nellie2 Posted May 20, 2004 Report Share Posted May 20, 2004 not at all.... mail away Link to comment Share on other sites More sharing options...
madboy33 Posted May 20, 2004 Author Report Share Posted May 20, 2004 erm do you want the hijack log here or in the appropriate section nells? Link to comment Share on other sites More sharing options...
nellie2 Posted May 20, 2004 Report Share Posted May 20, 2004 Here is the start up pic ( you might as well keep it here all in the same thread Madboy... HJT log I mean) Link to comment Share on other sites More sharing options...
madboy33 Posted May 20, 2004 Author Report Share Posted May 20, 2004 Logfile of HijackThis v1.97.7Scan saved at 21:45:58, on 20/05/2004Platform: Windows XP SP2, v.2120 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2120)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Sygate\SPF\smc.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files\Java\j2re1.4.2_04\bin\jusched.exeC:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exeC:\Program Files\Logitech\iTouch\iTouch.exeC:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exeC:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exeC:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exeC:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exeC:\Program Files\Logitech\MouseWare\system\em_exec.exeC:\WINDOWS\System32\cisvc.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exeC:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exeC:\Program Files\Raxco\PerfectDisk\PDSched.exeC:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\system32\msiexec.exeC:\Program Files\Outlook Express\msimn.exeD:\hijackthis\HijackThis.exeC:\WINDOWS\system32\cidaemon.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.blueyonder.co.uk/R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.blueyonder.co.uk/blueyonder/index.jspR3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dllO3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dllO3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exeO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exeO4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exeO4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.ExeO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [NvMixerTray] C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exeO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"O4 - HKLM\..\Run: [smcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startguiO8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTMO8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZSzeb029O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTMO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)O9 - Extra button: ieSpell (HKLM)O9 - Extra 'Tools' menuitem: ieSpell (HKLM)O9 - Extra 'Tools' menuitem: ieSpell Options (HKLM)O9 - Extra button: Messenger (HKLM)O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)O9 - Extra button: Research (HKLM)O9 - Extra button: Messenger (HKLM)O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)O10 - Broken Internet access because of LSP provider 'xfire_lsp.dll' missingO16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CABO16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa...director/sw.cabO16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} (MSSecurityAdvisor Class) - http://download.microsoft.com/download/0/5...b?1081989912328O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe...etup1.0.0.8.cabO16 - DPF: {2CAF9389-62C2-11D7-A914-00A0C96F4D57} (PrjPixelSharp.CtlPixelSharp) - http://www.monitorsdirect.com/pro/pro_tool...lPixelSharp.CABO16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cabO16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/V5co...b?1084954236875O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://housecall.trendmicro-europe.com/housecall/Xscan53.cabO16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - http://transfers.one.microsoft.com/FTM/Tra...ransferCtrl.cabO16 - DPF: {9B17FE0E-51F2-4692-8B32-8EFB805FC0E7} (HPObjectInstaller Class) - http://h30155.www3.hp.com/ediags/gs/instal...edsolutions.cabO16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - http://v4.windowsupdate.microsoft.com/CAB/...7975.4159722222O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78D} (DoomCln Object) - http://www.microsoft.com/security/controls/DoomCln.CABO16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/controls/SassCln.CABO16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://www.blueyonder.co.uk/assets/tool/fi...tivePreQual.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa...ash/swflash.cabO16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab Link to comment Share on other sites More sharing options...
nellie2 Posted May 20, 2004 Report Share Posted May 20, 2004 look what I foundhttp://www.windowsstartup.com/wso/detail.php?id=1217 Link to comment Share on other sites More sharing options...
madboy33 Posted May 20, 2004 Author Report Share Posted May 20, 2004 yeah i have put that in recyle bin anyways and have restarted comp and firstly can not get to upload to here or my FTP server Link to comment Share on other sites More sharing options...
nellie2 Posted May 20, 2004 Report Share Posted May 20, 2004 Well there are a couple of things that could do with fixing but nothing that I can see that would be causing this problem.Just make sure all browsers and windows are closed except for hjt and fix the followingR3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZSzeb029O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe...etup1.0.0.8.cab Link to comment Share on other sites More sharing options...
madboy33 Posted May 20, 2004 Author Report Share Posted May 20, 2004 will do that and report back once i have uploaded some pictures to my website Link to comment Share on other sites More sharing options...
