Skip to main content
Start a Conversation

Unsolved

This post is more than 5 years old

rubberducky505

2 Posts

3049

November 13th, 2004 00:00

Internet selectively working-hjt log included

Ok, I have a couple problems but my main one is that my internet doesn't work after I close and reopen my laptop (have to restart to get it to work again). Everytime I restart a couple messages come up:
1) net service configuration does not exist
2) I get a send error report message for RULaunch and Virus Scan Synchronization
And is 'mscdexnt' a thing I should block or unblock? Any help anyone could provide would be GREAT! And keep it simple because I'm a little (ok, a lot) computer illiterate :) THANKS!

Logfile of HijackThis v1.98.2
Scan saved at 8:53:20 PM, on 11/12/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\SYSTEM32\rundl32.exe
C:\WINDOWS\SYSTEM32\DLLCACHE\mscdexnt.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\SYSTEM32\sqlsrvr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\srvany.exe
C:\WINDOWS\system32\dllcache\secure32\netsvcs.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\RoamMgr.exe
C:\WINDOWS\system32\srvany.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Intel\Switching\User\RoamSvc.exe
C:\Program Files\McAfee\McAfee Firewall\CPD.EXE
C:\Program Files\McAfee\McAfee Firewall\CPDCLNT.EXE
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\System32\dllhost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\AIM\aim.exe
C:\Documents and Settings\Amanda Olson\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://uportal.cornell.edu/
O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:\WINDOWS\localNRD.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe" /SU
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [EPSON Stylus C42 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC1.EXE /P23 "EPSON Stylus C42 Series" /O6 "USB001" /M "Stylus C42"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [mscdexnt.exe] c:\WINDOWS\SYSTEM32\DLLCACHE\mscdexnt.exe
O4 - HKLM\..\Run: [zarwkafe] C:\WINDOWS\System32\xgucwks.exe
O4 - HKLM\..\Run: [ICQ Lite Messenger] ICQLITE.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\RunServices: [System Updater Service] wmiprvsd.exe
O4 - HKLM\..\RunOnce: [Ad-aware] "C:\Program Files\Lavasoft\Ad-aware 6\Ad-aware.exe" "+b1"
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /startmonitor
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=ffe5909ffe00eb7f12d063133b3d23bee077a5bf6056e04090b5d765ec2e75e4f9e8656dccedb6d89d09d2c86f5b30597ea87d3d2a4c1ed47e9128c74281bfb4:a6d60611056994dfac80e4ac3a715ede
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll

Midnight Star

4.8K Posts

November 13th, 2004 01:00

Ok, let's see what these might be...
 
 
Not being able to reconnect to the internet after going into 'standby' by closing the lid might be a power option setting or might require a newer BIOS version.
 
---
 
RULauch appears to be part of McAfee's anti-virus software.
 
O4 - HKCU\..\Run: [ McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /startmonitor
 
I've also heard of instances where anti-virus software can be compromised by currently running malware. If the anti-virus tries to access the internet, it's own firewall will catch it. Now, whether this is the case with McAfee, i'm not sure.
 
---
 
'mscdexnt' is on my XP SP2 system as well, it's 817 bytes and was created 9/3/2002. What's the stamp on your file?
 
---
 
This entry looks suspicious...
 
O4 - HKLM\..\Run: [zarwkafe] C:\WINDOWS\System32\xgucwks.exe
 
 
I'll be able to check your log in more detail here shortly. See if some of the above helps.
 
Mike.
 
 

rubberducky505

2 Posts

November 13th, 2004 22:00

I turned of the stand-by option and when I close my computer, I can open it and the internet still works. Is there anything I can do to fix the problem with the stand-by option? (What is BIOS?)

Midnight Star

4.8K Posts

November 16th, 2004 14:00

    rubberducky,
 
    Sorry for taking so long to get back with you, but my weekends now belong to family and software development ( :smileyvery-happy: - I LOVE PROGRAMMING! )
 
    BIOS stands for Basic Input Output System and evolved from the need to make a system more configurable (helps to define what your computing environement is - like CPU type, available drives, etc.,.). It provides the first instructions the computer sees when it boots up. It's contained on a chip that's plugged into the mother board of your computer. You can 'flash' or write code to this chip - this is upgrading your BIOS. Your simply putting new bootup/basic instructions on your computer for the CPU and OS to use. BIOS is the lowest operating level (or layer) of your computer.
 
    Let's work under the assumption that a CPU can only 'execute' instructions, not create them on it's own. So it needs to be told what to do, in order to perform certain functions, like surfing on the internet. That's the programmer job (software engineers to some). They write the 'code' that tells the computer how to do all the stuff it does, from clicking a button to opening and closing windows. Windows is programming code that was written by a team of programmers and designers.
 
    When the CPU gets power, it talks with the BIOS (a program that's contained on a chip in the computer). As the BIOS is 'running' (the CPU is executing it's code), it checks for any basic problems (like with memory and specific devices) - also called POST, then transfers control to the BOOT block which decides which partition(s) are bootable, and which one will get precedence (the primary boot partition - more than one os is allowed on a harddrive), then when it regains control, helps to manage certain system level functions; the operating system can make direct calls to it.
 
    Hope that helps some,
 
    Mike.
 

Was this post helpful?

View All

No Events found!

Top