Forum     

Go Back   Digit Technology Discussion Forum > Portables, Peripherals and Electronics > QnA (read only)
a weird problem.... a weird problem....
Register FAQ Calendar Mark Forums Read

QnA (read only) Mods please help transfer the contents of this forum to proper sections. :)


 
 
LinkBack Thread Tools Search this Thread Display Modes
Old 01-06-2005, 04:13 PM   #1 (permalink)
Apprentice
 
Join Date: Sep 2004
Location: Chandigarh
Posts: 90
Default a weird problem....

hi...my system is facing a new problem...

when i goto run and type either regedit or msconfig....the respective window come but only for one microsecond...i mean if i type regedit in run and click on...registry editor will come up...but will exist after a fraction of second...

help me please

thanx
hearthacker is offline  
Advertisements. Register and be a member of the community to get rid of them.
Advertisement

Old 01-06-2005, 04:34 PM   #2 (permalink)
Right Off the Assembly Line
 
Join Date: May 2005
Posts: 48
Default
try opening it from DOS prompt
c:\windows\regedit.exe where c:\windows is your OS dir.


see event viewer if there is any error reported.
amit_arya is offline  
Old 01-06-2005, 08:45 PM   #3 (permalink)
Human Spambot
 
swatkat's Avatar
 
Join Date: Mar 2004
Location: India
Posts: 2,033
Default
It's a virus. Download HijackThis and unzip it to dedicated folder (like C:\HJT\hijackthis.exe).
Then run it and click the button Do a System scan and save log file. HijackThis will perform a scan and saves the log file as hijackthis.log. Copy the entire contents of the file and post it here.
__________________
http://swatrant.blogspot.com/
swatkat is offline  
Old 01-06-2005, 09:51 PM   #4 (permalink)
Davislav Ivanuiz!!!
 
Kl@w-24's Avatar
 
Join Date: Apr 2004
Location: Pune
Posts: 1,396
Default
Yup, it's a virus. It happened to me too. I cudn't even run AVG antivirus!!! Paste ur HijackThis log file, as suggested by swatkat.
__________________
I was here when the forum's swear filter kept bleeping out the word 'FUNK'. :crazy::censored::eeksign:

www.abhi247.com | The Photohblog A Little Lunacy! [v3]

Flickr!
Kl@w-24 is offline  
Old 01-06-2005, 10:58 PM   #5 (permalink)
Apprentice
 
Join Date: Sep 2004
Location: Chandigarh
Posts: 90
Default my hijack lgofile
Logfile of HijackThis v1.99.1
Scan saved at 10:55:30 PM, on 6/1/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\userinit.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\WINDOWS\System32\nvsvc32.exe
D:\WINDOWS\System32\RUNDLL32.EXE
D:\WINDOWS\System32\ctfmon.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Virtual CD v4\System\vcdsecs.exe
E:\Softwares\HijackThis.exe
D:\WINDOWS\System32\imapi.exe

R3 - Default URLSearchHook is missing
O1 - Hosts: 203.197.24.163 www.citibank.co.in
O1 - Hosts: 210.210.19.82 www.sifymall.com
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVCLOCK] Rundll32 nvclock.dll,fnNvclock
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINDOWS\System32\msjava.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - D:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - D:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/sh...3/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/sh...20/mcgdmgr.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D62201D9-58A1-4012-B058-906CAD26838A}: NameServer = 210.210.69.72,202.144.13.50
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe
O23 - Service: VCDSecS - H+H Software GmbH - D:\Program Files\Virtual CD v4\System\vcdsecs.exe
hearthacker is offline  
Old 01-06-2005, 11:29 PM   #6 (permalink)
Human Spambot
 
swatkat's Avatar
 
Join Date: Mar 2004
Location: India
Posts: 2,033
Default Re: my hijack lgofile
Download McAfee Stinger.
Boot in SAFE mode, run HijackThis, click "Do only a system scan" and put a checkmark against these entries:-

R3 - Default URLSearchHook is missing
O1 - Hosts: 203.197.24.163 www.citibank.co.in
O1 - Hosts: 210.210.19.82 www.sifymall.com
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)

Close all other open programs and click "Fix Checked" in HijackThis.

Run McAfee Stinger, click "Add" and here type the Hard Disk partitions manually (for example, C:\) and click OK. Repeat this step so that all the partitions are added. Then click "Scan Now".

