Error D0CE0C16B1

Question

I have already run adware and spybot and something called Regcure  but I'm still getting this error message at sign on---help please!    Thanks!!    Logfile of Trend Micro HijackThis v2.0.2Scan saved at 2:03:27 PM, on 4/14/2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Boot mode: Normal Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exeC:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exeC:\WINDOWS\System32
vsvc32.exeC:\Program Files\ThreatFire\TFService.exeC:\WINDOWS\System32\wdfmgr.exeC:\WINDOWS\System32\alg.exeC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZENG07.EXEC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\wscntfy.exeC:\Program Files\Real\RealPlayer\RealPlay.exeC:\Program Files\QuickTime\QTTask.exeC:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exeC:\Program Files\Microsoft AntiSpyware\gcasDtServ.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exeC:\Program Files\Common Files\InstallShield\UpdateService\issch.exeC:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exeC:\Program Files\Java\j2re1.4.2_15\bin\jusched.exeC:\Program Files\ThreatFire\TFTray.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\FinePixViewer\QuickDCF.exeC:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sb/*http://www.yahoo.com/search/ie.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blankR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/homeR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\DRS\LOCALS~1\Temp\se.dll/sp.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blankR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.comR1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blankR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blankR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blankR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blankO1 - Hosts: 66.180.173.39 google.aeO1 - Hosts: 66.180.173.39 google.amO1 - Hosts: 66.180.173.39 google.asO1 - Hosts: 66.180.173.39 google.atO1 - Hosts: 66.180.173.39 google.azO1 - Hosts: 66.180.173.39 google.beO1 - Hosts: 66.180.173.39 google.biO1 - Hosts: 66.180.173.39 google.caO1 - Hosts: 66.180.173.39 google.cdO1 - Hosts: 66.180.173.39 google.cgO1 - Hosts: 66.180.173.39 google.chO1 - Hosts: 66.180.173.39 google.ciO1 - Hosts: 66.180.173.39 google.clO1 - Hosts: 66.180.173.39 google.co.crO1 - Hosts: 66.180.173.39 google.co.huO1 - Hosts: 66.180.173.39 google.co.ilO1 - Hosts: 66.180.173.39 google.co.inO1 - Hosts: 66.180.173.39 google.co.jeO1 - Hosts: 66.180.173.39 google.co.jpO1 - Hosts: 66.180.173.39 google.co.keO1 - Hosts: 66.180.173.39 google.co.krO1 - Hosts: 66.180.173.39 google.co.lsO1 - Hosts: 66.180.173.39 google.co.nzO1 - Hosts: 66.180.173.39 google.co.thO1 - Hosts: 66.180.173.39 google.co.ugO1 - Hosts: 66.180.173.39 google.co.ukO1 - Hosts: 66.180.173.39 google.co.veO1 - Hosts: 66.180.173.39 google.comO1 - Hosts: 66.180.173.39 google.com.agO1 - Hosts: 66.180.173.39 google.com.arO1 - Hosts: 66.180.173.39 google.com.auO1 - Hosts: 66.180.173.39 google.com.brO1 - Hosts: 66.180.173.39 google.com.coO1 - Hosts: 66.180.173.39 google.com.cuO1 - Hosts: 66.180.173.39 google.com.doO1 - Hosts: 66.180.173.39 google.com.ecO1 - Hosts: 66.180.173.39 google.com.fjO1 - Hosts: 66.180.173.39 google.com.giO1 - Hosts: 66.180.173.39 google.com.grO1 - Hosts: 66.180.173.39 google.com.gtO1 - Hosts: 66.180.173.39 google.com.hkO1 - Hosts: 66.180.173.39 google.com.lyO1 - Hosts: 66.180.173.39 google.com.mtO1 - Hosts: 66.180.173.39 google.com.mxO1 - Hosts: 66.180.173.39 google.com.myO1 - Hosts: 66.180.173.39 google.com.naO1 - Hosts: 66.180.173.39 google.com.nfO1 - Hosts: 66.180.173.39 google.com.niO1 - Hosts: 66.180.173.39 google.com.npO1 - Hosts: 66.180.173.39 google.com.paO1 - Hosts: 66.180.173.39 google.com.peO1 - Hosts: 66.180.173.39 google.com.phO1 - Hosts: 66.180.173.39 google.com.pkO1 - Hosts: 66.180.173.39 google.com.prO1 - Hosts: 66.180.173.39 google.com.pyO1 - Hosts: 66.180.173.39 google.com.saO1 - Hosts: 66.180.173.39 google.com.sgO1 - Hosts: 66.180.173.39 google.com.svO1 - Hosts: 66.180.173.39 google.com.trO1 - Hosts: 66.180.173.39 google.com.twO1 - Hosts: 66.180.173.39 google.com.uaO1 - Hosts: 66.180.173.39 google.com.uyO1 - Hosts: 66.180.173.39 google.com.vcO1 - Hosts: 66.180.173.39 google.com.vnO1 - Hosts: 66.180.173.39 google.deO1 - Hosts: 66.180.173.39 google.djO1 - Hosts: 66.180.173.39 