HJT log and description, help please.

stalled · 11-25-2005, 09:41 AM

HI ive had issues with all my browsers with popups and also flash popups that dont appear in the task manager. Ive also had a problem with rundll on start upand shut down. I've unticked a few things in msconfig startup and there's a file in the 36.tmp that im not sure of. ANy help would be much appreciated. Have used xoftspy, ad aware, got rid of a few things in Hijackthis that i knew were 'bad', also done avg,trend csw shredder and a panda scan. Heres my HJT log if you can help you'd find a friend lol.

Logfile of HijackThis v1.99.1
Scan saved at 9:37:52 p.m., on 25/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe
C:\WINDOWS\System32\DRIVERS\dcfssvc.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UStorSrv.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Rob Johnston\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co.nz
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.xtra.co.nz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.co.nz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.co.nz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co.nz
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.nz
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.google.co.nz
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/game...s/y/pote_x.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} - http://grfmail.gns.cri.nz/iNotes.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/ca...C_1_0_0_44.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{42264440-E8D6-4032-8174-5C5C1391F51E}: NameServer = 192.168.1.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: Internet Settings - C:\WINDOWS\system32\dn8801lue.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: dcfssvc (Dcfssvc) - Eastman Kodak Company - C:\WINDOWS\System32\DRIVERS\dcfssvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: UStorage Server Service - OTi - C:\WINDOWS\system32\UStorSrv.exe

**Buzz1927** · 11-25-2005, 11:18 AM

You have the latest version of VX2. Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log.
The whole log will be too big to post here, so just post the last section, it's a list of files and file sizes.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

if you receive, while running option #1, an error similar like: ''C:\windows\system32\cmd.exe
C:\windows\system32\autoexec.nt the system file is not suitable for running ms-dos and microsoft windows applications. choose close to terminate the application.."...then please use option 5 or the web page link in the l2mfix folder to solve this error condition. do not run the fix portion without fixing this first.

stalled · 11-26-2005, 01:37 AM

hey, thanks for this. Ive also had an error op p at start up to do with "c:\windows\system32\izmon.dll"GetNewVersion if thats any help.

heres the last bit of the log:

