I've got a real mess, please help

16 years ago

I really hope someone can help me with this blasted machine.

OK, I find it funny how one day my pc is working fine and the next time I go to start it up it is all jacked up. My 2 main problems are: Internet Explorer is not responding and I cannot access Diskcleaner.

This is what I have noticed so far, it is taking longer for my computer to start up and sometimes after start up the mouse arrow is unable to highlight anything so I have to reboot by holding down the power button. Like I mentioned above I have the 2 main issues, all other programms seem to be working.

When I click on Delete Files in the internet options this is the error I received- An exception has occured while trying to run "C:\Windows\system321Shell32.dll,control_RunDLL"C:\Windows\system32\INETCPL.CPL" If I try and click on Diskcleaner thru tools it just gets the hour glass then that goes away and it's like I never even tried to open Diskcleaner.

When I click on Internet Explore I get a white page and it just sits there with the windows logo waving.

This is what I have done to fix my pc: I have tried

System Restore,chkdsk,iexplore,sfs/scannow & I have tried to clear out some start up programs thru msconfig & of course have run a virus scan with my McAfee. One other thing occured is a got the blue screen one night and it said Repairing a corrupt file and then "Inserting an Index Entry & then it had a bunch of numbers and listed down the page. I thought maybe this bluescreen thing was the pc self correcting itself but it didn't.

I am at a loss and before I spend a few hundred dollars trying to fix it or buying a new pc I was hoping someone here might have some suggestions or know what I can do. I guess my question is, is this a virus or can a pc just decide one day to give me a headache? I would greatly appreciate any help, thank you!!

Sort by:Oldest

Comments (28)

zep516
16 years ago
last modified: 11 years ago
Download hijackthis from link provided follow instructions

Save HJTInstall.exe to your desktop.
Â Doubleclick on the HJTInstall.exe icon on your desktop.
Â By default it will install to C:\Program Files\Trend Micro\HijackThis .
Â Click on Install.
Â It will create a HijackThis icon on the desktop.
Â Once installed, it will launch Hijackthis.
Â Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
Â Click on "Edit > Select All" then click on "Edit > Copy" and Paste the entire contents of the log (no attachments) into your next post.
DO NOT use the AnalyzeThis button, its findings are dangerous if misinterpreted.
DO NOT have Hijackthis fix anything yet. Most of what HJT lists will be harmless or even required by your Operating System.
owbist
16 years ago
last modified: 11 years ago
Have you ran anything like Malwarebytes or Superantispyware to look for Trojans? Is your firewall shut down?

If you are infected you probably cannot download either of those programs on that computer, the infections will prevent you. But if you can get them on another computer using a thumb drive or similar you would be able to install and run probably.

