• Announcements

    • Budfred

      IE 11 copy/paste problem

      It has come to our attention that people using Internet Explorer 11 (IE 11) are having trouble with copy/paste to the forum. If you encounter this problem, using a different browser like Firefox or Chrome seems to get around the problem. We do not know what the problem is, but it seems to be specific to IE 11 and we are hopeful that Microsoft will eventually fix it.
Sign in to follow this  
Followers 0
prettyboy5

IE seach page hijack - MERGED 2

15 posts in this topic

Many screens appear one after the other that are blocked from taking over by Spywareguard. I am running and have attempted to clean with the following programs, Spyware blaster, The Cleaner, Ad Aware 6.0, Spybot Search & Destroy and CW Shredder. None of them are getting this pest out. I previously turned of the registry restore feature after a similar problem which I fixed. But now I cannot go back to a restore point . Please help if possible, also let me know if I need all of these programs and if there is a way to prevent this happening again and if I should turn the registry restore feature back on. Find below my hijack this log. Cheers for your help.

 

Logfile of HijackThis v1.97.7

Scan saved at 11:51:13 AM, on 20/07/2004

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\mfcyg32.exe

C:\WINDOWS\System32\hkcmd.exe

C:\WINDOWS\BCMSMMSG.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\WINDOWS\System32\DSentry.exe

C:\Program Files\Dell\Media Experience\PCMService.exe

C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

C:\Program Files\Common Files\Dell\EUSW\Support.exe

C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\The Cleaner\tca.exe

C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe

C:\Program Files\The Cleaner\tcm.exe

C:\WINDOWS\javavo.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\SpywareGuard\sgmain.exe

C:\Program Files\SpywareGuard\sgbhp.exe

C:\WINDOWS\System32\HPZipm12.exe

C:\WINDOWS\System32\wuauclt.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\wanker\Local Settings\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\thuve.dll/sp.html#27063

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://thuve.dll/index.html#27063

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://thuve.dll/index.html#27063

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\thuve.dll/sp.html#27063

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://thuve.dll/index.html#27063

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\thuve.dll/sp.html#27063

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.dell4me.com/myway

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {EDA3C39C-C507-6E06-432C-F1C75E92B6F7} - C:\WINDOWS\system32\sysok.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\System32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe

O4 - HKLM\..\Run: [bCMSMMSG] BCMSMMSG.exe

O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe

O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe

O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe

O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"

O4 - HKLM\..\Run: [tcactive] C:\Program Files\The Cleaner\tca.exe

O4 - HKLM\..\Run: [tcmonitor] C:\Program Files\The Cleaner\tcm.exe

O4 - HKLM\..\Run: [javavo.exe] C:\WINDOWS\javavo.exe

O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"

O4 - HKCU\..\Run: [spyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup

O4 - HKLM\..\RunOnce: [mfcyg32.exe] C:\WINDOWS\mfcyg32.exe

O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)

O9 - Extra button: Real.com (HKLM)

Share this post


Link to post
Share on other sites

Please find my AboutBuster and new Hijack this log files. The problem still exists so anymore input is a huge one. Cheers.

 

 

-- Scan 1 --------

About:Buster Version 1.31

Removed! : C:\WINDOWS\reczr.dat

Removed! : C:\WINDOWS\thuve.dll

Removed! : C:\WINDOWS\System32\mfczv32.exe

Removed! : C:\WINDOWS\System32\rlwxh.dat

Removed! : C:\WINDOWS\System32\swptc.dat

Attempted Clean Of Temp folder.

Removed Uninstall Key (HSA)

Removed Uninstall Key (SE)

Removed Uninstall Key (SW)

Pages Reset... Done!

 

 

 

 

Logfile of HijackThis v1.97.7

Scan saved at 2:13:49 PM, on 23/07/2004

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\mfcyg32.exe

C:\WINDOWS\System32\hkcmd.exe

C:\WINDOWS\BCMSMMSG.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\WINDOWS\System32\DSentry.exe

C:\Program Files\Dell\Media Experience\PCMService.exe

C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

C:\Program Files\Common Files\Dell\EUSW\Support.exe

C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\The Cleaner\tca.exe

C:\Program Files\The Cleaner\tcm.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\SpywareGuard\sgmain.exe

C:\Program Files\SpywareGuard\sgbhp.exe

C:\WINDOWS\System32\HPZipm12.exe

C:\WINDOWS\System32\wuauclt.exe

C:\WINDOWS\msag32.exe

C:\Documents and Settings\wanker\Local Settings\Temp\Temporary Directory 5 for hijackthis.zip\HijackThis.exe

C:\Documents and Settings\wanker\Local Settings\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\thuve.dll/sp.html#27063

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://thuve.dll/index.html#27063

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://thuve.dll/index.html#27063

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\thuve.dll/sp.html#27063

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://thuve.dll/index.html#27063

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\thuve.dll/sp.html#27063

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.dell4me.com/myway

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {EDA3C39C-C507-6E06-432C-F1C75E92B6F7} - C:\WINDOWS\system32\sysok.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\System32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe

O4 - HKLM\..\Run: [bCMSMMSG] BCMSMMSG.exe

O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe

O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe

O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe

O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"

O4 - HKLM\..\Run: [tcactive] C:\Program Files\The Cleaner\tca.exe

O4 - HKLM\..\Run: [tcmonitor] C:\Program Files\The Cleaner\tcm.exe

O4 - HKLM\..\Run: [msag32.exe] C:\WINDOWS\msag32.exe

O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"

O4 - HKCU\..\Run: [spyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup

O4 - HKLM\..\RunOnce: [mfcyg32.exe] C:\WINDOWS\mfcyg32.exe

O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)

O9 - Extra button: Real.com (HKLM)

Share this post


Link to post
Share on other sites

You already have About:Buster. Don´t run it yet.