************************************************** ********************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
browseui.dll Sat 3 Sep 2005 12:52:04 A.... 1,019,904 996.00 K
cdfview.dll Sat 3 Sep 2005 12:52:04 A.... 151,040 147.50 K
cdosys.dll Sat 10 Sep 2005 14:53:42 A.... 2,067,968 1.97 M
danim.dll Sat 3 Sep 2005 12:52:04 A.... 1,053,696 1.00 M
datkkq32.dll Wed 16 Nov 2005 17:54:30 A.... 1,771 1.73 K
dpl100.dll Fri 28 Oct 2005 8:37:46 A.... 86,016 84.00 K
dpu10.dll Fri 28 Oct 2005 8:37:44 A.... 294,912 288.00 K
dpu11.dll Fri 28 Oct 2005 8:37:44 A.... 294,912 288.00 K
dpugui10.dll Fri 28 Oct 2005 8:37:48 A.... 53,248 52.00 K
dpugui11.dll Fri 28 Oct 2005 8:37:46 A.... 593,920 580.00 K
dpus11.dll Fri 28 Oct 2005 8:37:44 A.... 339,968 332.00 K
dpv11.dll Fri 28 Oct 2005 8:37:44 A.... 57,344 56.00 K
dtu100.dll Fri 28 Oct 2005 8:37:44 A.... 200,704 196.00 K
dxtrans.dll Sat 3 Sep 2005 12:52:04 A.... 205,312 200.50 K
en4ol1~1.dll Thu 17 Nov 2005 20:52:26 ..S.R 234,832 229.33 K
extmgr.dll Sat 3 Sep 2005 12:52:04 ..... 55,808 54.50 K
f22mlc~1.dll Wed 16 Nov 2005 17:04:30 ..S.R 235,394 229.88 K
gdi32.dll Thu 6 Oct 2005 16:09:36 A.... 280,064 273.50 K
h42ole~1.dll Fri 25 Nov 2005 21:45:36 ..S.R 236,973 231.42 K
iepeers.dll Sat 3 Sep 2005 12:52:04 A.... 251,392 245.50 K
inseng.dll Sat 3 Sep 2005 12:52:04 A.... 96,256 94.00 K
izmon.dll Sat 26 Nov 2005 10:28:00 ..... 236,973 231.42 K
l8l6li~1.dll Wed 23 Nov 2005 0:10:16 ..S.R 235,289 229.77 K
lbgitc~1.dll Tue 22 Nov 2005 21:45:40 ..S.R 235,289 229.77 K
legitc~1.dll Fri 4 Nov 2005 16:27:24 A.... 534,280 521.76 K
libdivx.dll Thu 29 Sep 2005 7:50:06 A.... 1,044,480 1020.00 K
linkinfo.dll Thu 1 Sep 2005 14:41:54 A.... 19,968 19.50 K
m6julg~1.dll Fri 18 Nov 2005 11:41:30 ..S.R 234,889 229.38 K
mshtml.dll Tue 4 Oct 2005 17:26:00 A.... 3,015,168 2.88 M
mshtmled.dll Sat 3 Sep 2005 12:52:06 A.... 448,512 438.00 K
msrating.dll Sat 3 Sep 2005 12:52:06 A.... 146,432 143.00 K
mstime.dll Sat 3 Sep 2005 12:52:06 A.... 530,432 518.00 K
p8r4li~1.dll Wed 23 Nov 2005 9:50:42 ..S.R 235,289 229.77 K
pngfilt.dll Sat 3 Sep 2005 12:52:06 A.... 39,424 38.50 K
quartz.dll Tue 30 Aug 2005 16:54:26 A.... 1,287,168 1.23 M
russer.dll Thu 17 Nov 2005 0:00:46 ..S.R 234,832 229.33 K
s8880i~1.dll Sat 26 Nov 2005 9:46:10 ..S.R 235,289 229.77 K
shdocvw.dll Sat 3 Sep 2005 12:52:06 A.... 1,483,776 1.41 M
shell32.dll Fri 23 Sep 2005 16:05:30 A.... 8,450,560 8.06 M
shlwapi.dll Sat 3 Sep 2005 12:52:06 A.... 473,600 462.50 K
sirenacm.dll Wed 12 Oct 2005 17:11:06 A.... 118,784 116.00 K
ssldivx.dll Thu 29 Sep 2005 7:50:04 A.... 200,704 196.00 K
urlmon.dll Sat 3 Sep 2005 12:52:06 A.... 608,768 594.50 K
wininet.dll Sat 3 Sep 2005 12:52:06 A.... 658,432 643.00 K
winsrv.dll Thu 1 Sep 2005 14:41:54 A.... 291,840 285.00 K
xpsp3res.dll Tue 27 Sep 2005 13:29:46 ..... 21,504 21.00 K

46 items found: 46 files (9 H/S), 0 directories.
Total of file sizes: 28,833,116 bytes 27.50 M
Locate .tmp files:

C:\WINDOWS\SYSTEM32\
guard.tmp Sat 26 Nov 2005 13:35:00 ..S.R 236,973 231.42 K

1 item found: 1 file (1 H/S), 0 directories.
Total of file sizes: 236,973 bytes 231.42 K
************************************************** ********************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is D487-CDAD

