Forum     

Go Back   Digit Technology Discussion Forum > Portables, Peripherals and Electronics > QnA (read only)
Help Me Out Guyzzzz!!!!! Help Me Out Guyzzzz!!!!!
Register FAQ Calendar Mark Forums Read

QnA (read only) Mods please help transfer the contents of this forum to proper sections. :)


 
 
LinkBack Thread Tools Search this Thread Display Modes
Old 19-04-2005, 05:23 PM   #1 (permalink)
In The Zone
 
chinmay's Avatar
 
Join Date: Apr 2005
Location: Pune
Posts: 243
Default Help Me Out Guyzzzz!!!!!

Hey Guyz i m havin many problem with my comp which is really pissin me off....
1. As soon as i upgraded to win xp sp2 all my previous updates which r displayed as win xp hotfix in add remove programs in control panel on the comp were removed...is it normal?

2. Just after upgrading to win xp sp 2 my mouse is not behavin properly...it stops workin for a second or two(music playin in WMP also doesnt play when mouse stops)...i think my ati radeon 9200 can be culprit...is it possible?

3. a program called wp.exe came on my c: which put a blue screen error wallpaper...now when i right clickon desktop and go to display properties..."Desktop" and "apperance" tab is not diplayed at all....i found out the wallpaper was wp.bmp on c: tself....the file wp.exe was not deletin bcuz it was runnin in background but then i deleted it after exitin it from ctrl-alt-del....if it is a trojan it is a very rare one bcuz i cudnt find much on google about it nor did my Spybot s&d and norton av 2005 cud detect it(both fully updated)...

Guyz please help me out atlst for da third problem bcuz its a real pain in da back
__________________
I Blog at - http://www.chinmayspeaks.com
chinmay is offline  
Advertisements. Register and be a member of the community to get rid of them.
Advertisement

Old 19-04-2005, 06:51 PM   #2 (permalink)
Human Spambot
 
Join Date: May 2004
Location: off to "never ever" land
Posts: 2,912
Default
sounds like a trojan or something for sure
unless u have a wallpaper changin program installed
but its unlikely to be in ur root drive
anywho post ur hijack this log file here
we'll see what we can do

sp2 includes previous updates . so yeah its normal
all those will be under sp2 now

dun think ur radeon is at fault tho
if its an optical mouse there are issues with sp2 .. very rare tho !
__________________
No Mercy, No Limits.
Oobertech.net - Keeping Knowledge Free
theraven is offline  
Old 19-04-2005, 07:38 PM   #3 (permalink)
Human Spambot
 
swatkat's Avatar
 
Join Date: Mar 2004
Location: India
Posts: 2,033
Default
It is a Trojan. Did your AntiVirus picked up anything? Download TrojanHunter and do a Full scan. Then post the HijackThis log file.

Also, search your System for these files, and post back if any of them are found:-
Maria.doc .exe (there is a SPACE after doc)
MACROSOFTBT.EXE

Also, Open Autoexec.bat file in NotePad and post it's contents.

Then do this, Go to Start> Run and type regedit and press ENTER. Here navigate to this key (by click the "+" icon infront of the keys)

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run

and then go to to File Menu, and click "Export". Here type a filename as RunBkUp and in the "Export Range" option box, click "Selected Branch" and click "Ok".
Next, open NotePad and from File> Open, open the file RunBkUp.reg and then copy it's content and post it here.
__________________
http://swatrant.blogspot.com/
swatkat is offline  
Old 19-04-2005, 08:05 PM   #4 (permalink)
Alpha Geek
 
