-20 09:25 <DIR> d-------- C:\Program Files\bfgclient
2008-06-20 09:24 . 2008-06-20 09:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\BigFishGamesCache
2008-06-20 06:44 . 2008-06-20 06:44 138,368 --------- C:\WINDOWS\system32\dllcac
2008-06-19 20:19 . 2008-07-11 17:27 488 --a------ C:\hpfr5550.xml
2008-06-19 20:05 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\driver
2008-06-19 20:05 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\dllcac
2008-06-13 12:30 . 2008-06-13 12:30 524,288 --a------ C:\WINDOWS\opuc.dll
.
((((((((((((((((((((((((((
.
2008-07-12 01:01 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-07-11 19:35 --------- d-----w C:\Documents and Settings\jritcey\Applicati
2008-07-11 16:32 --------- d-----w C:\Program Files\Thumbs7
2008-07-09 21:58 --------- d-----w C:\Program Files\Trillian
2008-07-08 04:26 --------- d-----w C:\Documents and Settings\jritcey\Applicati
2008-07-01 03:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-06-23 04:04 --------- d-----w C:\Program Files\Windows Desktop Search
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsoc
2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcac
2008-06-20 13:25 0 ----a-w C:\Program Files\temp01
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\driver
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcac
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\driver
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\driver
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcac
2008-06-19 22:42 --------- d-----w C:\Program Files\SiteXpert
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\driver
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\dllcac
2008-06-11 15:26 48,020 ----a-w C:\termlicensekey.reg
2008-06-10 14:31 --------- d-----w C:\Program Files\Citrix
2008-06-10 03:04 --------- d-----w C:\Program Files\MSXML 6.0
2008-06-09 16:10 --------- d-----w C:\Documents and Settings\jritcey\Applicati
2008-06-08 23:23 --------- d-----w C:\Program Files\IrfanView
2008-06-08 20:39 --------- d-----w C:\Program Files\MSECache
2008-06-08 20:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-06-08 20:25 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-08 20:16 --------- d-----w C:\Program Files\Common Files\Adobe
2008-06-08 19:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-06-08 17:08 --------- d-----w C:\Program Files\MSBuild
2008-06-08 17:05 --------- d-----w C:\Program Files\Reference Assemblies
2008-06-08 16:03 --------- d-----w C:\Program Files\Nova Development
2008-06-08 16:03 --------- d-----w C:\Program Files\Common Files\Nova Development
2008-06-08 02:07 --------- d-----w C:\Program Files\HyperSnap-DX 4
2008-06-08 02:07 --------- d-----r C:\Program Files\AnfyTeam
2008-06-08 02:04 --------- d-----w C:\Program Files\Widget
2008-06-08 02:04 --------- d-----w C:\Program Files\WebEx
2008-06-08 02:04 --------- d-----w C:\Program Files\SmartDraw Viewer
2008-06-07 23:33 --------- d-----w C:\Program Files\Background Magic
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\dllcac
2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz
2008-05-07 05:18 1,287,680 ------w C:\WINDOWS\system32\dllcac
2008-05-07 00:47 69,632 ----a-w C:\WINDOWS\Shutterfly Studio Screen Saver.scr
2008-04-24 02:16 3,591,680 ----a-w C:\WINDOWS\system32\dllcac
2008-04-22 07:40 625,664 ------w C:\WINDOWS\system32\dllcac
2008-04-22 07:39 70,656 ------w C:\WINDOWS\system32\dllcac
2008-04-22 07:39 13,824 ------w C:\WINDOWS\system32\dllcac
2008-04-20 05:07 161,792 ------w C:\WINDOWS\system32\dllcac
.
------- Sigcheck -------
2004-08-04 06:00 16896 4e06f50f95357b8cfbc81f5699
2004-08-04 06:00 505856 e853481fef64a5be3fc3732d9d
2007-06-13 06:23 1035264 90bdefa8740e66dee42c12eb1c
2007-06-13 07:26 1033216 7712df0cdde3a5ac89843e61cd
2004-08-04 06:00 1032192 a0732187050030ae399b241436
2004-08-04 06:00 110080 5812a3513734517f8c2c5eab6b
2004-08-04 06:00 14336 c3e6b717e7b284e1fa89ba9f7a
2005-06-10 20:17 57856 ad3d9d191aea7b5445fe1d82ff
2005-06-10 19:53 58368 44fce06d98349f92a39a9a242b
.
