Obviously a major problem, but system running ok(weird)

Comments

• Trogan London, UK

  October 2005 edited October 2005

  Hi, sorry for the long delay!
  
  If you still need help, post a new HJT log

  0
• maz

  October 2005 edited October 2005

  Thank you for responding.
  
  Logfile of HijackThis v1.99.1
  Scan saved at 9:42:13 AM, on 10/28/2005
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\HPQ\One-Touch\OneTouch.EXE
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\WINDOWS\system32\carpserv.exe
  C:\WINDOWS\Logi_MwX.Exe
  C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\Program Files\Xp Updates\AntiSpywearBeta\gcasServ.exe
  C:\WINDOWS\SnoopFreeUI.exe
  C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
  C:\WINDOWS\system32\HPConfig.exe
  C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
  C:\Program Files\M-Audio USB Quattro\Install\QuatInst.exe
  C:\Program Files\Xp Updates\AntiSpywearBeta\gcasDtServ.exe
  C:\WINDOWS\System32\SnoopFreeSvc.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Filezilla\firefox.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  C:\Hijack\HijackThis.exe
  C:\WINDOWS\system32\NOTEPAD.EXE
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
  O2 - BHO: SysShield IE Popup Blocker - {9A23B8A4-C6C9-4A68-8FA6-5F905DC8FF80} - C:\Program Files\Internet Eraser\pkext.dll
  O2 - BHO: IECatcher Class - {B930BA63-9E5A-11D3-A288-0000E80E2EDE} - C:\Program Files\Microsoft Office\Office\MDHELPER.DLL
  O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Browser Mouse\1.0\LwbWheel.exe
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [srmclean] C:\System\cpqs\scom\srmclean.exe
  O4 - HKLM\..\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE
  O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
  O4 - HKLM\..\Run: [CARPService] carpserv.exe
  O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Xp Updates\AntiSpywearBeta\gcasServ.exe"
  O4 - HKLM\..\Run: [SnoopFreeUI] SnoopFreeUI.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1124377282029
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1124377273767
  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
  O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
  O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
  O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
  O23 - Service: Quattro Installer (QuattroInstallerService) - M-Audio - C:\Program Files\M-Audio USB Quattro\Install\QuatInst.exe
  O23 - Service: Snoop Free Service (SnoopFreeSvc) - Unknown owner - C:\WINDOWS\System32\SnoopFreeSvc.exe
  O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe

  0
• Trogan London, UK

  October 2005 edited October 2005

  Close all windows!
  
  Check the following in HJT and click 'Fix Checked'
  
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/...all/xscan53.cab
  
  Apart from those, I don't see anything that is malicious.
  ===
  Download Ewido Security Suite

  • Install ewido security suite
  • When installing, under "Additional Options" uncheck..
    • Install background guard
    • Install scan via context menu
  • Launch ewido, there should be an icon on your desktop, double-click it.
  • You will need to update ewido to the latest definition files.
    • On the left hand side of the main screen click update.
    • Then click on Start Update.
  • The update will start and a progress bar will show the updates being installed.
    (the status bar at the bottom will display "Update successful")
  • Now, scan with it by clicking 'Scanner' on the left and choosing 'Complete System Scan'

  ===
  
  Scan your PC with the following:
  
  Panda Activescan
  
  There maybe files that cannot be removed. Please post them here.
  ===
  
  Post a new HJT log

  0
• maz

  October 2005 edited October 2005

  I ran the Ewido Security Suite and it got rid of a lot of junk the other applications missed. However I couldn't run Panda, which requires me to use IE, which ironically, no longer runs on my computer. I can no longer view or run any programs from the start menu.
  