Join Date: Mar 2005
Posts: 517
Default hello
Well for your second problem , there might be a problem with your Modem or Lan card(if you have that). Try removing it and then running your PC to see if it works Fine or not. I once faced a similar problem and it turned out to be my LAN card.
mako_123 is offline  
Old 20-04-2005, 05:24 PM   #5 (permalink)
In The Zone
 
chinmay's Avatar
 
Join Date: Apr 2005
Location: Pune
Posts: 243
Default
hey mako...thnx a load for that suggestion...that irritating problem is no more...i had 2 lan cards in my pc out of which 1 was faulty...i jus disabled the faulty 1 n its workin fine...
__________________
I Blog at - http://www.chinmayspeaks.com
chinmay is offline  
Old 20-04-2005, 05:44 PM   #6 (permalink)
In The Zone
 
chinmay's Avatar
 
Join Date: Apr 2005
Location: Pune
Posts: 243
Default
hey theravan..although my mouse stoppin prblm is no more i see my mouse(optical) pointer movin slow at times n all....so cn u lemme know more about da issues of mouse with sp2...n guyz isnt it strange that i hv adawre...spybot..norton av...mcafee firewall...windws spyware remover...on my comp fully updated but still whenever i go to net a pop up from ZAdpower pops out with add.....n i still havent found solution to the third problem...dude trojan hunter showed one entry(in mcafee firewall which ws a cracked version downloaded from p2p)....but even after removin it the prob is still there
__________________
I Blog at - http://www.chinmayspeaks.com
chinmay is offline  
Old 20-04-2005, 05:57 PM   #7 (permalink)
In The Zone
 
Join Date: Sep 2004
Location: Kolkata
Posts: 324
Default
as of mouse its faulty
if it is under warranty replace it and if it is not then through it out of the window and get a new on e

and ur 3rd question please post ur highjack log 8)
__________________
Happy Computing :lol:
krishnathelord is offline  
Old 20-04-2005, 07:33 PM   #8 (permalink)
Alpha Geek
 
vysakh's Avatar
 
Join Date: Sep 2004
Location: Old trafford
Posts: 860
Default
if your mouse is moving real slow, y dont you increase its speed from control panel
__________________
Incompatible message format
vysakh is offline  
Old 21-04-2005, 12:04 PM   #9 (permalink)
In The Zone
 
chinmay's Avatar
 
Join Date: Apr 2005
Location: Pune
Posts: 243
Default
ofcourse i hv increased the speed....but actually the prblem was very simple and interesting one...actually i have an optical mouse and my mouse pad is little curved shaped(i folded it once)..so at hte area in which pad was not in contact with the mouse it moved real slow and other places it moved fast....its workin fine now...btw what is this hijack log???
__________________
I Blog at - http://www.chinmayspeaks.com
chinmay is offline  
Old 21-04-2005, 12:16 PM   #10 (permalink)
In The Zone
 
Join Date: Sep 2004
Location: Kolkata
Posts: 324
Default
highjack log is a log created by a programe called highjack

search or location in google.
the are pro like swatkat whould help u out
__________________
Happy Computing :lol:
krishnathelord is offline  
Old 21-04-2005, 12:23 PM   #11 (permalink)
A Year Closer To Heaven
 
ctrl_alt_del's Avatar
 
Join Date: Feb 2005
Location: Bangalore
Posts: 1,370
Default
Actually its HijackThis. download.com has to say this about it:
Quote:
If persistent spyware is bogging down your computer, you might need HijackThis. The tiny program examines vulnerable or suspect parts of your system, such as browser helper objects and certain types of Registry keys. Pressing the Scan button generates a log of dozens of items, most of which are just customizations. Don't check off an item and hit the Fix checked button unless you're sure it's malware. Clicking Info on selected item tells you why the entry was flagged as suspicious, but not whether it's actually malware. To find that out, search the Web for that item's name or go straight to a forum, such as SpywareInfo or Computer Cops. Saving the log creates a text document you can post to these forums.

