Problems when a network connection is active

[jorgecs]

Hello

I have 3 machines on a network of about 30 running XP pro sp2 that behave oddly when a network connection is active.

MS Office applications take forever to load, when called by oppening a document in the Windows Explorer view. Also, some aplications like Notepad hang when I print, or when I try to configure print settings. The printer selection dialog box doesn't pop-up, the application hangs and the machine desktop takes forever to restore.

In Outlook or Word, if I print from the print button the document gets printed, but if I print from the file menu Print, the applicattion hangs.

This only happens when a network connectio is active. If I unplug the network cable or deactivate the network connection the machine resumes normal operation.

I'm running AdAware, SpySweeper and Viruscan an all systems, but the problem persists even when AdAwre and SpySweeper are removed.

VirusScan is also running on every machine on the network.

[scuzzman]

This does indeed sound malware related. Could you please post a HijackThis log for review?

[jorgecs]

OK, here it is

Logfile of HijackThis v1.99.1

Scan saved at 1:01:15, on 26-04-2005

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\S24EvMon.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programas\Software WIDCOMM\Bluetooth\bin\btwdins.exe

C:\PROGRA~1\Iomega\System32\AppServices.exe

C:\Programas\Network Associates\Common Framework\FrameworkService.exe

C:\Programas\Network Associates\VirusScan\Mcshield.exe

C:\Programas\Network Associates\VirusScan\VsTskMgr.exe

C:\Programas\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\AGRSMMSG.exe

C:\Programas\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Programas\Alcatel\SpeedTouch USB\Dragdiag.exe

C:\Programas\Network Associates\VirusScan\SHSTAT.EXE

C:\Programas\Network Associates\Common Framework\UpdaterUI.exe

C:\Programas\Synaptics\SynTP\SynTPLpr.exe

C:\Programas\Synaptics\SynTP\SynTPEnh.exe

C:\Programas\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

C:\Programas\QuickTime\qttask.exe

C:\Programas\Hewlett-Packard\HP PrecisionScan\PrecisionScan Pro\hplamp.exe

C:\Programas\Nokia\Nokia PC Suite 6\Launch Application 2.exe

C:\PROGRA~1\FTPSER~1\FTPSER~1.EXE

C:\Programas\Ficheiros comuns\Nokia\NCLTools\NclTray.exe

C:\WINDOWS\system32\ZCfgSvc.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programas\Microsoft ActiveSync\WCESCOMM.EXE

C:\Programas\Nokia\Nokia PC Suite 6\PcSync2.exe

C:\Programas\Messenger\msmsgs.exe

C:\PROGRA~1\FICHEI~1\PCSuite\DATALA~1\DATALA~1.EXE

C:\Programas\Software WIDCOMM\Bluetooth\BTTray.exe

C:\Programas\Hewlett-Packard\AiO\hp officejet g series\Bin\hpoavn07.exe

C:\Programas\Nokia\PC Suite for Nokia 7650\connmngmntbox.exe

C:\Programas\Nokia\PC Suite for Nokia 7650\ectaskscheduler.exe

C:\Programas\WinZip\WZQKPICK.EXE

C:\PROGRA~1\FICHEI~1\Nokia\MPAPI\MPAPI3s.exe

C:\PROGRA~1\FICHEI~1\PCSuite\Services\SERVIC~1.EXE

C:\PROGRA~1\Nokia\PCSUIT~2\Elogerr.exe

C:\Programas\Intuwave\Shared\mRouterRunTime\mRouterRuntime.exe

C:\PROGRA~1\SOFTWA~1\BLUETO~1\BTSTAC~1.EXE

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\Nokia\PCSUIT~2\BROADC~1.EXE

C:\PROGRA~1\Nokia\PCSUIT~2\SCRFS.exe

C:\WINDOWS\system32\wuauclt.exe

C:\PROGRA~1\WINZIP\winzip32.exe

C:\Documents and Settings\Eng. Dias da Costa\Definições locais\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hp.pt/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:9090 ftp=localhost:9093 https=localhost:9092

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost; 127.0.0.1

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hiperligações

O1 - Hosts: 172.22.216.10 CibercaR

O1 - Hosts: 200.54.87.10 aurecom

O1 - Hosts: 172.22.217.11 servernt

O1 - Hosts: 172.22.216.11 serversbs

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [Cpqset] C:\Programas\HPQ\Default Settings\cpqset.exe