  Logfile of HijackThis v1.99.1
  Scan saved at 1:05:57 PM, on 10/28/2005
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\HPQ\One-Touch\OneTouch.EXE
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\WINDOWS\system32\carpserv.exe
  C:\WINDOWS\Logi_MwX.Exe
  C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\Program Files\Xp Updates\AntiSpywearBeta\gcasServ.exe
  C:\WINDOWS\SnoopFreeUI.exe
  C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
  C:\WINDOWS\system32\HPConfig.exe
  C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
  C:\Program Files\M-Audio USB Quattro\Install\QuatInst.exe
  C:\Program Files\Xp Updates\AntiSpywearBeta\gcasDtServ.exe
  C:\WINDOWS\System32\SnoopFreeSvc.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Filezilla\firefox.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  C:\Audio Programs\Djs Mk-I free\djsfree.exe
  C:\Hijack\security suite\ewidoctrl.exe
  C:\Hijack\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
  O2 - BHO: SysShield IE Popup Blocker - {9A23B8A4-C6C9-4A68-8FA6-5F905DC8FF80} - C:\Program Files\Internet Eraser\pkext.dll
  O2 - BHO: IECatcher Class - {B930BA63-9E5A-11D3-A288-0000E80E2EDE} - C:\Program Files\Microsoft Office\Office\MDHELPER.DLL
  O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Browser Mouse\1.0\LwbWheel.exe
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [srmclean] C:\System\cpqs\scom\srmclean.exe
  O4 - HKLM\..\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE
  O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
  O4 - HKLM\..\Run: [CARPService] carpserv.exe
  O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Xp Updates\AntiSpywearBeta\gcasServ.exe"
  O4 - HKLM\..\Run: [SnoopFreeUI] SnoopFreeUI.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1124377282029
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1124377273767
  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
  O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
  O23 - Service: ewido security suite control - ewido networks - C:\Hijack\security suite\ewidoctrl.exe
  O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
  O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
  O23 - Service: Quattro Installer (QuattroInstallerService) - M-Audio - C:\Program Files\M-Audio USB Quattro\Install\QuatInst.exe
  O23 - Service: Snoop Free Service (SnoopFreeSvc) - Unknown owner - C:\WINDOWS\System32\SnoopFreeSvc.exe
  O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe

  0
• Trogan London, UK

  October 2005 edited October 2005

  Did you remove the entries I mentioned above with HJT?
  
  I'l ask someone else to have a look but I'm not sure if this is SVT related. It could be a Windows problem.

  0
• maz

  October 2005 edited October 2005

  Trogan_1000 wrote:

  Did you remove the entries I mentioned above with HJT?

  
  Ok I removed the files
  

  Trogan_1000 wrote:

  I'l ask someone else to have a look but I'm not sure if this is SVT related. It could be a Windows problem.

  
  Well it many not be, but it all happened the same day when my firewall became disabled. Should I do a system restore?
  
  Here's my current hijack log:
  
  Logfile of HijackThis v1.99.1
  Scan saved at 2:37:04 PM, on 10/31/2005
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
  C:\Hijack\security suite\ewidoctrl.exe
  C:\WINDOWS\system32\HPConfig.exe
  C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
  C:\Program Files\M-Audio USB Quattro\Install\QuatInst.exe
  C:\WINDOWS\System32\SnoopFreeSvc.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Browser Mouse\1.0\LwbWheel.exe
  C:\Program Files\HPQ\One-Touch\OneTouch.EXE
  C:\WINDOWS\system32\carpserv.exe
  C:\WINDOWS\Logi_MwX.Exe
  C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  C:\Program Files\Xp Updates\AntiSpywearBeta\gcasServ.exe
  C:\WINDOWS\SnoopFreeUI.exe
  C:\Program Files\Xp Updates\AntiSpywearBeta\gcasDtServ.exe
  C:\Audio Programs\Djs Mk-I free\djsfree.exe
  C:\Hijack\HijackThis.exe
  C:\Program Files\Filezilla\firefox.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
  O2 - BHO: SysShield IE Popup Blocker - {9A23B8A4-C6C9-4A68-8FA6-5F905DC8FF80} - C:\Program Files\Internet Eraser\pkext.dll
  O2 - BHO: IECatcher Class - {B930BA63-9E5A-11D3-A288-0000E80E2EDE} - C:\Program Files\Microsoft Office\Office\MDHELPER.DLL
  O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Browser Mouse\1.0\LwbWheel.exe
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [srmclean] C:\System\cpqs\scom\srmclean.exe
  O4 - HKLM\..\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE
  O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
  O4 - HKLM\..\Run: [CARPService] carpserv.exe
  O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Xp Updates\AntiSpywearBeta\gcasServ.exe"
  O4 - HKLM\..\Run: [SnoopFreeUI] SnoopFreeUI.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1124377282029
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1124377273767
  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
  O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
  O23 - Service: ewido security suite control - ewido networks - C:\Hijack\security suite\ewidoctrl.exe
  O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
  O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
  O23 - Service: Quattro Installer (QuattroInstallerService) - M-Audio - C:\Program Files\M-Audio USB Quattro\Install\QuatInst.exe
  O23 - Service: Snoop Free Service (SnoopFreeSvc) - Unknown owner - C:\WINDOWS\System32\SnoopFreeSvc.exe
  O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe

  0
• Trogan London, UK

  October 2005 edited October 2005

  Did you run Panda Activescan and save a report?