Run the HJT scan as Zep suggests and post the log, there seems little doubt that you have unwanted company there.
Related Discussions
I've purchased a landscaping mess in the woods, help!
Q
Comments (13)
Thanks for the replies so far! I will research the slope stabilization. I don't want to randomly shove plants in the ground back there without a solid plan since they will be more difficult to remove compared to putting bulbs in the ground out front. I will be researching that and probably hiring an expert to advise me on the erosion issues. Drtygrl- I was actually thinking about the hostas last night. I definitely do not want to toss them. I think I'm going to put them in on the north side of the house. They should be happy there in the shade and there's plenty of bare space for them to expand. I do want to find a green filler ground cover for that slope by the driveway, but probably not a big plant like the hostas. I know I posted a ton at once, sorry! I look at the yard and it is overwhelming. I don't want to tackle all of it this year (that would be nearly impossible), but I would like to come up with a 3 year plan for the yard. If I don't have a plan, I fear that I will continue with my impulse to shove colorful plants randomly in the ground w/o a plan & have an even bigger mess on my hands! One more question: how far back can I cut the azaleas? Can I severly trim them without damaging them? I would like to reign in the ones in front of the house after they bloom as they are taking up most of that potential flower bed, and I think at least one needs a big time haircut. I really need to go dig out my horticulture textbook from college to go with the shade books I'm checking out from the library. I wish I had taken more classes like that instead of making it my last class before graduation! Thanks again!
...See More
I've got a mess-cleaning oil out
Q
Comments (5)
After you hae spun the engine several times with the plug out, replace the plug and leave air filter off for the moment. Engine should now crank and run, but plug may foul, meaning you have to clean oil off plug, reinstall and crank again. Once the engine starts, it will smoke like crazy, then clear up, and then begin to smoke again. This is normal. First smoke is oil in the combustion chamber, intake manifold, etc. When it starts smoking a second time, this is oil in the muffler, now hot enough to burn off. May take as much as 15 minutes or more to burn off completely. You make need to use a squirt of gasoline or starting fluid to get engine to light off initially. Use sparingly. Finally, don't forget to replace air filter.
...See More
I've got a yucky mess.
Q
Comments (7)
Natural charcoal type stuff could come from your woodstove, as almost entirely burned wood. Alternatively, it could come from Malaysia or Indonesia. What you are being warned off of is the use of briquettes, which have a binding material that is clay like, and might have petroleum products mixed in. Growing up in Denver, briquettes were all that were available. Maybe that has changed. I do not know if this helps your case, but I use wood ash to keep pH high. It helps alot with the ickiest sour smells.
...See More
What a mess I've created on my PC
Q
Comments (86)
Hello again nice people, I have a question. Since Zep has led me through so many steps and has helped me clean up some of the junk on my computer my question is this. What will the results be if I can find no way to get Java downloaded? Is it absolutely necessary that Java be on the computer for things to work right. I see no results from NOT having it, other than not being to play some games, I play most any game I want without any trouble, most of them very graphic. I still need to delete the Firefox Beta version and keep the right version, but I've got to straightened out the shortcut Icons on my desktop, they're both intertwined. Other than that I don't seem to be having any problems. I don't know if there is something else on the Hijack list that needs to be addressed, Zep didn't say so I assume that there is not. I did get the problem with Incredimail straightened out. That also was a register error. After today I am headed for hopefully a wonderful trip to Yellowstone National Park. I will check on this thread as soon as I get back to see what you think about leaving well enough alone. Thanks again for your time and sharing your knowledge.
...See More
oneslip
Original Author
16 years ago
last modified: 11 years ago
Thank you for your responses. Through my internet research I keep hearing about Hijack this, I appreciate the step by step instructions. Occasionally I have been able to access the web on the pc after my fooling around with settings etc but it doesn't hold. So if I can get the pc on line I can come to this site and click the link. Is there a disk I can buy at a store if I am unable to download anything?

I do not have any of the programs you mentioned owbist but my Mcafee is supposed to have a firewall, the windows firewall is turned off.

I'll play with the pc some more an hopefully I can get on-line and download HJT and post the log. I'm not sure what some hacker is getting out of this, I'd love to find this person.
zep516
16 years ago
last modified: 11 years ago
Boot to safe mode with networking.
zep516
16 years ago
last modified: 11 years ago
1. Restart your computer.
2. When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows Advanced Options menu.
3. Select the option for Safe Mode with networking using the arrow keys.
4. Then press enter on your keyboard to boot into Safe Mode with networking.
5 Download up date and run malwarebytes free version http://www.malwarebytes.org/

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
The log can also be found here: C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt

Copy and Paste the entire report in your next reply.
ravencajun Zone 8b TX
16 years ago
last modified: 11 years ago
I am going to tell you my own experience here it may not be what is happening to you but it might be, I too had McAfee on my pc, I kept having the strangest things suddenly happening to me (like you are) finally one day I decided to fully remove McAfee from my pc using their removal tool and the directions given on their forum. The moment I removed McAfee every one of the errors and weird problems stopped happening and never happened again. I personally will never use it again even though I get it free. So just for giggles you might want to try a full uninstall and see what happens. Totally up to you, but I know of several others that have done the same. If you need those instructions just ask.

I would definitely get and run malwarebytes at the very least. You can download it to a flash drive or cd from any other pc then install it to the pc from there.
susieq07
16 years ago
last modified: 11 years ago
And once rid of McAfee, download AVG9 FREE home edition, and malewarebytes FREE
owbist
16 years ago
last modified: 11 years ago
Your Mcafee has probably been compromised. Do you have a friend or neighbour where you could download Hijackthis and Malwarebytes and either burn to a CD or copy to a thumb or external drive?