 

How to use Ad-Aware to remove Spyware <= Please check this link for instructions on how to download, install and then use adaware. Don´t use it yet.

1 You already have Adaware installed. Make sure it's up to date. Just open Adaware and click on *Check for Updates Now* and then *Connect*. It will find a new reference-file. Click *ok* and let it download and install the updates by clicking on *Finish* .This will return you to the main screen. You should now see Reference File # : 01R333 18.07.2004 or higher listed.

 

2 Print out these instructions so you have them handy as most of the steps need to be done in safe mode and you may not be able to go online.

 

3. Next, go to Start->Run and type "Services.msc" (without quotes) then hit Ok

Scroll down and find the service called "Network Security Service". When you find it, double-click on it. In the next window that opens, click the Stop button, then click on properties and under the General Tab, change the Startup Type to Disabled. Now hit Apply and then Ok and close any open windows. This service is installed by the malware. If this service is not listed go ahead with the next step.

 

4. Reboot to Safe Mode

How to start the computer in

Safe mode

 

 

5. Make sure your PC is configured to show hidden files

 

Open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked.

Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"

Click "Apply" then "OK"

 

6.CLOSE ALL WINDOWS AND BROWSERS Scan with Hijack This and put checks next to all the following, then click "Fix Checked"

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\thuve.dll/sp.html#27063

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://thuve.dll/index.html#27063

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://thuve.dll/index.html#27063

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\thuve.dll/sp.html#27063

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://thuve.dll/index.html#27063

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\thuve.dll/sp.html#27063

O2 - BHO: (no name) - {EDA3C39C-C507-6E06-432C-F1C75E92B6F7} - C:\WINDOWS\system32\sysok.dll

O4 - HKLM\..\Run: [msag32.exe] C:\WINDOWS\msag32.exe

O4 - HKLM\..\RunOnce: [mfcyg32.exe] C:\WINDOWS\mfcyg32.exe

 

 

 

7. Delete the following files if present.

 

C:\WINDOWS\thuve.dll

C:\WINDOWS\system32\sysok.dll

C:\WINDOWS\msag32.exe

C:\WINDOWS\mfcyg32.exe

 

 

 

8. Double click AboutBuster.exe that you downloaded earlier. Click OK, click Start, then click OK. This will scan your computer for the bad files and delete them. Save the report(copy and paste into notepad or wordpad and save as a .txt file) and post a copy back here when you are done with all the steps.

 

9. Scan with Adaware and let it remove any bad files found.

 

10. Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure these 3 are checked and then press *ok* to remove:

 

 

Temporary Files

Temporary Internet Files

Recycle Bin

 

11. Reboot to normal mode, scan again with Hijack This and post a new log here.

 

12. Finally, do an online scan HERE. Let it remove any infected files found.

 

Replace Deleted Files

It is also possible that the infection may have deleted up to three files from your system. If these files are present, to be safe I suggest you overwrite them with a new copy.

 

Go here: http://www.spywareinfo.com/~merijn/winfiles.html#control and download the version of control.exe for your operating system. If you are running Windows 2000, copy it to c:\winnt\system32\. For Windows XP, copy it to c:\windows\system32\.

 

Download the Hoster from here: http://members.aol.com/toadbee/hoster.zip

Press 'Restore Original Hosts' and press 'OK'

Exit Program.

 

If you have Spybot S&D installed you may also need to replace one file.

Go here: http://www.spywareinfo.com/~merijn/winfiles.html#sdhelper and download SDHelper.dll. Copy the file to the folder containing you Spybot S&D program (normally C:\Program Files\Spybot - Search & Destroy)

 

Additionally, Please check your ActiveX security settings. They may have been changed by this CWS variant to allow ALL ActiveX!! If they have been changed, reset your active x security settings in IE as recommended.

 

Post a fresh HijackThis log and the AboutBuster report back here please.

Share this post


Link to post
Share on other sites

Hey thanks for the help, I would have replied sooner but have been superbusy. I've done all that you told me to do but the problem still remains. I did the online scan and it found 71 infected files but could not clean or delete them. Should I be thinking about doing a clean install of my operating system. Let me me know your thoughts. I'm posting the latest Hijackthis logfile. Cheers.

 

 

 

Logfile of HijackThis v1.97.7

Scan saved at 4:57:00 PM, on 02/08/2004

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\hkcmd.exe

C:\WINDOWS\BCMSMMSG.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\WINDOWS\System32\DSentry.exe

C:\Program Files\Dell\Media Experience\PCMService.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

C:\Program Files\Common Files\Dell\EUSW\Support.exe

C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\The Cleaner\tca.exe

C:\Program Files\The Cleaner\tcm.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\SpywareGuard\sgmain.exe

C:\Program Files\SpywareGuard\sgbhp.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\mfcyg32.exe

C:\WINDOWS\System32\HPZipm12.exe

C:\WINDOWS\addlg.exe

C:\WINDOWS\System32\wuauclt.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\wanker\Local Settings\Temp\Temporary Directory 6 for hijackthis.zip\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\kxfls.dll/sp.html#27063

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://kxfls.dll/index.html#27063

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://kxfls.dll/index.html#27063

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\kxfls.dll/sp.html#27063

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://kxfls.dll/index.html#27063

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\kxfls.dll/sp.html#27063

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.dell4me.com/myway

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {D1BE2EF1-8288-85D8-D0F8-3FECFF762039} - C:\WINDOWS\addcj32.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\System32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe

O4 - HKLM\..\Run: [bCMSMMSG] BCMSMMSG.exe

O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe

O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe

O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe

O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"

O4 - HKLM\..\Run: [tcactive] C:\Program Files\The Cleaner\tca.exe

O4 - HKLM\..\Run: [tcmonitor] C:\Program Files\The Cleaner\tcm.exe

O4 - HKLM\..\Run: [addlg.exe] C:\WINDOWS\addlg.exe

O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"

O4 - HKCU\..\Run: [spyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup

O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)

O9 - Extra button: Real.com (HKLM)

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab

Share this post


Link to post
Share on other sites

I just noticed that the files that you told me to delete that begin with R1-HKLM and end with #27063 havew returned. I will try to delete them again in the safe mode. But I have the feeling that if it didn't do it the first time then it won't help doing it again. But I'll give it a shot anyway.