Restart to Normal mode, post a new HijackThis log. Also, post whether Stinger found anything and Task manager/ Regedit are working or not.
__________________
http://swatrant.blogspot.com/
swatkat is offline  
Old 02-06-2005, 11:47 AM   #7 (permalink)
Apprentice
 
Join Date: Sep 2004
Location: Chandigarh
Posts: 90
Default new hijackthis log
Logfile of HijackThis v1.99.1
Scan saved at 11:41:45 AM, on 6/2/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\WINDOWS\System32\nvsvc32.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\RUNDLL32.EXE
D:\WINDOWS\System32\ctfmon.exe
D:\Program Files\Ares Lite Edition\Ares.exe
D:\Program Files\Virtual CD v4\System\vcdsecs.exe
D:\Program Files\Ahead\Nero\nero.exe
D:\WINDOWS\System32\ping.exe
E:\Softwares\HijackThis.exe
D:\WINDOWS\System32\imapi.exe

R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVCLOCK] Rundll32 nvclock.dll,fnNvclock
O4 - HKLM\..\Run: [MSConfig] D:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunServices: [HP Compaq Service Drivers] Hpmsnt32.exe
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [ares] "D:\Program Files\Ares Lite Edition\Ares.exe" -h
O4 - HKCU\..\RunServices: [HP Compaq Service Drivers] Hpmsnt32.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Download with &DAP - D:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - D:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINDOWS\System32\msjava.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - D:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - D:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/sh...3/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1117647329484
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/sh...20/mcgdmgr.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D62201D9-58A1-4012-B058-906CAD26838A}: NameServer = 210.210.69.72,202.144.13.50
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe
O23 - Service: VCDSecS - H+H Software GmbH - D:\Program Files\Virtual CD v4\System\vcdsecs.exe

************************************************** ********

And STINGER did not find anything in a system scan.

and now same is happening with hijackthis....i start it and it dissapears...and one more thing...I dont have anything of HP on my system...but eevrytime a file known as "hpmsnt32.exe" (HP Compaq service drivers" starts up wid my system even if i delete all the entries from registry and the file itself frmo system32 folder...
hearthacker is offline  
Old 02-06-2005, 02:16 PM   #8 (permalink)
Another Brick in the Wall
 
drgrudge's Avatar
 
Join Date: Jul 2004
Location: Dubai/Chennai
Posts: 3,027
Default
Quote:
O4 - HKCU\..\Run: [ares] "D:\Program Files\Ares Lite Edition\Ares.exe" -h
U are running Ares at startup, which is not necesary as it's system resource hungry and when u connect to internet it will connect automatically and upload stuffs and also download in case u have not finished any downaloads without ur knowledge. So u end up wasting ur BW and system resource.

Why is all the entry marked by swat showing up agian?
__________________
I Love Photography. I Love Aperture. I Love Mac.
drgrudge is offline  
Old 02-06-2005, 03:38 PM   #9 (permalink)
Human Spambot
 
swatkat's Avatar
 
Join Date: Mar 2004
Location: India
Posts: 2,033
Default Re: new hijackthis log
Can you run HijackThis in SAFE mode? If yes, follow the below steps:-
Run HijackThis, click "Do only a system scan", and select these entries:-

R3 - Default URLSearchHook is missing
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\RunServices: [HP Compaq Service Drivers] Hpmsnt32.exe
O4 - HKCU\..\RunServices: [HP Compaq Service Drivers] Hpmsnt32.exe

Then click "Fix Checked" in HijackThis.
After this, delete this file:-
Hpmsnt32.exe

Reboot and post a new log.

If you can run HijackThis in SAFE mode also, then open NotePad, and copy the contents of the below "Code" box into NotePad:-
Code:
regedit /e test1.txt "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" 
regedit /e test2.txt "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce" 
regedit /e test3.txt "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices" 
regedit /e test4.txt "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices" 
regedit /e test5.txt "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce" 
regedit /e test6.txt "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run"
regedit /e test7.txt "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects"

copy test1.txt + test2.txt + test3.txt + test4.txt + test5.txt + test6.txt + test7.txt = info.txt

del test1.txt
del test2.txt
del test3.txt
del test4.txt
del test5.txt
del test6.txt
del test7.txt
Go to File Menu> Save As and type the filename as Run.bat and save the file. Exit from NotePad.
Double-Click on the Run.bat file, a small DOS window appears, and after few seconds close it. There will be a text file named Info.txt in the same location where the Run.bat file is present, open the Info.txt file and copy it's contents and psot it here.
__________________
http://swatrant.blogspot.com/
swatkat is offline  
Old 03-06-2005, 10:19 AM   #10 (permalink)
Apprentice
 
Join Date: Sep 2004
Location: Chandigarh
Posts: 90
Default run.bat and hijackthis
RUN.BAT RESULT
-----------------------------------------------------------
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run]
"NvCplDaemon"="RUNDLL32.EXE D:\\WINDOWS\\System32\\NvCpl.dll,NvStartup"
"NvMediaCenter"="RUNDLL32.EXE D:\\WINDOWS\\System32\\NvMcTray.dll,NvTaskbarInit"
"NVCLOCK"="Rundll32 nvclock.dll,fnNvclock"
"HP Compaq Service Drivers"="Hpmsnt32.exe"
"Internet Services"="interserv.exe"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run\OptionalComponents\IMAIL]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run\OptionalComponents\MAPI]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run\OptionalComponents\MSFS]

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\RunOnce]

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\RunServices]
"Internet Services"="interserv.exe"

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\RunServices]
"Internet Services"="interserv.exe"