Directory of C:\WINDOWS\System32

26/11/2005 01:34 p.m. 236,973 guard.tmp
26/11/2005 09:46 a.m. 235,289 s8880ilue8q80.dll
25/11/2005 09:45 p.m. 236,973 h42olef31h2.dll
23/11/2005 09:50 a.m. 235,289 p8r4li9q18.dll
23/11/2005 12:10 a.m. 235,289 l8l6li3s18.dll
22/11/2005 09:45 p.m. 235,289 LbgitCheckControl.DLL
18/11/2005 11:41 a.m. 234,889 m6julg1916.dll
17/11/2005 08:52 p.m. 234,832 en4ol1h31.dll
17/11/2005 12:00 a.m. 234,832 rUsser.dll
16/11/2005 05:04 p.m. 235,394 f22mlcf11f2.dll
23/10/2005 07:25 p.m. <DIR> dllcache
07/10/2003 12:28 p.m. 10,240 Thumbs.db
16/05/2003 06:41 a.m. <DIR> Microsoft
11 File(s) 2,365,289 bytes
2 Dir(s) 2,467,377,152 bytes free

cheers.

**Buzz1927** · 11-26-2005, 03:39 PM

L2Mfix has been updated. Delete the copy you have, then download the program again from one of the links in my first post.

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter. It will process then start. Your desktop and icons will disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, it will be ready for a reboot. Press any key to reboot.

After the reboot, post a new Hijackthis log.

stalled · 11-27-2005, 12:07 AM

ran the new l2mfix, heres the new hijackthis log.
cheers

Logfile of HijackThis v1.99.1
Scan saved at 12:04:11 p.m., on 27/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\System32\DRIVERS\dcfssvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\system32\UStorSrv.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Rob Johnston\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co.nz
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.xtra.co.nz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.co.nz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.co.nz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co.nz
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.nz
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.google.co.nz
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/game...s/y/pote_x.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} - http://grfmail.gns.cri.nz/iNotes.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/ca...C_1_0_0_44.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{42264440-E8D6-4032-8174-5C5C1391F51E}: NameServer = 192.168.1.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: H323TSP - C:\WINDOWS\system32\hrj2051oe.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: dcfssvc (Dcfssvc) - Eastman Kodak Company - C:\WINDOWS\System32\DRIVERS\dcfssvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: UStorage Server Service - OTi - C:\WINDOWS\system32\UStorSrv.exe

**Buzz1927** · 11-27-2005, 12:09 AM

You running norton or avg?

stalled · 11-27-2005, 12:37 AM

avg

stalled · 11-27-2005, 12:38 AM

but old norton 2002 is there, hasnt been resubscribed.

**Buzz1927** · 11-27-2005, 01:31 AM

God, I hate Norton, causes so many problems. I'm too pissed to deal with it tonight, I'll post instructions tomorrow.

stalled · 11-27-2005, 01:36 AM

cheers mate. yeah its always been a bitch and when dad tried subscribing he ended up getting linked ot something else so shmeh. We want ot get a new one so any advice would be great. lol good to hear your on the piss, sadly i missed out last night cos had to get my bro to the airport, it will be a big one nextweekend to make up for it!

11-25-2005, 09:41 AM	#1 (permalink)
stalled Bronze Member Join Date: Nov 2005 Location: New Zealand Posts: 49	HJT log and description, help please. HI ive had issues with all my browsers with popups and also flash popups that dont appear in the task manager. Ive also had a problem with rundll on start upand shut down. I've unticked a few things in msconfig startup and there's a file in the 36.tmp that im not sure of. ANy help would be much appreciated. Have used xoftspy, ad aware, got rid of a few things in Hijackthis that i knew were 'bad', also done avg,trend csw shredder and a panda scan. Heres my HJT log if you can help you'd find a friend lol. Logfile of HijackThis v1.99.1 Scan saved at 9:37:52 p.m., on 25/11/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\Program Files\Microsoft Hardware\Keyboard\type32.exe C:\Program Files\Microsoft Hardware\Mouse\point32.exe C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe C:\WINDOWS\System32\DRIVERS\dcfssvc.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe C:\Program Files\Microsoft AntiSpyware\gcasServ.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE C:\WINDOWS\system32\devldr32.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\UStorSrv.exe C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Rob Johnston\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co.nz R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.xtra.co.nz/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.co.nz R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.co.nz R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co.nz R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.nz R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.google.co.nz O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe" O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/game...s/y/pote_x.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} - http://grfmail.gns.cri.nz/iNotes.cab O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/ca...C_1_0_0_44.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} - http://chat.yahoo.com/cab/yuplapp.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{42264440-E8D6-4032-8174-5C5C1391F51E}: NameServer = 192.168.1.1 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: Internet Settings - C:\WINDOWS\system32\dn8801lue.dll O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: dcfssvc (Dcfssvc) - Eastman Kodak Company - C:\WINDOWS\System32\DRIVERS\dcfssvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: UStorage Server Service - OTi - C:\WINDOWS\system32\UStorSrv.exe

