Can't figure it out

Question

Hello        I have a few questions concerning my Inspiron 8600 laptop.  Lately it has been extremely slow and every time I start it the windows installer process runs and asks me to insert my disk.  Also unless I try to open IE while this is happening I will be unable to.  It is the same way with my windows media player.  Also everytime I start up my computer, the windows task manager says that I have 70 to 80 processes running and my CPU usage is constantly fluctuating from 10 to 100%, and this is before I have even started anything myself!            I do have the windows firewall enabled.  I also have microsoft spyware beta, and macffee anti-virus protection and I run these daily with no viruses ever showing and only one or two spywares showing (which I delete).   I also have installed SP2.    What can I do to alleviate these problems?  Any help would be greatly appreciated.

ky331 · Answer

Sounds like you have 'a gazillion'  processes automatically running, that more-likely-than-not you don't really need. For a good introduction on this, go to  http://www2.whidbey.net/djdenham/Index.htm read the first 3 screens to get a feel for the subject and the MSCONFIG utility. Then, for more detail, and an up-to-date list of programs, go to http://www.pacs-portal.co.uk/startup_index.htm   you can search for each of your programs there, and then, decide which ones you really need (or want) to run automatically every time you boot up your pc. keep in mind that, 1) the less you run automatically, the faster your pc will boot up. and 2) you can always run any program you want from your icons (or start menu).   just keep in mind that certain programs (e.g., explorer and systray) MUST always be running, and your antivirus program SHOULD always be running.  most of the rest are up to you.  after consulting the program list at PacMan's Portal for preliminary advice, you can always post specific program names here for assistance.   Message Edited by ky331 on 02-28-2005 03:44 PM

zbestwun2001 · Answer

Let's start this way:
Go to here and do an online scan and delete whatever it finds. Be sure to highlight the drives you want to have searched.
After that could you please go to here
and download AdAwareSE and delete what it finds. Then while using
AdAware, click on add-ons and get their plug-in for the VX2 variant,
and run that and delete what it finds.
After that go to here
and download SpyBot and run that and delete what it finds.
Now go to
here and download HiJackThis to its own folder that you create on your C:\ drive.
After it is downloaded open the program and click Scan and Save to log.

Post the log that it generates here.

