My current HJT log - Thank You!

Forums: Computers
Email this Topic • Print this Page

Hi all you powerful computer gods (do we have any computer godesses?) My computer is having problems connecting to the internet - the DSL box seems to be working fine. I just get no connection. And, periodically I get a frozen, locked down computer which won't even recognize ctrl/alt/del.

I can't even tell if I've downloaded the current version of HJT, but here's my log in the hopes that it may help someone figure out what's wrong. Thanks!

Logfile of HijackThis v1.99.1
Scan saved at 11:35:37 AM, on 10/29/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\NORTONSYMANTEC\navapsvc.exe
C:\Program Files\NORTONSYMANTEC\IWP\NPFMntor.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\IZArc\IZArc.exe
C:\DOCUME~1\Kris\LOCALS~1\Temp\ARC19\HijackThis.exe

R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\NORTONSYMANTEC\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\NORTONSYMANTEC\NavShExt.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - Startup: Norton AntiVirus 2005.lnk = C:\Program Files\Common Files\Symantec Shared\NMain.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3299935F-2C5A-499A-9908-95CFFF6EF8C1} (Quicksilver Class) - https://vapwda.ops.placeware.com/etc/place/DESK/VADpws-a3s/5.1.8.511/lib/quicksilver.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1122347545779
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1122347888953
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab
O16 - DPF: {BCD5A227-8720-497B-AF5F-4403E94342E3} (CDDM Object) - https://netservices.verizon.net/portal/verizon/passwdchg/activex/DSLControl.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {EFAEF0E4-F044-4D57-9900-1C3FF18524C9} (AV Class) - http://www.pcpitstop.com/antivirus/PitPav.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by101fd.bay101.hotmail.msn.com/activex/HMAtchmt.ocx
O16 - DPF: {F229AB32-7BF9-4225-B78F-B4680AE6FC23} (Snapfish File Upload ActiveX Control) - http://www.snapfish.com/SnapfishUpload.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\NORTONSYMANTEC\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\NORTONSYMANTEC\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\NORTONSYMANTEC\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe (file missing)

Topic Stats
Top Replies
Link to this Topic

Type: Discussion • Score: 1 • Views: 1,343 • Replies: 14

No top replies

No one? Is there another website where I can check my list against known threats?

0 Replies

This line:
C:\DOCUME~1\Kris\LOCALS~1\Temp\ARC19\HijackThis.exe

shows you are running HJT from a temporary folder, which is a no-no. While it appears you have the latest version of HJT, I suggest you either move it to its own folder on your C: drive (open "My Computer", select your C: Drive folder, click "Explore", then right-click anywhere in a blank, empty area of the folder, select "New", the "Folder", and name the newly created folder something like "HJT"), or in your Programs folder (same trick, just locate your "Programs" folder and create the new HJT folder there), or uninstall/delete your current version and download this Self-Extracting .Zip file, which will properly install HJT with no further user input beyond clicking on the file once its been downloaded.

Though not malicious, the following entries should be "fixed" by HJT:

R3 - Default URLSearchHook is missing

O16 - DPF: {3299935F-2C5A-499A-9908-95CFFF6EF8C1} (Quicksilver Class) - https://vapwda.ops.placeware.com/etc/place/DESK/VADpws-a3s/5.1.8.511/lib/quicksilver.cab

O23 - Service: SymWMI Service (SymWSC) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe (file missing)

Run HJT WITH NO OTHER WINDOWS OR BROWSERS OPEN, place a checkmark next to each of the above entries only, then click "Fix Checked".

Now - on to your problem. No obvious yuckware signatures appear in the log you posted. Have you done any yuckware removal recently? The 023 entry listed above in red troubles me some; it indicates a problem with your Norton/Symantec software. This is something which could be caused either by yuckware itself, or by steps taken to remove yuckware. I recommend you completely uninstall then reinstall your Norton/Symantec software (See Symantec: Removing your Norton programs using SymNRT), which in this case appears to be stand-alone Norton Antivirus, though you might have Norton Internet Security. As you have Sygate Personal Firewall installed and running, a conflict with Norton Internet Security's firewall is all but inevitable. Use one or the other, but not both; uninstall the one you won't be using.

Its possible your connectivity problems are related to a corrupted Winsock stack. With WinXP/SP2, there's a relatively simple command-line fix. You are running Win2K though, which calls for a different approach.

