UNSOLVED
M
msully1001
5 Posts
0
790
August 20th, 2005 15:00
Hijack Log second posting
Help! Below is a copy of the Hijack file for my computer. I keep getting a Generic Host process for Win32 message followed by the NT Authority shutsdown. I cannot access the internet on that computer and most of my programs don't work. All my system restore dates are gone. I have run my MS Spyware and McAfee antivirus and both come up negative. I have run stinger.EXE and FixKorgo EXE. Both turn up nothing. I then tried this hijack and below are the posted results. Any help would be appreciated.
Logfile of HijackThis v1.99.1
Scan saved at 9:36:47 PM, on 8/13/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\mps\mscifapp.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.azcentral.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by Cox High Speed Internet
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\program files\mcafee.com\mps\mcbrhlpr.dll
O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [BuildBU] c:\dell\bldbubg.exe
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [Lexmark X6100 Series] "C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe"
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [StatusClient] C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup] C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe
O4 - HKLM\..\Run: [CheckRes] C:\Program Files\MyBackDrop\ActivDesk.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/install/hpobjinstaller_gmn.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
O16 - DPF: {555500CD-CB54-11D6-8DB9-0000864598B3} (Diagmgr Class) - http://ispe.sdc.hp.com/awebui/jsp/answerweb/applets/HPISDiagManager.CAB
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
msully1001
5 Posts
220
0
Posted August 23rd, 2005 12:00
Ok I fixchecked the first 3. Here is the Rundl32.exe
C:\WINDOWS\system32\ntdll.dll
C:\WINDOWS\system32\kernel32.dll
C:\WINDOWS\system32\msvcrt.dll
C:\WINDOWS\system32\GDI32.dll
C:\WINDOWS\system32\USER32.dll
C:\WINDOWS\system32\IMAGEHLP.dll
C:\WINDOWS\system32\ShimEng.dll
C:\WINDOWS\system32\AppPatch\AcGenral.DLL
C:\WINDOWS\system32\ADVAPI32.dll
C:\WINDOWS\system32\RPCRT4.dll
C:\WINDOWS\system32\WINMM.dll
C:\WINDOWS\system32\ole32.dll
C:\WINDOWS\system32\OLEAUT32.dll
C:\WINDOWS\system32\MSACM32.dll
C:\WINDOWS\system32\VERSION.dll
C:\WINDOWS\system32\SHELL32.dll
C:\WINDOWS\system32\SHLWAPI.dll
C:\WINDOWS\system32\USERENV.dll
C:\WINDOWS\system32\UxTheme.dll
C:\WINDOWS\system32\serwvdrv.dll
C:\WINDOWS\system32\umdmxfrm.dll
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\ comctl32.dll
C:\WINDOWS\system32\comctl32.dll
C:\WINDOWS\system32\P17.dll
C:\WINDOWS\system32\DSOUND.dll
C:\progra~1\mcafee.com\vso\ McVSSkt.dll
C:\WINDOWS\system32\WS2_32.dll
C:\WINDOWS\system32\WS2HELP.dll
Here is the services.exe
C:\WINDOWS\system32\ntdll.dll
C:\WINDOWS\system32\kernel32.dll
C:\WINDOWS\system32\msvcrt.dll
C:\WINDOWS\system32\ADVAPI32.dll
C:\WINDOWS\system32\ RPCRT4.dll
C:\WINDOWS\system32\ USER32.dll
C:\WINDOWS\system32\GDI32.dll
C:\WINDOWS\system32\USERENV.dll
C:\WINDOWS\system32\SCESRV.dll
C:\WINDOWS\system32\AUTHZ.dll
C:\WINDOWS\system32\ umpnpmgr.dll
C:\WINDOWS\system32\ WINSTA.dll
C:\WINDOWS\system32\ NETAPI32.dll
C:\WINDOWS\system32\NCObjAPI.DLL
C:\WINDOWS\system32\ MSVCP60.dll
C:\WINDOWS\system32\ AcGenral.DLL
C:\WINDOWS\system32\WINMM.dll
C:\WINDOWS\system32\ole32.dll
C:\WINDOWS\system32\OLEAUT32.dll
C:\WINDOWS\system32\MSACM32.dll
C:\WINDOWS\system32\VERSION.dll
C:\WINDOWS\system32\SHELL32.dll
C:\WINDOWS\system32\SHLWAPI.dll
C:\WINDOWS\system32\UxTheme.dll
C:\WINDOWS\system32\serwvdrv.dll
C:\WINDOWS\system32\umdmxfrm.dll
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\ comctl32.dll
comctl32.dll
C:\WINDOWS\system32\secur32.dll
C:\WINDOWS\system32\Apphelp.dll
C:\WINDOWS\system32\eventlog.dll
C:\WINDOWS\system32\WS2_32.dll
C:\WINDOWS\system32\WS2HELP.dll
C:\WINDOWS\system32\PSAPI.DLL
C:\WINDOWS\system32\wtsapi32.dll
On the sigverif I do not see wininet.dll or shell32.dll on the list. Here is what I see:
omci.sys
acfpdf.txt
acpdf207.dll
acpdfui207.dll
lxwf2000.dll
lxwf2000.gpd
Thanks for the help
How do you connect to the internet? Dialup, Cable modem, DSL, company LAN, Router, Wireless?
