• Announcements

    • Budfred

      IE 11 copy/paste problem

      It has come to our attention that people using Internet Explorer 11 (IE 11) are having trouble with copy/paste to the forum. If you encounter this problem, using a different browser like Firefox or Chrome seems to get around the problem. We do not know what the problem is, but it seems to be specific to IE 11 and we are hopeful that Microsoft will eventually fix it.
Sign in to follow this  
Followers 0
Midevil

My Hijack this log

10 posts in this topic

I want some help please on fixing my browser any help is appreciated.

 

Logfile of HijackThis v1.98.0

Scan saved at 10:04:18 PM, on 7/28/2004

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe

C:\WINDOWS\System32\CTsvcCDA.EXE

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\Program Files\Norton AntiVirus\SAVScan.exe

C:\WINDOWS\wanmpsvc.exe

C:\WINDOWS\System32\MsPMSPSv.exe

C:\WINDOWS\system32\winwh.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Creative\PlayCenter2\CTNMRun.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Cheryl Daugherty\Local Settings\Temp\Temporary Directory 4 for hijackthis.zip\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\twqsu.dll/sp.html#96676

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://twqsu.dll/index.html#96676

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://twqsu.dll/index.html#96676

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\twqsu.dll/sp.html#96676

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\twqsu.dll/sp.html#96676

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://twqsu.dll/index.html#96676

R3 - Default URLSearchHook is missing

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O2 - BHO: (no name) - {E2754F8D-63C3-4C97-8978-E9534291499E} - C:\WINDOWS\atlng32.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [winwh.exe] C:\WINDOWS\system32\winwh.exe

O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\RunOnce: [sysna32.exe] C:\WINDOWS\sysna32.exe

O4 - HKLM\..\RunOnce: [netjk.exe] C:\WINDOWS\system32\netjk.exe

O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [NOMAD Detector] "C:\Program Files\Creative\PlayCenter2\CTNMRun.exe"

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll

O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\IEExtension.dll

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\IEExtension.dll

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll

O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (HKCU)

O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll

O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com

O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/ac...ta/SymAData.cab

O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/ac.../ActiveData.cab

O18 - Protocol: icoo - {4A8DADD4-5A25-4D41-8599-CB7458766220} - C:\WINDOWS\msopt.dll

Share this post


Link to post
Share on other sites

The first thing I need you to do is download the file from here:

 

Getservices.zip

 

Extract the file to the c:\ drive. Then navigate to the c:\getservices and double-click on the getservices.bat file. A notepad will open up. Please paste the contents of that notepad as a reply to this post.

Share this post


Link to post
Share on other sites

Umm the link does not work i tried registering at bleeping computer but have not gotten a e-mail back the second time so i can be registered

Share this post


Link to post
Share on other sites

PsService v1.1 - local and remote services viewer/controller

Copyright © 2001-2003 Mark Russinovich

Sysinternals - www.sysinternals.com

 

SERVICE_NAME: Alerter

Notifies selected users and computers of administrative alerts. If the service is stopped, programs that use administrative alerts will not receive them. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Alerter

DEPENDENCIES : LanmanWorkstation

SERVICE_START_NAME: NT AUTHORITY\LocalService

 

SERVICE_NAME: ALG

Provides support for 3rd party protocol plug-ins for Internet Connection Sharing and the Internet Connection Firewall

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\alg.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Application Layer Gateway Service

DEPENDENCIES :

SERVICE_START_NAME: NT AUTHORITY\LocalService

 

SERVICE_NAME: AOL ACS

(null)

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : AOL Connectivity Service

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: AppMgmt

Provides software installation services such as Assign, Publish, and Remove.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Application Management

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: AudioSrv

Manages audio devices for Windows-based programs. If this service is stopped, audio devices and effects will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP : AudioGroup

TAG : 0

DISPLAY_NAME : Windows Audio

DEPENDENCIES : PlugPlay

: RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: BITS

Uses idle network bandwidth to transfer data.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Background Intelligent Transfer Service