  0
• maz

  November 2005 edited November 2005

  I cannot run Panda because at the moment, whatever is wrong with my computer has disabled a lot of things, includings Internet Explorer. I am using Mozilla as my browser and Panda won't run with Mozilla.

  0
• Trogan London, UK

  November 2005 edited November 2005

  Post a new HJT log and i'l see what I can do

  0
• maz

  November 2005 edited November 2005

  Hi! Thanks a lot for the help. Here's the new hijack. I am going to search for a good reg /windows fix. Got any tips on a good free one? I will try the search tool before i start a thread on where to find one.
  
  
  Logfile of HijackThis v1.99.1
  Scan saved at 5:56:10 PM, on 11/12/2005
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Browser Mouse\1.0\LwbWheel.exe
  C:\Program Files\HPQ\One-Touch\OneTouch.EXE
  C:\WINDOWS\system32\carpserv.exe
  C:\WINDOWS\Logi_MwX.Exe
  C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  C:\Program Files\Xp Updates\AntiSpywearBeta\gcasServ.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\WINDOWS\SnoopFreeUI.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
  C:\WINDOWS\system32\HPConfig.exe
  C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
  C:\Program Files\M-Audio USB Quattro\Install\QuatInst.exe
  C:\WINDOWS\System32\SnoopFreeSvc.exe
  C:\Program Files\Xp Updates\AntiSpywearBeta\gcasDtServ.exe
  C:\Program Files\Filezilla\firefox.exe
  C:\Audio Programs\Limewire\LimeWire.exe
  C:\Audio Programs\Djs Mk-I free\djsfree.exe
  C:\Hijack\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start
  
  Page = http://www.yahoo.com/
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start
  
  Page = http://www.yahoo.com/
  O2 - BHO: AcroIEHlprObj Class -
  
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program
  
  Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: SysShield IE Popup Blocker -
  
  {9A23B8A4-C6C9-4A68-8FA6-5F905DC8FF80} - C:\Program
  
  Files\Internet Eraser\pkext.dll
  O2 - BHO: IECatcher Class -
  
  {B930BA63-9E5A-11D3-A288-0000E80E2EDE} - C:\Program
  
  Files\Microsoft Office\Office\MDHELPER.DLL
  O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Browser
  
  Mouse\1.0\LwbWheel.exe
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program
  
  Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program
  
  Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [srmclean]
  
  C:\System\cpqs\scom\srmclean.exe
  O4 - HKLM\..\Run: [QT4HPOT] C:\Program
  
  Files\HPQ\One-Touch\OneTouch.EXE
  O4 - HKLM\..\Run: [Display Settings] C:\Program
  
  Files\HPQ\Notebook Utilities\hptasks.exe /s
  O4 - HKLM\..\Run: [CARPService] carpserv.exe
  O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI
  
  Technologies\ATI Control Panel\atiptaxx.exe
  O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
  O4 - HKLM\..\Run: [NeroFilterCheck]
  
  C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program
  
  Files\Java\jre1.5.0_05\bin\jusched.exe
  O4 - HKLM\..\Run: [AVG7_CC]
  
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [AVG7_EMC]
  
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Xp
  
  Updates\AntiSpywearBeta\gcasServ.exe"
  O4 - HKLM\..\Run: [SnoopFreeUI] SnoopFreeUI.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN
  
  Messenger\MsnMsgr.Exe" /background
  O4 - Global Startup: Microsoft Office.lnk = C:\Program
  
  Files\Microsoft Office\Office\OSA9.EXE
  O9 - Extra button: (no name) -
  
  {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
  
  Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console -
  
  {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
  
  Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
  O9 - Extra button: Messenger -
  
  {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
  
  Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger -
  
  {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
  
  Files\Messenger\msmsgs.exe
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows
  
  Genuine Advantage Validation Tool) -
  
  http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C}
  
  (WUWebControl Class) -
  
  http://update.microsoft.com/microsoftupdate/v6/V5Controls/en
  
  /x86/client/wuweb_site.cab?1124377282029
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3}
  