The latest version adds powerful tools to the Config window. The process manager and hosts file editor help you excise virulent infections. The unique ADS Spy tool scans for alternate data streams, which some browser hijackers use to hide from spyware removers. The program still installs into whatever directory in which you unzip the file, which can make it hard to locate. HijackThis is a serious tool for any user who needs to root out a serious infestation, but wield it with caution.
Download it here:
http://www.download.com/HijackThis/3...ml?tag=lst-0-1
__________________
The ANGRY Pixel proudly announces the launch of India's first ever launch center for a game, The ANGRY Pixel - Milestone Interactive Street Fighter 4 Launch Center
ctrl_alt_del is offline  
Old 21-04-2005, 05:16 PM   #12 (permalink)
In The Zone
 
chinmay's Avatar
 
Join Date: Apr 2005
Location: Pune
Posts: 243
Default
well guyz...igot it...here is my hijack this log file:-

Logfile of HijackThis v1.99.1
Scan saved at 5:12:41 PM, on 4/21/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TagScanner\Tagscan.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\eLitecore\Cyberoam Client for 24Online\CyberoamClient.exe
C:\Program Files\DAP\DAP.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Chinmay Dhandhania\Local Settings\Temp\HijackThis.exe

R3 - URLSearchHook: (no name) - {C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: CIEObject Object - {5D647E9C-6B37-4636-9A78-DADB1EB93BDF} - C:\WINDOWS\System32\CtxPopup.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [InteliSys] C:\WINDOWS\smss.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [AdUpdater] C:\WINDOWS\sysupudt.exe
O4 - HKLM\..\Run: [AdPopup] C:\WINDOWS\dcf5678.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [WindowsFY] c:\wp.exe
O4 - Global Startup: 24Online Client.lnk = C:\Program Files\eLitecore\Cyberoam Client for 24Online\CyberoamClient.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Microsoft AntiSpyware helper - {26F2505D-276A-4D13-8C36-2F08B03C344C} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {26F2505D-276A-4D13-8C36-2F08B03C344C} - (no file) (HKCU)
O15 - Trusted Zone: *.boxsearch.net
O15 - Trusted Zone: *.brdatahost.com
O16 - DPF: {11120607-1001-1111-1000-110199901123} - ms-its:mhtml:file://c:default.mht!http://www.globolook.com/v179/dropper.chm::/dropper.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1113539920593
O16 - DPF: {D8A8A7F1-53EF-41F2-B44D-F3E2E595DC27} - ms-its:mhtml:file://C:\MAIN.MHT!http://69.50.163.254/331//main.chm::/update.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{3195A4B6-AD01-4E02-BF97-3686A3864529}: NameServer = 202.56.215.6,202.56.230.6
O17 - HKLM\System\CS1\Services\Tcpip\..\{3195A4B6-AD01-4E02-BF97-3686A3864529}: NameServer = 202.56.215.6,202.56.230.6
O17 - HKLM\System\CS2\Services\Tcpip\..\{3195A4B6-AD01-4E02-BF97-3686A3864529}: NameServer = 202.56.215.6,202.56.230.6
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
__________________
I Blog at - http://www.chinmayspeaks.com
chinmay is offline  
Old 21-04-2005, 05:20 PM   #13 (permalink)
In The Zone
 
chinmay's Avatar
 
Join Date: Apr 2005
Location: Pune
Posts: 243
Default
Hey swatkat...here is the RunBkUp.reg file...now plz tell me whats the problem...

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"SoundMan"="SOUNDMAN.EXE"
"InteliSys"="C:\\WINDOWS\\smss.exe"
"iTunesHelper"="C:\\Program Files\\iTunes\\iTunesHelper.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe"
"AdUpdater"="C:\\WINDOWS\\sysupudt.exe"
"AdPopup"="C:\\WINDOWS\\dcf5678.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"

BTW i cudnt find autoexec.bat...where is it??
__________________
I Blog at - http://www.chinmayspeaks.com
chinmay is offline  
Old 21-04-2005, 05:26 PM   #14 (permalink)
why need title?
 
bharathbala2003's Avatar
 
Join Date: Feb 2005
Location: CONFUSED!! AM LOST
Posts: 1,134
Default
well am not a pro as swat is but then this is wat i think..


R3 - URLSearchHook: (no name) - {C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70} - (no file)
O2 - BHO: CIEObject Object - {5D647E9C-6B37-4636-9A78-DADB1EB93BDF} - C:\WINDOWS\System32\CtxPopup.dll
O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)


the above one's in red i suppose are to be fixed..

am not too sure about the below ones in blue.. haven seen em in much of HJT..


