Help Me Out Guyzzzz!!!!!

chinmay · Apr 19, 2005

Hey Guyz i m havin many problem with my comp which is really pissin me off....
1. As soon as i upgraded to win xp sp2 all my previous updates which r displayed as win xp hotfix in add remove programs in control panel on the comp were removed...is it normal?

2. Just after upgrading to win xp sp 2 my mouse is not behavin properly...it stops workin for a second or two(music playin in WMP also doesnt play when mouse stops)...i think my ati radeon 9200 can be culprit...is it possible?

3. a program called wp.exe came on my c: which put a blue screen error wallpaper...now when i right clickon desktop and go to display properties..."Desktop" and "apperance" tab is not diplayed at all....i found out the wallpaper was wp.bmp on c: tself....the file wp.exe was not deletin bcuz it was runnin in background but then i deleted it after exitin it from ctrl-alt-del....if it is a trojan it is a very rare one bcuz i cudnt find much on google about it nor did my Spybot s&d and norton av 2005 cud detect it(both fully updated)...

Guyz please help me out atlst for da third problem bcuz its a real pain in da back

theraven · Apr 19, 2005

sounds like a trojan or something for sure
unless u have a wallpaper changin program installed
but its unlikely to be in ur root drive
anywho post ur hijack this log file here
we'll see what we can do

sp2 includes previous updates . so yeah its normal
all those will be under sp2 now

dun think ur radeon is at fault tho
if its an optical mouse there are issues with sp2 .. very rare tho !

swatkat · Apr 19, 2005

It is a Trojan. Did your AntiVirus picked up anything? Download TrojanHunter and do a Full scan. Then post the HijackThis log file.

Also, search your System for these files, and post back if any of them are found:-
Maria.doc .exe (there is a SPACE after doc)
MACROSOFTBT.EXE

Also, Open Autoexec.bat file in NotePad and post it's contents.

Then do this, Go to Start> Run and type regedit and press ENTER. Here navigate to this key (by click the "+" icon infront of the keys)

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

and then go to to File Menu, and click "Export". Here type a filename as RunBkUp and in the "Export Range" option box, click "Selected Branch" and click "Ok".
Next, open NotePad and from File> Open, open the file RunBkUp.reg and then copy it's content and post it here.

mako_123 · Apr 19, 2005

hello

Well for your second problem , there might be a problem with your Modem or Lan card(if you have that). Try removing it and then running your PC to see if it works Fine or not. I once faced a similar problem and it turned out to be my LAN card.

chinmay · Apr 20, 2005

hey mako...thnx a load for that suggestion...that irritating problem is no more...i had 2 lan cards in my pc out of which 1 was faulty...i jus disabled the faulty 1 n its workin fine...

chinmay · Apr 20, 2005

hey theravan..although my mouse stoppin prblm is no more i see my mouse(optical) pointer movin slow at times n all....so cn u lemme know more about da issues of mouse with sp2...n guyz isnt it strange that i hv adawre...spybot..norton av...mcafee firewall...windws spyware remover...on my comp fully updated but still whenever i go to net a pop up from ZAdpower pops out with add.....n i still havent found solution to the third problem...dude trojan hunter showed one entry(in mcafee firewall which ws a cracked version downloaded from p2p)....but even after removin it the prob is still there

krishnathelord · Apr 20, 2005

as of mouse its faulty
if it is under warranty replace it and if it is not then through it out of the window and get a new on e

and ur 3rd question please post ur highjack log 8) :lol:

vysakh · Apr 20, 2005

if your mouse is moving real slow, y dont you increase its speed from control panel

chinmay · Apr 21, 2005

ofcourse i hv increased the speed....but actually the prblem was very simple and interesting one...actually i have an optical mouse and my mouse pad is little curved shaped(i folded it once)..so at hte area in which pad was not in contact with the mouse it moved real slow and other places it moved fast....its workin fine now...btw what is this hijack log???

krishnathelord · Apr 21, 2005

highjack log is a log created by a programe called highjack

search or location in google.
the are pro like swatkat whould help u out

ctrl_alt_del · Apr 21, 2005

Actually its HijackThis. download.com has to say this about it:

If persistent spyware is bogging down your computer, you might need HijackThis. The tiny program examines vulnerable or suspect parts of your system, such as browser helper objects and certain types of Registry keys. Pressing the Scan button generates a log of dozens of items, most of which are just customizations. Don't check off an item and hit the Fix checked button unless you're sure it's malware. Clicking Info on selected item tells you why the entry was flagged as suspicious, but not whether it's actually malware. To find that out, search the Web for that item's name or go straight to a forum, such as SpywareInfo or Computer Cops. Saving the log creates a text document you can post to these forums.

The latest version adds powerful tools to the Config window. The process manager and hosts file editor help you excise virulent infections. The unique ADS Spy tool scans for alternate data streams, which some browser hijackers use to hide from spyware removers. The program still installs into whatever directory in which you unzip the file, which can make it hard to locate. HijackThis is a serious tool for any user who needs to root out a serious infestation, but wield it with caution.