How much important data do you have on this machine? If you have everything backed up you might be as well off to return the computer to factory defaults.
genes
16 years ago
last modified: 11 years ago
Actually, if you decide to get rid of McAfee (which I believe would be a great idea) I would download Avast Free rather than AVG. Then, download and install SpywareBlaster, which runs in the background and will keep nasties from initially loading on your PC. Just remember to update it every week or so.
ravencajun Zone 8b TX
16 years ago
last modified: 11 years ago
these are the full directions for Mcafee removal, I used this exact procedure and it went well and have since shared it with others for their removal.

be sure you use the mcafee removal tool after you have removed it from add remove programs or much will be left behind.
First turn off Mcafee at the icon in the systray.
I had to go into msconfig and turn off all mcafee items from startup prior to trying to uninstall, just turning them off did not work it would say the program was still running. So if you run into this when going to add remove programs try this.

I then removed everything using add remove programs, leaving Security center till last. Then used the removal tool, after that I went to Program Files and deleted all mcafee files. Also set Windows explorer to show all hidden files and folders and deleted the mcafee folders. I found these instructions on how to do this on the mcafee forums.
1. Uninstall all mcafee programs through "Add or Remove Programs" in Windows "Control Panel".

2. Use the MCPR tool, see this article: How to remove supported mcafee consumer products using the mcafee Consumer Products removal tool (MCPR.exe). This will remove all mcafee remnants from your computer. (you must have Windows Vista, XP or 2000 SP4 to use this tool)

3. Launch Windows Explorer and delete all mcafee files in "Program Files" but especially in "C:\Document and Settings\\Application Data" and "C:\Document and Settings\All Users\Application Data". You have to set Windows Explorer to show all hidden files and folders (Tools > Folder Options > View tab). Just delete the mcafee folders even if they are empty in all the "Application Data" folders. Can be more than one!
In Vista: C:\Program Files, C:\ProgramData and C:\Users\yourname\AppData\Roaming
Removal tool (MCPR.exe)
http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe
or from here
Removal tool (MCPR.exe)

I also now prefer AVAST and use it on my windows machines along with malwarebytes, superantispyware, spywareblaster all free.
oneslip
Original Author
16 years ago
last modified: 11 years ago
I appreciate all the feedback. I am going to buy a flashdrive this weekend and save some things to my old pc & like you guys said I may have to download some of the software mentioned to the flashdrive and move it to the infected pc. Again, thanks for all your help.
zep516
16 years ago
last modified: 11 years ago
So SafeMode with Networking does not work?
oneslip
Original Author
16 years ago
last modified: 11 years ago
Zep- I was able to use safemode with networking and I signed on as Administrator & downloaded Malwarebytes. I ran the scan and it detected 2 items and I copied the log and the computer restarted. Since I have restarted of course I cannot paste the log. I went into the C drive and found the log but it says that I cannot open it and to search the internet to see which programs open but so far I am stuck. I'll keep playing with it and see if I can get the log posted. Thanks Zep, appreciate your help.
oneslip
Original Author
16 years ago
last modified: 11 years ago
I just ran the scan again & now it's saying there are no infections.

Malwarebytes' Anti-Malware 1.44
Database version: 3697
Windows 5.1.2600 Service Pack 2 (Safe Mode)
Internet Explorer 6.0.2900.2180