DEPENDENCIES : Rpcss

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: Browser

Maintains an updated list of computers on the network and supplies this list to computers designated as browsers. If this service is stopped, this list will not be updated or maintained. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Computer Browser

DEPENDENCIES : LanmanWorkstation

: LanmanServer

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: ccEvtMgr

Symantec Event Manager

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 0 IGNORE

BINARY_PATH_NAME : "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"

LOAD_ORDER_GROUP : Symantec Services

TAG : 0

DISPLAY_NAME : Symantec Event Manager

DEPENDENCIES : RPCSS

: ccSetMgr

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: ccPwdSvc

Symantec Password Validation Service

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 0 IGNORE

BINARY_PATH_NAME : "C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe"

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Symantec Password Validation

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: ccSetMgr

Symantec Settings Manager

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 0 IGNORE

BINARY_PATH_NAME : "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"

LOAD_ORDER_GROUP : Symantec Services

TAG : 0

DISPLAY_NAME : Symantec Settings Manager

DEPENDENCIES : RPCSS

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: CiSvc

Indexes contents and properties of files on local and remote computers; provides rapid access to files through flexible querying language.

TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\cisvc.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Indexing Service

DEPENDENCIES : RPCSS

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: ClipSrv

Enables ClipBook Viewer to store information and share it with remote computers. If the service is stopped, ClipBook Viewer will not be able to share information with remote computers. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\clipsrv.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : ClipBook

DEPENDENCIES : NetDDE

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: COMSysApp

Manages the configuration and tracking of Component Object Model (COM)+-based components. If the service is stopped, most COM+-based components will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : COM+ System Application

DEPENDENCIES : rpcss

SERVICE_START_NAME: LocalSystem

FAIL_RESET_PERIOD : 30 seconds

FAILURE_ACTIONS : Restart DELAY: 1000 seconds

: Restart DELAY: 5000 seconds

: None DELAY: 1000 seconds

 

SERVICE_NAME: Creative Service for CDROM Access

(null)

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\CTsvcCDA.EXE

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Creative Service for CDROM Access

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: CryptSvc

Provides three management services: Catalog Database Service, which confirms the signatures of Windows files; Protected Root Service, which adds and removes Trusted Root Certification Authority certificates from this computer; and Key Service, which helps enroll this computer for certificates. If this service is stopped, these management services will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Cryptographic Services

DEPENDENCIES : RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: Dhcp

Manages network configuration by registering and updating IP addresses and DNS names.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP : TDI

TAG : 0

DISPLAY_NAME : DHCP Client

DEPENDENCIES : Tcpip

: Afd

: NetBT

: SYMTDI

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: dmadmin

Configures hard disk drives and volumes. The service only runs for configuration processes and then stops.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\dmadmin.exe /com

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Logical Disk Manager Administrative Service

DEPENDENCIES : RpcSs

: PlugPlay

: DmServer

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: dmserver

Detects and monitors new hard disk drives and sends disk volume information to Logical Disk Manager Administrative Service for configuration. If this service is stopped, dynamic disk status and configuration information may become out of date. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Logical Disk Manager

DEPENDENCIES : RpcSs

: PlugPlay

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: Dnscache

Resolves and caches Domain Name System (DNS) names for this computer. If this service is stopped, this computer will not be able to resolve DNS names and locate Active Directory domain controllers. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k NetworkService

LOAD_ORDER_GROUP : TDI

TAG : 0

DISPLAY_NAME : DNS Client

DEPENDENCIES : Tcpip

SERVICE_START_NAME: NT AUTHORITY\NetworkService

 

SERVICE_NAME: ERSvc

Allows error reporting for services and applictions running in non-standard environments.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 0 IGNORE

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Error Reporting Service

DEPENDENCIES : RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: Eventlog

Enables event log messages issued by Windows-based programs and components to be viewed in Event Viewer. This service cannot be stopped.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\services.exe