Download This File to your desktop, saving it as "*.* All files" type. Don't do anything with it yet, just download it to somewhere you can find it easily.

Next, just to be safe, Back up your registry (Also see: Microsoft - How To Use the Backup Program to Back Up and Restore the System State in Windows 2000). Its always good practice to back up the registry before doing anything involving it; that way, if anything screws up, you at least should be able to get back to where you were systemwise.

Now, locate the file I just asked you to download-without-executing and double-click to run it, confirming you wish to merge it into your registry when prompted. Reboot and see what happens when you try to connect to the internet and browse from page to page.

Lemme know how it goes.

0 Replies

Timber - thank you!

I am learning, slowly. I almost (decided to wait for you) went ahead to fix the R3 and 016 lines because they didn't look right. Meanwhile, I ran a disk health thing and deleted a bunch of software I use 'rarely' (god help me).

My sym/norton is NOT working right. Especially the internet worm files. I've already printed the info for uninstalling and reinstalling norton, but the whole thing scares me. I'll do it tomorrow when I have a block of time (maaaaybe tonight.....).

I can't back up anything to CD because I don't have a writing drive.

My HJT is messed up (I think) because when I tried to check for the latest update there was no way to do it except for downloading it anew (so far as I could tell).

0 Replies

I tired to back up the system but it errored saying that Drive A:\Backup.bkf is empty.

0 Replies

I can't run both sygate and norton?

0 Replies

littlek wrote:

I can't run both sygate and norton?

You should not have more than one software firewall active, nor should you have more than one real-time protection antivirus application active and running at any one time. Many will not play well together, causing "sluggishness", instability issues, system hangs, even apparently inescapable lockups, and sometimes fairly spectacular total "only-way-to-recover-is-to-power-off-and-reboot"crashes, some of which symptoms you describe experiencing. Its possible resolving your problems might be as easy as getting your system whittled down to one active example each of firewall and antivirus (if you happen also to have an extra one of those running).

earlier, you wrote:

I tired to back up the system but it errored saying that Drive A:\Backup.bkf is empty.

OK, I think I know what's going on there, but no biggie; there's not much to be served by stepping you through how to get by that - the write-capable optical drive (Cd burner) you don't have is the obvious, easy (though not only) solution. Before doing what I outline below as "Plan B", first see what happens when you sort out the firewall/antivirus deal. That just might be all you need to do.

Now for Plan B - if you think you gotta/wanna. This may be getting beyond what you feel comfortable with, but if you wanna go ahead with the Registry Fix, I suggest before executing the downloaded Registry Fix, you at least back up just the keys that will be affected:

Start>Run, type, without the quotes, "regedt32.exe", then either click "OK" or hit <Enter> to open the Registry Editor. Expand [HKEY_LOCAL_MACHINE\SYSTEM\] and find [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2].

Under that, find [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters].

On the Registry menu, click "Save Key". In the "Save in" dialog box, select or create an easy-to-find-later location in which to save the .reg file, type a file name (the last word or string of the key's name - in this case "Parameters" - will do fine) in the "File" name box, and then click "Save", making sure the file is saved as the "All Files" type.

Next, locate [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5]. Repeat the "Save" procedure and then continue with the keys:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001]. (here, use the last word of the key name, "Catalog_Entries" AND the numeric string, "000000000001" for the file name, as " Catalog_Entries 000000000001 - don't use the "special character" \; "special characters" are not allowed as part of a file name.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002].

Next, navigate to [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9], and repeat the "save" procedure with that and the following keys;

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] (remember to use the last word and the numeric string as the file name, without the special character "\"),

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002],

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003],

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004],

and

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005], then close Registry Editor.

Now, locate the downloaded Registry Fix file and double-click-and-confirm to merge the downloaded registry fix into your registry, reboot, and see what happens.

Just for reference, what the "new" registry entries should be may be determined by right-clicking on the downloaded Registry Fix file, selecting "Open With ... " Notepad, and confirming, which will cause the registry fix to open as a text file. Whatever else you do, DO NOT EDIT IT.

