Need Help Asap...

scsoccer009scsoccer009
edited September 2004 in Spyware & Virus Removal
my computer kept restarting it self and saying "operating system not found" or it would freeze up and wouldn't let me do anything. In my start up i found "dumprep 0 -k" i disabled it and my computer was working fine but it keeps inabling itself again and my computer makes a beeping sound and goes crazy again :grr: so i figured that was the virus so i got my hi jack log and deleted it and it worked fine for about 5 min then it restarted itself and went crazy again... maybe theres another virus?? :rant::eek2:

heres my hi jack log... SOMEONE PLEASE HELPPPPPPPPPPPPPPpppppppp!!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
c:\program files\mcafee.com\agent\mcagent.exe
C:\Program Files\hijack this\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us7.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us7.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Zero Knowledge Freedom] C:\Program Files\Zero Knowledge\Freedom\AutoStarterR.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\Program Files\AIM\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [msbb] c:\program files\gluz\msbb.exe
O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
O4 - HKLM\..\Run: [zkf] C:\WINDOWS\zkf.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,83/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,20/mcgdmgr.cab



thanks.... :confused:

Comments

  • scsoccer009scsoccer009
    edited August 2004
    can anybody help me?????

    1 more question is msmsgs a virus???? i heard it's for MSN messenger but i don't have MSN messanger anywhere on my cmputer... could it be a virus??? PLEASE HELP!!

    thanks...
  • rykoryko new york
    edited August 2004
    Random restars could be several things......bad memory, bad power supply, or even a virus. First, run memtest+, you can find it in the Short-Media dowloads section. Next check the output rails of your psu......this can be done in your BIOS. They should be close to 12v, 3.3v, and 5v.

    Next, msmmsgs is not a virus.... it is bundled with the o/s...you can safely disable it in HJT though.

    Give me a few seconds and i will go through your log completely...
  • DexterDexter Vancouver, BC Canada
    edited August 2004
    Reboot in SAFE MODE. Run HJT. FIX:


    O4 - HKLM\..\Run: [zkf] C:\WINDOWS\zkf.exe

    O4 - HKLM\..\Run: [msbb] c:\program files\gluz\msbb.exe

    For info on that last one, see: http://www.liutilities.com/products/wintaskspro/processlibrary/msbb/

    Quarantine those 2 exe files, using the instructions here: http://www.short-media.com/forum/showpost.php?p=173532&postcount=5

    Reboot normally, and see how it looks. If it is clean, set a new System Restore Point: http://www.short-media.com/forum/showpost.php?p=172591&postcount=4

    Post a fresh log for follow-up.

    Dexter...
  • DexterDexter Vancouver, BC Canada
    edited August 2004
    scsoccer009 wrote:
    can anybody help me?????

    1 more question is msmsgs a virus???? i heard it's for MSN messenger but i don't have MSN messanger anywhere on my cmputer... could it be a virus??? PLEASE HELP!!

    thanks...


    No, it is not:

    http://www.liutilities.com/products/wintaskspro/processlibrary/msmsgs/

    Dexter...
  • DexterDexter Vancouver, BC Canada
    edited August 2004
    ryko wrote:
    Random restars could be several things......bad memory, bad power supply, or even a virus. First, run memtest+, you can find it in the Short-Media dowloads section. Next check the output rails of your psu......this can be done in your BIOS. They should be close to 12v, 3.3v, and 5v.

    Next, msmmsgs is not a virus.... it is bundled with the o/s...you can safely disable it in HJT though.

    Give me a few seconds and i will go through your log completely...


    Sorry Ryko, I had already started reviewing his log before seeing your post :)

    scsoccer009: Ryko is correct about your reboots, they are likely not spyware related.

    Dexter...
  • rykoryko new york
    edited August 2004
    ok, kill these.....

