Incorrect command line parameter error message for windows installer

Question

Everytime i start or log on to windows XP i get the error message 'Incorrect command line parameters.'  Also, i have no task manager, and ive tried downloading McAfee online with aol. but it never completes.  Ive tried many things to get rid of this virus.  AD Aware, I think that it is the W32.Xabot.Worm.  But i am missing files that are stated to be corrected in the recovery walkthrough in this message board. Here is my HijackThis log.  Can someone please help? Logfile of HijackThis v1.97.7Scan saved at 9:17:52 PM, on 2/2/2004Platform: Windows XP  (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Nhksrv.exeC:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exeC:\WINDOWS\system32\cisvc.exeC:\WINDOWS\System32\CTsvcCDA.EXEC:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exeC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\System32\snmp.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\wanmpsvc.exeC:\WINDOWS\System32\Winkfyj.exeC:\WINDOWS\System32\Winkye.exeC:\WINDOWS\System32\MsPMSPSv.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\DELLMMKB.EXEC:\WINDOWS\System32\devldr32.exeC:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXEC:\Program Files\Netropa\OSD.exeC:\WINDOWS\wt\updater\wcmdmgr.exeC:\Program Files\Real\RealPlayer\RealPlay.exeC:\Program Files\Common Files\Totem Shared\Uninstall0001\upd.exeC:\Program Files\Common Files\CMEII\CMESys.exeC:\Program Files\QuickTime\qttask.exeC:\WINDOWS\System32undll32.exeC:\Program Files\Netropa\OSDksl.exeC:\Program Files\BroadJump\Client Foundation\CFD.exeC:\Program Files\Creative\SBLive\Creative Diagnostics 2.0\DIAGENT.EXEC:\Program Files\BroadJump\Client Foundation\CFDhju.exeC:\WINDOWS\System32\ctfmon.exeC:\WINDOWS\System32\RUNDLL32.EXEC:\Program Files\America Online 9.0\aoltray.exeC:\Program Files\Date Manager\DateManager.exeC:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exeC:\Program Files\PrecisionTime\PrecisionTime.exeC:\Program Files\Common Files\GMT\GMT.exeC:\Program Files\Internet Explorer\iexplore.exeC:\PROGRA~1\AMERIC~1.0\waol.exeC:\PROGRA~1\AMERIC~1.0\shellmon.exeC:\PROGRA~1\AMERIC~1.0\aolwbspd.exeC:\Documents and Settings\RyMac\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet
ewdotnet5_48.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXEO4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exeO4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exeO4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exeO4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXEO4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launchO4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYERO4 - HKLM\..\Run: [Uninstall0001] 'C:\Program Files\Common Files\Totem Shared\Uninstall0001\upd.exe' LASTCALL!adverts.stripsaver.com!StatsStripSaverO4 - HKLM\..\Run: [CMESys] 'C:\Program Files\Common Files\CMEII\CMESys.exe'O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [GLSetIT] c:\windows\system32\msiexec.exeO4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartupO4 - HKLM\..\Run: [workflo] D:\install\workflow.exeO4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [DIAGENT] C:\Program Files\Creative\SBLive\Creative Diagnostics 2.0\DIAGENT.EXE startupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\RunServices: [GLSetIT] c:\windows\system32\msiexec.exeO4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /backgroundO4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exeO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exeO4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInitO4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exeO4 - Global Startup: Date Manager.lnk = C:\Program Files\Date Manager\DateManager.exeO4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exeO4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?O4 - Global Startup: PrecisionTime.lnk = C:\Program Files\PrecisionTime\PrecisionTime.exeO9 - Extra button: Related (HKLM)O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)O9 - Extra button: Real.com (HKLM)O9 - Extra button: Messenger (HKLM)O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)O10 - Hijacked Internet access by New.NetO10 - Hijacked Internet access by New.NetO10 - Hijacked Internet access by New.NetO10 - Hijacked Internet access by New.NetO10 - Hijacked Internet access by New.NetO12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dllO16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - https://support.dell.com/systemprofiler/SysPro.CABO16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cabO16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.av.aol.com/molbin/shared/mcinsctl/en-us/4,0,0,77/mcinsctl.cabO16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.av.aol.com/molbin/shared/mcgdmgr/en-us/1,0,0,18/mcgdmgr.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Yellowhammer · Answer

First go into add/remove programs and uninstall the following if they are there.