11-25-2005, 11:18 AM	#2 (permalink)
Buzz1927 Digaredd Join Date: May 2005 Location: Melbourne AU Posts: 7,613	You have the latest version of VX2. Download L2mfix from one of these two locations: http://www.atribune.org/downloads/l2mfix.exe http://www.downloads.subratam.org/l2mfix.exe Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. The whole log will be too big to post here, so just post the last section, it's a list of files and file sizes. IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so! if you receive, while running option #1, an error similar like: ''C:\windows\system32\cmd.exe C:\windows\system32\autoexec.nt the system file is not suitable for running ms-dos and microsoft windows applications. choose close to terminate the application.."...then please use option 5 or the web page link in the l2mfix folder to solve this error condition. do not run the fix portion without fixing this first. __________________ Son of Glyndwr Mae hen wlad fy nhadau yn annwyl i mi

11-26-2005, 03:39 PM	#4 (permalink)
Buzz1927 Digaredd Join Date: May 2005 Location: Melbourne AU Posts: 7,613	L2Mfix has been updated. Delete the copy you have, then download the program again from one of the links in my first post. Close any programs you have open since this step requires a reboot. From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter. It will process then start. Your desktop and icons will disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, it will be ready for a reboot. Press any key to reboot. After the reboot, post a new Hijackthis log. __________________ Son of Glyndwr Mae hen wlad fy nhadau yn annwyl i mi

11-27-2005, 12:07 AM	#5 (permalink)
stalled Bronze Member Join Date: Nov 2005 Location: New Zealand Posts: 49	hijack this log ran the new l2mfix, heres the new hijackthis log. cheers Logfile of HijackThis v1.99.1 Scan saved at 12:04:11 p.m., on 27/11/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\WINDOWS\System32\DRIVERS\dcfssvc.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE C:\Program Files\Microsoft Hardware\Keyboard\type32.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Microsoft Hardware\Mouse\point32.exe C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe C:\WINDOWS\system32\devldr32.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\Microsoft AntiSpyware\gcasServ.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\WINDOWS\system32\UStorSrv.exe C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Rob Johnston\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co.nz R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.xtra.co.nz/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.co.nz R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.co.nz R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co.nz R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.nz R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.google.co.nz O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe" O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/game...s/y/pote_x.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} - http://grfmail.gns.cri.nz/iNotes.cab O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/ca...C_1_0_0_44.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} - http://chat.yahoo.com/cab/yuplapp.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{42264440-E8D6-4032-8174-5C5C1391F51E}: NameServer = 192.168.1.1 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: H323TSP - C:\WINDOWS\system32\hrj2051oe.dll (file missing) O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: dcfssvc (Dcfssvc) - Eastman Kodak Company - C:\WINDOWS\System32\DRIVERS\dcfssvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: UStorage Server Service - OTi - C:\WINDOWS\system32\UStorSrv.exe

11-27-2005, 12:09 AM	#6 (permalink)
Buzz1927 Digaredd Join Date: May 2005 Location: Melbourne AU Posts: 7,613	You running norton or avg? __________________ Son of Glyndwr Mae hen wlad fy nhadau yn annwyl i mi

