Windows ME Shutdown & malware problems
-
Windows ME Shutdown & malware problems
Hello
Here is my HJT log
Logfile of HijackThis v1.99.1
Scan saved at 9:02:09 PM, on 8/2/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\BCMDMMSG.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\DEVLDR16.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\APPPATCH\REGIP.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\MUSICMATCH\MUSICMATCH JUKEBOX\MM_TRAY.EXE
C:\PROGRAM FILES\COMMON FILES\ADAPTEC SHARED\CREATECD\CREATECD50.EXE
C:\PROGRAM FILES\ROXIO\EASY CD CREATOR 5\DIRECTCD\DIRECTCD.EXE
C:\WINDOWS\SYSTEM\HPZTSB07.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\COMMON FILES\KODAK\KODAK_DR\KODAKCCS.EXE
C:\WINDOWS\SYSTEM\USBMONIT.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\KODAK\KODAK EASYSHARE SOFTWARE\BIN\EASYSHARE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
O2 - BHO: CATLEvents Object - {3EC8E271-FAB9-418a-8A8E-65AEB4029E64} - C:\WINDOWS\TEMP\SARCFM.DAT (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: CATLEvents Object - {C69FA570-7FDE-4C49-A7BC-CB1CF24BE66B} - C:\WINDOWS\TEMP\PIGER.DAT
O3 - Toolbar: SearchScout Toolbar - {FD7D6851-616E-48DE-AF55-EE2E34F389B0} - C:\PROGRAM FILES\SEARCHSCOUTTOOLBAR\SEARCHSCOUTTOOLBAR.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [*regip] C:\WINDOWS\APPPATCH\REGIP.EXE
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [InkWatch] C:\PROGRA~1\GATEWAY\GATEWA~1\InkWatch.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [BCMDMMSG] BCMDMMSG.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb07.exe
O4 - HKLM\..\Run: [FCZC] C:\WINDOWS\FCZC.exe
O4 - HKLM\..\Run: [MFCRAS] C:\WINDOWS\MSAGENT\MFCRAS.EXE
O4 - HKLM\..\Run: [*MFCRAS] C:\WINDOWS\MSAGENT\MFCRAS.EXE
O4 - HKLM\..\Run: [*DOCDVD] C:\WINDOWS\HELP\TOUR\CNT\DOCDVD.EXE
O4 - HKLM\..\Run: [*SRVMS] C:\WINDOWS\SYSTEM32\SRVMS.EXE
O4 - HKLM\..\Run: [*SVRMS] C:\WINDOWS\HELP\SVRMS.EXE
O4 - HKLM\..\Run: [*AVWEB] C:\WINDOWS\INF\AVWEB.EXE
O4 - HKLM\..\Run: [KodakCCS] C:\Program Files\Common Files\KODAK\KODAK_DR\KodakCCS.exe --pdr: "C:\Program Files\Common Files\KODAK\KODAK_DR\dcmnter.pdr"
O4 - HKLM\..\Run: [USBMonit.exe] "C:\WINDOWS\SYSTEM\USBMonit.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [*BINLIB] C:\WINDOWS\SYSTEM\MACROMED\BINLIB.EXE
O4 - HKLM\..\Run: [*SYSDNS] C:\WINDOWS\WEB\SYSDNS.EXE
O4 - HKLM\..\Run: [*PSC] C:\WINDOWS\TASKS\PSC.EXE
O4 - HKLM\..\Run: [*ADHARD] C:\WINDOWS\CONFIG\ADHARD.EXE
O4 - HKLM\..\Run: [*WEBDLL] C:\WINDOWS\HELP\WEBDLL.EXE
O4 - HKLM\..\Run: [*MP3ANTI] C:\WINDOWS\HELP\MP3ANTI.EXE
O4 - HKLM\..\Run: [*MAINAS] C:\WINDOWS\CURSORS\MAINAS.EXE
O4 - HKLM\..\Run: [*REGWIN] C:\WINDOWS\WEB\REGWIN.EXE
O4 - HKLM\..\Run: [*UTILAV] C:\WINDOWS\SYSTEM32\UTILAV.EXE
O4 - HKLM\..\Run: [*CRFONT] C:\WINDOWS\TASKS\CRFONT.EXE
O4 - HKLM\..\Run: [*COMRAS] C:\WINDOWS\MSAGENT\CHARS\COMRAS.EXE
O4 - HKLM\..\Run: [*accdos] C:\WINDOWS\WEB\ACCDOS.EXE
O4 - HKLM\..\Run: [devldr16.exe] C:\WINDOWS\SYSTEM\devldr16.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunOnce: [*regip] C:\WINDOWS\APPPATCH\REGIP.EXE rerun
O4 - HKCU\..\Run: [ClockSync] C:\Program Files\ClockSync\Sync.exe /q
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: SearchScout Search - res://C:\PROGRAM FILES\SEARCHSCOUTTOOLBAR\SEARCHSCOUTTOOLBAR.DLL/SEARCHSCOUTMENUSEARCH.HTM
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/actives...ree/asinst.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = aoldsl.net
Thanks for the help.
-
Hello,Giulia & Welcome
First do an online free scan give us feedback on what if anyting
could not be removed.
http://www.ewido.net/en/onlinescan/
Then do this here
We ask that you please have a look at these 2 links here first
http://www.d-a-l.com/help/showthread.php?t=15083
http://www.d-a-l.com/help/showthread.php?t=605
then once that is done we here will be more then happy to
help with your HijackThis logfile.
HGD