Help with HijackThis log file, pls.

Question

Hi I am trying to uninstall Kazaa Media Desktop from Add/Remove programs and it throws installshield error:'InstallShield(R) Setup Launcher has encountered a problem and needs to close'. I had unintsalled Kazaa months before and I think this Kazaa Media Desktop went unnoticed. I am posting my HijackThis log file here. Please help me to sort it out. I started tidying up my computer as I am getting a nasty pop-up of 'Drivecleaner' whenever I visit the website www.123greetings.com. I have problem with that site only. is it a spyware?Pleae help. Awaiting your reply Many thanks AMathew Logfile of HijackThis v1.99.1 Scan saved at 20:46:26, on 19/12/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\Explorer.EXE C:\apache\Apache2\bin\Apache.exe C:\Sun\SDK\lib\appservService.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\CFusionMX\db\slserver52\bin\swagent.exe C:\CFusionMX\db\slserver52\bin\swstrtr.exe C:\CFusionMX\db\slserver52\bin\swsoc.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\apache\Apache2\bin\Apache.exe c:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\mysql\bin\mysqld-nt.exe C:\WINDOWS\System32
vsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\wanmpsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Sun\SDK\jdk\bin\java.exe C:\WINDOWS\system32\ezSP_Px.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32undll32.exe C:\Program Files\Microsoft Office\Office10\WINWORD.EXE C:\hijackthis 1.99.1 download\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/uk/enu/gen/default.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://au.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://au.search.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/uk/enu/gen/default.htm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://au.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://au.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://au.search.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://au.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://au.search.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://au.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://au.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://au.search.yahoo.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.euro.dell.com/countries/uk/enu/gen/default.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Tiscali 10.0 R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {2AA0D77D-C8A5-66CE-BC1B-8F3AAE9652B5} - C:\WINDOWS\addgj.dll (file missing) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe O4 - HKCU\..\Run: [SpySweeper] 'C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe' /0 O4 - HKCU\..\Run: [Yahoo! Pager] 'C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe' -quiet O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_02\bin
pjpi142_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_02\bin
pjpi142_02.dll O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O15 - Trusted Zone: *.awmdabest.com O15 - Trusted Zone: *.frame.crazywinnings.com O15 - Trusted Zone: *.static.topconverting.com O15 - Trusted Zone: *.05p.com (HKLM) O15 - Trusted Zone: *.awmdabest.com (HKLM) O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM) O15 - Trusted Zone: *.scoobidoo.com (HKLM) O15 - Trusted Zone: *.static.topconverting.com (HKLM) O15 - Trusted IP range: 206.161.125.149 O15 - Trusted IP range: 206.161.124.130 (HKLM) O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://www.ipswitch.com/_installs/wsftp_le/setup.exe O16 - DPF: {4E7BD74F-2B8D-469E-C0FF-FD78B598BB30} - http://www.mamma.com/info/services_tools/tlbar/mamatbar.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/200dcff2505650b9d221/netzip/RdxIE601.cab O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - https://mysupport.nai.com/amiuptodate/bin/1,0,0,7/McUpdatePortal.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab O16 - DPF: {88C51E90-8E9C-4C96-8A45-574D88B63FAF} - http://acceso.masminutos.com/laaplicacion.cab O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/ydropper/ydropper1_3us.cab O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - 'C:\PROGRA~1\MSNMES~1\msgrapp.dll' (file missing) O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Apache2 - Unknown owner - C:\apache\Apache2\bin\Apache.exe' -k runservice (file missing) O23 - Service: SunJavaSystemAppserver9PE (AppServer9PE) - Unknown owner - C:\Sun\SDK\lib\appservService.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: ColdFusion MX Application Server - Macromedia Inc. - C:\CFusionMXuntime\bin\jrunsvc.exe O23 - Service: ColdFusion MX ODBC Agent - Unknown owner - C:\CFusionMX\db\slserver52\bin\swagent.exe O23 - Service: ColdFusion MX ODBC Server - Unknown owner - C:\CFusionMX\db\slserver52\bin\swstrtr.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: MySql - Unknown owner - C:/mysql/bin/mysqld-nt.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

RKinner · Answer

Download

http://www.mvps.org/winhelp2002/DelDomains.inf

IE may tell you that it doesn't want to download the file but click on the warning line and download it.

Save to your desktop. Then close IE, rightclick on deldomain and install. That should cleanout the O15 entries.

Boot into Safe Mode (without networking) by rebooting and when you see the maker's logo start tapping the F8 key until it gives you the Safe Mode menu. Choose the top option and login as your usual login.

Run HJT (scan only) and check the following (if still there) then Fix Checked.