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run]
"ctfmon.exe"="D:\\WINDOWS\\System32\\ctfmon.ex e"
"ares"="\"D:\\Program Files\\Ares Lite Edition\\Ares.exe\" -h"
"Yahoo! Pager"="D:\\Program Files\\Yahoo!\\Messenger\\ypager.exe -quiet"
"HP Compaq Service Drivers"="Hpmsnt32.exe"
"Internet Services"="interserv.exe"

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\explorer\Browser Helper Objects]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]

----------------------------------------------------------------------

NEW HIJACK THIS LOG

***********************************************
Logfile of HijackThis v1.99.1
Scan saved at 10:10:29 AM, on 6/3/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\userinit.exe
D:\WINDOWS\Explorer.EXE
E:\Softwares\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVCLOCK] Rundll32 nvclock.dll,fnNvclock
O4 - HKLM\..\Run: [HP Compaq Service Drivers] Hpmsnt32.exe
O4 - HKLM\..\Run: [Internet Services] interserv.exe
O4 - HKLM\..\RunServices: [Internet Services] interserv.exe
O4 - HKLM\..\RunServices: [HP Compaq Service Drivers] Hpmsnt32.exe
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [ares] "D:\Program Files\Ares Lite Edition\Ares.exe" -h
O4 - HKCU\..\Run: [Yahoo! Pager] D:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [HP Compaq Service Drivers] Hpmsnt32.exe
O4 - HKCU\..\Run: [Internet Services] interserv.exe
O4 - HKCU\..\RunServices: [Internet Services] interserv.exe
O4 - HKCU\..\RunServices: [HP Compaq Service Drivers] Hpmsnt32.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Download with &DAP - D:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - D:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINDOWS\System32\msjava.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - D:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - D:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/sh...3/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1117647329484
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/sh...20/mcgdmgr.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D62201D9-58A1-4012-B058-906CAD26838A}: NameServer = 210.210.69.72,202.144.13.50
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - D:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe
O23 - Service: VCDSecS - H+H Software GmbH - D:\Program Files\Virtual CD v4\System\vcdsecs.exe

**************************************************
hearthacker is offline  
Old 03-06-2005, 07:36 PM   #11 (permalink)
Apprentice
 
Join Date: Sep 2004
Location: Chandigarh
Posts: 90
Default BUMP
***BUMP***
hearthacker is offline  
Old 03-06-2005, 08:04 PM   #12 (permalink)
Human Spambot
 
swatkat's Avatar
 
Join Date: Mar 2004
Location: India
Posts: 2,033
Default Re: run.bat and hijackthis
Right-click on the empty part of the Desktop and choose "New" > "Text Document" to open NotePad. Copy the contents of the below "Code" box, and paste it in NotePad:-
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"HP Compaq Service Drivers"=-
"Internet Services"=-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
"Internet Services"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices]
"Internet Services"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"HP Compaq Service Drivers"=-
"Internet Services"=-
Go to File Menu> Save As and type the filename as Fix.reg and save it. Exit from NotePad.
Boot in SAFE mode. Run HijackThis and click "Do only a system scan", and select these entries:-

O4 - HKLM\..\Run: [HP Compaq Service Drivers] Hpmsnt32.exe
O4 - HKLM\..\Run: [Internet Services] interserv.exe
O4 - HKLM\..\RunServices: [Internet Services] interserv.exe
O4 - HKLM\..\RunServices: [HP Compaq Service Drivers] Hpmsnt32.exe
O4 - HKCU\..\Run: [HP Compaq Service Drivers] Hpmsnt32.exe
O4 - HKCU\..\Run: [Internet Services] interserv.exe
O4 - HKCU\..\RunServices: [Internet Services] interserv.exe
O4 - HKCU\..\RunServices: [HP Compaq Service Drivers] Hpmsnt32.exe

Click "Fix Checked" in HijackThis.

Delete these files:-
interserv.exe
Hpmsnt32.exe

Double-click on the Fix.reg file, and choose "Yes" to merge it with Registry.

Restart to Normal Mode, and post a new HijackThis log.
__________________
http://swatrant.blogspot.com/
swatkat is offline  
 

Bookmarks

« Previous Thread | Next Thread »
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes
Linear Mode Linear Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On

 
Latest Threads
Must Watch Movies Recommended By Digitians
- by ~Phenom~
Kingdom of Amalur: Reckoning discussion
- by vamsi_krishna
Your Gaming Backlog/Progress Report!
- by Ethan_Hunt
The LG Optimus One Thread
- by noobdroid
Poor Jokes Thread
- by rezurect007
Letsbuy.com now integrated with Flipkart.com
- by Terabyte
Battlefield 3 Multiplayer Discussion
- by Charan
Battlefield 3 discussion!
- by cyborg47
How to disable Airtel Missed Call Alerts
- by Charan
Diablo III Discussion
- by Gaurav Bhattacharjee

Advertisement




All times are GMT +5.5. The time now is 03:35 AM.

Contact Us - Thinkdigit.com - Archive - Top

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2012, vBulletin Solutions, Inc.

Search Engine Optimization by vBSEO 3.3.2