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = 127.0.0.1
    not 100% on this, but you can always restore the backup if needed
    O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
    O4 - HKLM\..\Run: [Zero Knowledge Freedom] C:\Program Files\Zero Knowledge\Freedom\AutoStarterR.exe
    O4 - HKLM\..\Run: [msbb] c:\program files\gluz\msbb.exe
    O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
    you don't need this, check list at bottom---
    O4 - HKLM\..\Run: [zkf] C:\WINDOWS\zkf.exe
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    removing these will free up resources
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

    you can also kill the AIM related ones, unless you use AIM!

    For spyware removal, use the following apps.....

    Ad-Aware SE personal, Spybot Search & Destroy, and HJT.....all of which can be found in the SM downloads section....

    Also consider switching browsers.....ever since i switched to mozilla firefox, i have had way less spyware and problems.

    Remove the entries from HJT, then run all of the apps i mentioned, then re-run HJT and post a new (hopefully cleaner!) log...
  • rykoryko new york
    edited August 2004
    Hey Dexter, at least he has 2 people helping him!
  • DexterDexter Vancouver, BC Canada
    edited August 2004
    ryko wrote:
    ok, kill these.....



    O4 - HKLM\..\Run: [Zero Knowledge Freedom] C:\Program Files\Zero Knowledge\Freedom\AutoStarterR.exe


    Actually, don't kill that one. Zero Knowledge is the back-end provider for many ISP's freee anti-virus / firewall solutions:

    http://www.zeroknowledge.com/


    If you removed that entry scsoccer009, please replace it from HJT's Backup function.

    Dexter...
  • scsoccer009scsoccer009
    edited August 2004
    i deleated workin fine for about a day then it made this really loud beeping sound, and retarted itwhat you said and my comptuer was self and said opperating system not found... what can i do>>???
  • DexterDexter Vancouver, BC Canada
    edited August 2004
    Can you explain that a little more clearly please?

    Dexter...
  • scsoccer009scsoccer009
    edited August 2004
    sorry that came out wrong i don't know what happened but it was supposed to be...

    I deleated the things you said to and it was working fine for about a day then it made this really loud beeping sound, and restarted itself and said "operating system not found"... what can i do???
  • DexterDexter Vancouver, BC Canada
    edited August 2004
    You have hardware troubles, sounds like your hard drive is failing. Post a thread in the Emergency Help Forum for better assistance.

    Dexter...
  • Geeky1Geeky1 University of the Pacific (Stockton, CA, USA)
    edited August 2004
    Sounds like more than just a hard drive issue to me. Hard drive failures don't generally cause random reboots as far as I know. $5 says their PSU is dying and/or their cpu hsf is full of junk. The hard drive issue sounds like a symptom of a larger problem to me, not the cause of the problem. :)
  • scsoccer009scsoccer009
    edited September 2004
    okay i think i should tell you more about what's wrong adn what i did maybe then someone will know about the problem...
    i've formatted the computer about 3 times and the same problem still happens:
    wehn you turn it on it works for about 30 min to an hour and then it will start making a beeping noise (it sounds like someone's screaming) then all of a sudden it restarts and wehn it begins to start up again it says "operating system not found. So i shut it off wehn this happens and you have to wait like 5 min before you can turn it back on again or it will do the same thing again. When you wait about 5 min then it works agian for 30 min to an hour.
    Another problem is sometimes it just starts beeping (screaming) and it will just freeze up and i have to shut it down and wait 5 min again.
    i thought it was a virus that's why i kept formatting it wehn it would happen again... someone told me that it is a virus and after you format it and when you get updates that the virus comes back on to your computer...

    well whatever it is,
    if anyone knows anything about this
    PLEASE HELP
    thank you soo much..
  • DexterDexter Vancouver, BC Canada
    edited September 2004
    As I said above:

    Post a thread in the Emergency Help Forum for better assistance with the hardware issues.

    I will close this topic as it appears the spyware portion of it is resolved.

    Dexter...
This discussion has been closed.