Prep: says this:
Logfile of HijackThis v1.99.1
Running processes:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local#Id_String1 .6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
end.
I’ve updated my firewall and blocked most of the pop up domains that have been popping up frequently. It seems to have stopped… for now. I just want to have a clean system, because I’m pretty sure your right about my system being infected.
Also, some programs crash repeatedly… and sometime even the a whole computer restart. Less now that I’ve gotten more ram.
:T
Thanks for the response.
http://img235.imageshack.us/img235/3081/untitled3mg8.jpg
That’s a screenshot of the Event Viewer in Administrative Tools. The steps say:
""If you happen to encounter a crash, please send the report to Microsoft to help us investigate. Then let us know the crash ID number you sent in the report. To find this information, please do the following:
From Start - Run dialog, run “eventvwr.msc”
Open the “Application Log” node.
Look for the newest event with Source=“Microsoft Development Environment” and Event=“1–1”
Open that event and you’ll see “Bucket” followed by the crash ID number we’re looking for""
But I can’t find any event with source as Microsoft Development Environment, nor can I find the “Bucket” number in the columns. Am I looking in the wrong place? Is the bucket number the event number, which is 1001?
Preppy
July 5, 2007, 9:07pm
163
VR: All we care about are the contents of the Application Error events. If you don’t have that data, we can’t get anywhere. My steps cover what you’re trying to do exactly. In the other guy’s steps, you should have replaced “Microsoft Development Environment” with “Application Error”.
Kakarotte: “lavdcfji.dll” sure looks like an evil trojan/adware. A quick search on the CLSID for that shows these results - do those help?
Ah ok thanks, I found it I think:
Fault bucket 204575743.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp .
Preppy
July 5, 2007, 10:32pm
165
According to Watson, the other event log should have read:this response page .
So there’s your problem and your solution all wrapped up. :tup:
You mean do the Google results help? I looked threw them. I’m running a scan now. Hopefully I can delete or at least quarantine that file.
I’ll do that and run hijack again and post up my results.
Thanks.
thanks Preppy, I downloaded the ffdshow thing and I can move the files onto my timeline now.
Ok so I did a full scan and it caught most of the crap that was corrupting my system. I also ran HiJackThis again and deleted the suspicious crap.
I tried to redo my cookie settings and they actually stay now. Also, no more pop ups, and everything seems to be running smoother and cleaner.
I’ll post up the report anyways, because there’s a few things in there that I’m not sure of that I don’t want to delete, for they might be important.
I bolded the ones that looked suspicious to ME, but I know little about these programs so they could be normal. I’ll leave that up to you.
Thanks!
Logfile of HijackThis v1.99.1
Running processes:
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dllO2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL #Id_String1 .6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
Okay. So I’ve still been having computer problems ever since I last posted, but I tried souporman’s advice over re-installing the operating system (which I don’t think I have for this computer, unlike with my poor zombie laptop). The problems seemed to mellowed out after that, allowing me to be on the4 computer for hours instead of “just” an hour before something went bad.
I still eventually, accidentally, got rid of Webshots, which I thought was causing the problem. However, it seems to have become somewhat worse given that I still get the Webshots error message alongside a slower computer–the computer is making omnious sounds lately as well, though I hope that’s just because I’ve been leaving it on too much lately.
Anyway, I finally remember to write down the damn error and it reads like this:
“One of your albums could not be read: C:\Documents and Settings\Owner.YOURC3D2164251\My Documents\Webshots\album-10000.”
This is then followed by another error message:
“Rename failed. Damaged file could not be moved.”
And it then repeats that up to five or six times for albums 10000-10005.
Does this problem look minor? Is it solvable?
Alright now im getting random RPC errors on my comp checked into it saying its the MS blaster and i had too patch. Did that and scanned for the worm found nothing. Any ideas what it could be? Also im getting a explorer.exe error as well on my BT download folder “The instruction at 0x02a6415b referenced memory 0x000000 the memory can’t be written explorer.exe”. Any suggestions on these problems?
Does anyone know of any programs they recommend to clean up spyware/malware/etc.?
The_Damned:
Okay. So I’ve still been having computer problems ever since I last posted, but I tried souporman’s advice over re-installing the operating system (which I don’t think I have for this computer, unlike with my poor zombie laptop). The problems seemed to mellowed out after that, allowing me to be on the4 computer for hours instead of “just” an hour before something went bad.