2/6/2010 2:08:10 PM
mbam-log-2010-02-06 (14-08-10).txt

Scan type: Full Scan (C:\:D:\:)
Objects scanned: 162017
Time elapsed: 14 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)
oneslip
Original Author
16 years ago
last modified: 11 years ago
Here's my log from HJT, maybe this will have more info.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:17:30 PM, on 2/6/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.toshibadirect.com/dpdstart
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshibadirect.com/dpdstart
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.toshibadirect.com/dpdstart
O2 - BHO: EarthLink BHO Guard - (00000000-0000-0000-0000-000000000002) - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: AcroIEHlprObj Class - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: EarthLink ScamBlocker V3 - (15F4D456-5BAA-4076-8486-EECB38CD3E57) - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: EarthLink PopUp Blocker V2 - (512ACF1B-64D9-4928-B382-A80556F28DB4) - C:\Program Files\EarthLink TotalAccess\Toolbar\ElnkPuB.dll
O2 - BHO: SSVHelper Class - (761497BB-D6F0-462C-B6EB-D4DAF1D92D43) - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: scriptproxy - (7DB2D5A0-7241-4E79-B68D-6309F01C5231) - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Earthlink Protection BHO - (9579D574-D4D8-4335-9560-FE8641A013BD) - C:\Program Files\EarthLink TotalAccess\Toolbar\ProtctIE.dll
O2 - BHO: Google Toolbar Helper - (AA58ED58-01DD-4d91-8333-CF10577473F7) - c:\program files\google\googletoolbar1.dll
O2 - BHO: McAfee SiteAdvisor BHO - (B164E929-A1B6-4A06-B104-2CD0E90A88FF) - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Uninstall Legacy Earthlink Toolbar - (E713904C-DF05-4C79-BBAD-02DB923253BE) - C:\Program Files\EarthLink TotalAccess\Toolbar\uninsttb.dll
O3 - Toolbar: &Google - (2318C2B1-4965-11d4-9B18-009027A5CD4F) - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: EarthLink Toolbar - (C7768536-96F8-4001-B1A2-90EE21279187) - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - (0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064) - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [DDWMon] C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - (92780B25-18CC-41C8-B9BE-3C9C571A8263) - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - (CD67F990-D8E9-11d2-98FE-00C0F0318AFE) - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
O16 - DPF: (6E32070A-766D-4EE6-879C-DC1FA91D2FC3) (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1160611558312
O17 - HKLM\System\CCS\Services\Tcpip\..\(88BC058B-D4FC-459F-BA20-5829B8D57FD1): NameServer = 207.69.188.171,207.69.188.172
O18 - Protocol: dssrequest - (5513F07E-936B-4E52-9B00-067394E91CC5) - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: sacore - (5513F07E-936B-4E52-9B00-067394E91CC5) - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: EarthLinkSafeConnectAgent - Unknown owner - C:\Program Files\EarthLink\EarthLink Protection Control Center\Sana\Bin\SanaAgent.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\WINDOWS\system32\TODDSrv.exe

--
End of file - 9238 bytes
ravencajun Zone 8b TX
16 years ago
last modified: 11 years ago
try opening your malwarebytes program and there should be a tab labeled logs you should find your logs there which can be copied and pasted here.
oneslip
Original Author
16 years ago
last modified: 11 years ago
OK, here is the Malware log showing the issues.
Malwarebytes' Anti-Malware 1.44
Database version: 3697
Windows 5.1.2600 Service Pack 2 (Safe Mode)
Internet Explorer 6.0.2900.2180

2/6/2010 1:25:19 PM
mbam-log-2010-02-06 (13-25-19).txt

Scan type: Full Scan (C:\:D:\:)
Objects scanned: 161757
Time elapsed: 15 minute(s), 20 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
oneslip
Original Author
16 years ago
last modified: 11 years ago
The internet explorer will not work with my user in safe mode with networking but it will work if I use the admin user. If I just reinstall my start up windows XP disk and wipe everything off will that rid this virus or correct my pc so it works normal again? This just seems pretty screwed up to me.
zep516
16 years ago
last modified: 11 years ago
I don't see any Malware / virus. But we are only looking at a hijackthis log from Safe Mode, and Malwarebytes only ran for 14 Mins?

I see an out of date computer.
adobe 7!
Java 1.5!
IE6!
Then McAfee is that up to date?

For starters I would go into your add/remove programs list and remove Adobe. We can get you another reader later.

Then remove all versions of Java from the add / remove programs. The only version there should be Version 6 u_18. Remove all others.

Then install IE7, http://www.microsoft.com/downloads/details.aspx?FamilyId=9AE91EBE-3385-447C-8A30-081805B2F90B&displaylang=en

You said yourself your getting Internet Explorer is not responding errors

Then I would download Avast 5.0, to the desktop, don't install it yet.
http://www.avast.com/free-antivirus-download

Now I would run the McAfee removal tool,

http://service.mcafee.com/FAQDocument.aspx?id=TS100507

When that finishes double click the Avast that you downloaded before and install it AND SCAN WITH IT TOO.

After we can remove some 04 entries in hijackthis log. Unnecessary Start ups.

Up date Java , Get a reader program for pdf files.

Run some cleaners, ccleaner ect.