Start a notepad file: Start, Run, notepad, OK.
Start then Rightclick on My Computer and select Manage then Event Viewer and finally System. Look for Red Marks. Starting at the top one, double click to open the message then click on the bottom of the three buttons to copy the text to your clipboard then paste it (Ctrl + v or Edit, Paste ) to the notepad. Go back 3 or 4 red marks or until you reach the last reboot.
Also Start, Run, cmd, OK to bring up a black CMD screen. Type:
ipconfig /all
Highlight the results and press Enter. This will copy it to your clipboard. Paste that to the notepad.
Finally type:
net start
Highlight the results and press Enter. This will copy it to your clipboard. Paste that to the notepad too.
Close the cmd window then File, Save As the notepad file to a floppy: a:\junk Move the floppy to another computer and open the notepad file: Start, Run, notepad a:\junk.txt, OK. Then open a reply to this post and copy and paste the text from the notepad file.
Ron
msully1001
5 Posts
220
0
Posted August 23rd, 2005 22:00
This computer connects to the internet via a wired router to the cable modem.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/23/2005
Time: 4:08:02 PM
User: N/A
Computer: DELL
Description:
The IPSEC Services service terminated with the following error:
The parameter is incorrect.For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/23/2005
Time: 4:08:02 PM
User: N/A
Computer: DELL
Description:
The ASCTRM service failed to start due to the following error:
The system cannot find the file specified.For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 8/23/2005
Time: 6:33:11 AM
User: N/A
Computer: DELL
Description:
The Remote Procedure Call (RPC) service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/22/2005
Time: 10:09:09 PM
User: N/A
Computer: DELL
Description:
The IPSEC Services service terminated with the following error:
The parameter is incorrect.For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.C:\Documents and Settings\Michael>ipconfig/all
Windows IP Configuration
Host Name . . . . . . . . . . . . : Dell
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : NoEthernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Broadcom Net
roller
Physical Address. . . . . . . . . : 00-13-20-04-
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Autoconfiguration IP Address. . . : 169.254.186.
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . :C:\Documents and Settings\Michael>net start
These Windows services are started:Application Layer Gateway Service
Ati HotKey Poller
COM+ Event System
Creative Service for CDROM Access
Cryptographic Services
DCOM Server Process Launcher
DHCP Client
Distributed Link Tracking Client
DNS Client
Error Reporting Service
Event Log
Fast User Switching Compatibility
Help and Support
IAA Event Monitor
LexBce Server
McAfee Personal Firewall Service
McAfee.com McShield
McAfee.com VirusScan Online Realtime Engine
Network Connections
Network Location Awareness (NLA)
Plug and Play
Print Spooler
Protected Storage
Remote Access Connection Manager
Remote Procedure Call (RPC)
Secondary Logon
Security Accounts Manager
Server
Shell Hardware Detection
System Event Notification
Task Scheduler
TCP/IP NetBIOS Helper
Telephony
Terminal Services
Themes
WebClient
Windows Audio
Windows Firewall/Internet Connection Sharing (ICS)
Windows Image Acquisition (WIA)
Windows Management Instrumentation
Windows Time
Windows User Mode Driver Framework
Wireless Zero Configuration
WMDM PMSP Service
WorkstationThe command completed successfully.