Share this post


Link to post
Share on other sites

I went back into safe mode and there are two user names. One is mine and the other is administrator. When I went into the settings with my name the files where no longer there. So my thinking is that they must be inside the administrator section. I have tried to access this so I can put Hijackthis into it to clean but I can't figure it out. Please help.

Share this post


Link to post
Share on other sites

A clean install won't be necessary to clear this up.

 

Move Hijackthis out of the temp directory (extract from zip)into a permanent folder. Example:

c:\program files\hijackthis\hijackthis.exe

 

This will allow backups to be made and saved By hijackthis in case something goes wrong.

 

Download the latest version of About:buster from here.

 

http://www.downloads.subratam.org/AboutBuster.zip

 

Unzip it to your desktop and check for updates.

 

Now boot into into safe mode and open hijackthis. Place a check next to the following entries, then close all other windows and click the fix button.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\kxfls.dll/sp.html#27063

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://kxfls.dll/index.html#27063

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://kxfls.dll/index.html#27063

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\kxfls.dll/sp.html#27063

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://kxfls.dll/index.html#27063

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\kxfls.dll/sp.html#27063

O2 - BHO: (no name) - {D1BE2EF1-8288-85D8-D0F8-3FECFF762039} - C:\WINDOWS\addcj32.dll

O4 - HKLM\..\Run: [addlg.exe] C:\WINDOWS\addlg.exe

Close hijackthis.

 

Open About:buster and hit Ok, then Start, then Ok to start the scan. The scan should take a few seconds. Once it is done save the report. Reboot into normal mode and post the report and a new Hijack this log here.

Share this post


Link to post
Share on other sites

Hey again and thanks again for your help. I did what you asked and it all is the same as before. I've posted the log files from the administrtor and from my user ID locations. Again any input is greatly appreciated.

 

Logfile of HijackThis v1.97.7

Scan saved at 3:04:16 PM, on 03/08/2004

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\mfcyg32.exe

C:\WINDOWS\System32\hkcmd.exe

C:\WINDOWS\BCMSMMSG.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\WINDOWS\System32\DSentry.exe

C:\Program Files\Dell\Media Experience\PCMService.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

C:\Program Files\Common Files\Dell\EUSW\Support.exe

C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\The Cleaner\tca.exe

C:\Program Files\The Cleaner\tcm.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\SpywareGuard\sgmain.exe

C:\Program Files\SpywareGuard\sgbhp.exe

C:\WINDOWS\System32\HPZipm12.exe

C:\WINDOWS\System32\wuauclt.exe

C:\Program Files\HP\hpcoretech\comp\hpdarc.exe

C:\Documents and Settings\wanker\Local Settings\Temp\Temporary Directory 8 for hijackthis.zip\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.fastlook.net/sb.php

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.dell4me.com/myway

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\System32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe

O4 - HKLM\..\Run: [bCMSMMSG] BCMSMMSG.exe

O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe

O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe

O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe

O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"

O4 - HKLM\..\Run: [tcactive] C:\Program Files\The Cleaner\tca.exe

O4 - HKLM\..\Run: [tcmonitor] C:\Program Files\The Cleaner\tcm.exe

O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"

O4 - HKCU\..\Run: [spyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup

O4 - HKLM\..\RunOnce: [apics.exe] C:\WINDOWS\apics.exe

O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)

O9 - Extra button: Real.com (HKLM)

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab

 

 

Logfile of HijackThis v1.97.7

Scan saved at 3:06:00 PM, on 03/08/2004

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\mfcyg32.exe

C:\WINDOWS\System32\hkcmd.exe

C:\WINDOWS\BCMSMMSG.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\WINDOWS\System32\DSentry.exe

C:\Program Files\Dell\Media Experience\PCMService.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

C:\Program Files\Common Files\Dell\EUSW\Support.exe

C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\The Cleaner\tca.exe

C:\Program Files\The Cleaner\tcm.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\SpywareGuard\sgmain.exe

C:\Program Files\SpywareGuard\sgbhp.exe

C:\WINDOWS\System32\HPZipm12.exe

C:\WINDOWS\System32\wuauclt.exe

C:\Program Files\HP\hpcoretech\comp\hpdarc.exe

C:\WINDOWS\winuy32.exe

C:\Program Files\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\xhowx.dll/sp.html#27063

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://xhowx.dll/index.html#27063

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://xhowx.dll/index.html#27063

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\xhowx.dll/sp.html#27063

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://xhowx.dll/index.html#27063

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\xhowx.dll/sp.html#27063

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.fastlook.net/sb.php

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.dell4me.com/myway

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {D1BE2EF1-8288-85D8-D0F8-3FECFF762039} - C:\WINDOWS\addcj32.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\System32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe

O4 - HKLM\..\Run: [bCMSMMSG] BCMSMMSG.exe

O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe

O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe

O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe

O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"

O4 - HKLM\..\Run: [tcactive] C:\Program Files\The Cleaner\tca.exe

O4 - HKLM\..\Run: [tcmonitor] C:\Program Files\The Cleaner\tcm.exe

O4 - HKLM\..\Run: [winuy32.exe] C:\WINDOWS\winuy32.exe

O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"

O4 - HKCU\..\Run: [spyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup

O4 - HKLM\..\RunOnce: [apics.exe] C:\WINDOWS\apics.exe

O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)

O9 - Extra button: Real.com (HKLM)

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab

Share this post


Link to post
Share on other sites

When I posted I noticed that some of the files that you told me to delete have returned. I went back into safe mode and recleaned again but when I went back to normal they returned. How mad is that.