O2 - BHO: (no name) - {2AA0D77D-C8A5-66CE-BC1B-8F3AAE9652B5} - C:\WINDOWS\addgj.dll (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.static.topconverting.com
O15 - Trusted Zone: *.05p.com (HKLM)
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted Zone: *.scoobidoo.com (HKLM)
O15 - Trusted Zone: *.static.topconverting.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: 206.161.124.130 (HKLM)
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://www.ipswitch.com/_installs/wsftp_le/setup.exe
O16 - DPF: {4E7BD74F-2B8D-469E-C0FF-FD78B598BB30} - http://www.mamma.com/info/services_tools/tlbar/mamatbar.cab
O16 - DPF: {88C51E90-8E9C-4C96-8A45-574D88B63FAF} - http://acceso.masminutos.com/laaplicacion.cab

Reboot into regular mode. Open IE and select Internet Options, Security then set Click on Default Level then
Apply then Privacy and slid the slider up to Medium if not already there. OK. Tools, Popup Blocker, Turn On Popup blocker.

Make a new log and post it as a reply.

For your Kazaa problem.

Download regseeker.

http://www.hoverdesk.net/freeware.htm

Click on where it says:

DOWNLOAD RegSeeker 1.52 (>20 languages included !) then when you get to the next page click on Download.

IE may tell you that it doesn't want to download the file but click on the warning line and download it.

Save it to your desktop then rightclick on it and Extract it to C:\reg (new folder) or Open it With WinZip.
Then run regseeker.exe (Start, Run, C:\reg\regseeker.exe, OK. It should start the program. Select Find in Registry then check all of the HKEY entries and search for kazaa.

Then Select All, Select All, rightclick on the selection and Delete Selected Items.

Ron

amathew · Answer

Hi That was great. Thank you very much. I did it all. Removed the Kazaa stuff as well. I am using firefox and still some pop-ups are there. Never mind. I can use IE. With IE no problems now. Thanks once again. I am posting the new log. Awaiting to hear from you if there is anything more to be done. Logfile of HijackThis v1.99.1 Scan saved at 11:54:35, on 21/12/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\apache\Apache2\bin\Apache.exe C:\Sun\SDK\lib\appservService.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\CFusionMX\db\slserver52\bin\swagent.exe C:\CFusionMX\db\slserver52\bin\swstrtr.exe C:\CFusionMX\db\slserver52\bin\swsoc.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\apache\Apache2\bin\Apache.exe c:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\mysql\bin\mysqld-nt.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32
vsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\wanmpsvc.exe C:\Sun\SDK\jdk\bin\java.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\WINDOWS\system32\ezSP_Px.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\hijackthis 1.99.1 download\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/uk/enu/gen/default.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://au.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://au.search.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/uk/enu/gen/default.htm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://au.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://au.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://au.search.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://au.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://au.search.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://au.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://au.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://au.search.yahoo.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.euro.dell.com/countries/uk/enu/gen/default.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Tiscali 10.0 R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe O4 - HKCU\..\Run: [SpySweeper] 'C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe' /0 O4 - HKCU\..\Run: [Yahoo! Pager] 'C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe' -quiet O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_02\bin
pjpi142_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_02\bin
pjpi142_02.dll O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/200dcff2505650b9d221/netzip/RdxIE601.cab O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - https://mysupport.nai.com/amiuptodate/bin/1,0,0,7/McUpdatePortal.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab O16 - DPF: {88C51E90-8E9C-4C96-8A45-574D88B63FAF} - http://acceso.masminutos.com/laaplicacion.cab O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/ydropper/ydropper1_3us.cab O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - 'C:\PROGRA~1\MSNMES~1\msgrapp.dll' (file missing) O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Apache2 - Unknown owner - C:\apache\Apache2\bin\Apache.exe' -k runservice (file missing) O23 - Service: SunJavaSystemAppserver9PE (AppServer9PE) - Unknown owner - C:\Sun\SDK\lib\appservService.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: ColdFusion MX Application Server - Macromedia Inc. - C:\CFusionMXuntime\bin\jrunsvc.exe O23 - Service: ColdFusion MX ODBC Agent - Unknown owner - C:\CFusionMX\db\slserver52\bin\swagent.exe O23 - Service: ColdFusion MX ODBC Server - Unknown owner - C:\CFusionMX\db\slserver52\bin\swstrtr.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: MySql - Unknown owner - C:/mysql/bin/mysqld-nt.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

RKinner · Answer

I'm glad things are working better.  Can't help you much with Firefox since I've never used it but I'm surprised that it doesn't have a popup blocker.   Log looks clean now.  I assume you are running apache for some some reason?   Ron

amathew · Answer

Hi Yes, I am running apache. I was doing a project work in PHP. Project has finished , but I am still keeping it.Thanks again. A Mathew

RKinner · Answer

http://www.mozilla.org/support/firefox/options   tells me that by default firefox blocks popup windows.  There is talk about a whitelist which allows a site to give you popups.  You might check and see if there is anything in the whitelist.    Ron

RKinner · Answer

You can send it to me at rkinner AT gmail DOT com.   AT = @ DOT =.   Ron

amathew · Answer

Hi
Since you have replied again, I was checking once more that it is happening with Firefox only and not IE. I had gone through the options in Firefox earlier. Pop-up windows are blocked. And I had seen that so called 'whitelist'. There is only one entry, that for localhost. I added it when I was doing my project.
I can send you the scree-shots of the ridiculous things the pop-up does(I have saved it in a word document), if it is something you can chase. But I cannot see any option to attach a file here. Is there any?
Thanks again for your prompt replies.
A Mathew