LOAD_ORDER_GROUP : Event log

TAG : 0

DISPLAY_NAME : Event Log

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: EventSystem

Supports System Event Notification Service (SENS), which provides automatic distribution of events to subscribing Component Object Model (COM) components. If the service is stopped, SENS will close and will not be able to provide logon and logoff notifications. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP : Network

TAG : 0

DISPLAY_NAME : COM+ Event System

DEPENDENCIES : RPCSS

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: FastUserSwitchingCompatibility

Provides management for applications that require assistance in a multiple user environment.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Fast User Switching Compatibility

DEPENDENCIES : TermService

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: helpsvc

Enables Help and Support Center to run on this computer. If this service is stopped, Help and Support Center will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Help and Support

DEPENDENCIES : RPCSS

SERVICE_START_NAME: LocalSystem

FAIL_RESET_PERIOD : 86400 seconds

FAILURE_ACTIONS : Restart DELAY: 100 seconds

: Restart DELAY: 100 seconds

: None DELAY: 100 seconds

 

SERVICE_NAME: HidServ

Enables generic input access to Human Interface Devices (HID), which activates and maintains the use of predefined hot buttons on keyboards, remote controls, and other multimedia devices. If this service is stopped, hot buttons controlled by this service will no longer function. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : HID Input Service

DEPENDENCIES : RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: ImapiService

Manages CD recording using Image Mastering Applications Programming Interface (IMAPI). If this service is stopped, this computer will be unable to record CDs. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\imapi.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : IMAPI CD-Burning COM Service

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: lanmanserver

Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Server

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: lanmanworkstation

Creates and maintains client network connections to remote servers. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP : NetworkProvider

TAG : 0

DISPLAY_NAME : Workstation

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: LmHosts

Enables support for NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService

LOAD_ORDER_GROUP : TDI

TAG : 0

DISPLAY_NAME : TCP/IP NetBIOS Helper

DEPENDENCIES : NetBT

: Afd

SERVICE_START_NAME: NT AUTHORITY\LocalService

 

SERVICE_NAME: Messenger

Transmits net send and Alerter service messages between clients and servers. This service is not related to Windows Messenger. If this service is stopped, Alerter messages will not be transmitted. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Messenger

DEPENDENCIES : LanmanWorkstation

: NetBIOS

: PlugPlay

: RpcSS

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: mnmsrvc

Enables an authorized user to access this computer remotely by using NetMeeting over a corporate intranet. If this service is stopped, remote desktop sharing will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\mnmsrvc.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : NetMeeting Remote Desktop Sharing

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: MSDTC

Coordinates transactions that span multiple resource managers, such as databases, message queues, and file systems. If this service is stopped, these transactions will not occur. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\msdtc.exe

LOAD_ORDER_GROUP : MS Transactions

TAG : 0

DISPLAY_NAME : Distributed Transaction Coordinator

DEPENDENCIES : RPCSS

: SamSS

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: MSIServer

Installs, repairs and removes software according to instructions contained in .MSI files.

TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\msiexec.exe /V

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Windows Installer

DEPENDENCIES : RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: navapsvc

Handles Norton AntiVirus Auto-Protect events.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : "C:\Program Files\Norton AntiVirus\navapsvc.exe"

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Norton AntiVirus Auto Protect Service

DEPENDENCIES : RPCSS

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: NetDDE

Provides network transport and security for Dynamic Data Exchange (DDE) for programs running on the same computer or on different computers. If this service is stopped, DDE transport and security will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\netdde.exe

LOAD_ORDER_GROUP : NetDDEGroup

TAG : 0

DISPLAY_NAME : Network DDE

DEPENDENCIES : NetDDEDSDM

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: NetDDEdsdm

Manages Dynamic Data Exchange (DDE) network shares. If this service is stopped, DDE network shares will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\netdde.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Network DDE DSDM

DEPENDENCIES :

: EGrLocalSystem

: Network DDE DSDM

: etwork DDE

: on AntiVirus Auto Protect Service

: ative Service

: ion

: er

: sole

: d

:

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: Netlogon

Supports pass-through authentication of account logon events for computers in a domain.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\lsass.exe

LOAD_ORDER_GROUP : RemoteValidation

TAG : 0

DISPLAY_NAME : Net Logon

DEPENDENCIES : LanmanWorkstation

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: Netman

Manages objects in the Network and Dial-Up Connections folder, in which you can view both local area network and remote connections.

TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Network Connections

DEPENDENCIES : RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: Nla

Collects and stores network configuration and location information, and notifies applications when this information changes.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Network Location Awareness (NLA)

DEPENDENCIES : Tcpip

: Afd

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: NtLmSsp

Provides security to remote procedure call (RPC) programs that use transports other than named pipes.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\lsass.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : NT LM Security Support Provider

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: NtmsSvc

(null)

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Removable Storage

DEPENDENCIES : RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: PlugPlay

Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\services.exe

LOAD_ORDER_GROUP : PlugPlay

TAG : 0

DISPLAY_NAME : Plug and Play

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: PolicyAgent

Manages IP security policy and starts the ISAKMP/Oakley (IKE) and the IP security driver.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\lsass.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : IPSEC Services

DEPENDENCIES : RPCSS

: Tcpip

: IPSec

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: ProtectedStorage

Provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services, processes, or users.

TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\lsass.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Protected Storage

DEPENDENCIES : RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: RasAuto

Creates a connection to a remote network whenever a program references a remote DNS or NetBIOS name or address.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Remote Access Auto Connection Manager

DEPENDENCIES : RasMan

: Tapisrv

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: RasMan

Creates a network connection.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Remote Access Connection Manager

DEPENDENCIES : Tapisrv

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: RDSessMgr

Manages and controls Remote Assistance. If this service is stopped, Remote Assistance will be unavailable. Before stopping this service, see the Dependencies tab of the Properties dialog box.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\sessmgr.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Remote Desktop Help Session Manager

DEPENDENCIES : RPCSS

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: RemoteAccess

Offers routing services to businesses in local area and wide area network environments.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 4 DISABLED

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Routing and Remote Access

DEPENDENCIES : RpcSS

: +NetBIOSGroup

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: RpcLocator

Manages the RPC name service database.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\locator.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Remote Procedure Call (RPC) Locator

DEPENDENCIES : LanmanWorkstation

SERVICE_START_NAME: NT AUTHORITY\NetworkService

 

SERVICE_NAME: RpcSs

Provides the endpoint mapper and other miscellaneous RPC services.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\svchost -k rpcss

LOAD_ORDER_GROUP : COM Infrastructure

TAG : 0

DISPLAY_NAME : Remote Procedure Call (RPC)

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

FAIL_RESET_PERIOD : 0 seconds

FAILURE_ACTIONS : Reboot DELAY: 60000 seconds

 

SERVICE_NAME: RSVP

Provides network signaling and local traffic control setup functionality for QoS-aware programs and control applets.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\rsvp.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : QoS RSVP

DEPENDENCIES : TcpIp

: Afd

: RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: SamSs

Stores security information for local user accounts.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\lsass.exe

LOAD_ORDER_GROUP : LocalValidation

TAG : 0

DISPLAY_NAME : Security Accounts Manager

DEPENDENCIES : RPCSS

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: SAVScan

Handles Norton AntiVirus Auto-Protect Archive Scanning

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\Program Files\Norton AntiVirus\SAVScan.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : SAVScan

DEPENDENCIES : SAVRT

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: SBService

(null)

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : ScriptBlocking Service

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: SCardDrv

Enables support for legacy non-plug and play smart-card readers used by this computer. If this service is stopped, this computer will not support legacy reader. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 0 IGNORE

BINARY_PATH_NAME : C:\WINDOWS\System32\SCardSvr.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Smart Card Helper

DEPENDENCIES : +Smart Card Reader

SERVICE_START_NAME: NT AUTHORITY\LocalService

 

SERVICE_NAME: SCardSvr

Manages access to smart cards read by this computer. If this service is stopped, this computer will be unable to read smart cards. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 0 IGNORE

BINARY_PATH_NAME : C:\WINDOWS\System32\SCardSvr.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Smart Card

