Please Help

Question

Something keeps happening to my laptop today.  I'll be online for a while then all of a sudden I can't open any new pages, I can't click on anything under start nor anything in my tray at the bottom.  I can still use any chat i have open on im and the current internet page. I ran ad-ware and also cwshredder Here is a copy of my hijack this Logfile of HijackThis v1.97.7Scan saved at 1:08:05 AM, on 8/31/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\LEXPPS.EXEC:\WINDOWS\System32\Ati2evxx.exeC:\WINDOWS\system32\cisvc.exeC:\WINDOWS\system32\drivers\dcfssvc.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\Program Files\Synaptics\SynTP\SynTPLpr.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files\Dell\AccessDirect\dadapp.exeC:\WINDOWS\System32\DSentry.exeC:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Dell\EUSW\Support.exeC:\Program Files\Dell AIO Printer A940\dlbabmgr.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\Dell\AccessDirect\DadTray.exeC:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exeC:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exeC:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exeC:\Program Files\Common Files\Real\Update_OBealsched.exeC:\Program Files\Dell AIO Printer A940\dlbabmon.exeC:\WINDOWS\System32\qttask.exeC:\Program Files\ICQLite\ICQLite.exeC:\Program Files\Spybot - Search & Destroy\TeaTimer.exeC:\Program Files\Yahoo!\Messenger\ypager.exeC:\Program Files\Digital Line Detect\DLG.exeC:\Program Files\Kodak\KODAK Picture Transfer Software\pts.exeC:\Program Files\WinZip\WZQKPICK.EXEC:\WINDOWS\System32\wbem\wmiapsrv.exeC:\Documents and Settings\Alexandria Szwarc\Desktop\HijackThis.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\System32\wuauclt.exeC:\Program Files\Messenger\msmsgs.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 200.160.128.20R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.ne2.attbb.netO2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {0F660F64-F4C9-477F-8529-44181B717472} - (no file)O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: (no name) - {82315A18-6CFB-44a7-BDFD-90E36537C252} - C:\Program Files\QuickSearch\QuickSearchBar1_27.dllO2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exeO4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exeO4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exeO4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe'O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exeO4 - HKLM\..\Run: [Dell AIO Printer A940] 'C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe'O4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe'O4 - HKLM\..\Run: [ccRegVfy] 'C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe'O4 - HKLM\..\Run: [Ad-watch] 'C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe'O4 - HKLM\..\Run: [Ad-aware] 'C:\Program Files\Lavasoft\Ad-aware 6\Ad-aware.exe' +cO4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exeO4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe' -osbootO4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\System32\qttask.exeO4 - HKLM\..\Run: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -minimizeO4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exeO4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quietO4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.EXE 1O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -traybootO4 - Global Startup: Digital Line Detect.lnk = ?O4 - Global Startup: KODAK Picture Transfer Software.lnk = ?O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXEO9 - Extra button: AIM (HKLM)O9 - Extra button: ICQ 4.1 (HKLM)O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)O9 - Extra button: Messenger (HKLM)O9 - Extra 'Tools' menuitem: Messenger (HKLM)O16 - DPF: Arcsoft Web Uploader - http://www.cartogra.com/downloads/ReadFileApplet.cabO16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cabO16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} (MSSecurityAdvisor Class) - http://download.microsoft.com/download/0/5/c/05c905f4-dd30-427d-a3de-373c3e5552fc/msSecAdv.cab?1083331975091O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralInitialSetup1.0.0.8.cabO16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cabO16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cabO16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab Can you please help??

pskelley · Answer

With a quick glance, I can see some issues. Looks like Host file problems, and I spotted one hostile ActiveX and this:

82315A18-6CFB-44a7-BDFD-90E36537C252 = http://cexx.org/newnet.htm

There is probably more but time constraints limit what I can do for you. You also have a badly outdated HijackThis log as you are running 1.97.7 and the current version is 1.98.2. You need to update before you post a new log anywhere and this time put the HijackThis.exe in a folder on the C:\ so it will be able to safely store your backups for safety and logfile storage. I will give you a recent post by ChrisRLG:

Lots of the regular posting anti-malware experts on this board have moved to pastures new for various reasons. You may find it better to find another support site to assist you.

Please go to this link and choose one of the websites on the left of the page.
Alliance of Security Analysis Professionals: http://www.a-sap.org/
As you can see they all work together in cleaning malware (Virus, Spyware and adware).

To help you choose from that list

TomCoyotes contains the anti-malware school - Classroom.
SpyWareInfo contains the anti-malware school - BootCamp.
Net-Intergration is the support site of Spybot S&D.
Lavasoft Support is the support site of Ad-aware.
Wilders Security has since stopped hijackthis log support due to the lack of experienced helpers.
Others that I would recommend Zerosrealm, Subratam.org, SpyWare BeWare and ComputerCops, but generally all those on that list will have experts to help you.
Texruss and ChrisRLG are Teachers at The TomCoyote Forum.

There are still some knowledgable people left posting here at Dell, so you may still get help from them.

I wish you all the best at getting your computer clean.

pskelley
in training at
TomCoyote and
SpywareInfo

Virus & Spyware

Please Help

Was this post helpful?