Download it here:
*www.download.com/HijackThis/3000-8022_4-10379544.html?tag=lst-0-1

chinmay · Apr 21, 2005

well guyz...igot it...here is my hijack this log file:-

Logfile of HijackThis v1.99.1
Scan saved at 5:12:41 PM, on 4/21/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TagScanner\Tagscan.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\eLitecore\Cyberoam Client for 24Online\CyberoamClient.exe
C:\Program Files\DAP\DAP.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Chinmay Dhandhania\Local Settings\Temp\HijackThis.exe

R3 - URLSearchHook: (no name) - {C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: CIEObject Object - {5D647E9C-6B37-4636-9A78-DADB1EB93BDF} - C:\WINDOWS\System32\CtxPopup.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [InteliSys] C:\WINDOWS\smss.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [AdUpdater] C:\WINDOWS\sysupudt.exe
O4 - HKLM\..\Run: [AdPopup] C:\WINDOWS\dcf5678.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [WindowsFY] c:\wp.exe
O4 - Global Startup: 24Online Client.lnk = C:\Program Files\eLitecore\Cyberoam Client for 24Online\CyberoamClient.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Microsoft AntiSpyware helper - {26F2505D-276A-4D13-8C36-2F08B03C344C} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {26F2505D-276A-4D13-8C36-2F08B03C344C} - (no file) (HKCU)
O15 - Trusted Zone: *.boxsearch.net
O15 - Trusted Zone: *.brdatahost.com
O16 - DPF: {11120607-1001-1111-1000-110199901123} - ms-its:mhtml:file://c:default.mht!*www.globolook.com/v179/dropper.chm::/dropper.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - *v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1113539920593
O16 - DPF: {D8A8A7F1-53EF-41F2-B44D-F3E2E595DC27} - ms-its:mhtml:file://C:\MAIN.MHT!*69.50.163.254/331//main.chm::/update.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{3195A4B6-AD01-4E02-BF97-3686A3864529}: NameServer = 202.56.215.6,202.56.230.6
O17 - HKLM\System\CS1\Services\Tcpip\..\{3195A4B6-AD01-4E02-BF97-3686A3864529}: NameServer = 202.56.215.6,202.56.230.6
O17 - HKLM\System\CS2\Services\Tcpip\..\{3195A4B6-AD01-4E02-BF97-3686A3864529}: NameServer = 202.56.215.6,202.56.230.6
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

chinmay · Apr 21, 2005

Hey swatkat...here is the RunBkUp.reg file...now plz tell me whats the problem...

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE"
"InteliSys"="C:\\WINDOWS\\smss.exe"
"iTunesHelper"="C:\\Program Files\\iTunes\\iTunesHelper.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe"
"AdUpdater"="C:\\WINDOWS\\sysupudt.exe"
"AdPopup"="C:\\WINDOWS\\dcf5678.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"

BTW i cudnt find autoexec.bat...where is it??

bharathbala2003 · Apr 21, 2005

well am not a pro as swat is but then this is wat i think..

R3 - URLSearchHook: (no name) - {C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70} - (no file)
O2 - BHO: CIEObject Object - {5D647E9C-6B37-4636-9A78-DADB1EB93BDF} - C:\WINDOWS\System32\CtxPopup.dll
O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)

the above one's in red i suppose are to be fixed..

am not too sure about the below ones in blue.. haven seen em in much of HJT..

O15 - Trusted Zone: *.boxsearch.net
O15 - Trusted Zone: *.brdatahost.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{3195A4B6-AD01-4E02-BF97-3686A3864529}: NameServer = 202.56.215.6,202.56.230.6
O17 - HKLM\System\CS1\Services\Tcpip\..\{3195A4B6-AD01-4E02-BF97-3686A3864529}: NameServer = 202.56.215.6,202.56.230.6
O17 - HKLM\System\CS2\Services\Tcpip\..\{3195A4B6-AD01-4E02-BF97-3686A3864529}: NameServer = 202.56.215.6,202.56.230.6

bharathbala2003 · Apr 21, 2005

chinmay_d said:
Hey swatkat...here is the RunBkUp.reg file...now plz tell me whats the problem...