DEPENDENCIES : PlugPlay

SERVICE_START_NAME: NT AUTHORITY\LocalService

 

SERVICE_NAME: Schedule

Enables a user to configure and schedule automated tasks on this computer. If this service is stopped, these tasks will not be run at their scheduled times. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP : SchedulerGroup

TAG : 0

DISPLAY_NAME : Task Scheduler

DEPENDENCIES : RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: seclogon

Enables starting processes under alternate credentials. If this service is stopped, this type of logon access will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 0 IGNORE

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Secondary Logon

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: SENS

Tracks system events such as Windows logon, network, and power events. Notifies COM+ Event System subscribers of these events.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP : Network

TAG : 0

DISPLAY_NAME : System Event Notification

DEPENDENCIES : EventSystem

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: SharedAccess

Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)

DEPENDENCIES : Netman

: NLA

: RasMan

: ALG

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: ShellHWDetection

(null)

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 0 IGNORE

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP : ShellSvcGroup

TAG : 0

DISPLAY_NAME : Shell Hardware Detection

DEPENDENCIES : RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: Spooler

Loads files to memory for later printing.

TYPE : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\spoolsv.exe

LOAD_ORDER_GROUP : SpoolerGroup

TAG : 0

DISPLAY_NAME : Print Spooler

DEPENDENCIES : RPCSS

SERVICE_START_NAME: LocalSystem

FAIL_RESET_PERIOD : 86400 seconds

FAILURE_ACTIONS : Restart DELAY: 60000 seconds

: Restart DELAY: 60000 seconds

: None DELAY: 0 seconds

 

SERVICE_NAME: srservice

Performs system restore functions. To stop service, turn off System Restore from the System Restore tab in My Computer->Properties

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : System Restore Service

DEPENDENCIES : RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: SSDPSRV

Enables discovery of UPnP devices on your home network.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : SSDP Discovery Service

DEPENDENCIES :

SERVICE_START_NAME: NT AUTHORITY\LocalService

 

SERVICE_NAME: stisvc

Provides image acquisition services for scanners and cameras.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k imgsvc

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Windows Image Acquisition (WIA)

DEPENDENCIES : RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: SwPrv

Manages software-based volume shadow copies taken by the Volume Shadow Copy service. If this service is stopped, software-based volume shadow copies cannot be managed. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 0 IGNORE

BINARY_PATH_NAME : C:\WINDOWS\System32\dllhost.exe /Processid:{96FFF8EF-18F1-4432-A5EA-B72198048EEF}

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : MS Software Shadow Copy Provider

DEPENDENCIES : rpcss

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: SysmonLog

Collects performance data from local or remote computers based on preconfigured schedule parameters, then writes the data to a log or triggers an alert. If this service is stopped, performance information will not be collected. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\smlogsvc.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Performance Logs and Alerts

DEPENDENCIES :

SERVICE_START_NAME: NT Authority\NetworkService

 

SERVICE_NAME: TapiSrv

Provides Telephony API (TAPI) support for programs that control telephony devices and IP based voice connections on the local computer and, through the LAN, on servers that are also running the service.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Telephony

DEPENDENCIES : PlugPlay

: RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: TermService

Allows multiple users to be connected interactively to a machine as well as the display of desktops and applications to remote computers. The underpinning of Remote Desktop (including RD for Administrators), Fast User Switching, Remote Assistance, and Terminal Server.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Terminal Services

DEPENDENCIES : RPCSS

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: Themes

Provides user experience theme management.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP : UIGroup

TAG : 0

DISPLAY_NAME : Themes

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

FAIL_RESET_PERIOD : 86400 seconds

FAILURE_ACTIONS : Restart DELAY: 60000 seconds

: Restart DELAY: 60000 seconds

: None DELAY: 0 seconds

 

SERVICE_NAME: TrkWks

Maintains links between NTFS files within a computer or across computers in a network domain.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Distributed Link Tracking Client