  (MUWebControl Class) -
  
  http://update.microsoft.com/microsoftupdate/v6/V5Controls/en
  
  /x86/client/muweb_site.cab?1124377273767
  O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA}
  
  (AvxScanOnline Control) -
  
  http://www.bitdefender.com/scan/Msie/bitdefender.cab
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) -
  
  GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT,
  
  s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: C-DillaSrv - C-Dilla Ltd -
  
  C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
  O23 - Service: HP Configuration Interface Service (HPConfig)
  
  - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
  O23 - Service: HPWirelessMgr - Hewlett-Packard Co. -
  
  C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
  O23 - Service: Quattro Installer (QuattroInstallerService) -
  
  M-Audio - C:\Program Files\M-Audio USB
  
  Quattro\Install\QuatInst.exe
  O23 - Service: Snoop Free Service (SnoopFreeSvc) - Unknown
  
  owner - C:\WINDOWS\System32\SnoopFreeSvc.exe
  O23 - Service: Sony SPTI Service (SPTISRV) - Sony
  
  Corporation -
  
  C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe

  0
• Trogan London, UK

  November 2005 edited November 2005

  Can you post a new HJT as there seems to be a problem with the one above.
  
  There are some good free reg tools available. I use RegCleaner which is Free.
  
  
  What problems are you still having?

  0
• maz

  November 2005 edited November 2005

  Well, the same ones I've had. I can't view my programs and system apps from the start menu, or from add remove programs. I also can't run IE, which keeps me from accessing certain sites, like one of my work website, and even that Panda scanner thing. I also can't run my disc defrag.
  
  I'm thinking about reinstalling windows since nothing seems to be working. I'e tried that reg program, and my computer seems to run more efficiently, but it still hasn't fixed my Windows problems.
  
  Here's my new Hijack file and cheers again for your help!
  
  
  Logfile of HijackThis v1.99.1
  Scan saved at 7:56:45 PM, on 11/12/2005
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Browser Mouse\1.0\LwbWheel.exe
  C:\Program Files\HPQ\One-Touch\OneTouch.EXE
  C:\WINDOWS\system32\carpserv.exe
  C:\WINDOWS\Logi_MwX.Exe
  C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  C:\Program Files\Xp Updates\AntiSpywearBeta\gcasServ.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\WINDOWS\SnoopFreeUI.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
  C:\WINDOWS\system32\HPConfig.exe
  C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
  C:\Program Files\M-Audio USB Quattro\Install\QuatInst.exe
  C:\WINDOWS\System32\SnoopFreeSvc.exe
  C:\Program Files\Xp Updates\AntiSpywearBeta\gcasDtServ.exe
  C:\Program Files\Filezilla\firefox.exe
  C:\Audio Programs\Limewire\LimeWire.exe
  C:\Audio Programs\Djs Mk-I free\djsfree.exe
  C:\Hijack\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: SysShield IE Popup Blocker - {9A23B8A4-C6C9-4A68-8FA6-5F905DC8FF80} - C:\Program Files\Internet Eraser\pkext.dll
  O2 - BHO: IECatcher Class - {B930BA63-9E5A-11D3-A288-0000E80E2EDE} - C:\Program Files\Microsoft Office\Office\MDHELPER.DLL
  O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Browser Mouse\1.0\LwbWheel.exe
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [srmclean] C:\System\cpqs\scom\srmclean.exe
  O4 - HKLM\..\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE
  O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
  O4 - HKLM\..\Run: [CARPService] carpserv.exe
  O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Xp Updates\AntiSpywearBeta\gcasServ.exe"
  O4 - HKLM\..\Run: [SnoopFreeUI] SnoopFreeUI.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1124377282029
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1124377273767
  O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
  O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
  O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
  O23 - Service: Quattro Installer (QuattroInstallerService) - M-Audio - C:\Program Files\M-Audio USB Quattro\Install\QuatInst.exe
  O23 - Service: Snoop Free Service (SnoopFreeSvc) - Unknown owner - C:\WINDOWS\System32\SnoopFreeSvc.exe
  O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe

  0
• Trogan London, UK

  November 2005 edited November 2005

  Do you know what Snoop Free Service is?
  
  
  I can't see anything bad in your log still. I think a Repair Install would be the best thing. If you want more help with doing that then you can ask in the Windows Forum.
  
  Good Luck!

  0