I still eventually, accidentally, got rid of Webshots, which I thought was causing the problem. However, it seems to have become somewhat worse given that I still get the Webshots error message alongside a slower computer–the computer is making omnious sounds lately as well, though I hope that’s just because I’ve been leaving it on too much lately.
Anyway, I finally remember to write down the damn error and it reads like this:
“One of your albums could not be read: C:\Documents and Settings\Owner.YOURC3D2164251\My Documents\Webshots\album-10000.”
This is then followed by another error message:
“Rename failed. Damaged file could not be moved.”
And it then repeats that up to five or six times for albums 10000-10005.
Does this problem look minor? Is it solvable?
Could be. In XP, run chkdisk (in My Computer, right click on your C: drive, select the Tools tab and click on the Check Now button), which is supposed to fix any problems you have with your hard drive. If that doesn’t do the trick, a reformat and reinstall my be your last resort.
^why doesnt he just ctrl+alt+del and ends the precoess in task manager
also id advise going in as safemode if above fails
I have a log file from hijackthis and was wondering if anyone could tell me what the malware/spyware could be.
Logfile of HijackThis v1.99.1
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id= http://websearch.drsnsrch.com/sidesearch.cgi?id= http://www.yahoo.com/ http://websearch.drsnsrch.com/sidesearch.cgi?id= http://websearch.drsnsrch.com/sidesearch.cgi?id= http://websearch.drsnsrch.com/sidesearch.cgi?id= http://websearch.drsnsrch.com/sidesearch.cgi?id= websearch.drsnsrch.com/q.cgi?q= http://www.yahoo.com/ PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\PartyGaming\PartyPoker\RunApp.exe (file missing)PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\PartyGaming\PartyPoker\RunApp.exe (file missing)http://download.games.yahoo.com/games/clients/y/mjst4_x.cab http://download.games.yahoo.com/games/clients/y/pt3_x.cab http://download.games.yahoo.com/games/clients/y/pyt1_x.cab http://download.cdn.winsoftware.com/files/installers/cab/WinAntiVirusPro2006FreeInstall.cab http://download.games.yahoo.com/games/web_games/tikgames/cinematycoon/cinematycoon.cab
Thanks a lot.
Sazae
July 10, 2007, 8:04pm
175
^it looks like it is the SpamBlockerUtility program you have on there. Remove that as best you can and run a spyware scan with a few different programs (Spybot, Ad-Aware, Bitdefender).
fjf314
July 10, 2007, 10:42pm
176
Keep getting a buncha pop-ups. DL’ed Highjackthis and heres the report:
Running processes:
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocxhttp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1180676280062 https://bluesocket.csi.cuny.edu/sre/Downloads/ICSScanner.cab
Any help would be appreciated
Makato, the best thing I would recommend to go ahead and remove that is download, ad-aware and update it. Then run a scan under safe mode to remove all that unwanted it crap. To get to safe mode go ahead and reboot the computer and keep pressing F8. Should get to a black screen with options such as Safe Mode with networking, safe mode with command prompt and others. Just choose regular safe mode and run ad aware through there. Also make sure it’s a full system scan. Then after the scan is done, you can go ahead remove all that junk ad aware found such as cookies to registery keys related to any type of adware or spyware. Hope this helps.
Mixah
July 11, 2007, 4:47pm
179
make sure nothing’s attached itself to any of the svchosts or the explorer process.
get spybot search and destroy (not spywarebot), and go to tools > advanced mode, and look at their process tree. run the scan, and also immunize your system with it. it’s one of the most comprehensive tools for free for getting rid of such things.
also, PM me, as i might be able to send you a copy of ad-aware professional full liscence for free, since i have two laying around. you’re a good guy, so i’d do you that favor
I have a display adapter problem. The display adapter is nVIDIA Geforce4 488 GO (medion) but when I downloaded the driver from nVIDIA’s site it says:
The nvidia setup program could not locate any drivers that are compatible with your current hardware. Setup will now exit.
Using Everest and then looking under ‘display’ and ‘gpu’ is where I found the adapter info. I am running XP sp2. Could this be caused by the fact that Video controller (VGA Compatible) has a yellow ! next to it and does not appear to have any drivers whatsoever. Thanks in advance. :tup:
