Options
removing HSA: HJT file+active services
Hello,
Dexter, thank you. I didn't see the services you talk about in step4 to remove HSA. So as you recommand it I'm sending the results for HJT and Get active services.
Thank you again.
Be well,
Ed.
Logfile of HijackThis v1.98.2
Scan saved at 20:15:54, on 24/08/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Fichiers communs\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\Pavsrv51.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\AVENGINE.EXE
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\ipyt32.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\apvxdwin.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\system32\javaou.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
C:\Acrobat3\Distillr\DISTASST.EXE
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\WebProxy.exe
C:\Palm\HOTSYNC.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Christian\Bureau\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/fr/fra/gen/default.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ewcst.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ewcst.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\ewcst.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ewcst.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ewcst.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ewcst.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ewcst.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {30C16827-1FE8-9C39-95A4-CA3E7FEC6A5D} - C:\WINDOWS\system32\sdkid32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [VirusScan] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Fichiers communs\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [javaou.exe] C:\WINDOWS\system32\javaou.exe
O4 - HKLM\..\Run: [SafeGuard Popup Updater (required)] regsvr32 /s C:\WINDOWS\System32\pdfupd.dll
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\RunOnce: [ipyt32.exe] C:\WINDOWS\ipyt32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - Startup: ExtConfig.lnk = C:\Program Files\LibertySurf\Config\ExtConf.exe
O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Contrôleur de calendrier Ulead.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O4 - Global Startup: Distiller Assistant 3.01.lnk = C:\Acrobat3\Distillr\DISTASST.EXE
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Ulead Photo Express 3.0 SE Calendar Checker.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
These are the Current Active Services:
Service de la passerelle de la couche Application: ALG
C:\WINDOWS\System32\alg.exe
Audio Windows: AudioSrv
C:\WINDOWS\System32\svchost.exe -k netsvcs
Explorateur d'ordinateur: Browser
C:\WINDOWS\System32\svchost.exe -k netsvcs
Services de cryptographie: CryptSvc
C:\WINDOWS\system32\svchost.exe -k netsvcs
Client DHCP: Dhcp
C:\WINDOWS\System32\svchost.exe -k netsvcs
Service de rapport d'erreurs: ERSvc
C:\WINDOWS\System32\svchost.exe -k netsvcs
Système d'événements de COM+: EventSystem
C:\WINDOWS\System32\svchost.exe -k netsvcs
Compatibilité avec le Changement rapide d'utilisateur: FastUserSwitchingCompatibility
C:\WINDOWS\System32\svchost.exe -k netsvcs
Aide et support: helpsvc
C:\WINDOWS\System32\svchost.exe -k netsvcs
Serveur: lanmanserver
C:\WINDOWS\System32\svchost.exe -k netsvcs
Station de travail: lanmanworkstation
C:\WINDOWS\System32\svchost.exe -k netsvcs
Connexions réseau: Netman
C:\WINDOWS\System32\svchost.exe -k netsvcs
NLA (Network Location Awareness): Nla
C:\WINDOWS\System32\svchost.exe -k netsvcs
Gestionnaire de connexions d'accès distant: RasMan
C:\WINDOWS\System32\svchost.exe -k netsvcs
Planificateur de tâches: Schedule
C:\WINDOWS\System32\svchost.exe -k netsvcs
Connexion secondaire: seclogon
C:\WINDOWS\System32\svchost.exe -k netsvcs
Notification d'événement système: SENS
C:\WINDOWS\system32\svchost.exe -k netsvcs
Pare-feu de connexion Internet (ICF) / Partage de connexion Internet (ICS): SharedAccess
C:\WINDOWS\System32\svchost.exe -k netsvcs
Détection matériel noyau: ShellHWDetection
C:\WINDOWS\System32\svchost.exe -k netsvcs
Service de restauration système: srservice
C:\WINDOWS\System32\svchost.exe -k netsvcs
Téléphonie: TapiSrv
C:\WINDOWS\System32\svchost.exe -k netsvcs
Services Terminal Server: TermService
C:\WINDOWS\System32\svchost.exe -k netsvcs
Thèmes: Themes
C:\WINDOWS\System32\svchost.exe -k netsvcs