Good luck you have a lot to do. Don't surf The Internet in Safe Mode no Virus protection in that mode....Just go to links provided and get Avast installed after McAfee is removed.
mikie_gw
16 years ago
last modified: 11 years ago
Probably should not update IE until the old one is working correctly as the new ie will clone all the old setup/configurations.
zep516
16 years ago
last modified: 11 years ago
Maybe your right. The only thing I know to do is set IE6 back to default settings. Or repair IE 6. To try and fix the "IE is not responding error"

So you could Google "SET IE 6 to default settings" try that first and see if it helps the IE is not responding error.

I'm Afraid to Google That error HA HA, "IE6 is not responding" a Million possibilities.
oneslip
Original Author
16 years ago
last modified: 11 years ago
I appreciate all the help. The reason I have Ie6 is because when I had Ie7 none of my sound would work, iTunes & Vids so I went back to Ie6.

I have my stuff I want to keep on a flash drive. How beneficial would it be for me to just use my recovery disk? Will that wipe out everything and then I can just start over or will what ever is on my pc still be there?
mikie_gw
16 years ago
last modified: 11 years ago
If I have recovery disk(s) thats great.
Of course any documnets/pictures/personal stuff plus optional installed programs will be erased. So I'd save a bunch of stuff to cd/dvd/thumb drives. Let the recovery disks reformat if they have that option.

First thing then I might do after that is install a virus program.. my preference is Microsofts new Security Essentials - If that will work with your windows version?

Go straight to my windows version page or windows downloads and install the latests service packs before turning on any windows auto updates. That way you wont install updates forever, only to duplicate them with a service pack .... Then leave it online for a couple days with windows auto updates fully enabled to bring it fully uptodate. IE8 is great and fast for me. Plus it will work on microsoft site and my banks, and with network cams ...where I have to jump thru hoops to get firefox to work them and banking sites.. etc,,, pita browser if you like active x and are used to IE configurations.
zep516
16 years ago
last modified: 11 years ago
I couldn't agree more. Use the recovery disks.
ravencajun Zone 8b TX
16 years ago
last modified: 11 years ago
if you choose to do that do NOT put McAfee back on it is my recommendation, try AVAST free or one of the other good free AV programs, install malwarebytes and superantispyware and spywareblaster for your layered protection.
you may need a firewall also we can recommend one.
exgm
16 years ago
last modified: 11 years ago
I would definitely build the system up from scratch if you have the recovery media. I used to troubleshoot this stuff but now have it down to "you get an hour of my time, not including scan times" and if not resolved, it's load the o/s up from scratch. You will end up with a far better end result. If you can back up your data, do so and be careful about what you save, because obviously a payload can travel with files, not to mention be imparted to the backup media simply by using it. Ravencajun's advice about avast is spot-on! Finally, ensure your o/s gets all the necessary Win updates.
kudzu9
16 years ago
last modified: 11 years ago
Just so this is clear: anything you save off your computer to put back on it after you use the recovery discs will need to be scanned with an anti-virus program before they go back on the computer. Otherwise you may just be reinstalling an infection if it happens to be buried in one of those files.
oneslip
Original Author
16 years ago
last modified: 11 years ago
Just wanted to say thanks to everyone that helped me with this situation. I have used my recover disk and have been putting things back together & so far so good everything is working. What a pain but better then spending some bucks. Well, time to go watch some football. Thanks again, have a great weekend.

I've got a real mess, please help

Comments (28)

zep516

owbist

Related Discussions

oneslip
Original Author

zep516

zep516

ravencajun Zone 8b TX

susieq07

owbist

genes

ravencajun Zone 8b TX

oneslip
Original Author

zep516

oneslip
Original Author

oneslip
Original Author

oneslip
Original Author

ravencajun Zone 8b TX

oneslip
Original Author

oneslip
Original Author

zep516

mikie_gw

zep516

oneslip
Original Author

mikie_gw

zep516

ravencajun Zone 8b TX

exgm

kudzu9

oneslip
Original Author

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

I've got a real mess, please help

Comments (28)

Related Discussions

oneslipOriginal Author

oneslipOriginal Author

oneslipOriginal Author

oneslipOriginal Author

oneslipOriginal Author

oneslipOriginal Author

oneslipOriginal Author

oneslipOriginal Author

oneslipOriginal Author

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

oneslip
Original Author

oneslip
Original Author

oneslip
Original Author

oneslip
Original Author

oneslip
Original Author

oneslip
Original Author

oneslip
Original Author

oneslip
Original Author

oneslip
Original Author