Share this post


Link to post
Share on other sites

Locate the following files.

C:\WINDOWS\mfcyg32.exe

C:\WINDOWS\winuy32.exe

C:\WINDOWS\addcj32.dll

 

Zip them up and email them along with a link to this thread to This Address

 

Open about:buster and check for updates.

 

Then boot into safe mode.

 

Run another hijackthis scan. Place a check next to the following entries, then close all open windows and click the fix button.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\xhowx.dll/sp.html#27063

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://xhowx.dll/index.html#27063

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://xhowx.dll/index.html#27063

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\xhowx.dll/sp.html#27063

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://xhowx.dll/index.html#27063

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\xhowx.dll/sp.html#27063

O2 - BHO: (no name) - {D1BE2EF1-8288-85D8-D0F8-3FECFF762039} - C:\WINDOWS\addcj32.dll

O4 - HKLM\..\Run: [winuy32.exe] C:\WINDOWS\winuy32.exe

O4 - HKLM\..\RunOnce: [apics.exe] C:\WINDOWS\apics.exe

Close hijackthis.

Then locate these files and delete them.

C:\WINDOWS\xhowx.dll

C:\WINDOWS\addcj32.dll

C:\WINDOWS\winuy32.exe

C:\WINDOWS\apics.exe

C:\WINDOWS\mfcyg32.exe

 

Then open adaware and perform a scan.

 

Next open About:buster hit start and then Ok. The program should start scanning. Then hit exit and reboot. After reboot post the report and a new Hijack this log here.

Share this post


Link to post
Share on other sites

Hey there I have been away on holiday so I apologize for the delay in getting back to you. I sent the zipped files that you wanted and have done the other things as well. There is no change in my problem and I have noticed some new weird looking addtions at the bottom of the new hijack this report. Again any help is very much appreicated. please find my new reports below. Cheers.

 

Logfile of HijackThis v1.97.7

Scan saved at 4:25:49 PM, on 28/08/2004

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\hkcmd.exe

C:\WINDOWS\BCMSMMSG.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\WINDOWS\System32\DSentry.exe

C:\Program Files\Dell\Media Experience\PCMService.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

C:\Program Files\Common Files\Dell\EUSW\Support.exe

C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\system32\ieij32.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\SpywareGuard\sgmain.exe

C:\Program Files\SpywareGuard\sgbhp.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\iun6002.exe:loiay

C:\WINDOWS\System32\HPZipm12.exe

C:\WINDOWS\System32\wuauclt.exe

C:\Program Files\HijackThis.exe

C:\Program Files\HP\hpcoretech\comp\hpdarc.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\uqhbo.dll/sp.html#27063

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.dell4me.com/myway

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\System32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe

O4 - HKLM\..\Run: [bCMSMMSG] BCMSMMSG.exe

O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe

O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe

O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe

O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"

O4 - HKLM\..\Run: [sysA] C:\windows\system32\wingov32.exe

O4 - HKLM\..\Run: [cdawtugvj] C:\WINDOWS\System32\gnyqier.exe

O4 - HKLM\..\Run: [ieij32.exe] C:\WINDOWS\system32\ieij32.exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"

O4 - HKCU\..\Run: [spyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup

O4 - HKCU\..\Run: [startPage] C:\WINDOWS\system32\rundll32.exe

O4 - HKCU\..\Run: [romahere] C:\WINDOWS\System32\matrixhere.exe

O4 - HKLM\..\RunOnce: [loiay] C:\WINDOWS\iun6002.exe:loiay

O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)

O9 - Extra button: Real.com (HKLM)

O15 - Trusted Zone: *.05p.com

O15 - Trusted Zone: *.clickspring.net

O15 - Trusted Zone: *.my-internet.info

O15 - Trusted Zone: *.scoobidoo.com

O15 - Trusted Zone: *.searchmiracle.com

O16 - DPF: v2cab - http://searchmiracle.com/cab/v2cab.cab

O16 - DPF: {10000030-1000-0000-1000-000000000000} - its:mhtml:file://c:\\MAIN.MHT!http://zloeboogle.biz/dial.chm?wmid=3309::/x.exe

O16 - DPF: {11120607-1001-1111-1000-110199901123} - ms-its:mhtml:file://c:\explorer.mht!http://download.lansolution.net/rundlg32.chm::/rundlg32.exe

O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php...0e1e2729109a237

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab

 

-- Scan 1 --------

About:Buster Version 2.0

Removed! : C:\WINDOWS\System32\6bedivzjz5.dll

Removed! : C:\WINDOWS\System32\winfk32.dll

Attempted Clean Of Temp folder.

Removed Uninstall Key (HSA)

Removed Uninstall Key (SE)

Removed Uninstall Key (SW)

Pages Reset... Done!

 

-- Scan 2 --------

About:Buster Version 2.0

Attempted Clean Of Temp folder.

Removed Uninstall Key (HSA)

Removed Uninstall Key (SE)

Removed Uninstall Key (SW)

Pages Reset... Done!

Share this post


Link to post
Share on other sites

Download the most recent version of hijackthis.

 

http://www.majorgeeks.com/download3155.html

 

Then download the most recent version of About:Buster.

 

http://www.downloads.subratam.org/AboutBuster.zip

 

Next download

 

http://www.bleepingcomputer.com/files/spyware/getservice.zip

 

Extract the file to the c:\ drive. Then navigate to the c:\getservices and double-click on the getservices.bat file. A notepad will open up. Please paste the contents of that notepad as a reply to this post.

Share this post


Link to post
Share on other sites

As per your request please find the notepad contents from getservice.