Steve

umaineball · Answer

Thank you all for all the help.  I ran the hijackthis and here is the log:   Logfile of HijackThis v1.99.1Scan saved at 7:53:36 PM, on 2/28/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\S24EvMon.exeC:\WINDOWS\system32\ZCfgSvc.exeC:\WINDOWS\System32\1XConfig.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Apoint\Apoint.exeC:\WINDOWS\system32\BacsTray.exeC:\Program Files\Intel\NCS\PROSet\PRONoMgr.exeC:\Program Files\Dell\QuickSet\quickset.exeC:\WINDOWS\System32\DSentry.exeC:\Program Files\Dell\Media Experience\PCMService.exeC:\Program Files\Common Files\Real\Update_OBealsched.exeC:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exeC:\Program Files\Common Files\Dell\EUSW\Support.exeC:\Program Files\DIGStream\digstream.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exeC:\WINDOWS\BCMSMMSG.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Java\jre1.5.0_01\bin\jusched.exeC:\WINDOWS\system32undll32.exeC:\Program Files\Network Associates\Common Framework\UpdaterUI.exeC:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exeC:\Program Files\Network Associates\VirusScan\SHSTAT.EXEC:\WINDOWS\SysCheckBop32.exeC:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exeC:\Program Files\Apoint\Apntex.exeC:\WINDOWS\sys01520703923.exeC:\Program Files\Microsoft AntiSpyware\gcasServ.exeC:\Program Files\Microsoft Money\System\mnyexpr.exeC:\Program Files\MSN Messenger\MsnMsgr.ExeC:\Program Files\AIM\aim.exeC:\WINDOWS\system32\??plorer.exeC:\Program Files\Network Associates\McAfee Desktop Firewall for Windows XP\FireTray.exeC:\Program Files\Microsoft AntiSpyware\gcasDtServ.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\system32\cisvc.exeC:\Program Files\Network Associates\McAfee Desktop Firewall for Windows XP\FireSvc.exeC:\Program Files\Network Associates\Common Framework\FrameworkService.exeC:\Program Files\Network Associates\VirusScan\Mcshield.exeC:\Program Files\Network Associates\VirusScan\VsTskMgr.exeC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\System32\RegSrvc.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\System32\wbem\wmiapsrv.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\cidaemon.exeC:\WINDOWS\system32\cidaemon.exeC:\Program Files\Yahoo!\Messenger\YPager.exeC:\Program Files\iTunes\iTunes.exeC:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Aware.exeC:\Documents and Settings\Bartholomew Bischoff\My Documents\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.popupsearches.com/sidesearch.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.popupsearches.com/sidesearch.htmlR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://access.wright.eduR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://access.wright.eduO2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\ycomp5_5_7_0.dllO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dllO2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dllO3 - Toolbar: Vc Chic Thunk - {668C6885-11F9-69C3-33D3-69F6526624A7} - C:\PROGRA~1\CHINJO~1\Hold site.dll (file missing)O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\ycomp5_5_7_0.dllO3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installquietO4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exeO4 - HKLM\..\Run: [bacstray] BacsTray.exeO4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exeO4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exeO4 - HKLM\..\Run: [StorageGuard] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /rO4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exeO4 - HKLM\..\Run: [PCMService] 'C:\Program Files\Dell\Media Experience\PCMService.exe'O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe' -osbootO4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exeO4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exeO4 - HKLM\..\Run: [Desksite CMA] C:\Program Files\desksite\bin\cma.exeO4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exeO4 - HKLM\..\Run: [16 FACE] C:\PROGRA~1\BENDDO~1\bolt great.exeO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exeO4 - HKLM\..\Run: [conscorr] C:\WINDOWS\conscorr.exeO4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exeO4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exeO4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1O4 - HKLM\..\Run: [McAfeeUpdaterUI] 'C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe' /StartedFromRunKeyO4 - HKLM\..\Run: [Network Associates Error Reporting Service] 'C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe'O4 - HKLM\..\Run: [ShStatEXE] 'C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE' /STANDALONEO4 - HKLM\..\Run: [SystemCheck] C:\WINDOWS\SysCheckBop32O4 - HKLM\..\Run: [sys01520703923] C:\WINDOWS\sys01520703923.exeO4 - HKLM\..\Run: [gcasServ] 'C:\Program Files\Microsoft AntiSpyware\gcasServ.exe'O4 - HKLM\..\Run: [orvy] C:\WINDOWS\system32\orvy.exeO4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /autoO4 - HKCU\..\Run: [MsnMsgr] 'C:\Program Files\MSN Messenger\MsnMsgr.Exe' /backgroundO4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quietO4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odlO4 - HKCU\..\Run: [Z07sRVJpO] crvsl.exeO4 - HKCU\..\Run: [SpyWareWall] C:\PROGRA~1\SPYWAR~1\SpyWareWall.exeO4 - HKCU\..\Run: [Dascty] C:\WINDOWS\system32\??plorer.exeO4 - Global Startup: McAfee Desktop Firewall Tray.lnk = ?O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTMLO8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htmO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000O8 - Extra context menu item: View Link Source - C:\windows\web\viewsource.htmlO8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htmO8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin
pjpi150_01.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin
pjpi150_01.dllO9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dllO9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dllO9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exeO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dllO9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO15 - Trusted Zone: http://www.espn.comO15 - Trusted Zone: http://www.msn.comO15 - Trusted Zone: http://www.neededware.comO15 - Trusted Zone: *.musicmatch.com (HKLM)O16 - DPF: NDWCab - http://www.neededware.com/NDWCab.CABO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cabO16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cabO16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/autocomplete.cabO20 - Winlogon Notify: Sebring - C:\WINDOWS\System32\LgNotify.dllO23 - Service: McAfee Desktop Firewall Service (FireSvc) - Networks Associates Technology, Inc. - C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows XP\FireSvc.exeO23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exeO23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exeO23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exeO23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exeO23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exeO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exeO23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcappcapd.exe' -d -f '%ProgramFiles%\WinPcappcapd.ini (file missing)O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\WINDOWS\System32\S24EvMon.exeO23 - Service: SpyDetectorWatcher - Unknown owner - C:\Program Files\SpyDetector\spywatcher.exe (file missing)

Midnight Star · Answer

umaineball,

Hello! and welcome to the Dell forums.

-

Let's see what we can do...

Go to www.trendmicro.com, and then:

1. Click " Free Online Scan".
2. Click " Scan now, it's free".

It'll take a few minutes to download (especially with a dialup connection), so be patient. When it's down:

1. Select all available drives.
2. Check(tick) " Auto Clean".
3. Click " Scan".

When it completes, post back the full filename of any files that cannot be cleaned or deleted.

Download, unzip to your desktop CWShredder and run it, then:

1. Click " Check For Update"

( If an update isn't available, skip to step #4.)