O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d

O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe

O4 - HKLM\..\Run: [ATIPTA] C:\Programas\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [Nokia Connection Monitor] "C:\Programas\Ficheiros comuns\Nokia\NCLTools\NCLConf.exe"

O4 - HKLM\..\Run: [speedTouch USB Diagnostics] "C:\Programas\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon

O4 - HKLM\..\Run: [shStatEXE] "C:\Programas\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE

O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Programas\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe

O4 - HKLM\..\Run: [synTPLpr] C:\Programas\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Programas\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programas\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programas\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [WheelMouse] C:\WHEELM~1\wh_exec.exe

O4 - HKLM\..\Run: [HP Lamp] "C:\Programas\Hewlett-Packard\HP PrecisionScan\PrecisionScan Pro\hplamp.exe"

O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programas\Nokia\Nokia PC Suite 6\Launch Application 2.exe -onlytray

O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\FICHEI~1\PCSuite\DATALA~1\DATALA~1.EXE

O4 - HKLM\..\Run: [FTP Server] C:\PROGRA~1\FTPSER~1\FTPSER~1.EXE

O4 - HKLM\..\Run: [Nokia Tray Application] C:\Programas\Ficheiros comuns\Nokia\NCLTools\NclTray.exe

O4 - HKLM\..\Run: [iomega Automatic Backup 1.0.1] C:\Programas\Iomega\Iomega Automatic Backup\ibackup.exe

O4 - HKLM\..\Run: [ZCfgSvc.exe] c:\WINDOWS\system32\ZCfgSvc.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programas\Microsoft ActiveSync\WCESCOMM.EXE"

O4 - HKCU\..\Run: [PcSync] C:\Programas\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

O4 - HKCU\..\Run: [MSMSGS] "C:\Programas\Messenger\msmsgs.exe" /background

O4 - Startup: Iomega Product Registration.lnk = C:\Programas\Iomega\Registration\Register.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: BTTray.lnk = ?

O4 - Global Startup: HPAiODevice(hp officejet g series) - 1.lnk = C:\Programas\Hewlett-Packard\AiO\hp officejet g series\Bin\hpoavn07.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Programas\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: PCSuiteForNokia7650 Detect.lnk = ?

O4 - Global Startup: PCSuiteForNokia7650 TS.lnk = ?

O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programas\WinZip\WZQKPICK.EXE

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Enviar para &Bluetooth - C:\Programas\Software WIDCOMM\Bluetooth\btsendto_ie_ctx.htm

O9 - Extra button: Criar favorito móvel - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programas\Microsoft ActiveSync\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programas\Microsoft ActiveSync\INetRepl.dll

O9 - Extra 'Tools' menuitem: Criar favorito móvel... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programas\Microsoft ActiveSync\INetRepl.dll

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programas\Software WIDCOMM\Bluetooth\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programas\Software WIDCOMM\Bluetooth\btsendto_ie.htm

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe

O16 - DPF: {02BED220-FBC7-4392-93A2-3A50B056F78E} - http://down.plaxo.com/down/release/instub.cab

O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSInstall...oducts/vmp.html

O16 - DPF: {08BEF711-06DA-48B2-9534-802ECAA2E4F9} (PlxInstall Class) - http://down.plaxo.com/down/release/PlaxoInstall.cab

O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab

O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur...loadManager.ocx

O17 - HKLM\System\CCS\Services\Tcpip\..\{08F5AF71-A96A-49FE-98A3-6E9235CDC4E9}: NameServer = 62.48.131.10,62.48.131.11

O17 - HKLM\System\CS1\Services\Tcpip\..\{08F5AF71-A96A-49FE-98A3-6E9235CDC4E9}: NameServer = 62.48.131.10,62.48.131.11

O17 - HKLM\System\CS2\Services\Tcpip\..\{08F5AF71-A96A-49FE-98A3-6E9235CDC4E9}: NameServer = 62.48.131.10,62.48.131.11

O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Programas\Software WIDCOMM\Bluetooth\bin\btwdins.exe

O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe

O23 - Service: Serviço McAfee Framework (McAfeeFramework) - Unknown owner - C:\Programas\Network Associates\Common Framework\FrameworkService.exe" /ServiceStart (file missing)

O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Programas\Network Associates\VirusScan\Mcshield.exe

O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Programas\Network Associates\VirusScan\VsTskMgr.exe

O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - c:\Programas\Intel\NCS\Sync\NetSvc.exe

O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\system32\RegSrvc.exe

O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\system32\S24EvMon.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programas\Analog Devices\SoundMAX\SMAgent.exe