google.dkO1 - Hosts: 66.180.173.39 google.esO1 - Hosts: 66.180.173.39 google.fiO1 - Hosts: 66.180.173.39 google.fmO1 - Hosts: 66.180.173.39 google.frO1 - Hosts: 66.180.173.39 google.ggO1 - Hosts: 66.180.173.39 google.glO1 - Hosts: 66.180.173.39 google.gmO1 - Hosts: 66.180.173.39 google.hnO1 - Hosts: 66.180.173.39 google.ieO1 - Hosts: 66.180.173.39 google.itO1 - Hosts: 66.180.173.39 google.kzO1 - Hosts: 66.180.173.39 google.liO1 - Hosts: 66.180.173.39 google.ltO1 - Hosts: 66.180.173.39 google.luO1 - Hosts: 66.180.173.39 google.lvO1 - Hosts: 66.180.173.39 google.mnO1 - Hosts: 66.180.173.39 google.msO1 - Hosts: 66.180.173.39 google.muO1 - Hosts: 66.180.173.39 google.mwO1 - Hosts: 66.180.173.39 google.nlO1 - Hosts: 66.180.173.39 google.noO1 - Hosts: 66.180.173.39 google.off.aiO1 - Hosts: 66.180.173.39 google.plO1 - Hosts: 66.180.173.39 google.pnO1 - Hosts: 66.180.173.39 google.ptO1 - Hosts: 66.180.173.39 google.roO1 - Hosts: 66.180.173.39 google.ruO1 - Hosts: 66.180.173.39 google.rwO1 - Hosts: 66.180.173.39 google.seO1 - Hosts: 66.180.173.39 google.shO1 - Hosts: 66.180.173.39 google.skO1 - Hosts: 66.180.173.39 google.smO1 - Hosts: 66.180.173.39 google.tdO1 - Hosts: 66.180.173.39 google.tmO2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {391DD382-D15B-43E9-84F2-F3D53A142D29} - (no file)O2 - BHO: COM+ Service - {3C49DDAC-3DA4-4743-AF6C-5974FEAF875C} - C:\WINDOWS\System32\winload.dllO2 - BHO: (no name) - {497EAEE2-A154-4C1C-B829-EAF0A9DFEFDF} - (no file)O2 - BHO: Yahoo Toolbar - {54C7D1DD-4296-451e-B756-1E94F665B4FF} - C:\WINDOWS\System32\yatool.dllO2 - BHO: (no name) - {5BF017AE-FE4D-433A-9B9A-1AD891EED140} - (no file)O2 - BHO: (no name) - {7319961D-95FD-43A5-BC60-D21E1D461E50} - (no file)O2 - BHO: (no name) - {A6EF85E4-FFF4-4C3F-8865-3099EF3760C3} - (no file)O2 - BHO: (no name) - {A9D4D344-CE0D-4234-A8C2-AE9428DFC4CA} - (no file)O2 - BHO: (no name) - {CAEF8995-98FF-96DE-4812-B3F3AC4F1E4E} - C:\WINDOWS\pdlhuh.dllO2 - BHO: (no name) - {EF3CE89C-AC18-3C38-89E6-EEDA68DB9B00} - (no file)O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)O4 - HKLM\..\Run: [gcasServ] 'C:\Program Files\Microsoft AntiSpyware\gcasServ.exe'O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUNO4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYERO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\QTTask.exe' -atboottimeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe'O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startupO4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exeO4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsersO4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exeO4 - HKLM\..\Run: [ISUSScheduler] 'C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe' -startO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] 'C:\Program Files\Java\j2re1.4.2_15\bin\jusched.exe'O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exeO4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe'O4 - HKLM\..\RunOnce: [RegisterHPDeviceDetectionDll] regsvr32.exe /s 'C:\Program Files\HP\Common\HPDeviceDetection.dll'O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htmO8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTMLO8 - Extra context menu item: Optimum Online Cursor Search - C:\Documents and Settings\All Users\Application Data\Infospace\OptimumOnline\contextsearch.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dllO9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\System32\shdocvw.dllO9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\System32\shdocvw.dllO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {315B0BFB-2BD4-481B-80A3-A9B80727C61B} - http://webiq005.webiqonline.com/WebIQ/DataServer/Pub/DataServer.dll?Handler=GetEngineDistribution&EDID={896A23A1-5821-4609-A6C6-6D5536C585C9}O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1190599915482O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cabO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1190599905060O22 - SharedTaskScheduler: COM+ Service - {3C49DDAC-3DA4-4743-AF6C-5974FEAF875C} - C:\WINDOWS\System32\winload.dllO23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Belkin Wireless USB Network Adapter (Belkin Wireless USB Network Adapter Service) - Unknown owner - C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exeO23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe --End of file - 12703 bytes