((((((((((((((((((((((((((
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWAR
"H/PC Connection Agent"="C:\PROGRA~1\MI3AA1
"ctfmon.exe"="C:\WINDOWS\s
[HKEY_LOCAL_MACHINE\SOFTWA
"NvCplDaemon"="C:\WINDOWS\
"vptray"="C:\PROGRA~1\SYMA
"SunJavaUpdateSched"="C:\P
"RoxioDragToDisc"="C:\Prog
"ReminderApp"="C:\Program Files\Nova Development\Greeting Card Factory Deluxe 7.0\ReminderApp.exe" [2007-08-25 01:03 185664]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe
"PDVDDXSrv"="C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2006-10-20 18:23 118784]
"NvMediaCenter"="C:\WINDOW
"KADxMain"="C:\WINDOWS\sys
"ISUSScheduler"="C:\Progra
"ISUSPM Startup"="C:\PROGRA~1\COMM
"HPDJ Taskbar Utility"="C:\WINDOWS\syste
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-11-21 17:38 52840]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\W
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2007-04-15 22:49 159744]
"Adobe Version Cue CS2"="C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCu
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-10 22:46 624248]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
"SigmatelSysTrayApp"="stsy
"nwiz"="nwiz.exe" [2007-05-31 16:50 1626112 C:\WINDOWS\system32\nwiz.e
"NVHotkey"="nvHotkey.dll" [2007-05-31 16:50 67584 C:\WINDOWS\system32\nvhotk
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Ad
Cisco Systems VPN Client.lnk - C:\Program Files\Cisco Systems\VPN Client\vpngui.exe [2007-08-06 08:51:04 1528880]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2007-07-25 03:49:01 50688]
hp psc 2000 Series.lnk - C:\Program Files\Hewlett-Packard\Digi
hpoddt01.exe.lnk - C:\Program Files\Hewlett-Packard\Digi
Program Neighborhood Agent.lnk - C:\WINDOWS\Installer\{2624
[HKEY_LOCAL_MACHINE\softwa
"DisableMonitoring"=dword:
[HKLM\~\services\sharedacc
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedacc
"%windir%\\system32\\sessm
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:16
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169
"C:\\Program Files\\Adobe\\Adobe Version Cue CS2\\bin\\VersionCueCS2.ex
[HKLM\~\services\sharedacc
"26675:TCP"= 26675:TCP:169.254.2.0/255.
R1 DLARTL_M;DLARTL_M;C:\WINDO
R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;C:\Program Files\Broadcom\ASFIPMon\As
R3 DXEC01;DXEC01;C:\WINDOWS\s
[HKEY_CURRENT_USER\softwar
\Shell\AutoRun\command - E:\LaunchU3.exe -a
[HKEY_CURRENT_USER\softwar
\Shell\AutoRun\command - E:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder
"2008-06-30 02:30:16 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2170 series#1214792967.job"
- C:\Program Files\Hewlett-Packard\Digi
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-SMshcjo3j0ej79 - C:\Program Files\shcjo3j0ej79\shcjo3j
SSODL-AlATdKGy-{D069857C-7
**************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-11 21:03:55
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************
.
Completion time: 2008-07-11 21:04:48
ComboFix-quarantined-files
Pre-Run: 63,593,558,016 bytes free
Post-Run: 63,615,287,296 bytes free
215 --- E O F --- 2008-07-11 02:08:00
Malwarebytes' Anti-Malware 1.20
Database version: 930
Windows 5.1.2600 Service Pack 2
21:17:18 2008-07-11
mbam-log-7-11-2008 (21-17-18).txt
Scan type: Quick Scan
Objects scanned: 45043
Time elapsed: 2 minute(s), 5 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\Documents and Settings\jritcey\Applicati
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:22:08 PM, on 7/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Safe mode
Running processes:
C:\WINDOWS\System32\smss.e
C:\WINDOWS\system32\winlog
C:\WINDOWS\system32\servic
C:\WINDOWS\system32\lsass.
C:\WINDOWS\system32\svchos
C:\WINDOWS\System32\svchos
C:\Program Files\Citrix\ICA Client\ssonsvr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThi
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTra
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\D
O4 - HKLM\..\Run: [ReminderApp] C:\Program Files\Nova Development\Greeting Card Factory Deluxe 7.0\ReminderApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTr
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [KADxMain] C:\WINDOWS\system32\KADxMa
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\Update
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTA
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Adobe Version Cue CS2] "C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCu
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Ad
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digi
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Program Neighborhood Agent.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-0
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-0
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-0
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-0
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-0
O16 - DPF: {17492023-C23A-453E-A040-C
O16 - DPF: {9600F64D-755F-11D4-A47F-0
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-4
O17 - HKLM\System\CCS\Services\T
O17 - HKLM\Software\..\Telephony
O17 - HKLM\System\CS1\Services\T
O17 - HKLM\System\CS2\Services\T
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.