2. Click " Click here to Download the upate".
3. When the new version has been downloaded, click " Save".

4. Click " Fix ->"

Go to Add/Remove programs and remove(uninstall) the following, if present:

Conscorr

The above could appear anywhere within the entry. Be careful not to remove any personal or system software.

Run HiJackThis then:

1. Click " Config..."
2. Click " Misc Tools"
3. Click " Open Process manager"

-

Next, while holding down the CTRL key, locate ( if present) and click on ( highlight) each of the following:

C:\WINDOWS\SysCheckBop32.exe
C:\WINDOWS\sys01520703923.exe
C:\WINDOWS\system32\??plorer.exe

Now double-check and make sure that only those item(s) above are highlighted, then click " Kill process". Now, click " Refresh", check again, and repeat this step if any remain.

Run HiJackThis and click " Scan", then check(tick) the following, if present:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.popupsearches.com/sidesearch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.popupsearches.com/sidesearch.html

O3 - Toolbar: Vc Chic Thunk - {668C6885-11F9-69C3-33D3-69F6526624A7} - C:\PROGRA~1\CHINJO~1\Hold site.dll (file missing)
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)

O4 - HKLM\..\Run: [16 FACE] C:\PROGRA~1\BENDDO~1\bolt great.exe
O4 - HKLM\..\Run: [conscorr] C:\WINDOWS\conscorr.exe
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [SystemCheck] C:\WINDOWS\SysCheckBop32
O4 - HKLM\..\Run: [sys01520703923] C:\WINDOWS\sys01520703923.exe
O4 - HKLM\..\Run: [orvy] C:\WINDOWS\system32\orvy.exe
O4 - HKCU\..\Run: [Z07sRVJpO] crvsl.exe
O4 - HKCU\..\Run: [Dascty] C:\WINDOWS\system32\??plorer.exe
O4 - Global Startup: McAfee Desktop Firewall Tray.lnk = ?

Now, with all windows closed except HiJackThis, click " Fix checked".

Locate and delete the following item(s), if present. Make sure your able to view system and hidden files/ folders:

folders...

C:\PROGRA~1\BENDDO~1

files...

C:\WINDOWS\SysCheckBop32.exe
C:\WINDOWS\sys01520703923.exe
C:\WINDOWS\conscorr.exe
C:\WINDOWS\system32\orvy.exe

Search for...

crvsl.exe

...using " Start | Search...".

-

Note that some of these file(s) may or may not be present. If present, and cannot be deleted because they're ' in use', try deleting them from " Safe Mode".

Post back a new log, and let me know how everything goes.

-

Mike.