Chris Posted May 20, 2004 Report Share Posted May 20, 2004 The IDW thing...As your running XPSP2 that explains it.p.s remeber its a beta :o maybe your problem is because of this., Link to comment Share on other sites More sharing options...
madboy33 Posted May 20, 2004 Author Report Share Posted May 20, 2004 powerlessi know its a beta, but it has only just started to go wrongi have been using service pack2 for a few months now Link to comment Share on other sites More sharing options...
Guest ellas Posted May 20, 2004 Report Share Posted May 20, 2004 its defo sp2 Link to comment Share on other sites More sharing options...
madboy33 Posted May 20, 2004 Author Report Share Posted May 20, 2004 having to agree with you and powerless here ellasits done it again and i have uninstalled loads of things that could have attributed to itok so its SP2Going for the full format and gonna use SP1 until SP2 has been released as a non beta Link to comment Share on other sites More sharing options...
Chris Posted May 20, 2004 Report Share Posted May 20, 2004 Whoa...Be sure that it's SP2 for such a drastic measure. Link to comment Share on other sites More sharing options...
madboy33 Posted May 20, 2004 Author Report Share Posted May 20, 2004 powerlessi didnt mean a full format, i meant an uninstall of SP2 Link to comment Share on other sites More sharing options...
Chris Posted May 20, 2004 Report Share Posted May 20, 2004 Pheww Link to comment Share on other sites More sharing options...
madboy33 Posted May 20, 2004 Author Report Share Posted May 20, 2004 heres an update guysuninstalled SP2 and have exactly the same problem, those files are being dumped in Trend folderTo be honest i think it is time for a format, well using Drive image Link to comment Share on other sites More sharing options...
bvw Posted May 20, 2004 Report Share Posted May 20, 2004 To save all that extra work why don't you install AVG and just remove PC-Cillin and see what, if anything, happens ? Link to comment Share on other sites More sharing options...
Chris Posted May 21, 2004 Report Share Posted May 21, 2004 or email trend. Link to comment Share on other sites More sharing options...
nellie2 Posted May 21, 2004 Report Share Posted May 21, 2004 Just as a matter of interest if it isn't too late, it would be interesting to have a look at your running processes in Task manager..... don't you think? Link to comment Share on other sites More sharing options...
madboy33 Posted May 21, 2004 Author Report Share Posted May 21, 2004 task manager attachedi hope Link to comment Share on other sites More sharing options...
nellie2 Posted May 21, 2004 Report Share Posted May 21, 2004 have you checked out your exe's? Link to comment Share on other sites More sharing options...
Guest ellas Posted May 21, 2004 Report Share Posted May 21, 2004 have you checked out your exe's?whats his old girlfriends got to do with it :mellow: :P :D Link to comment Share on other sites More sharing options...
madboy33 Posted May 21, 2004 Author Report Share Posted May 21, 2004 all checked okgoing for a formate-mailed Trend and all they said was a load of noob computer talk Link to comment Share on other sites More sharing options...
Guest ellas Posted May 21, 2004 Report Share Posted May 21, 2004 but what then are you gonna reinstall pccillin why not try bvw's idea you have nothing to lose and it could eliminate pccillin. Link to comment Share on other sites More sharing options...
madboy33 Posted May 21, 2004 Author Report Share Posted May 21, 2004 ellastried to uninstall itit now wont let meComputer is locking up all the time now and the only thing for it is a format Link to comment Share on other sites More sharing options...
Recommended Posts