Client de suivi de lien distribué: TrkWks
C:\WINDOWS\system32\svchost.exe -k netsvcs
Gestionnaire de téléchargement: uploadmgr
C:\WINDOWS\System32\svchost.exe -k netsvcs
Windows Time: w32time
C:\WINDOWS\system32\svchost.exe -k netsvcs
Infrastructure de gestion Windows: winmgmt
C:\WINDOWS\system32\svchost.exe -k netsvcs
Numéro de série du média portable: WmdmPmSp
C:\WINDOWS\System32\svchost.exe -k netsvcs
Mises à jour automatiques: wuauserv
C:\WINDOWS\system32\svchost.exe -k netsvcs
Configuration automatique sans fil: WZCSVC
C:\WINDOWS\System32\svchost.exe -k netsvcs
Creative Service for CDROM Access: Creative Service for CDROM Access
C:\WINDOWS\System32\CTsvcCDA.exe
Client DNS: Dnscache
C:\WINDOWS\System32\svchost.exe -k NetworkService
Journal des événements: Eventlog
C:\WINDOWS\system32\services.exe
Plug-and-Play: PlugPlay
C:\WINDOWS\system32\services.exe
LexBce Server: LexBceS
C:\WINDOWS\system32\LEXBCES.EXE
Assistance TCP/IP NetBIOS: LmHosts
C:\WINDOWS\System32\svchost.exe -k LocalService
Service de découvertes SSDP: SSDPSRV
C:\WINDOWS\System32\svchost.exe -k LocalService
WebClient: WebClient
C:\WINDOWS\System32\svchost.exe -k LocalService
NVIDIA Driver Helper Service: NVSvc
C:\WINDOWS\System32\nvsvc32.exe
Panda Process Protection Service: PavPrSrv
C:\Program Files\Fichiers communs\Panda Software\PavShld\pavprsrv.exe
Panda anti-virus service: PAVSRV
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\Pavsrv51.exe
Emplacement protégé: ProtectedStorage
C:\WINDOWS\system32\lsass.exe
Gestionnaire de comptes de sécurité: SamSs
C:\WINDOWS\system32\lsass.exe
Appel de procédure distante (RPC): RpcSs
C:\WINDOWS\system32\svchost -k rpcss
Spouleur d'impression: Spooler
C:\WINDOWS\system32\spoolsv.exe
Acquisition d'image Windows (WIA): stisvc
C:\WINDOWS\System32\svchost.exe -k imgsvc
TrueVector Internet Monitor: vsmon
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe -service
WMDM PMSP Service: WMDM PMSP Service
C:\WINDOWS\System32\MsPMSPSv.exe
Workstation NetLogon Service: ½O.#ž‚„õØ´â
"C:\WINDOWS\ipyt32.exe" /s
Dexter, thank you. I didn't see the services you talk about in step4 to remove HSA. So as you recommand it I'm sending the results for HJT and Get active services.
Thank you again.
Be well,
Ed.
Logfile of HijackThis v1.98.2
Scan saved at 20:15:54, on 24/08/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Fichiers communs\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\Pavsrv51.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\AVENGINE.EXE
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\ipyt32.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\apvxdwin.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\system32\javaou.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
C:\Acrobat3\Distillr\DISTASST.EXE
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\WebProxy.exe
C:\Palm\HOTSYNC.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Christian\Bureau\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/fr/fra/gen/default.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ewcst.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ewcst.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\ewcst.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ewcst.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ewcst.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ewcst.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ewcst.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {30C16827-1FE8-9C39-95A4-CA3E7FEC6A5D} - C:\WINDOWS\system32\sdkid32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [VirusScan] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Fichiers communs\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [javaou.exe] C:\WINDOWS\system32\javaou.exe
O4 - HKLM\..\Run: [SafeGuard Popup Updater (required)] regsvr32 /s C:\WINDOWS\System32\pdfupd.dll
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\RunOnce: [ipyt32.exe] C:\WINDOWS\ipyt32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - Startup: ExtConfig.lnk = C:\Program Files\LibertySurf\Config\ExtConf.exe
O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Contrôleur de calendrier Ulead.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O4 - Global Startup: Distiller Assistant 3.01.lnk = C:\Acrobat3\Distillr\DISTASST.EXE
