Its still here. COMP NOT TURNING ON

Comments

• Trumandrummer Taylor Michigan Icrontian

  October 2005 edited October 2005

  well today i got home from school. the comp froze again and it didnt turn on again. so everytime i have to set it back i loose avg anti-virus (well its there but dont work, needs reinstalled) and i loose all my virus blocker updates. its so pointless to even have anti virus right now because its not gonna work . in order for updates to work u have to restart your computer (usually) well if i restart it i have to set it back an i loose the updates. man this sux, idk what to do.

  0
• Trogan London, UK

  October 2005 edited October 2005

  Your log looks clean.
  
  Hmm. do you remember how to disable System Restore? If so, do that and then run these two:
  
  Panda Activescan
  Trend Micro: Housecall
  
  Save a log for them both and post them here

  0
• Trumandrummer Taylor Michigan Icrontian

  October 2005 edited October 2005

  heres the active scan. i didnt have time to run the other , i will do it 2morrow.
  
  
  
  
  Incident Status Location
  
  Spyware:spyware/altnet No disinfected C:\PROGRAM FILES\KAZAA\TopSearch.dll
  Spyware:spyware/bridge No disinfected C:\WINNT\DOWNLOADED PROGRAM FILES\bridge.inf
  Adware:adware/comet No disinfected C:\WINNT\DOWNLOADED PROGRAM FILES\cc.inf
  Dialer:dialer.vz No disinfected C:\WINNT\SYSTEM32\defaulttxt.dat
  Spyware:spyware/whazit No disinfected C:\WINNT\SYSTEM32\fiz1
  Spyware:spyware/betterinet No disinfected C:\WINNT\INF\biini.inf
  Spyware:spyware/clearsearch No disinfected C:\PROGRAM FILES\ClearSearch
  Adware:adware/sidesearch No disinfected C:\PROGRAM FILES\Lycos
  Adware:adware/ncase No disinfected C:\WINNT\SYSTEM32\FLEOK
  Adware:adware/p2pnetworking No disinfected Windows Registry
  Adware:Adware/SAHAgent No disinfected C:\WINNT\inf\bi1.inf
  Spyware:Spyware/BetterInet No disinfected C:\WINNT\inf\biini.inf
  Spyware:Spyware/BetterInet No disinfected C:\WINNT\inf\biO.inf
  Adware:Adware/P2PNetworking No disinfected C:\WINNT\system32\P2P Networking v122.cpl
  
  Adware:Adware/SAHAgent No disinfected C:\WINNT\system32\xmltok.dll

  0
• Trogan London, UK

  October 2005 edited October 2005

  View Hidden Files and Folders - explained here and tell me if you can find the highlighted items:
  
  C:\PROGRAM FILES\KAZAA\TopSearch.dll
  C:\WINNT\DOWNLOADED PROGRAM FILES\bridge.inf
  C:\WINNT\system32\xmltok.dll
  C:\WINNT\SYSTEM32\defaulttxt.dat
  C:\WINNT\SYSTEM32\fiz1
  
  Don't do anything to them. Just let me know if you can see them.

  0
• Trumandrummer Taylor Michigan Icrontian

  October 2005 edited October 2005

  ok, i only found the fiz1. but i dleted some of those yesterday (all the ones that i could find) maybe that was stupid but it said it was spyware so i said out with that lol. ooops. but yea i did find fiz1.

  0
• Trumandrummer Taylor Michigan Icrontian

  October 2005 edited October 2005

  o yea and one more thing. and i beleive this may be how i got the virus. but like for the past year. someone or some machine has been coming on AIM and sending me messages and file transfers. and when i click deny it rapidlly comes up on the screen like 20 times. well i block them and they come up on a new screen name. and i get kicked off aim alot of times for it to. and it creats a file for trillian (which is how i use aim, im sure you know what it is) called a crash file. i immiatally delete it. but one time i was talking to my freind and their IM poped up right as i hit enter. and their message was "hey how do i look (LINK)" and it automatically clicked it because i hit enter. but it took me to a white page. then if i can remember right that was right around the time my computer started acting up again. FOR SOME REASON I DIDNT POST THIS IN THE LAST TOPIC, I JUST REMEMBERED ABOUT IT.

  0
• Leonardo Wake up and smell the glaciers Eagle River, Alaska Icrontian

  October 2005 edited October 2005

  We aren't ignoring you. We have a tremendous number of desparate people here who have been infested by the low-lifes' spyware. We take this seriously - just have a limited number of volunteers to help.
  
  I am not an expert at computer sanitizing, so I won't offer advice. I will say though, it sounds like your computer was hit very hard when you opened the blank page. You probably already know, but NEVER open attachments or links in an instant messaging window. Many AIM (or other brands for that matter) have completely infested computers and are blisfully unaware that they've been hijacked.