RKinner · Answer

I went to the same site and I got a popup too saying WINNER.  Using IE.  IE said it stopped a popup but I still got one.  That is just a nasty site.  It's not a real popup.  It a javascript fake that is written in the source code of the page:        You could turn off Javascript but normally you need it on a lot of sites.  Might want to find another greeting card site.    I should mention you need to upgrade your Java.  You are running 1.42   O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_02\bin
pjpi142_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_02\bin
pjpi142_02.dll   There are a lot of bugs in your version that can let in malware.  You can get the latest version from:   http://www.java.com/en/download/index.jsp   You should uninstall older versions of java or j2re.     Ron Message Edited by RKinner on 12-21-200604:14 PM

amathew · Answer

Hi
That was a useful tip on Java. These days I was trying to get to grips with J2EE. I installed that, but did not bother to look for the latest version of runtime. I am going to do it. Thanks for the advice. I have sent the screen-shots to your gmail id. Not a serious issue(I can stop using that site as you said), but just a curiosity to find out whether it is actually installing some nasty things on my system. As I am getting prompt replies from this forum I feel proud to be a Dell customer. Though,I have to say my system has slowed down considerably. It is my fault.I am lazy to tidy it up. So far I haven't had any problems with the system. 3 successful years!!!.
Many Thanks
A Mathew

RKinner · Answer

Dell's only input to this is to provide the forum software and computers. We are all volunteers on the forum. Just do it because we don't like spyware.

You might try rogueremover to make sure you don't have any drivecleaner on your system.

http://www.malwarebytes.org/rogueremover_history.php

You might be getting this because your Java is out of date. Winfixer used a hole in 1.42 to install itself.

For slowness this is my generic list of things to check:

You can also try a few other things:

Blacklight Rootkit Detector:

Download Blacklight trial from here: http://www.f-secure.com/blacklight/

Hit "I accept." It will take you to the download page. Download blbeta.exe and save it to the Desktop. Once saved... double click blbeta.exe (you may not be able to see the .exe) to install the program. Click Accept Agreement and click Scan This app may trigger a warning from your antivirus. Let the driver load. Wait for it to finish. If it displays any items...don't do anything with them yet. Just hit exit (close) It will drop a log on Desktop that starts with fsbl....big number

Please post contents of log in your next reply.

A Disk Check:

Run a disk error check and see if your harddrive has problems. Start, My Computer then right click on Local Drive C and select Properties (verify that it shows you have at least 15% free) then Tools, Error-Checking => Check Now. Check the 2 boxes then Start. It will tell you it can't do it now but will be glad to schedule it for your next boot. Tell it OK. When you reboot it will check your drive which usually takes 30-60 minutes. Sometimes it will even fix your problems while it is at it.

Memory Check:

Verify that you still have the same amount of memory as you did originally. (Start) then Open My Computer and select Help then about Windows. Is the physical memory about what you bought? Sometimes a single chip will fail and drop your memory in half.

Run a memory test.

http://oca.microsoft.com/en/windiag.asp

When it is running slow: rightclick on the clock and select Task Manager then select Processes. Click once or twice on the CPU column heading until you get the numbers at the top in that column. What are the top three processes and what % do they each take.

Check the Event logs for errors:

Start, Run, eventvwr.msc, OK then select System. Look for red marked files that have a time stamp about the time of the slowdown. Open the event then click on the bottom of the three buttons to copy the text. Move to a reply and Edit, Paste. Repeat for any other different errors that happened during the last slowdown period or last reboot. Please don't go back to the beginning of time and no events from a Safe Mode boot. Repeat for Application. If your PC speaks something other than English don't translate it unless it doesn't use the Latin alphabet and then please include the timestamps.

Check the Device Manager for problems:

(Start) then rightclick on My Computer and select Manage. Then Device Driver. click on each of the + marks to open each item. Look for red marked items and uninstall them or delete them and reboot. Do they come back with red marks?

Check for a bad file in System32:

Start, Run, sigverif, OK then press Start and wait for the program to finish. When it finishes sort the output by date by clicking on the Modified column header once or twice. Look for files with .exe, .dll or ,sys extensions that were modified about the time the problem started.

Check for a bad program:

Start Run, msconfig, OK

Go to Services tab and click on the box to hide Microsoft Services then uncheck everything that remains. Go to Startup tab and uncheck everything. OK and reboot. If it doesn't run faster then go back into msconfig and recheck the things you turned off. If it helps then go back and turn on a few items each time until you find the culprit.

Also once you upgrade Java you will see a line like this in your HJT log:

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

The BHO is installed by the latest Java program but on certain PC's it causes a big slowdown in Internet Explorer. We don't know why. We also don't know what the BHO is supposed to do but older versions of Java do not have this BHO and removing it doesn't seem to hurt anything.

Ron

Virus & Spyware

Help with HijackThis log file, pls.

Was this post helpful?