DEPENDENCIES : RpcSs

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: uploadmgr

Manages synchronous and asynchronous file transfers between clients and servers on the network. If this service is stopped, synchronous and asynchronous file transfers between clients and servers on the network will not occur. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Upload Manager

DEPENDENCIES : RPCSS

SERVICE_START_NAME: LocalSystem

FAIL_RESET_PERIOD : 86400 seconds

FAILURE_ACTIONS : Restart DELAY: 100 seconds

: Restart DELAY: 100 seconds

: None DELAY: 100 seconds

 

SERVICE_NAME: upnphost

Provides support to host Universal Plug and Play devices.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Universal Plug and Play Device Host

DEPENDENCIES : SSDPSRV

SERVICE_START_NAME: NT AUTHORITY\LocalService

FAIL_RESET_PERIOD : -1 seconds

FAILURE_ACTIONS : Restart DELAY: 0 seconds

 

SERVICE_NAME: UPS

Manages an uninterruptible power supply (UPS) connected to the computer.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\ups.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Uninterruptible Power Supply

DEPENDENCIES :

SERVICE_START_NAME: NT AUTHORITY\LocalService

 

SERVICE_NAME: VSS

Manages and implements Volume Shadow Copies used for backup and other purposes. If this service is stopped, shadow copies will be unavailable for backup and the backup may fail. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\vssvc.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Volume Shadow Copy

DEPENDENCIES : RPCSS

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: W32Time

Maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

 

 

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Windows Time

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: WANMiniportService

(null)

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 0 IGNORE

BINARY_PATH_NAME : "C:\WINDOWS\wanmpsvc.exe"

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : WAN Miniport (ATW) Service

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: WebClient

Enables Windows-based programs to create, access, and modify Internet-based files. If this service is stopped, these functions will not be available. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService

LOAD_ORDER_GROUP : NetworkProvider

TAG : 0

DISPLAY_NAME : WebClient

DEPENDENCIES : MRxDAV

SERVICE_START_NAME: NT AUTHORITY\LocalService

 

SERVICE_NAME: winmgmt

Provides a common interface and object model to access management information about operating system, devices, applications and services. If this service is stopped, most Windows-based software will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 0 IGNORE

BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Windows Management Instrumentation

DEPENDENCIES : RPCSS

: Eventlog

SERVICE_START_NAME: LocalSystem

FAIL_RESET_PERIOD : 86400 seconds

FAILURE_ACTIONS : Restart DELAY: 60000 seconds

: Restart DELAY: 60000 seconds

 

SERVICE_NAME: WMDM PMSP Service

(null)

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\MsPMSPSv.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : WMDM PMSP Service

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: WmdmPmSN

Retrieves the serial number of any portable media player connected to this computer. If this service is stopped, protected content might not be down loaded to the device.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Portable Media Serial Number Service

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: WmiApSrv

Provides performance library information from WMI HiPerf providers.

TYPE : 10 WIN32_OWN_PROCESS

START_TYPE : 3 DEMAND_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\wbem\wmiapsrv.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : WMI Performance Adapter

DEPENDENCIES : RPCSS

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: wuauserv

Enables the download and installation of critical Windows updates. If the service is disabled, the operating system can be manually updated at the Windows Update Web site.

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Automatic Updates

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: WZCSVC

Provides automatic configuration for the 802.11 adapters

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 1 NORMAL

BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs

LOAD_ORDER_GROUP : TDI

TAG : 0

DISPLAY_NAME : Wireless Zero Configuration

DEPENDENCIES : RpcSs

: Ndisuio

SERVICE_START_NAME: LocalSystem

 

SERVICE_NAME: ½O.#ž‚„?õØ´â

(null)

TYPE : 20 WIN32_SHARE_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 0 IGNORE

BINARY_PATH_NAME : C:\WINDOWS\system32\winsn.exe /s

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Workstation NetLogon Service

DEPENDENCIES :

SERVICE_START_NAME: LocalSystem

Share this post


Link to post
Share on other sites

You are currently using hijackthis from a temp directory. This can cause problems. Please create a directory on your c: drive called c:\hijackthis and download and unzip hijackthis into that directory. Run the program from that directory from now on.