  0
• Trumandrummer Taylor Michigan Icrontian

  October 2005 edited October 2005

  o i know you guys arnt ignoring me. lol im pateint i just forgot to tell him about the aim thing. yea i used to dierect connect just to my best freind and my drumline section leader (because he would send me drum music) but i dont direct connect to anyone. they always ask me why and im like "if you want your computer to turn on then dont connect to me" LOL

  0
• profdlp The Holy City Of Westlake, Ohio

  October 2005 edited October 2005

  I'm not sure what extra steps you have to take with Trillian, but there's a preference in AIM to only allow file transfers from members of your Buddy List. Enabling it might prevent any future skullduggery.

  0
• Trumandrummer Taylor Michigan Icrontian

  October 2005 edited October 2005

  yea i now have it set to where people not on my list can send file transfers and people on my list it will ask first.

  0
• Trogan London, UK

  October 2005 edited October 2005

  Post a new HJT log please. I think I see the AIM Virus in your first log - how did I miss that!?

  0
• Trumandrummer Taylor Michigan Icrontian

  October 2005 edited October 2005

  well idk if its gonna still be there. i was reading other peoples posts and i downloaded that aimfix program. but my regular aim still doesnt work. and doesthat program just make aim work or does it delete the virus completely? heres the new log.
  
  Logfile of HijackThis v1.99.1
  Scan saved at 10:30:36 PM, on 10/14/2005
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINNT\System32\smss.exe
  C:\WINNT\system32\winlogon.exe
  C:\WINNT\system32\services.exe
  C:\WINNT\system32\lsass.exe
  C:\WINNT\system32\svchost.exe
  C:\WINNT\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  C:\WINNT\system32\spoolsv.exe
  C:\WINNT\system32\CTsvcCDA.EXE
  C:\Program Files\ewido\security suite\ewidoctrl.exe
  c:\program files\mcafee.com\agent\mcdetect.exe
  c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
  C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
  C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
  C:\WINNT\System32\NMSSvc.exe
  C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
  C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
  C:\WINNT\System32\nvsvc32.exe
  C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
  C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
  C:\WINNT\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\WINNT\Explorer.EXE
  C:\WINNT\wanmpsvc.exe
  C:\WINNT\system32\SK9910DM.EXE
  C:\WINNT\system32\CTHELPER.EXE
  C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb05.exe
  C:\WINNT\System32\hphmon04.exe
  C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
  C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
  C:\Program Files\PhoneTools\CapFax.EXE
  C:\Updater.exe
  C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
  C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
  C:\Program Files\D-Tools\daemon.exe
  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
  C:\Documents and Settings\NICKS\Desktop\nicks music\iTunesHelper.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\PROGRA~1\mcafee.com\agent\mcagent.exe
  C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
  C:\Program Files\McAfee.com\VSO\mcvsshld.exe
  C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  C:\WINNT\system32\ctfmon.exe
  C:\Program Files\CursorXP\CursorXP.exe
  c:\progra~1\mcafee.com\vso\mcvsescn.exe
  C:\WINNT\System32\HPHipm11.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
  C:\Program Files\iPod\bin\iPodService.exe
  c:\progra~1\mcafee.com\vso\mcvsftsn.exe
  C:\Program Files\Creative\MediaSource\CTCMS.exe
  C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
  C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
  C:\hijackthis_199\HijackThis.exe
  
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.net
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://aimtoday.aol.com/_ads/adsPopup2.htm?0
  O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\PROGRA~1\mcafee.com\mps\mcbrhlpr.dll
  O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
  O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll
  O2 - BHO: McAfee Anti-Phishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
  O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
  O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] SK9910DM.EXE
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
  O4 - HKLM\..\Run: [GWMDMpi] C:\WINNT\GWMDMpi.exe
  O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
  O4 - HKLM\..\Run: [Jet Detection] C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe
  O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb05.exe
  O4 - HKLM\..\Run: [HPHmon04] C:\WINNT\System32\hphmon04.exe
  O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
  O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
  O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
  O4 - HKLM\..\Run: [CapFax] C:\Program Files\PhoneTools\CapFax.EXE
  O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
  O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
  O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
  O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Documents and Settings\NICKS\Desktop\nicks music\iTunesHelper.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
  O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
  O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
  O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
  O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
  O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
  O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
  O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
  O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
  O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" -quiet
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
  O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
  O9 - Extra 'Tools' menuitem: McAfee Anti-Phishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
  O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmesus.dll
  O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmesus.dll
  O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
  O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
  O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe
  O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,99/mcinsctl.cab
  O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
  O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab
  O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/SymAData.cab
  O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\system32\CTsvcCDA.EXE
  O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
  O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
  O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
  O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
  O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
  O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
  O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
  O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
  O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
  O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
  O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
  O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
  O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
  O23 - Service: Pml Driver HPH11 - HP - C:\WINNT\System32\HPHipm11.exe
  O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
  O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
  O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe
  
  
  
  What is this................................... O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/...all/xscan53.cab.
  
  
  its not on my other log, and i know nothing about bad entries, but to me that seems fishy. housecall control? maybe this is showing up now because all the other times i still had the hidden folders un-veiwable.