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Ulead Photo Express 3.0 SE Calendar Checker.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
These are the Current Active Services:
Service de la passerelle de la couche Application: ALG
C:\WINDOWS\System32\alg.exe
Audio Windows: AudioSrv
C:\WINDOWS\System32\svchost.exe -k netsvcs
Explorateur d'ordinateur: Browser
C:\WINDOWS\System32\svchost.exe -k netsvcs
Services de cryptographie: CryptSvc
C:\WINDOWS\system32\svchost.exe -k netsvcs
Client DHCP: Dhcp
C:\WINDOWS\System32\svchost.exe -k netsvcs
Service de rapport d'erreurs: ERSvc
C:\WINDOWS\System32\svchost.exe -k netsvcs
Système d'événements de COM+: EventSystem
C:\WINDOWS\System32\svchost.exe -k netsvcs
Compatibilité avec le Changement rapide d'utilisateur: FastUserSwitchingCompatibility
C:\WINDOWS\System32\svchost.exe -k netsvcs
Aide et support: helpsvc
C:\WINDOWS\System32\svchost.exe -k netsvcs
Serveur: lanmanserver
C:\WINDOWS\System32\svchost.exe -k netsvcs
Station de travail: lanmanworkstation
C:\WINDOWS\System32\svchost.exe -k netsvcs
Connexions réseau: Netman
C:\WINDOWS\System32\svchost.exe -k netsvcs
NLA (Network Location Awareness): Nla
C:\WINDOWS\System32\svchost.exe -k netsvcs
Gestionnaire de connexions d'accès distant: RasMan
C:\WINDOWS\System32\svchost.exe -k netsvcs
Planificateur de tâches: Schedule
C:\WINDOWS\System32\svchost.exe -k netsvcs
Connexion secondaire: seclogon
C:\WINDOWS\System32\svchost.exe -k netsvcs
Notification d'événement système: SENS
C:\WINDOWS\system32\svchost.exe -k netsvcs
Pare-feu de connexion Internet (ICF) / Partage de connexion Internet (ICS): SharedAccess
C:\WINDOWS\System32\svchost.exe -k netsvcs
Détection matériel noyau: ShellHWDetection
C:\WINDOWS\System32\svchost.exe -k netsvcs
Service de restauration système: srservice
C:\WINDOWS\System32\svchost.exe -k netsvcs
Téléphonie: TapiSrv
C:\WINDOWS\System32\svchost.exe -k netsvcs
Services Terminal Server: TermService
C:\WINDOWS\System32\svchost.exe -k netsvcs
Thèmes: Themes
C:\WINDOWS\System32\svchost.exe -k netsvcs
Client de suivi de lien distribué: TrkWks
C:\WINDOWS\system32\svchost.exe -k netsvcs
Gestionnaire de téléchargement: uploadmgr
C:\WINDOWS\System32\svchost.exe -k netsvcs
Windows Time: w32time
C:\WINDOWS\system32\svchost.exe -k netsvcs
Infrastructure de gestion Windows: winmgmt
C:\WINDOWS\system32\svchost.exe -k netsvcs
Numéro de série du média portable: WmdmPmSp
C:\WINDOWS\System32\svchost.exe -k netsvcs
Mises à jour automatiques: wuauserv
C:\WINDOWS\system32\svchost.exe -k netsvcs
Configuration automatique sans fil: WZCSVC
C:\WINDOWS\System32\svchost.exe -k netsvcs
Creative Service for CDROM Access: Creative Service for CDROM Access
C:\WINDOWS\System32\CTsvcCDA.exe
Client DNS: Dnscache
C:\WINDOWS\System32\svchost.exe -k NetworkService
Journal des événements: Eventlog
C:\WINDOWS\system32\services.exe
Plug-and-Play: PlugPlay
C:\WINDOWS\system32\services.exe
LexBce Server: LexBceS
C:\WINDOWS\system32\LEXBCES.EXE
Assistance TCP/IP NetBIOS: LmHosts
C:\WINDOWS\System32\svchost.exe -k LocalService
Service de découvertes SSDP: SSDPSRV
C:\WINDOWS\System32\svchost.exe -k LocalService
WebClient: WebClient
C:\WINDOWS\System32\svchost.exe -k LocalService
NVIDIA Driver Helper Service: NVSvc
C:\WINDOWS\System32\nvsvc32.exe
Panda Process Protection Service: PavPrSrv
C:\Program Files\Fichiers communs\Panda Software\PavShld\pavprsrv.exe
Panda anti-virus service: PAVSRV
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\Pavsrv51.exe
Emplacement protégé: ProtectedStorage
C:\WINDOWS\system32\lsass.exe
Gestionnaire de comptes de sécurité: SamSs
C:\WINDOWS\system32\lsass.exe
Appel de procédure distante (RPC): RpcSs
C:\WINDOWS\system32\svchost -k rpcss
Spouleur d'impression: Spooler
C:\WINDOWS\system32\spoolsv.exe
Acquisition d'image Windows (WIA): stisvc
C:\WINDOWS\System32\svchost.exe -k imgsvc
TrueVector Internet Monitor: vsmon
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe -service
WMDM PMSP Service: WMDM PMSP Service
C:\WINDOWS\System32\MsPMSPSv.exe
Workstation NetLogon Service: ½O.#ž‚„õØ´â
"C:\WINDOWS\ipyt32.exe" /s
0
Comments
Here is your offending service:
Workstation NetLogon Service: ½O.#ž‚„õØ´â
"C:\WINDOWS\ipyt32.exe" /s
Find that in the services.msc, right click on it, stop it, then right click again, go into properties and disable that. Then follow the guide on from Step 5.
Let us know if that helped you.
Dexter...