 

PsService v1.1 - local and remote services viewer/controller

Copyright © 2001-2003 Mark Russinovich

Sysinternals - www.sysinternals.com

 

SERVICE_NAME: Alerter

Notifies selected users and computers of administrative alerts. If the service is stopped, programs that use administrative alerts will not receive them. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Alerter

DEPENDENCIES : LanmanWorkstation

SERVICE_START_NAME: NT AUTHORITY\LocalService

 

SERVICE_NAME: ALG

Provides support for 3rd party protocol plug-ins for Internet Connection Sharing and the Internet Connection Firewall

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\alg.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Application Layer Gateway Service

DEPENDENCIES :

SERVICE_START_NAME: NT AUTHORITY\LocalService

 

SERVICE_NAME: AppMgmt

Provides software installation services such as Assign, Publish, and Remove.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 4 DISABLED

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Application Management

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: aspnet_state

Provides support for out-of-process session states for ASP.NET. If this service is stopped, out-of-process requests will not be processed. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : ASP.NET State Service

DEPENDENCIES :

SERVICE_START_NAME: NT AUTHORITY\NetworkService

 

SERVICE_NAME: AudioSrv

Manages audio devices for Windows-based programs. If this service is stopped, audio devices and effects will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP : AudioGroup

TAG : 0

DISPLAY_NAME : Windows Audio

DEPENDENCIES : PlugPlay

: RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: BITS

Uses idle network bandwidth to transfer data.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Background Intelligent Transfer Service

DEPENDENCIES : LanmanWorkstation

: RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: Browser

Maintains an updated list of computers on the network and supplies this list to computers designated as browsers. If this service is stopped, this list will not be updated or maintained. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Computer Browser

DEPENDENCIES : LanmanWorkstation

: LanmanServer

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: CiSvc

Indexes contents and properties of files on local and remote computers; provides rapid access to files through flexible querying language.

TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\cisvc.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Indexing Service

DEPENDENCIES : RPCSS

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: ClipSrv

Enables ClipBook Viewer to store information and share it with remote computers. If the service is stopped, ClipBook Viewer will not be able to share information with remote computers. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\clipsrv.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : ClipBook

DEPENDENCIES : NetDDE

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: COMSysApp

Manages the configuration and tracking of Component Object Model (COM)+-based components. If the service is stopped, most COM+-based components will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : COM+ System Application

DEPENDENCIES : rpcss

SERVICE_START_NAME: LocalSystem

FAIL_RESET_PERIOD : 30 seconds

FAILURE_ACTIONS : Restart DELAY: 1000 seconds

: Restart DELAY: 5000 seconds

: None DELAY: 1000 seconds

 

SERVICE_NAME: CryptSvc

Provides three management services: Catalog Database Service, which confirms the signatures of Windows files; Protected Root Service, which adds and removes Trusted Root Certification Authority certificates from this computer; and Key Service, which helps enroll this computer for certificates. If this service is stopped, these management services will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Cryptographic Services

DEPENDENCIES : RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: Dhcp

Manages network configuration by registering and updating IP addresses and DNS names.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP : TDI

TAG : 0

DISPLAY_NAME : DHCP Client

DEPENDENCIES : Tcpip

: Afd

: NetBT

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: dmadmin

Configures hard disk drives and volumes. The service only runs for configuration processes and then stops.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\dmadmin.exe /com

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Logical Disk Manager Administrative Service

DEPENDENCIES : RpcSs

: PlugPlay

: DmServer

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: dmserver

Detects and monitors new hard disk drives and sends disk volume information to Logical Disk Manager Administrative Service for configuration. If this service is stopped, dynamic disk status and configuration information may become out of date. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Logical Disk Manager

DEPENDENCIES : RpcSs

: PlugPlay

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: Dnscache

Resolves and caches Domain Name System (DNS) names for this computer. If this service is stopped, this computer will not be able to resolve DNS names and locate Active Directory domain controllers. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k NetworkService

LOAD_ORDER_GROUP : TDI

TAG : 0

DISPLAY_NAME : DNS Client

DEPENDENCIES : Tcpip

SERVICE_START_NAME: NT AUTHORITY\NetworkService

 

SERVICE_NAME: ERSvc

Allows error reporting for services and applictions running in non-standard environments.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 0 IGNORE

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Error Reporting Service

DEPENDENCIES : RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: Eventlog

Enables event log messages issued by Windows-based programs and components to be viewed in Event Viewer. This service cannot be stopped.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\services.exe

LOAD_ORDER_GROUP : Event log

TAG : 0

DISPLAY_NAME : Event Log

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: EventSystem

Supports System Event Notification Service (SENS), which provides automatic distribution of events to subscribing Component Object Model (COM) components. If the service is stopped, SENS will close and will not be able to provide logon and logoff notifications. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP : Network

TAG : 0

DISPLAY_NAME : COM+ Event System

DEPENDENCIES : RPCSS

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: FastUserSwitchingCompatibility

Provides management for applications that require assistance in a multiple user environment.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Fast User Switching Compatibility

DEPENDENCIES : TermService

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: Fax

Enables you to send and receive faxes, utilizing fax resources available on this computer or on the network.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\fxssvc.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Fax

DEPENDENCIES : TapiSrv

: RpcSs

: PlugPlay

: Spooler

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: helpsvc

Enables Help and Support Center to run on this computer. If this service is stopped, Help and Support Center will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Help and Support

DEPENDENCIES : RPCSS

SERVICE_START_NAME: LocalSystem

FAIL_RESET_PERIOD : 86400 seconds

FAILURE_ACTIONS : Restart DELAY: 100 seconds

: Restart DELAY: 100 seconds

: None DELAY: 100 seconds

 

SERVICE_NAME: HidServ

Enables generic input access to Human Interface Devices (HID), which activates and maintains the use of predefined hot buttons on keyboards, remote controls, and other multimedia devices. If this service is stopped, hot buttons controlled by this service will no longer function. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 4 DISABLED