  0
• Trogan London, UK

  October 2005 edited October 2005

  Yeah, get rid of that entry with HJT.
  
  
  Apart from that, your log looks clean.

  0
• Trumandrummer Taylor Michigan Icrontian

  October 2005 edited October 2005

  Ok i dleted that entrie. well i sure hope this fixes it. after i did the active scan and dleted those things i restarted and it turned on. but i just got my ram i got 2 kingston 512 mb ram. my computer can only have 1 gb so im getting rid of this 256 mb and putting in both of the 512 mb. should make it faster. and one more thing. what about that fiz1 file thing? is that bad? u never told me what to do with it

  0
• Trogan London, UK

  October 2005 edited October 2005

  Yeah, just find and delete the highlighted file:
  
  C:\WINNT\SYSTEM32\fiz1
  
  If it says that it is in use then go into Safe Mode and delete it.
  
  Sorry I forgot
  ==
  
  Having 1GB of RAM will work great

  0
• Trumandrummer Taylor Michigan Icrontian

  October 2005 edited October 2005

  ok, i deleted fiz1. but there is also fizo fiz2 fiz3 fiz4 - all the way to fiz20. are those bad too?

  0
• Trogan London, UK

  October 2005 edited October 2005

  Where are the files located? Are they in the System32 folder?

  0
• Leonardo Wake up and smell the glaciers Eagle River, Alaska Icrontian

  October 2005 edited October 2005

  Go into Safe Mode and delete anything and everything with "fiz" in it. There are no MS, Symantec, McAffee...or any legitimate files to my knowledge with "fiz" in the name.

  0
• Trogan London, UK

  October 2005 edited October 2005

  Thanks Leo. I wasn't too sure if they where legit

  0
• Trogan London, UK

  October 2005 edited October 2005

  Trumandrummer, I believe I see the AGOBOT-OT Worm.
  
  Could you please go here and in the box copy and paste the following. Then, Click on 'Submit'
  
  C:\Updater.exe
  
  Please to me what the scan finds. Keep trying if the server is busy

  0
• Leonardo Wake up and smell the glaciers Eagle River, Alaska Icrontian

  October 2005 edited October 2005

  There is some Polish language software replete with "Fiz~". Can't tell if it's legitimate or not; but I'm sure our drummer friend is not running Polish language software (or Polish articles about something "fiz"). Fiz1 is the name of a protein, whose interaction in a zinc environmnent has been studied. Fiz20.zip is associated with a branded archiving software program. Yup, I think Mr. Drummer can safely squash any fizzy files he finds.

  0
• Trumandrummer Taylor Michigan Icrontian

  October 2005 edited October 2005

  alright, do they have to be dleted in safe mode? cuz i dont have time i have drumline pratice in 10 min.

  0
• Trogan London, UK

  October 2005 edited October 2005

  They don't neccesarliy need to be deleted in Safe Mode but it saves time and effort deleting them in Safe Mode rather than someone saying they can't remove something in Normal Mode.
  
  You don't need to remove the files now if you have pratice. You can do them whenever you are free, we'll be here lol
  
  EDIT: I'l explain my post (#21) when you are free - Just let me know

  0
• Trumandrummer Taylor Michigan Icrontian

  October 2005 edited October 2005

  well i did what u said with that scan. for C:\Updater.exe , and it found nothing. but i still feel as if there is something with this computer.

  0
• Trogan London, UK

  October 2005 edited October 2005

  Did it go thru all the scans on the site?
  ==
  
  First, check for updates with AVG, Ewido, Ad-Aware and SpyBot.
  
  Turn off System Restore and go into Safe Mode. Then, Delete the following:
  
  C:\Updater.exe
  
  In Safe Mode, scan with Ewido, Ad-Aware, SpyBot and AVG doing complete scans with them all.
  
  
  Reboot back into Normal Mode and enable System Restore

  0
• Trumandrummer Taylor Michigan Icrontian

  October 2005 edited October 2005

  yea it did everything. and everything said nothing found. well it looks as if i WILL have to delete updater.exe in safe mode. cuz it wont delete here.

  0
• Trogan London, UK

  October 2005 edited October 2005

  Have you done the other part of the instructions?

  0
• Trumandrummer Taylor Michigan Icrontian

  October 2005 edited October 2005

  well i havnt had time to do the scans in safe mode. cuz after i deleted the file in safe mode. we put the ram and the new dvd burner in . then it was 2:00 am so i went to bed.

  0
• Trogan London, UK

  October 2005 edited October 2005

  As long as you deleted the file, it should be ok
  
  
  How does your computer feel with 1GB?

  0
• Trumandrummer Taylor Michigan Icrontian

  October 2005 edited October 2005

  it feels so awsome lol. its fast once again. and im sure if i didnt have nortan it would be way faster. im trying to talk my dad into using avg. but he dont trust it he said hes gonna buy mcaffe . i was like "why avg free is better, doesnt slow down your computer, and its free" but i guess he wants name brands. i have to talk him into avg lol.

  0