11-26-2005, 01:37 AM	#3 (permalink)
stalled Bronze Member Join Date: Nov 2005 Location: New Zealand Posts: 49	hey, thanks for this. Ive also had an error op p at start up to do with "c:\windows\system32\izmon.dll"GetNewVersion if thats any help. heres the last bit of the log: ************************************************ **************************** Files Found are not all bad files: C:\WINDOWS\SYSTEM32\ browseui.dll Sat 3 Sep 2005 12:52:04 A.... 1,019,904 996.00 K cdfview.dll Sat 3 Sep 2005 12:52:04 A.... 151,040 147.50 K cdosys.dll Sat 10 Sep 2005 14:53:42 A.... 2,067,968 1.97 M danim.dll Sat 3 Sep 2005 12:52:04 A.... 1,053,696 1.00 M datkkq32.dll Wed 16 Nov 2005 17:54:30 A.... 1,771 1.73 K dpl100.dll Fri 28 Oct 2005 8:37:46 A.... 86,016 84.00 K dpu10.dll Fri 28 Oct 2005 8:37:44 A.... 294,912 288.00 K dpu11.dll Fri 28 Oct 2005 8:37:44 A.... 294,912 288.00 K dpugui10.dll Fri 28 Oct 2005 8:37:48 A.... 53,248 52.00 K dpugui11.dll Fri 28 Oct 2005 8:37:46 A.... 593,920 580.00 K dpus11.dll Fri 28 Oct 2005 8:37:44 A.... 339,968 332.00 K dpv11.dll Fri 28 Oct 2005 8:37:44 A.... 57,344 56.00 K dtu100.dll Fri 28 Oct 2005 8:37:44 A.... 200,704 196.00 K dxtrans.dll Sat 3 Sep 2005 12:52:04 A.... 205,312 200.50 K en4ol1~1.dll Thu 17 Nov 2005 20:52:26 ..S.R 234,832 229.33 K extmgr.dll Sat 3 Sep 2005 12:52:04 ..... 55,808 54.50 K f22mlc~1.dll Wed 16 Nov 2005 17:04:30 ..S.R 235,394 229.88 K gdi32.dll Thu 6 Oct 2005 16:09:36 A.... 280,064 273.50 K h42ole~1.dll Fri 25 Nov 2005 21:45:36 ..S.R 236,973 231.42 K iepeers.dll Sat 3 Sep 2005 12:52:04 A.... 251,392 245.50 K inseng.dll Sat 3 Sep 2005 12:52:04 A.... 96,256 94.00 K izmon.dll Sat 26 Nov 2005 10:28:00 ..... 236,973 231.42 K l8l6li~1.dll Wed 23 Nov 2005 0:10:16 ..S.R 235,289 229.77 K lbgitc~1.dll Tue 22 Nov 2005 21:45:40 ..S.R 235,289 229.77 K legitc~1.dll Fri 4 Nov 2005 16:27:24 A.... 534,280 521.76 K libdivx.dll Thu 29 Sep 2005 7:50:06 A.... 1,044,480 1020.00 K linkinfo.dll Thu 1 Sep 2005 14:41:54 A.... 19,968 19.50 K m6julg~1.dll Fri 18 Nov 2005 11:41:30 ..S.R 234,889 229.38 K mshtml.dll Tue 4 Oct 2005 17:26:00 A.... 3,015,168 2.88 M mshtmled.dll Sat 3 Sep 2005 12:52:06 A.... 448,512 438.00 K msrating.dll Sat 3 Sep 2005 12:52:06 A.... 146,432 143.00 K mstime.dll Sat 3 Sep 2005 12:52:06 A.... 530,432 518.00 K p8r4li~1.dll Wed 23 Nov 2005 9:50:42 ..S.R 235,289 229.77 K pngfilt.dll Sat 3 Sep 2005 12:52:06 A.... 39,424 38.50 K quartz.dll Tue 30 Aug 2005 16:54:26 A.... 1,287,168 1.23 M russer.dll Thu 17 Nov 2005 0:00:46 ..S.R 234,832 229.33 K s8880i~1.dll Sat 26 Nov 2005 9:46:10 ..S.R 235,289 229.77 K shdocvw.dll Sat 3 Sep 2005 12:52:06 A.... 1,483,776 1.41 M shell32.dll Fri 23 Sep 2005 16:05:30 A.... 8,450,560 