O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
O23 - Service: Broadcom ASF IP and SMBIOS Mailbox Monitor (ASFIPmon) - Broadcom Corporation - C:\Program Files\Broadcom\ASFIPMon\As
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: CWShredder Service - Unknown owner - C:\Documents and Settings\jritcey\My Documents\Executables\CWSh
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingServ
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEU
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCON
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc3
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm
O23 - Service: Reflection Line Printer Daemon - WRQ, Inc. - C:\Program Files\Reflection\lpdserv.e
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\StacSV
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYS
--
End of file - 7804 bytes
Any suggestions to get those two programs running again? Microsoft's Outlook did recognize the problem once and asked if I wanted to let it run diagnostics on itself, which I did, but still didn't fix it.
thanks.
Jim.
Outlook or Outlook Express? Have you tried running sfc /scannow (if you have the windows CD) to check for corrupted files.
Also try the steps mentioned here for IE7 crash:
http://enhanceie.com/ie/tr
If IE crashes, the most likely problem is that there's a buggy add-on (Toolbar or Browser Helper Object). In order to verify and isolate the buggy add-on, follow these steps:
1. Start IE in No Add-ons mode, either by right-clicking the Desktop icon,
or clicking START | RUN and typing: iexplore.exe -extoff
2. Determine if IE fails.
3. If not, use Tools | Manage Add-ons to disable all browser extensions and toolbars.
4. Restart IE and reenable browser extensions one-by-one.
5. Once you've found a broken extension, contact the manufacturer and ask for an update.
Ok, well, we don't have an sp2 cd, as it was upgraded to sp2 online. and IE won't run in -extoff mode, it just hangs and errors out (not responding) and it is outlook proper. very frustrating, I'm on that computer right now, so IE is running ok for the moment, but it won't last. but outlook everytime I open it, it just forever says (trying to connect) in the bottom right corner, and then hangs there. never making a connection. it is outlook 2007 according to the help about screen.
thanks.
In order to get the sfc command to work again, you could create a slipstreamed XP SP2 install CD, using:
- your original install CD
- the SP2 update pack: https://www.microsoft.com/
- the program 'nliteos' for creating slipstreamed CDs: http://www.nliteos.com/gui
yellow1053,
Sorry that the other issues weren't solved in this thread.
I hope you'll get a solution for that soon.
Vee_mod,
You're absolutely right, Hijackthis should be run in normal mode unless safe mode is the only mode the pc boots into.
The entries showing in the first Hijackthis log eventhough in safe mode was enough to call for SDFix and followed with Combofix.
And everything shows in combofix log even the disabled startup entries which Hijackthis doesn't scan, which means a CF log shows more than a Hijackthis log ran in normal mode.
You're very observant, very thorough and wise, :)
EE is blessed to have Mods who actively patrols the zones and making sure everything's okay.
Thank you all.
3 Ways to Join
Business Accounts
- Perfect for organizations
- Multiple users
- Save over 36%
- Create a Business Account
Answer for Membership
- Earn free access
- Showcase your knowledge
- No credit card required
- Sign Up to Answer
Loading Advertisement...
by: rpggamergirlPosted on 2008-07-10 at 23:11:41ID: 21980276
Hi,
Download and run SDFix and show us a fresh Hijackthis after to review, you might need other tool as well.
Download SDFix and save it to your desktop.
http://downloads.andymanch
Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)
Please then reboot your computer in Safe Mode by doing the following :
* Restart your computer
* After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
* Instead of Windows loading as normal, a menu with options should appear;
* Select the first option, to run Windows in Safe Mode, then press "Enter".
* Choose your usual account.
* Open the extracted folder and double click "RunThis.bat" to start the script.
* Type "Y" to begin the script.
* It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
* Press any Key and it will restart the PC.
* Your system will take longer that normal to restart as the fixtool will be running and removing files.
* When the desktop loads the Fixtool will complete the removal and display "Finished", then press any key to end the script and load your desktop icons.
* Finally open the SDFix folder on your desktop and copy and attach the contents of the results file "Report.txt" back