O15 - Trusted Zone: *.boxsearch.net
O15 - Trusted Zone: *.brdatahost.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{3195A4B6-AD01-4E02-BF97-3686A3864529}: NameServer = 202.56.215.6,202.56.230.6
O17 - HKLM\System\CS1\Services\Tcpip\..\{3195A4B6-AD01-4E02-BF97-3686A3864529}: NameServer = 202.56.215.6,202.56.230.6
O17 - HKLM\System\CS2\Services\Tcpip\..\{3195A4B6-AD01-4E02-BF97-3686A3864529}: NameServer = 202.56.215.6,202.56.230.6
bharathbala2003 is offline  
Old 21-04-2005, 05:34 PM   #15 (permalink)
why need title?
 
bharathbala2003's Avatar
 
Join Date: Feb 2005
Location: CONFUSED!! AM LOST
Posts: 1,134
Default
Quote:
Originally Posted by chinmay_d
Hey swatkat...here is the RunBkUp.reg file...now plz tell me whats the problem...

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"SoundMan"="SOUNDMAN.EXE"
"InteliSys"="C:\\WINDOWS\\smss.exe"
"iTunesHelper"="C:\\Program Files\\iTunes\\iTunesHelper.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe"
"AdUpdater"="C:\\WINDOWS\\sysupudt.exe"
"AdPopup"="C:\\WINDOWS\\dcf5678.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"

BTW i cudnt find autoexec.bat...where is it??
i suppose the three needs to be fixed.. haven heard of em mayb swat will b more clearer..

as for autoexec.bat its an important MBR file.. i think its in the C:\Windows\system32
bharathbala2003 is offline  
Old 21-04-2005, 06:54 PM   #16 (permalink)
Human Spambot
 
swatkat's Avatar
 
Join Date: Mar 2004
Location: India
Posts: 2,033
Default
Quote:
Originally Posted by chinmay_d
well guyz...igot it...here is my hijack this log file:-

Logfile of HijackThis v1.99.1
Scan saved at 5:12:41 PM, on 4/21/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TagScanner\Tagscan.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\eLitecore\Cyberoam Client for 24Online\CyberoamClient.exe
C:\Program Files\DAP\DAP.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Chinmay Dhandhania\Local Settings\Temp\HijackThis.exe

R3 - URLSearchHook: (no name) - {C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: CIEObject Object - {5D647E9C-6B37-4636-9A78-DADB1EB93BDF} - C:\WINDOWS\System32\CtxPopup.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [InteliSys] C:\WINDOWS\smss.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [AdUpdater] C:\WINDOWS\sysupudt.exe
O4 - HKLM\..\Run: [AdPopup] C:\WINDOWS\dcf5678.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [WindowsFY] c:\wp.exe
O4 - Global Startup: 24Online Client.lnk = C:\Program Files\eLitecore\Cyberoam Client for 24Online\CyberoamClient.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Microsoft AntiSpyware helper - {26F2505D-276A-4D13-8C36-2F08B03C344C} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {26F2505D-276A-4D13-8C36-2F08B03C344C} - (no file) (HKCU)
O15 - Trusted Zone: *.boxsearch.net
O15 - Trusted Zone: *.brdatahost.com
O16 - DPF: {11120607-1001-1111-1000-110199901123} - ms-its:mhtml:file://c:default.mht!http://www.globolook.com/v179/dropper.chm::/dropper.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1113539920593
O16 - DPF: {D8A8A7F1-53EF-41F2-B44D-F3E2E595DC27} - ms-its:mhtml:file://C:\MAIN.MHT!http://69.50.163.254/331//main.chm::/update.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{3195A4B6-AD01-4E02-BF97-3686A3864529}: NameServer = 202.56.215.6,202.56.230.6
O17 - HKLM\System\CS1\Services\Tcpip\..\{3195A4B6-AD01-4E02-BF97-3686A3864529}: NameServer = 202.56.215.6,202.56.230.6
O17 - HKLM\System\CS2\Services\Tcpip\..\{3195A4B6-AD01-4E02-BF97-3686A3864529}: NameServer = 202.56.215.6,202.56.230.6
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
Run HijackThis, click "Do a System scan only" button, and put a check mark for the items which are made red above. Then close ALL open windows, programs except HijackThis, and click the button "Fix".