New Dot Net
Date Manager
Precision Time

Then run ad-aware and remove all it finds. Then run Spybot Search & Destroy and remove all the "red" items it finds. Links to these are below my signature.

Then move hijackthis to a non temporary directory that you create and unzip it there. Run it again and post another log.

YoKenny · Answer

In adition to what Yellowhammer indicated please update your Windows operating system to Service pack 1 and ALL Critical Updates.

In Internet Explorer go to Tools then Windows Update and install all patches individually rebooting when necessary.

Then download Ad-aware then update and run to remove all that it finds. Reboot and post a new log to permit us to help you remove any remnants.

Message Edited by YoKenny on 02-03-2004 10:30 PM

rpm900 · Answer

Okay, I

rpm900 · Answer

Okay, I used

rpm900 · Answer

Okay, I used ad aware and spybot.  In spybot, it found the Klez Worm, located at C:/Windows/System32/winkeye.exe.  It said i need to use my virus scan program to remove it.  But like i said i don't exactly have one right now.  Anyways here is my Hijack this log. Logfile of HijackThis v1.97.7Scan saved at 12:32:17 AM, on 2/4/2004Platform: Windows XP  (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Nhksrv.exeC:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exeC:\WINDOWS\system32\cisvc.exeC:\WINDOWS\System32\CTsvcCDA.EXEC:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exeC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\System32\snmp.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\wanmpsvc.exeC:\WINDOWS\System32\Winkfyj.exeC:\WINDOWS\System32\Winkye.exeC:\WINDOWS\System32\MsPMSPSv.exeC:\WINDOWS\DELLMMKB.EXEC:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXEC:\Program Files\Real\RealPlayer\RealPlay.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\BroadJump\Client Foundation\CFD.exeC:\Program Files\Creative\SBLive\Creative Diagnostics 2.0\DIAGENT.EXEC:\WINDOWS\System32\devldr32.exeC:\WINDOWS\System32\ctfmon.exeC:\WINDOWS\System32\RUNDLL32.EXEC:\Program Files\America Online 9.0\aoltray.exeC:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exeC:\Program Files\BroadJump\Client Foundation\CFDhju.exeC:\Program Files\Netropa\OSD.exeC:\Program Files\Netropa\OSDksl.exeC:\Program Files\America Online 9.0\waol.exeC:\Program Files\America Online 9.0\shellmon.exeC:\Program Files\America Online 9.0\aolwbspd.exeC:\WINDOWS\System32\wuauclt.exeC:\Documents and Settings\RyMac\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXEO4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exeO4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exeO4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exeO4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXEO4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYERO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [GLSetIT] c:\windows\system32\msiexec.exeO4 - HKLM\..\Run: [workflo] D:\install\workflow.exeO4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [DIAGENT] C:\Program Files\Creative\SBLive\Creative Diagnostics 2.0\DIAGENT.EXE startupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\RunServices: [GLSetIT] c:\windows\system32\msiexec.exeO4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /backgroundO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exeO4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInitO4 - HKLM\..\RunOnce: [SpyBotSnD] 'C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe' /autocheckO4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exeO4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 - Extra button: Real.com (HKLM)O9 - Extra button: Messenger (HKLM)O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dllO16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - https://support.dell.com/systemprofiler/SysPro.CABO16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cabO16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.av.aol.com/molbin/shared/mcinsctl/en-us/4,0,0,77/mcinsctl.cabO16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.av.aol.com/molbin/shared/mcgdmgr/en-us/1,0,0,18/mcgdmgr.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{C8812BB9-8AF8-480A-809F-6C07810842CE}: NameServer = 205.188.146.146 Thanks Ryan

ChrisRLG · Answer

I would suggest you visit one of the online AV scanners to get rid of the virus. Look on my website - link below - AV section, and one of the online scanner sites listed.

Also look at the recommended AV's on that page.

AVG6 is free from www.grisoft.com , install that, update it for all updates, and then scan your machine (complete scan)

Virus & Spyware

Was this post helpful?