- Start,then rightclick on My Computer and select Manage, then Services and Applications then Services and find the Remote Procedure Call (RPC) and double click on it. Click on Recovery and then change the options under First failure to Restart Service then under the others to Take No Action. Apply. That will stop the reboots anyway. Now go to the Dependencies Tab and verify that there are no Services that RPC depends on. (There are a bunch that depend on it)The service depends on a file \Windows\System32\rpcss.dllThe file may be corrupted. You can try SFC /scannow from a cmd window and see if it finds any problems. You can get a new file from:You will need to replace the one in C:\windows\system32\dllcache first then run SFC /scanonce and reboot.The ASCTRM error has something to do with real player. See:Not sure it hurts anything tho.You can also double click on the IPSEC Service and look to see what program it is running and what parameters it uses. (on the General page where it says Path to Executable). It is probably a dependent of RPC which may explain its failure.ipconfig shows that you are not getting a DHCP address from the router. This could be a bad cable or network interface but I have seen this when a firewall failed to work correctly. Often the firewall depends on RPC so it may be a secondary problem to the rpc failure. We can try setting a manual address. Look on another computer attached to the same router and see what IP address, mask, default gateway, and DNS server it gets and I will tell you how to set the IP address manually. You may want to try uninstalling your mcafee firewall temporarily to see if it is blocking you. It appears you are also running the XP firewall. You certainly do not need both on at the same time so try turning it off too.Ron
msully1001
5 Posts
220
0
Posted August 25th, 2005 03:00
Ron,
Ok. Changed the options. When I click on dependencies I get a pop up box called Service Dependencies. Has a big Red X then says Win32:Access is denied. I click OK and both boxes are blank. Now I keep getting the Generic Host Process for Win 32 box popping up.
You can try SFC /scannow from a cmd window and see if it finds any problems. This took about 10 minutes of scanning and then nothing. No info. one way or another.
I downloaded the dll file but have no idea how to use it.
You will need to replace the one in C:\windows\system32\dllcache first then run SFC /scanonce and reboot. How do I replace this?
Also how can I look up the DNS mask and IP info on my laptop to give you? I turned off both the windows firewall and the McAffe service. No help. Also have a question. If I am running Mcaffee and windows firewalls plus Microfsoft antispyware how did my computer get so messed up?
Thanks
Mike
- So far we don't know it was malware so they might have done their job OK but none of them are perfect. It could be your harddrive has a problem.To check the ip address & such:Start, Run, cmd, OKipconfig /all(unless it's ME or 98 then it's)Start, Run, command, OKwinipcfgReplacing the rpcss.dll file should probably be done as a last resort. It is probably not the problem since sfc and sigverif did not flag it.It would not hurt to try reregistering the file.Start, Run, cmd, OKthen type:cd \windows\system32regsvr32 rpcss.dll(You can also type )dcomcnfg(if the program comes up you then follow the steps at:On my win2k box I've had luck with this program where it noticed a problem when it came up and asked if I wanted to fix it. Also check under the Default Protocol tab that tcp/ip is present. )I'm in Miami and we have a hurricane coming so I'm going home.Ron
RKinner
2 Intern
•
5851 Posts
220
0
Posted August 20th, 2005 20:00
I am suspicious of this one:
O4 - HKLM\..\Run: [CheckRes] C:\Program Files\MyBackDrop\ActivDesk.exe
These are usually installed as part of the smitfraud infections so are probably no good.
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe
I'd check them and Fix Checked.
Also I see:
C:\WINDOWS\system32\Rundll32.exe
but no where do I see how it starts. Open HijackThis, Open the Misc tools section, Open Process Manager and check the box that says Show DLLs. Then find the
C:\WINDOWS\system32\Rundll32.exe
entry and highlight it. What .dlls files show up in the bottom pane? Do the same for:
C:\WINDOWS\system32\services.exe
Also Start, Run, sigverif, OK to bring up the File Signature Verification program. Then press Start. Do you see wininet.dll or shell32.dll on the list? What else do you see?
Ron