Bugbatter · Answer

Hi, Beezy20,I do not have good news for you.How long have you been experiencing symptoms of malware?Your system appears to have no anti-virus running, and it is severely compromised. You have several infections including a password stealer. Because your data and privacy have been compromised, this machine is not safe to have connected to the Internet. I suggest doing a reformat/reinstall, and getting an anti-virus program on there. See this note on when to flatten and reinstall a system:http://aumha.net/viewtopic.php?t=28580

Beezy20 · Answer

This is a relatively old computer --2002. I had major problems with it in 2003 and 2004; reloading everything a couple of times during that period. It wasn't connected to the internet for about a year in 2005 and has been riunning ok since early 2006 until recently (last 8 months). So I guess it's time to clean it out again, or get a new computer. I found out some time ago that the microsoft anti spyware was disabled, and I couldn't reinstate it. I thought I was running something called threat fire.....what programs do you reccomend for virus protection?

Thanks for the help.

Bugbatter · Answer

I suspected that you had problems years ago because we have not seen one of those infections for about four years.

The password stealer is of concern to me, though, so if it were my computer I would reformat/reinstall Windows. If the hardware is good, perhaps a reformat is all it will take to have everything running smoothly again.

I use free anti-virus software on all the computers in my family. There is a list of free security software in the announcement at the top of the Virus and Spyware Board.
http://www.dellcommunity.com/supportforums/board/message?board.id=si_virus&thread.id=66825
I use AVG (Free Version) Anti-Virus and find it to be very user-friendly. Many of the regulars here like Avast as well.

As far as the infections that are showing, the anti-virus programs did not pick them up years ago when they were prevalent, so keep in mind that there is always a chance that you will run into something that won't be targeted by whatever security you are using.
As you can see, most of the logs posted in this forum are showing an anti-virus and at least one anti-spyware application running. The best defense is the person sitting the chair behind the computer. It's where you surf and how you surf that makes a difference.

I do not know if you will take your computer to a shop or attempt the reformat yourself, but if you need help, feel free to ask on the XP Board. Here are some additional instructions:

http://www.winsupersite.com/showcase/windowsxp_sg_clean.asp

Virus & Spyware

Error D0CE0C16B1

Was this post helpful?