 

For a tutorial on how to use HijackThis please see the following link:

 

Using HijackThis to Remove Spyware, Browser Hijackers, and Dialers

 

You may want to print out these directions as the Internet will not be available. Please continue with the next step if you run into a problem with the current one. Just be sure to let us know what the problem was when you reply.

 

Please make sure that you can view all hidden files. Instructions on how to do this can be found here:

 

How to see hidden files in Windows

 

Please download About:Buster from here: http://tools.zerosrealm.com/AboutBuster.zip. Once it is downloaded extract it to

c:\aboutbuster. We will use that program later in this process.

 

Reboot your computer into Safe Mode and follow these steps:

 

Step 1:

 

Click on start, then control panel, then administrative programs, then services. Look for a service called Workstation NetLogon Service. Double click on the that service and click stop and then set the startup to disabled. Also write down the name and path of the file listed in the Path to executable field. This filename must be deleted below.

 

Step 2:

 

Press control-alt-delete to get into the task manager and end the follow processes if they exist:

 

winwh.exe

 

Step 3:

I now need you to delete the following files:

 

C:\WINDOWS\system32\winwh.exe

The file from the services above.

C:\WINDOWS\twqsu.dll

C:\WINDOWS\atlng32.dll

C:\WINDOWS\sysna32.exe

C:\WINDOWS\system32\netjk.exe

 

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. if it is uncheck it and try again.

 

Step 4:

Then close all programs and windows and run hijackthis. Put a checkmark next to each of these entries and press the fix button when ready:

 

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\twqsu.dll/sp.html#96676

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://twqsu.dll/index.html#96676

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://twqsu.dll/index.html#96676

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\twqsu.dll/sp.html#96676

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\twqsu.dll/sp.html#96676

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://twqsu.dll/index.html#96676

R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {E2754F8D-63C3-4C97-8978-E9534291499E} - C:\WINDOWS\atlng32.dll

O4 - HKLM\..\Run: [winwh.exe] C:\WINDOWS\system32\winwh.exe

O4 - HKLM\..\RunOnce: [sysna32.exe] C:\WINDOWS\sysna32.exe

O4 - HKLM\..\RunOnce: [netjk.exe] C:\WINDOWS\system32\netjk.exe

 

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\IEExtension.dll

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program

Step 5:

 

In the next step we are going to remove a service that gets installed by this malware.

 

Go to Start>Run and type regedit.

 

Press enter.

 

Navigate to:

 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\½O.#ž‚„?õØ´â

 

If ½O.#ž‚„?õØ´â exists , right click on it and choose delete from the menu.

 

Now navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_½O.#ž‚„?õØ´â

 

If LEGACY_½O.#ž‚„?õØ´â exists then right click on it and choose delete from the menu.

 

If you have trouble deleting a key. Then click once on the key name to highlight it and click on the Permission menu option under Security or Edit. Then Uncheck "Allow inheritible permissions" and press copy. Then click on everyone and put a checkmark in "full control". Then press apply and ok and attempt to delete the key again.

 

 

Step 6:

 

This is the step where we will use About:Buster that you had downloaded previously.

 

Navigate to the c:\aboutbuster directory and double-click on aboutbuster.exe When the tool is open press the OK button, then the Start button, then the OK button, and then finally the Yes button. It will start scanning your computer for files. If it asks if you would like to do a second pass, allow it to do so.

 

When it completed move on to step 7.

 

Step 7:

 

Copy the contents of the Quote Box below to Notepad.

Name the file as fix.reg

Change the Save as Type to All Files

Save this file on the desktop

 

REGEDIT4

 

 

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HSA]

 

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SE]

 

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SW]

 

Then double-click on the fix.reg file, and when it prompts to merge say yes, and this will clear some registry entries left behind by the process.

 

Step 8:

Reboot your computer back to normal mode so that we can restore see if we need to restore some deleted files:

  • Download the Hoster from here. Press "Restore Original Hosts" and press "OK". Exit Program. This will restore the original deleted Hosts file.
     