8.06 M shlwapi.dll Sat 3 Sep 2005 12:52:06 A.... 473,600 462.50 K sirenacm.dll Wed 12 Oct 2005 17:11:06 A.... 118,784 116.00 K ssldivx.dll Thu 29 Sep 2005 7:50:04 A.... 200,704 196.00 K urlmon.dll Sat 3 Sep 2005 12:52:06 A.... 608,768 594.50 K wininet.dll Sat 3 Sep 2005 12:52:06 A.... 658,432 643.00 K winsrv.dll Thu 1 Sep 2005 14:41:54 A.... 291,840 285.00 K xpsp3res.dll Tue 27 Sep 2005 13:29:46 ..... 21,504 21.00 K 46 items found: 46 files (9 H/S), 0 directories. Total of file sizes: 28,833,116 bytes 27.50 M Locate .tmp files: C:\WINDOWS\SYSTEM32\ guard.tmp Sat 26 Nov 2005 13:35:00 ..S.R 236,973 231.42 K 1 item found: 1 file (1 H/S), 0 directories. Total of file sizes: 236,973 bytes 231.42 K ********************************************** ****************************** Directory Listing of system files: Volume in drive C has no label. Volume Serial Number is D487-CDAD Directory of C:\WINDOWS\System32 26/11/2005 01:34 p.m. 236,973 guard.tmp 26/11/2005 09:46 a.m. 235,289 s8880ilue8q80.dll 25/11/2005 09:45 p.m. 236,973 h42olef31h2.dll 23/11/2005 09:50 a.m. 235,289 p8r4li9q18.dll 23/11/2005 12:10 a.m. 235,289 l8l6li3s18.dll 22/11/2005 09:45 p.m. 235,289 LbgitCheckControl.DLL 18/11/2005 11:41 a.m. 234,889 m6julg1916.dll 17/11/2005 08:52 p.m. 234,832 en4ol1h31.dll 17/11/2005 12:00 a.m. 234,832 rUsser.dll 16/11/2005 05:04 p.m. 235,394 f22mlcf11f2.dll 23/10/2005 07:25 p.m. <DIR> dllcache 07/10/2003 12:28 p.m. 10,240 Thumbs.db 16/05/2003 06:41 a.m. <DIR> Microsoft 11 File(s) 2,365,289 bytes 2 Dir(s) 2,467,377,152 bytes free cheers.

11-27-2005, 12:37 AM	#7 (permalink)
stalled Bronze Member Join Date: Nov 2005 Location: New Zealand Posts: 49	avg

11-27-2005, 12:38 AM	#8 (permalink)
stalled Bronze Member Join Date: Nov 2005 Location: New Zealand Posts: 49	but old norton 2002 is there, hasnt been resubscribed.

11-27-2005, 01:31 AM	#9 (permalink)
Buzz1927 Digaredd Join Date: May 2005 Location: Melbourne AU Posts: 7,613	God, I hate Norton, causes so many problems. I'm too pissed to deal with it tonight, I'll post instructions tomorrow. __________________ Son of Glyndwr Mae hen wlad fy nhadau yn annwyl i mi

11-27-2005, 01:36 AM	#10 (permalink)
stalled Bronze Member Join Date: Nov 2005 Location: New Zealand Posts: 49	cheers mate. yeah its always been a bitch and when dad tried subscribing he ended up getting linked ot something else so shmeh. We want ot get a new one so any advice would be great. lol good to hear your on the piss, sadly i missed out last night cos had to get my bro to the airport, it will be a big one nextweekend to make up for it!

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Switch to Linear Mode Hybrid Mode Switch to Threaded Mode