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Human Interface Device Access

DEPENDENCIES : RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: ImapiService

Manages CD recording using Image Mastering Applications Programming Interface (IMAPI). If this service is stopped, this computer will be unable to record CDs. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\imapi.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : IMAPI CD-Burning COM Service

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: lanmanserver

Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Server

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: lanmanworkstation

Creates and maintains client network connections to remote servers. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP : NetworkProvider

TAG : 0

DISPLAY_NAME : Workstation

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: LmHosts

Enables support for NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService

LOAD_ORDER_GROUP : TDI

TAG : 0

DISPLAY_NAME : TCP/IP NetBIOS Helper

DEPENDENCIES : NetBT

: Afd

SERVICE_START_NAME: NT AUTHORITY\LocalService

 

SERVICE_NAME: Messenger

Transmits net send and Alerter service messages between clients and servers. This service is not related to Windows Messenger. If this service is stopped, Alerter messages will not be transmitted. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 4 DISABLED

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Messenger

DEPENDENCIES : LanmanWorkstation

: NetBIOS

: PlugPlay

: RpcSS

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: mnmsrvc

Enables an authorized user to access this computer remotely by using NetMeeting over a corporate intranet. If this service is stopped, remote desktop sharing will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\mnmsrvc.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : NetMeeting Remote Desktop Sharing

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: MSDTC

Coordinates transactions that span multiple resource managers, such as databases, message queues, and file systems. If this service is stopped, these transactions will not occur. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\msdtc.exe

LOAD_ORDER_GROUP : MS Transactions

TAG : 0

DISPLAY_NAME : Distributed Transaction Coordinator

DEPENDENCIES : RPCSS

: SamSS

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: MSIServer

Installs, repairs and removes software according to instructions contained in .MSI files.

TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\msiexec.exe /V

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Windows Installer

DEPENDENCIES : RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: NetDDE

Provides network transport and security for Dynamic Data Exchange (DDE) for programs running on the same computer or on different computers. If this service is stopped, DDE transport and security will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\netdde.exe

LOAD_ORDER_GROUP : NetDDEGroup

TAG : 0

DISPLAY_NAME : Network DDE

DEPENDENCIES : NetDDEDSDM

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: NetDDEdsdm

Manages Dynamic Data Exchange (DDE) network shares. If this service is stopped, DDE network shares will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\netdde.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Network DDE DSDM

DEPENDENCIES :

: EGrLocalSystem

: Network DDE DSDM

: etwork DDE

: ributed Transaction Coordinator

: r

: ative Service

: ion

: LLECTIONŠ

:

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: Netlogon

Supports pass-through authentication of account logon events for computers in a domain.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\lsass.exe

LOAD_ORDER_GROUP : RemoteValidation

TAG : 0

DISPLAY_NAME : Net Logon

DEPENDENCIES : LanmanWorkstation

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: Netman

Manages objects in the Network and Dial-Up Connections folder, in which you can view both local area network and remote connections.

TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Network Connections

DEPENDENCIES : RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: Nla

Collects and stores network configuration and location information, and notifies applications when this information changes.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Network Location Awareness (NLA)

DEPENDENCIES : Tcpip

: Afd

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: NtLmSsp

Provides security to remote procedure call (RPC) programs that use transports other than named pipes.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\lsass.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : NT LM Security Support Provider

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: NtmsSvc

(null)

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Removable Storage

DEPENDENCIES : RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: O?’ŽrtñåȲ$Ó

(null)

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 0 IGNORE

BINARY_PATH_NAME : C:\WINDOWS\javamd.exe /s

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Remote Procedure Call (RPC) Helper

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: PlugPlay

Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\services.exe

LOAD_ORDER_GROUP : PlugPlay

TAG : 0

DISPLAY_NAME : Plug and Play

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: Pml Driver HPZ12

(null)

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\HPZipm12.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Pml Driver HPZ12

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: PolicyAgent

Manages IP security policy and starts the ISAKMP/Oakley (IKE) and the IP security driver.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\lsass.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : IPSEC Services

DEPENDENCIES : RPCSS

: Tcpip

: IPSec

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: ProtectedStorage

Provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services, processes, or users.

TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\lsass.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Protected Storage

DEPENDENCIES : RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: RasAuto

Creates a connection to a remote network whenever a program references a remote DNS or NetBIOS name or address.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Remote Access Auto Connection Manager

DEPENDENCIES : RasMan

: Tapisrv

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: RasMan

Creates a network connection.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Remote Access Connection Manager

DEPENDENCIES : Tapisrv

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: RDSessMgr

Manages and controls Remote Assistance. If this service is stopped, Remote Assistance will be unavailable. Before stopping this service, see the Dependencies tab of the Properties dialog box.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\sessmgr.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Remote Desktop Help Session Manager

DEPENDENCIES : RPCSS

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: RemoteAccess

Offers routing services to businesses in local area and wide area network environments.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 4 DISABLED

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Routing and Remote Access

DEPENDENCIES : RpcSS

: +NetBIOSGroup

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: RpcLocator

Manages the RPC name service database.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\locator.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Remote Procedure Call (RPC) Locator

DEPENDENCIES : LanmanWorkstation

SERVICE_START_NAME: NT AUTHORITY\NetworkService

 

SERVICE_NAME: RpcSs

Provides the endpoint mapper and other miscellaneous RPC services.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\svchost -k rpcss

LOAD_ORDER_GROUP : COM Infrastructure

TAG : 0

DISPLAY_NAME : Remote Procedure Call (RPC)

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

FAIL_RESET_PERIOD : 0 seconds

FAILURE_ACTIONS : Reboot DELAY: 60000 seconds

 

SERVICE_NAME: RSVP

Provides network signaling and local traffic control setup functionality for QoS-aware programs and control applets.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\rsvp.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : QoS RSVP