  • If you have Spybot S&D installed you will also need to replace one file. Go here: Merijn's Files (sdhelper) and download SDHelper.dll. Copy the file to the folder containing you Spybot S&D program (normally C:\Program Files\Spybot - Search & Destroy). Then click Start > Run > regsvr32 "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" and press the OK button
     
  • If you are using Windows 95, 98, or ME it is possible that the malware deleted your control.exe. Please check for the existence of this file by going to to Merijn Files control.exe and examine where the file should be for your operating system. If the file is missing then download the appropriate file and place it in the proper place according to this information.

Step 9:

 

Run an online antivirus scan at:

 

http://housecall.antivirus.com/

 

Reboot and post a last log

Share this post


Link to post
Share on other sites

Here is my new log the files in step 3 i could not find any of these even after having it in safe mode and showing hidden files.

 

Logfile of HijackThis v1.98.0

Scan saved at 12:39:37 PM, on 7/31/2004

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe

C:\WINDOWS\System32\CTsvcCDA.EXE

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\Program Files\Norton AntiVirus\SAVScan.exe

C:\WINDOWS\wanmpsvc.exe

C:\WINDOWS\System32\MsPMSPSv.exe

C:\WINDOWS\ipim.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Creative\PlayCenter2\CTNMRun.exe

C:\WINDOWS\system32\winwh.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Hijackthis\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\twqsu.dll/sp.html#96676

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://twqsu.dll/index.html#96676

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://twqsu.dll/index.html#96676

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\twqsu.dll/sp.html#96676

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\twqsu.dll/sp.html#96676

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://twqsu.dll/index.html#96676

R3 - Default URLSearchHook is missing

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O2 - BHO: (no name) - {E2754F8D-63C3-4C97-8978-E9534291499E} - C:\WINDOWS\atlng32.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [winwh.exe] C:\WINDOWS\system32\winwh.exe

O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [NOMAD Detector] "C:\Program Files\Creative\PlayCenter2\CTNMRun.exe"

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll

O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll

O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (HKCU)

O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll

O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab

O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/ac...ta/SymAData.cab

O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/ac.../ActiveData.cab

O18 - Protocol: icoo - {4A8DADD4-5A25-4D41-8599-CB7458766220} - C:\WINDOWS\msopt.dll

Share this post


Link to post
Share on other sites

Run the getservice.bat file i had you download earlier. Dont paste the whole contents this time though. Look at the bottom of the output and towards the bottom, there should be one service entry (of about 5-6 lines) that will either be called:

 

Network Security service

Remove Procedure Call Helper

Workstation Login Service

 

The display name will be one of thopse. THe service name will be garbage chatracters and the path name will end with /s

 

I need those three thuings

Share this post


Link to post
Share on other sites

I found it im stupid lol it is good now thank you very much and here is updated Hijackthis.

 

Logfile of HijackThis v1.98.0

Scan saved at 12:56:44 PM, on 7/31/2004

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Creative\PlayCenter2\CTNMRun.exe

C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe

C:\WINDOWS\System32\CTsvcCDA.EXE

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\Program Files\Norton AntiVirus\SAVScan.exe

C:\WINDOWS\wanmpsvc.exe

C:\WINDOWS\System32\MsPMSPSv.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Hijackthis\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\twqsu.dll/sp.html#96676

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O2 - BHO: (no name) - {E2754F8D-63C3-4C97-8978-E9534291499E} - C:\WINDOWS\atlng32.dll (file missing)

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [NOMAD Detector] "C:\Program Files\Creative\PlayCenter2\CTNMRun.exe"

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll

O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll

O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (HKCU)

O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll

O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab

O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/ac...ta/SymAData.cab

O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/ac.../ActiveData.cab

O18 - Protocol: icoo - {4A8DADD4-5A25-4D41-8599-CB7458766220} - C:\WINDOWS\msopt.dll

Share this post


Link to post
Share on other sites
Sign in to follow this  
Followers 0