more hjt questions.

that was supposed to say "sorry" NOT sirry! I also wanted to say that the reason I need to post my log is because I got a message from my virus scan yesterday saying it had detected and cleaned a trojan! Now today my floppy is inoperable so I think I still have a big problem somewhere as my floppy was working fine before today. I have dell 4600 win xp ie6.0

Logfile of HijackThis v1.97.7
Scan saved at 6:48:04 PM, on 7/21/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Sierra\Planner\PLNRnote.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\SpywareGuard\sgbhp.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Outlook Express\msimn.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Event Planner Reminders.lnk = C:\Program Files\Sierra\Planner\PLNRnote.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Real.com (HKLM)
O15 - Trusted Zone: www.ebay.com
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,83/mcinsctl.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX25.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38037.6666898148
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/controls/SassCln.CAB
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,19/mcgdmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DE22A7AB-A739-4C58-AD52-21F9CD6306B7} (CTAdjust Class) - http://download.microsoft.com/download/7/E/6/7E6A8567-DFE4-4624-87C3-163549BE2704/clearadj.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{323ED60C-6E27-4BE3-820A-341E760EA061}: NameServer = 66.94.212.81 66.94.212.82
O17 - HKLM\System\CS1\Services\Tcpip\..\{323ED60C-6E27-4BE3-820A-341E760EA061}: NameServer = 66.94.212.81 66.94.212.82

 

No, you do not need to make a new HJT folder everytime you run HJT.  You can run it from the one it is in.

Steve

Could a virus be the cause of my inoperable floppy drive? When I put a floppy into the drive I keep getting the error message to insert a floppy. I used the device trouble shooter and the device appears to be working properly. My sytem is only a few months old so I have no idea what could have caused something that was working fine yesterday to now be inoperable especially since this latest trojan was detected on my machine, I am wondering if a virus could have killed my floppy drive! Thank You. I know you are all busy so I will be patient.

I hope someone sees my log here :)

>Could a virus be the cause of my inoperable floppy drive?

Possible, but unlikely. In any case if a virus affected the operation of the drive it is only a software glitch.

>When I put a floppy into the drive I keep getting the error message to insert a floppy.

What is the exact error message? See KB article:

http://support.microsoft.com/default.aspx?scid=kb;en-us;811839&Product=winxp

Check the basics if you can work inside the case...is the floppy cable connected properly?

HTH,

Texruss

Run HJT and with all other explorer windows closed, put a check in front of each of these line items and click on "Fix Checked".

O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?

O15 - Trusted Zone: www.ebay.com
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,83/mcinsctl.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX25.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38037.6666898148
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/controls/SassCln.CAB
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,19/mcgdmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DE22A7AB-A739-4C58-AD52-21F9CD6306B7} (CTAdjust Class) - http://download.microsoft.com/download/7/E/6/7E6A8567-DFE4-4624-87C3-163549BE2704/clearadj.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab

Empty your recycle bin and reboot the computer.  Then follow these directions:
http://www.cjwd.demon.co.uk/spybot-adaware.html
Please note the free Spybot 1.3 does have a slight bug...it detects some DSO exploits falsely. Hopefully an upgrade will fix this.The problem is not serious and should not deter people from using Spybot.
A new version of HJT has been released, To update HJT, open the program, then click on Config to the right. Then on the top line, choose Misc Tools.
On the left column choose "Check for update online". Follow the instructions. Post a new log staying in this same thread for continuity.

Thanks...pskelley
In training Tom Coyote Forum 
& SpywareInfo.com
Expert Malware Responder Dell Forum

 

Thanks Texruss-also I contacted tech support and they are sending a technician to replace my floppy drive.

 

Hi PSKELLEY-Wow I must have a bad virus! The problem is I ran HJT but not all the things you listed to be fixed are showing up on the scan?????So of course I am even more confused as to what to do now and just sick thinking my puter is infected. I guess it does not really matter what protection you have because a virus is going to get through if it wants to. I have done all you guys have said by having spybot, adaware, spywareguard, spywareblaster and keeping windows and mcafee updated but now I have all these viruses? Anyway, I hope you have time to walk me through this so I can get this stuff fixed. You guys and gals are so great and I know you are helping loads of people like me and I am so thankful you are here :) for us!

Not to fret,  all I removed in 02 and 04 were usless orphans, the 016 items are ActiveX contols and were just a general cleaning, they will prompt you to download the .cab file again should you visit the site.  Ad-aware and Spybot also were part of the general cleaning.  Texruss will stop by to take one last look and give you the all clean list, Hope this helps...pskelley

Message Edited by pskelley on 07-22-2004 10:15 AM

Thank you pskelley but is there something else I need to do on my end? I haven't fixed the items you listed because when I saw that some were not there I just closed hjt and posted here. Did I even do this right? Meaning did I open my hjt right? I just went to my computer..c-drive..the hjt folder and then clicked on that which brought up hjt icon which I then double clicked on and then clicked scan and then got the list. then when I saw that not all the items you had listed in your post for me to check to be fixed, were not all there I stopped and closed out and came to the board to post. I just feel like a big pain  but you guys are so patient. And yesterday I do not know what  I did to make all those repeat posts..that was a big accident but I can imagine what you all must have been thinking....like you already have enough work without having to deal with accidental posts! So sorry again!

Please follow the instruction in my post that starts like this:

Run HJT and with all other explorer windows closed, put a check in front of each of these line items and click on "Fix Checked".

If any item is not there when you look for it to check it, tell us that when you post.  When you have finished those instructions, please post a new log, and stay in this same thread. (please note: only  push submit one time, it will take a bit for it to happen, if you keep pushing send or submit, it wil post multiples.

Run HJT and fix checked the items pskelley listed that you still see in the log. Then reboot, rerun HJT and post the latest log.

When I clicked to fix certain of those checked items do you think it may have disabled mcaffee?

also my system is not starting up normally and I believe this is how the tech support had me leave it after disconnecting the floppy drive. I am wondering if doing a system restore will affect the hjt? Is that what you would advise? I have no idea why it is telling me mcafee needs to be reinstalled. Do I need to uninstall before reinstalling?

I am losingit  here. When it rains it pours I guess..anyway, I just ran hjt and then fixed the items you told me to Pskelley and then cleaned the recycle bin and rebooted but when it came back up it tells me now that I must need to reinstall mcaffee because some items did not install properly, now I am not sure if this is because of my talking with tech support this am regarding my inoperable floppy drive (the tech lady walked me through about 6 different checks so maybe my system is now out of whack because of that??? Either way, I do not have mcafee at the moment. The icon is on my desktop but when I click on it it tells me I must reinstall it. I feel like just throwing this whole (just about brand new puter out the window today!) I feel I am being punished for something..lol...anyway, do you guys suggest I get the mcaffee back up or continue with posting a hjt log here? I am so afraid now that with no protection I will get another virus. I am even afraid to check my email. This bites!