I have a problem with a Windows XP SP2 system that has demonstrated several irregularities. Regedit will open and after 10 seconds it would close automatically. Additionally, after doing a Google search, I would click on a link and end up going to a random website. It doesnt happen everytime but enough to get my attention. Additionally, chkdsk doesnt run after rebooting. I ran Spyware Doctor in Safe Mode and all the problems mentioned happened in Safe Mode as well.
Ive run the following programs in order to try and find a virus, adware or spyware:
Spyware Doctor 6.0.0.386
http://www.trendmicro.com/housecall
EZTrust 7.0 Virus Scan
sfc /scannow
Advanced System Care 3
Ive also followed the directions from your "Steps to Take Before Posting":
I went to Add/Remove Programs and did not find any of the listed applications. I also went through and removed any programs that seemed out of place
Ran Spybot - Search and Destroy in Safe Mode - found a few things but all were cookies
Rebooted to Safe Mode
Ran Ad-Aware and only found one cookie
Rebooted to Desktop
Ran Regedit again and window closed after 10 seconds
Here is the HiJackThis log file:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:08:00 PM, on 3/25/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSSystem32cisvc.exe
D:Program FilesDiskeeper CorporationDiskeeperDkService.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesCAeTrust AntivirusInoRpc.exe
C:Program FilesCAeTrust AntivirusInoRT.exe
C:Program FilesCAeTrust AntivirusInoTask.exe
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
C:Program FilesReflectionrtsserv.exe
C:WINDOWSsystem32r_server.exe
C:WINDOWSProPatchesSchedulerstSchedEx.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesRealVNCVNC4WinVNC4.exe
C:WINDOWSsystem32MsPMSPSv.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:Program FilesCommon FilesMicrosoft SharedWorks SharedWkUFind.exe
C:Program FilesHewlett-PackardPhotoSmartPhoto ImagingHpi_Monitor.exe
C:Program FilesJavajre1.6.0_01binjusched.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesAdobeAcrobat 6.0Distillracrotray.exe
C:Program FilesJavajre1.6.0_01binjucheck.exe
C:WINDOWSsystem32cidaemon.exe
C:Documents and Settingsitadmin.bhtnDesktopHiJackThis.exe
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page =
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre1.6.0_01binssv.dll
O4 - HKLM..Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM..Run: [Microsoft Works Update Detection] C:Program FilesCommon FilesMicrosoft SharedWorks SharedWkUFind.exe
O4 - HKLM..Run: [CXMon] "C:Program FilesHewlett-PackardPhotoSmartPhoto ImagingHpi_Monitor.exe"
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre1.6.0_01binjusched.exe"
O4 - HKLM..Run: [Ad-Watch] C:Program FilesLavasoftAd-AwareAAWTray.exe
O4 - HKCU..Run: [Advanced SystemCare 3] "C:Program FilesIObitAdvanced SystemCare 3AWC.exe" /startup
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 - HKUSS-1-5-18..RunOnce: [RunNarrator] Narrator.exe (User SYSTEM)
O4 - HKUSS-1-5-18..RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%InstallerTSClientMsiTranstscuinst.vbs" (User SYSTEM)
O4 - HKUSS-1-5-18..RunOnce: [] (User SYSTEM)
O4 - HKUS.DEFAULT..RunOnce: [RunNarrator] Narrator.exe (User Default user)
O4 - Global Startup: Acrobat Assistant.lnk = C:Program FilesAdobeAcrobat 6.0Distillracrotray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:Program FilesAdobeAcrobat 7.0Readerreader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_01binssv.dll
O9 - Extra Tools menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_01binssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra Tools menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1ED48504-8834-11D5-AC75-0008C73FD642} (ProductView Express) - file://D:ptcproei486_ntobjpvx_install.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://ushousecall02.trendmicro.com/hou ... hcImpl.cab
O16 - DPF: {44C7F862-906C-11D3-A8ED-0008C75B3588} (IEPAPI Class) - http://docs1/CyberDOCS/Plugins/papibrdg.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 1182576871
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/i ... ection.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 1186971069
O16 - DPF: {72C23FEC-3AF9-48FC-9597-241A8EBDFE0A} (InstallShield International Setup Player) - http://docs1/CyberDOCS/Plugins/isetupml.cab
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:Program FilesAcadm 6AcDcToday.ocx
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:Program FilesAcadm 6InstBanr.ocx
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:Program FilesAcadm 6InstFred.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:Program FilesAcadm 6AcPreview.ocx
O16 - DPF: {F694EA1F-2EC1-445D-8988-1862AD0CC4C8} (pvvercheck_ie Control) - http://31s004.bushhog.local/Windchill/w ... eck_ie.cab
O17 - HKLMSystemCCSServicesTcpipParameters: Domain = BHTN.local
O17 - HKLMSoftware..Telephony: DomainName = bhtn.local
O17 - HKLMSystemCS1ServicesTcpipParameters: Domain = BHTN.local
O17 - HKLMSystemCS1ServicesTcpipParameters: SearchList = bhtn.local,bushhog.local
O17 - HKLMSystemCS2ServicesTcpipParameters: Domain = BHTN.local
O17 - HKLMSystemCS2ServicesTcpipParameters: SearchList = bhtn.local,bushhog.local
O17 - HKLMSystemCCSServicesTcpipParameters: SearchList = bhtn.local,bushhog.local
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:WINDOWSsystem32Ati2evxx.exe
O23 - Service: Diskeeper - Diskeeper Corporation - D:Program FilesDiskeeper CorporationDiskeeperDkService.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:Program FilesCAeTrust AntivirusInoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:Program FilesCAeTrust AntivirusInoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:Program FilesCAeTrust AntivirusInoTask.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:Program FilesLavasoftAd-AwareAAWService.exe
O23 - Service: Reflection TimeSync - WRQ, Inc. - C:Program FilesReflectionrtsserv.exe
O23 - Service: Remote Administrator Service (r_server) - Unknown owner - C:WINDOWSsystem32r_server.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:Program FilesSpyware DoctorpctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:Program FilesSpyware DoctorpctsSvc.exe
O23 - Service: Shavlik Remote Scheduler Service (Shavlik Scheduler) - Shavlik Technologies - C:WINDOWSProPatchesSchedulerstSchedEx.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:Program FilesRealVNCVNC4WinVNC4.exe
--
End of file - 7548 bytes
Any help would be greatly appreciated - of course
Read More...
No comments:
Post a Comment