DEPENDENCIES : TcpIp

: Afd

: RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: SamSs

Stores security information for local user accounts.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\lsass.exe

LOAD_ORDER_GROUP : LocalValidation

TAG : 0

DISPLAY_NAME : Security Accounts Manager

DEPENDENCIES : RPCSS

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: SCardDrv

Enables support for legacy non-plug and play smart-card readers used by this computer. If this service is stopped, this computer will not support legacy reader. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 0 IGNORE

BINARY_PATH_NAME : C:\WINDOWS\System32\SCardSvr.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Smart Card Helper

DEPENDENCIES : +Smart Card Reader

SERVICE_START_NAME: NT AUTHORITY\LocalService

 

SERVICE_NAME: SCardSvr

Manages access to smart cards read by this computer. If this service is stopped, this computer will be unable to read smart cards. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 0 IGNORE

BINARY_PATH_NAME : C:\WINDOWS\System32\SCardSvr.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Smart Card

DEPENDENCIES : PlugPlay

SERVICE_START_NAME: NT AUTHORITY\LocalService

 

SERVICE_NAME: Schedule

Enables a user to configure and schedule automated tasks on this computer. If this service is stopped, these tasks will not be run at their scheduled times. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP : SchedulerGroup

TAG : 0

DISPLAY_NAME : Task Scheduler

DEPENDENCIES : RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: seclogon

Enables starting processes under alternate credentials. If this service is stopped, this type of logon access will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 0 IGNORE

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Secondary Logon

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: SENS

Tracks system events such as Windows logon, network, and power events. Notifies COM+ Event System subscribers of these events.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP : Network

TAG : 0

DISPLAY_NAME : System Event Notification

DEPENDENCIES : EventSystem

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: SharedAccess

Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)

DEPENDENCIES : Netman

: NLA

: RasMan

: ALG

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: ShellHWDetection

(null)

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 0 IGNORE

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP : ShellSvcGroup

TAG : 0

DISPLAY_NAME : Shell Hardware Detection

DEPENDENCIES : RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: Spooler

Loads files to memory for later printing.

TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\spoolsv.exe

LOAD_ORDER_GROUP : SpoolerGroup

TAG : 0

DISPLAY_NAME : Print Spooler

DEPENDENCIES : RPCSS

SERVICE_START_NAME: LocalSystem

FAIL_RESET_PERIOD : 86400 seconds

FAILURE_ACTIONS : Restart DELAY: 60000 seconds

: Restart DELAY: 60000 seconds

: None DELAY: 0 seconds

 

SERVICE_NAME: srservice

Performs system restore functions. To stop service, turn off System Restore from the System Restore tab in My Computer->Properties

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : System Restore Service

DEPENDENCIES : RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: SSDPSRV

Enables discovery of UPnP devices on your home network.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : SSDP Discovery Service

DEPENDENCIES :

SERVICE_START_NAME: NT AUTHORITY\LocalService

 

SERVICE_NAME: stisvc

Provides image acquisition services for scanners and cameras.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k imgsvc

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Windows Image Acquisition (WIA)

DEPENDENCIES : RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: SwPrv

Manages software-based volume shadow copies taken by the Volume Shadow Copy service. If this service is stopped, software-based volume shadow copies cannot be managed. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 0 IGNORE

BINARY_PATH_NAME : C:\WINDOWS\System32\dllhost.exe /Processid:{F79A1568-D6C5-4C69-A086-936CF52DBBE3}

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : MS Software Shadow Copy Provider

DEPENDENCIES : rpcss

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: SysmonLog

Collects performance data from local or remote computers based on preconfigured schedule parameters, then writes the data to a log or triggers an alert. If this service is stopped, performance information will not be collected. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\smlogsvc.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Performance Logs and Alerts

DEPENDENCIES :

SERVICE_START_NAME: NT Authority\NetworkService

 

SERVICE_NAME: TapiSrv

Provides Telephony API (TAPI) support for programs that control telephony devices and IP based voice connections on the local computer and, through the LAN, on servers that are also running the service.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Telephony

DEPENDENCIES : PlugPlay

: RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: TermService

Allows multiple users to be connected interactively to a machine as well as the display of desktops and applications to remote computers. The underpinning of Remote Desktop (including RD for Administrators), Fast User Switching, Remote Assistance, and Terminal Server.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Terminal Services

DEPENDENCIES : RPCSS

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: Themes

Provides user experience theme management.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP : UIGroup

TAG : 0

DISPLAY_NAME : Themes

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

FAIL_RESET_PERIOD : 86400 seconds

FAILURE_ACTIONS : Restart DELAY: 60000 seconds

: Restart DELAY: 60000 seconds

: None DELAY: 0 seconds

 

SERVICE_NAME: TrkWks

Maintains links between NTFS files within a computer or across computers in a network domain.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Distributed Link Tracking Client

DEPENDENCIES : RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: uploadmgr

Manages synchronous and asynchronous file transfers between clients and servers on the network. If this service is stopped, synchronous and asynchronous file transfers between clients and servers on the network will not occur. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Upload Manager

DEPENDENCIES : RPCSS

SERVICE_START_NAME: LocalSystem

FAIL_RESET_PERIOD : 86400 seconds

FAILURE_ACTIONS : Restart DELAY: 100 seconds

: Restart DELAY: 100 seconds

: None DELAY: 100 seconds

 

SERVICE_NAME: upnphost

Provides support to host Universal Plug and Play devices.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Universal Plug and Play Device Host

DEPENDENCIES : SSDPSRV

SERVICE_START_NAME: NT AUTHORITY\LocalService

FAIL_RESET_PERIOD : -1 seconds

FAILURE_ACTIONS : Restart DELAY: 0 seconds

 

