Windows ME Shutdown & malware problems

  1. #1
    Giulia is offline Newbie

    Windows ME Shutdown & malware problems

    Hello

    Here is my HJT log

    Logfile of HijackThis v1.99.1
    Scan saved at 9:02:09 PM, on 8/2/2005
    Platform: Windows ME (Win9x 4.90.3000)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\BCMDMMSG.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\WINDOWS\SYSTEM\SSDPSRV.EXE
    C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
    C:\WINDOWS\SYSTEM\DEVLDR16.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\APPPATCH\REGIP.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\PROGRAM FILES\MUSICMATCH\MUSICMATCH JUKEBOX\MM_TRAY.EXE
    C:\PROGRAM FILES\COMMON FILES\ADAPTEC SHARED\CREATECD\CREATECD50.EXE
    C:\PROGRAM FILES\ROXIO\EASY CD CREATOR 5\DIRECTCD\DIRECTCD.EXE
    C:\WINDOWS\SYSTEM\HPZTSB07.EXE
    C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\PROGRAM FILES\COMMON FILES\KODAK\KODAK_DR\KODAKCCS.EXE
    C:\WINDOWS\SYSTEM\USBMONIT.EXE
    C:\WINDOWS\SYSTEM\QTTASK.EXE
    C:\WINDOWS\SYSTEM\SPOOL32.EXE
    C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    C:\PROGRAM FILES\KODAK\KODAK EASYSHARE SOFTWARE\BIN\EASYSHARE.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\WINDOWS\SYSTEM\PSTORES.EXE
    C:\PROGRAM FILES\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
    O2 - BHO: CATLEvents Object - {3EC8E271-FAB9-418a-8A8E-65AEB4029E64} - C:\WINDOWS\TEMP\SARCFM.DAT (file missing)
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
    O2 - BHO: CATLEvents Object - {C69FA570-7FDE-4C49-A7BC-CB1CF24BE66B} - C:\WINDOWS\TEMP\PIGER.DAT
    O3 - Toolbar: SearchScout Toolbar - {FD7D6851-616E-48DE-AF55-EE2E34F389B0} - C:\PROGRAM FILES\SEARCHSCOUTTOOLBAR\SEARCHSCOUTTOOLBAR.DLL
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [*regip] C:\WINDOWS\APPPATCH\REGIP.EXE
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
    O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [InkWatch] C:\PROGRA~1\GATEWAY\GATEWA~1\InkWatch.exe
    O4 - HKLM\..\Run: [MMTray] C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
    O4 - HKLM\..\Run: [BCMDMMSG] BCMDMMSG.exe
    O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb07.exe
    O4 - HKLM\..\Run: [FCZC] C:\WINDOWS\FCZC.exe
    O4 - HKLM\..\Run: [MFCRAS] C:\WINDOWS\MSAGENT\MFCRAS.EXE
    O4 - HKLM\..\Run: [*MFCRAS] C:\WINDOWS\MSAGENT\MFCRAS.EXE
    O4 - HKLM\..\Run: [*DOCDVD] C:\WINDOWS\HELP\TOUR\CNT\DOCDVD.EXE
    O4 - HKLM\..\Run: [*SRVMS] C:\WINDOWS\SYSTEM32\SRVMS.EXE
    O4 - HKLM\..\Run: [*SVRMS] C:\WINDOWS\HELP\SVRMS.EXE
    O4 - HKLM\..\Run: [*AVWEB] C:\WINDOWS\INF\AVWEB.EXE
    O4 - HKLM\..\Run: [KodakCCS] C:\Program Files\Common Files\KODAK\KODAK_DR\KodakCCS.exe --pdr: "C:\Program Files\Common Files\KODAK\KODAK_DR\dcmnter.pdr"
    O4 - HKLM\..\Run: [USBMonit.exe] "C:\WINDOWS\SYSTEM\USBMonit.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
    O4 - HKLM\..\Run: [*BINLIB] C:\WINDOWS\SYSTEM\MACROMED\BINLIB.EXE
    O4 - HKLM\..\Run: [*SYSDNS] C:\WINDOWS\WEB\SYSDNS.EXE
    O4 - HKLM\..\Run: [*PSC] C:\WINDOWS\TASKS\PSC.EXE
    O4 - HKLM\..\Run: [*ADHARD] C:\WINDOWS\CONFIG\ADHARD.EXE
    O4 - HKLM\..\Run: [*WEBDLL] C:\WINDOWS\HELP\WEBDLL.EXE
    O4 - HKLM\..\Run: [*MP3ANTI] C:\WINDOWS\HELP\MP3ANTI.EXE
    O4 - HKLM\..\Run: [*MAINAS] C:\WINDOWS\CURSORS\MAINAS.EXE
    O4 - HKLM\..\Run: [*REGWIN] C:\WINDOWS\WEB\REGWIN.EXE
    O4 - HKLM\..\Run: [*UTILAV] C:\WINDOWS\SYSTEM32\UTILAV.EXE
    O4 - HKLM\..\Run: [*CRFONT] C:\WINDOWS\TASKS\CRFONT.EXE
    O4 - HKLM\..\Run: [*COMRAS] C:\WINDOWS\MSAGENT\CHARS\COMRAS.EXE
    O4 - HKLM\..\Run: [*accdos] C:\WINDOWS\WEB\ACCDOS.EXE
    O4 - HKLM\..\Run: [devldr16.exe] C:\WINDOWS\SYSTEM\devldr16.exe
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
    O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
    O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
    O4 - HKLM\..\RunOnce: [*regip] C:\WINDOWS\APPPATCH\REGIP.EXE rerun
    O4 - HKCU\..\Run: [ClockSync] C:\Program Files\ClockSync\Sync.exe /q
    O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
    O8 - Extra context menu item: SearchScout Search - res://C:\PROGRAM FILES\SEARCHSCOUTTOOLBAR\SEARCHSCOUTTOOLBAR.DLL/SEARCHSCOUTMENUSEARCH.HTM
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/actives...ree/asinst.cab
    O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = aoldsl.net

    Thanks for the help.


  2. #2
    HJThis is offline Senior Member
    Save 20% on AVG Internet Security 2012 Suite!
    Hello,Giulia & Welcome

    First do an online free scan give us feedback on what if anyting
    could not be removed.
    http://www.ewido.net/en/onlinescan/

    Then do this here

    We ask that you please have a look at these 2 links here first

    http://www.d-a-l.com/help/showthread.php?t=15083

    http://www.d-a-l.com/help/showthread.php?t=605

    then once that is done we here will be more then happy to
    help with your HijackThis logfile.

    HGD

+ Reply to Thread