Message Edited by Midnight Star on 03-01-2005 12:48 AM

umaineball · Answer

Thank you for all of your help.  I did everything that I was told and the new log is posted below.  I have noticed a difference in speed for the better but there still are some problems.  Everytime I start windows the windows installer is started and I am told to insert my disk, I just stop the installer and continue on my way but if I don't open my internet explorer while this is happening I will be unable to. Nothing will open it not clicking on the icon, not trying to run it by calling the file name, nothing will open it.  And my windows media will not open at all not even while the windows installer window is open.  What is this and how can I fix it?    Logfile of HijackThis v1.99.1Scan saved at 6:47:44 PM, on 3/1/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\S24EvMon.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\cisvc.exeC:\Program Files\Network Associates\McAfee Desktop Firewall for Windows XP\FireSvc.exeC:\Program Files\Network Associates\Common Framework\FrameworkService.exeC:\WINDOWS\system32\ZCfgSvc.exeC:\Program Files\Network Associates\VirusScan\Mcshield.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\1XConfig.exeC:\Program Files\Network Associates\VirusScan\VsTskMgr.exeC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\System32\RegSrvc.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Apoint\Apoint.exeC:\WINDOWS\system32\BacsTray.exeC:\Program Files\Intel\NCS\PROSet\PRONoMgr.exeC:\Program Files\Dell\QuickSet\quickset.exeC:\Program Files\Common Files\Sonic\Update Manager\sgtray.exeC:\WINDOWS\System32\DSentry.exeC:\Program Files\Dell\Media Experience\PCMService.exeC:\Program Files\Common Files\Real\Update_OBealsched.exeC:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exeC:\Program Files\Common Files\Dell\EUSW\Support.exeC:\Program Files\DIGStream\digstream.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exeC:\WINDOWS\BCMSMMSG.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Java\jre1.5.0_01\bin\jusched.exeC:\Program Files\Network Associates\Common Framework\UpdaterUI.exeC:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exeC:\Program Files\Network Associates\VirusScan\SHSTAT.EXEC:\Program Files\Microsoft AntiSpyware\gcasServ.exeC:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exeC:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exeC:\Program Files\MSN Messenger\MsnMsgr.ExeC:\Program Files\AIM\aim.exeC:\Program Files\Apoint\Apntex.exeC:\Program Files\Yahoo!\Messenger\ymsgr_tray.exeC:\Program Files\Microsoft AntiSpyware\gcasDtServ.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\System32\msiexec.exeC:\WINDOWS\System32\wbem\wmiapsrv.exeC:\WINDOWS\system32\wuauclt.exeC:\Documents and Settings\Bartholomew Bischoff\My Documents\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://access.wright.eduR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://access.wright.eduO2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\ycomp5_5_7_0.dllO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dllO2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dllO3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\ycomp5_5_7_0.dllO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installquietO4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exeO4 - HKLM\..\Run: [bacstray] BacsTray.exeO4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exeO4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exeO4 - HKLM\..\Run: [StorageGuard] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /rO4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exeO4 - HKLM\..\Run: [PCMService] 'C:\Program Files\Dell\Media Experience\PCMService.exe'O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe' -osbootO4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exeO4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exeO4 - HKLM\..\Run: [Desksite CMA] C:\Program Files\desksite\bin\cma.exeO4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exeO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exeO4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exeO4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exeO4 - HKLM\..\Run: [McAfeeUpdaterUI] 'C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe' /StartedFromRunKeyO4 - HKLM\..\Run: [Network Associates Error Reporting Service] 'C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe'O4 - HKLM\..\Run: [ShStatEXE] 'C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE' /STANDALONEO4 - HKLM\..\Run: [gcasServ] 'C:\Program Files\Microsoft AntiSpyware\gcasServ.exe'O4 - HKLM\..\Run: [orvy] C:\WINDOWS\system32\orvy.exeO4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /autoO4 - HKCU\..\Run: [MsnMsgr] 'C:\Program Files\MSN Messenger\MsnMsgr.Exe' /backgroundO4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quietO4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odlO4 - HKCU\..\Run: [SpyWareWall] C:\PROGRA~1\SPYWAR~1\SpyWareWall.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTMLO8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htmO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000O8 - Extra context menu item: View Link Source - C:\windows\web\viewsource.htmlO8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htmO8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin
pjpi150_01.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin
pjpi150_01.dllO9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dllO9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dllO9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exeO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dllO9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO15 - Trusted Zone: http://www.espn.comO15 - Trusted Zone: http://www.msn.comO15 - Trusted Zone: http://www.neededware.comO15 - Trusted Zone: *.musicmatch.com (HKLM)O16 - DPF: NDWCab - http://www.neededware.com/NDWCab.CABO16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com/housecall/xscan60.cabO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cabO16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} - http://launch.gamespyarcade.com/software/launch/alaunch.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cabO16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/autocomplete.cabO20 - Winlogon Notify: Sebring - C:\WINDOWS\System32\LgNotify.dllO23 - Service: McAfee Desktop Firewall Service (FireSvc) - Networks Associates Technology, Inc. - C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows XP\FireSvc.exeO23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exeO23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exeO23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exeO23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exeO23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exeO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exeO23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcappcapd.exe' -d -f '%ProgramFiles%\WinPcappcapd.ini (file missing)O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\WINDOWS\System32\S24EvMon.exeO23 - Service: SpyDetectorWatcher - Unknown owner - C:\Program Files\SpyDetector\spywatcher.exe (file missing)

umaineball · Answer

I just restarted my computer and now I am able to open wmp and ie anytime again.  Though my windows installer still opens when I start windows.

Midnight Star · Answer

umaineball,

Let's remove this final entry. Have you considered letting the windows installation complete? Or are you concerned it might be something it shouldn't?

Run HiJackThis and click " Scan", then check(tick) the following, if present:

O4 - HKLM\..\Run: [orvy] C:\WINDOWS\system32\orvy.exe

Now, with all windows closed except HiJackThis, click " Fix checked".

Mike

umaineball · Answer

Yes and I have let the windows installer complete and all it does is tell me to insert a disk.  This installer runs everytime that I run an application such as frontpage, word, excel, powerpoint...etc.    but after it prompts me to insert the disk, and I don't, it closes and the program runs perfect.

Midnight Star · Answer

umaineball,

I not sure on that, unless it's looking to that disc on startup for a document or something to load; have you tried posting this in the software forums yet? They might be able to help you resolve that issue.

-

Mike.

Virus & Spyware

Can't figure it out

Was this post helpful?