SERVICE_NAME: UPS

Manages an uninterruptible power supply (UPS) connected to the computer.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\ups.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Uninterruptible Power Supply

DEPENDENCIES :

SERVICE_START_NAME: NT AUTHORITY\LocalService

 

SERVICE_NAME: VSS

Manages and implements Volume Shadow Copies used for backup and other purposes. If this service is stopped, shadow copies will be unavailable for backup and the backup may fail. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\vssvc.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Volume Shadow Copy

DEPENDENCIES : RPCSS

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: w32time

Maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Windows Time

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: WebClient

Enables Windows-based programs to create, access, and modify Internet-based files. If this service is stopped, these functions will not be available. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService

LOAD_ORDER_GROUP : NetworkProvider

TAG : 0

DISPLAY_NAME : WebClient

DEPENDENCIES : MRxDAV

SERVICE_START_NAME: NT AUTHORITY\LocalService

 

SERVICE_NAME: winmgmt

Provides a common interface and object model to access management information about operating system, devices, applications and services. If this service is stopped, most Windows-based software will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 0 IGNORE

BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Windows Management Instrumentation

DEPENDENCIES : RPCSS

: Eventlog

SERVICE_START_NAME: LocalSystem

FAIL_RESET_PERIOD : 86400 seconds

FAILURE_ACTIONS : Restart DELAY: 60000 seconds

: Restart DELAY: 60000 seconds

 

SERVICE_NAME: WmdmPmSN

Retrieves the serial number of any portable media player connected to this computer. If this service is stopped, protected content might not be down loaded to the device.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Portable Media Serial Number Service

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: WmiApSrv

Provides performance library information from WMI HiPerf providers.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\wbem\wmiapsrv.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : WMI Performance Adapter

DEPENDENCIES : RPCSS

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: wuauserv

Enables the download and installation of critical Windows updates. If the service is disabled, the operating system can be manually updated at the Windows Update Web site.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Automatic Updates

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: WZCSVC

Provides automatic configuration for the 802.11 adapters

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP : TDI

TAG : 0

DISPLAY_NAME : Wireless Zero Configuration

DEPENDENCIES : RpcSs

: Ndisuio

SERVICE_START_NAME: LocalSystem

Share this post


Link to post
Share on other sites

It would probably be best if you printed these instructions out. We will be doing most or this in safe mode and you will not have access to this page.

 

Download About:Buster from the following link. Extract it from zip to your desktop. Open it and check for updates. (don't run the scan yet)

 

http://www.downloads.subratam.org/AboutBuster.zip

 

Then download and install adaware. (check for updates)

 

http://www.lavasoftusa.com/software/adaware/

 

Lets set your computer to show hidden files. Follow the instructions here.

 

enable hidden files

 

Now boot into safe mode

 

Go to Start/ Run and type

services.msc

Click OK

 

Scroll down and find the following service. The name must match exactly (close doesn't count)

Remote Procedure Call (RPC) Helper

 

Double click on it.

In the next window that opens, click the Stop button, then change the Startup Type to Disabled. Click Apply and then OK.

 

Now open task manager (alt+ctrl+del) right click on any of the following file names that apear in the list and select end task.

ieij32.exe

iun6002.exe:loiay

matrixhere.exe

javamd.exe

 

Next open hijackthis and run another scan. Place a check next to the following entries, then close all other windows and click the fix button.

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\uqhbo.dll/sp.html#27063

O4 - HKLM\..\Run: [sysA] C:\windows\system32\wingov32.exe

O4 - HKLM\..\Run: [cdawtugvj] C:\WINDOWS\System32\gnyqier.exe

O4 - HKLM\..\Run: [ieij32.exe] C:\WINDOWS\system32\ieij32.exe

O4 - HKCU\..\Run: [startPage] C:\WINDOWS\system32\rundll32.exe

O4 - HKCU\..\Run: [romahere] C:\WINDOWS\System32\matrixhere.exe

O4 - HKLM\..\RunOnce: [loiay] C:\WINDOWS\iun6002.exe:loiay

O15 - Trusted Zone: *.05p.com

O15 - Trusted Zone: *.clickspring.net

O15 - Trusted Zone: *.my-internet.info

O15 - Trusted Zone: *.scoobidoo.com

O15 - Trusted Zone: *.searchmiracle.com

O16 - DPF: v2cab - http://searchmiracle.com/cab/v2cab.cab

O16 - DPF: {10000030-1000-0000-1000-000000000000} - its:mhtml:file://c:\\MAIN.MHT!http://zloeboogle.biz/dial.chm?wmid=3309::/x.exe

O16 - DPF: {11120607-1001-1111-1000-110199901123} - ms-its:mhtml:file://c:\explorer.mht!http://download.lansolution.net/rundlg32.chm::/rundlg32.exe

O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php...0e1e2729109a237

Close hijackthis.

Locate the following files and delete them.

C:\WINDOWS\javamd.exe

C:\WINDOWS\uqhbo.dll

C:\windows\system32\wingov32.exe

C:\WINDOWS\System32\gnyqier.exe

C:\WINDOWS\system32\ieij32.exe

C:\WINDOWS\System32\matrixhere.exe

C:\WINDOWS\iun6002.exe:loiay

 

Now open About:buster.

Click ok then start, then ok and finally yes to start the scan. Allow it to close explorer during the scan. If it asks to do a second scan allow it to do so. When the scan is complete save the log and close the program.

 

Then reboot your computer back into normal mode.

 

Download Hoster from here.

http://members.aol.com/toadbee/hoster.zip

 

Unzip and open the program.

Press "Restore Original Hosts" and press "OK".

Exit Program.

 

Then run this free online virus scan.

http://housecall.antivirus.com/

 

Finally reboot and run another hijackthis scan and post your new log and About:buster report here.

Share this post


Link to post
Share on other sites
Sign in to follow this  
Followers 0