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE"
"InteliSys"="C:\\WINDOWS\\smss.exe"
"iTunesHelper"="C:\\Program Files\\iTunes\\iTunesHelper.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe"
"AdUpdater"="C:\\WINDOWS\\sysupudt.exe"
"AdPopup"="C:\\WINDOWS\\dcf5678.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"

BTW i cudnt find autoexec.bat...where is it??

i suppose the three needs to be fixed.. haven heard of em mayb swat will b more clearer..

as for autoexec.bat its an important MBR file.. i think its in the C:\Windows\system32

swatkat · Apr 21, 2005

chinmay_d said:
well guyz...igot it...here is my hijack this log file:-

Logfile of HijackThis v1.99.1
Scan saved at 5:12:41 PM, on 4/21/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TagScanner\Tagscan.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\eLitecore\Cyberoam Client for 24Online\CyberoamClient.exe
C:\Program Files\DAP\DAP.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Chinmay Dhandhania\Local Settings\Temp\HijackThis.exe

R3 - URLSearchHook: (no name) - {C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: CIEObject Object - {5D647E9C-6B37-4636-9A78-DADB1EB93BDF} - C:\WINDOWS\System32\CtxPopup.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [InteliSys] C:\WINDOWS\smss.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [AdUpdater] C:\WINDOWS\sysupudt.exe
O4 - HKLM\..\Run: [AdPopup] C:\WINDOWS\dcf5678.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [WindowsFY] c:\wp.exe
O4 - Global Startup: 24Online Client.lnk = C:\Program Files\eLitecore\Cyberoam Client for 24Online\CyberoamClient.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Microsoft AntiSpyware helper - {26F2505D-276A-4D13-8C36-2F08B03C344C} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {26F2505D-276A-4D13-8C36-2F08B03C344C} - (no file) (HKCU)
O15 - Trusted Zone: *.boxsearch.net
O15 - Trusted Zone: *.brdatahost.com
O16 - DPF: {11120607-1001-1111-1000-110199901123} - ms-its:mhtml:file://c:default.mht!*www.globolook.com/v179/dropper.chm::/dropper.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - *v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1113539920593
O16 - DPF: {D8A8A7F1-53EF-41F2-B44D-F3E2E595DC27} - ms-its:mhtml:file://C:\MAIN.MHT!*69.50.163.254/331//main.chm::/update.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{3195A4B6-AD01-4E02-BF97-3686A3864529}: NameServer = 202.56.215.6,202.56.230.6
O17 - HKLM\System\CS1\Services\Tcpip\..\{3195A4B6-AD01-4E02-BF97-3686A3864529}: NameServer = 202.56.215.6,202.56.230.6
O17 - HKLM\System\CS2\Services\Tcpip\..\{3195A4B6-AD01-4E02-BF97-3686A3864529}: NameServer = 202.56.215.6,202.56.230.6
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Run HijackThis, click "Do a System scan only" button, and put a check mark for the items which are made red above. Then close ALL open windows, programs except HijackThis, and click the button "Fix".

After this, delete these files:-
CtxPopup.dll
C:\WINDOWS\smss.exe
C:\WINDOWS\sysupudt.exe
C:\WINDOWS\dcf5678.exe
c:\wp.exe
Delete the files present in above mentioned path only.

After this, get SpyBot SnD, AdAware and do a full system scan using them. Then download SpywareBlaster and run it and click the button "Enable All Button".
*security.kolla.de/
*www.lavasoftusa.com/software/adaware/
*www.javacoolsoftware.com/spywareblaster.html

Download CCLeaner, and run it. Click the Options button, and here clikc Settings tab, adn UNCHECK the option "Delete temp files older than 8 hours". Then clikc "Run Cleaner". Restart PC.
*www.ccleaner.com/
After this, post a fresh log file of HijackThis.

swatkat · Apr 21, 2005

chinmay_d said:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE"
"InteliSys"="C:\\WINDOWS\\smss.exe"
"iTunesHelper"="C:\\Program Files\\iTunes\\iTunesHelper.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe"
"AdUpdater"="C:\\WINDOWS\\sysupudt.exe"
"AdPopup"="C:\\WINDOWS\\dcf5678.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"

Go to Start> Run and type regedit and press ENTER. Then navigate to this key [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]. Click on the key, this will display some VALUES at the RIGHT PANE of the Registry Editor. Then right-click on the entries which are made RED by me, and click "Delete".

Most probably, Autoexec.bat is non existant in your system, so dont worry.
Also, download TrojanHunter and perform a full system scan.

chinmay · Apr 23, 2005

hey swatkat thnx 4 workin upon my prob but i still cant change my wallpaper...nothin was shown in all those cleaners u mentioned...i think some settings of windows has been changed....i wanna shw u ppl a screenshot of 1 of my windows.....but then i dont have the pic on net...where should i upload it n how..?

Sourabh · Apr 23, 2005

well Press the print screen to capture the screen shot and paste it in MSPAINT

save the file in jpeg format

upload the image at www.imageshack.us and post the direct link here

hope u get the procedure

Help Me Out Guyzzzz!!!!!

chinmay

Journeyman

theraven

Technomancer

swatkat

Technomancer

mako_123

Ambassador of Buzz

chinmay

Journeyman

chinmay

Journeyman

krishnathelord

In the zone

vysakh

Padawan

chinmay

Journeyman

krishnathelord

In the zone

ctrl_alt_del

A Year Closer To Heaven

chinmay

Journeyman

chinmay

Journeyman

bharathbala2003

why need title?

bharathbala2003

why need title?

swatkat

Technomancer

swatkat

Technomancer

chinmay

Journeyman

Sourabh

Laptoping