After this, delete these files:-
CtxPopup.dll
C:\WINDOWS\smss.exe
C:\WINDOWS\sysupudt.exe
C:\WINDOWS\dcf5678.exe
c:\wp.exe
Delete the files present in above mentioned path only.

After this, get SpyBot SnD, AdAware and do a full system scan using them. Then download SpywareBlaster and run it and click the button "Enable All Button".
http://security.kolla.de/
http://www.lavasoftusa.com/software/adaware/
http://www.javacoolsoftware.com/spywareblaster.html

Download CCLeaner, and run it. Click the Options button, and here clikc Settings tab, adn UNCHECK the option "Delete temp files older than 8 hours". Then clikc "Run Cleaner". Restart PC.
http://www.ccleaner.com/
After this, post a fresh log file of HijackThis.
__________________
http://swatrant.blogspot.com/
swatkat is offline  
Old 21-04-2005, 07:01 PM   #17 (permalink)
Human Spambot
 
swatkat's Avatar
 
Join Date: Mar 2004
Location: India
Posts: 2,033
Default
Quote:
Originally Posted by chinmay_d
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"SoundMan"="SOUNDMAN.EXE"
"InteliSys"="C:\\WINDOWS\\smss.exe"
"iTunesHelper"="C:\\Program Files\\iTunes\\iTunesHelper.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe"
"AdUpdater"="C:\\WINDOWS\\sysupudt.exe"
"AdPopup"="C:\\WINDOWS\\dcf5678.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
Go to Start> Run and type regedit and press ENTER. Then navigate to this key [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]. Click on the key, this will display some VALUES at the RIGHT PANE of the Registry Editor. Then right-click on the entries which are made RED by me, and click "Delete".

Most probably, Autoexec.bat is non existant in your system, so dont worry.
Also, download TrojanHunter and perform a full system scan.
__________________
http://swatrant.blogspot.com/
swatkat is offline  
Old 23-04-2005, 06:46 AM   #18 (permalink)
In The Zone
 
chinmay's Avatar
 
Join Date: Apr 2005
Location: Pune
Posts: 243
Default
hey swatkat thnx 4 workin upon my prob but i still cant change my wallpaper...nothin was shown in all those cleaners u mentioned...i think some settings of windows has been changed....i wanna shw u ppl a screenshot of 1 of my windows.....but then i dont have the pic on net...where should i upload it n how..?
__________________
I Blog at - http://www.chinmayspeaks.com
chinmay is offline  
Old 23-04-2005, 07:22 AM   #19 (permalink)
Laptoping
 
Sourabh's Avatar
 
Join Date: Aug 2004
Location: Mumbai
Posts: 2,211
Default
well Press the print screen to capture the screen shot and paste it in MSPAINT

save the file in jpeg format

upload the image at www.imageshack.us and post the direct link here

hope u get the procedure
__________________
You could think I'm wrong, but that's no reason to stop thinking.
Sourabh is offline  
 

Bookmarks

« Previous Thread | Next Thread »
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes
Linear Mode Linear Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On

 
Latest Threads
The Offtopic discussion thread...
- by IronManForever
National Telecom Policy 2012 Approved
- by ssk_the_gr8
low fps problem
- by akt_vampire
who wanna buy Galaxy s3?
- by clmlbx
Anime/Cartoon/Mangas Recommended by Digitians
- by tkin
Official Android discussion thread
- by amitabhishek
Merge HDD Partitons without loosing data
- by mitraark
Battlefield 3 discussion!
- by cyborg47
post your gaming hardware !
- by NoasArcAngel
Diablo III Discussion
- by Gaurav Bhattacharjee

Advertisement




All times are GMT +5.5. The time now is 05:59 PM.

Contact Us - Thinkdigit.com - Archive - Top

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2012, vBulletin Solutions, Inc.

Search Engine Optimization by vBSEO 3.3.2