The Fix as downloaded is well known, widely recommended and used, tested-and-proven-safe. If you feel gutsy, you can be fairly confident you can execute it (as instructed, of course) without backing up registry keys. Nothing bad should happen, even though we're dealing with Windows Mr. Green

It might be best to leave "Plan B" to someone higher up in the geek tree than yourself if you're uncomfortable with/uncertain of the procedure. Its really pretty simple, but then, so's rebuilding a carburetor, if you know what you're doing :wink:

0 Replies

You worried that perhaps this last post was getting beyond me..... I was already gotten beyond.

Do I need anything to back up norton a-v if I stop running sygate firewall?

0 Replies

And, as always, thank you, Timber!

0 Replies

As long as you have one currently updated, properly configured software firewall up and running, there's no reason to have another installed, active or not. It can be done, though the hoops you gotta go through to make such a setup work reliably are more than most folks ever will need - or want - to deal with. When it comes to antivirus, a backup for on-demand second opinions, run only to update as necessary and when wanted for a second opinion is a good idea. Whenever using the backup antivirus (or an online virus scanner), deactivate the real-time protection of the primary antivirus. Remember, of course, to re-enable your primary before wandering off out onto the web.

0 Replies

is norton a-v the same as a firewall......? And, would pcpitstop.com be a good back-up second opinion?

0 Replies

No, Norton a-v is a stand-alone antivirus, though if you have Norton Internet Security, not just Norton a-v, you would have Norton Firewall as well. PC-Pitstop's online scanner (which actually is Panda's ActiveScan) is fine for a backup scan - set your resident antivirus to scan at least weekly, and around once a month or so, or whenever suspicious, go to an online scanner's home page, disable the real-time protection of your resident antivirus, and run the online scan. When finished, restore your resident a-v's real-time protection.

Its not real difficult to maintain multiple antivirus apps resident on a single machine, only one of which is configured for always-on, start-with-Windows, real-time protection, though some don't play well together without some tweaking, and most folks really have no need to do so anyhow. Its even quite doable to have multiple antivirus apps running simultaneously without interfering with one another, though that can take a good bit of tweaking, apart from placing a load on system resources, and is impractical in all but very specialized instances, and even then its really workable only on machines with very fast processors and gobs and gobs of RAM.

Without going a lot further into stuff you probably have no interest in or need for knowing, its also possible to submit individual files to a variety of online or reply-by-mail "single file scanners", some of which actually run the submitted file through several mainline major-brand virus and/or yuckware scanners.

Thats something really of use only to folks who deal heavily with security and privacy, though its not alltogether uncommon for skilled, experienced yuckware removal advisors occasionally to ask a client send an unknown suspect file to one or more of them and report back the results.

Anyhow, one (1) reliable, reputable resident antivirus, one (1) reliable, reputable resident firewall; that's all most folks should have on a machine - one of each. If you're running more than one machine on a small network, its generally most practical to have all machines running the same security/privacy software, particularly firewall software. That makes configuration for interoperability and communication among the subject machines much, much simpler.

Some folks contend that if a small network is configured for intenet access sharing, all 'net traffic passing through a single machine configured as the access point/server for the network, that the daughter machines/work stations don't need resident protection of their own. I understand the argument, but I disagree with it; every machine should have its own protection, IMO.

0 Replies

Ok, I priced the norton suite (a-v, firewall, securities, blahblahblah) and will purchase that before my norton a-v expires in february - maybe well before.

I'd worked out that above schedule (norton scan weekly and pcpitstop when having issues or periodically).

We do have a little network here with 2 laptops connected either via wireless or by cable. It sort of depends on who's here any given semester. There is issue, sometimes, with their operating systems and securities being different than mine. but, I figure that the whole thing works, cantankerously maybe, reasonably well (after many hours on tech calls and much tinkering).

Now, in the interim, I will attempt the ominous uninstall-reinstall on sunday.

Thanks again Timber!

0 Replies

Yer entirely weccum. Hope I helped some, though I'm sure I confused you some, too. Sorry 'bout that - can't help it. I'm a lousy teacher; I tend to forget Embarrassed

stuff I totally take for granted/don't even think about is all-new and unheard-of for "computer civilians" :wink: - sorta like telling someone who doesn't know how to ride a bicycle "Just get on and pedal" Laughing

0 Replies

Timber, I don't think you're a lousy teacher - you're very thorough which is important.

After being offline all day, I decided to try and call verizon to see if they could do anything for me. The service was shockingly fast and perky. And, stupidly on my part, the solution was also quick and easy - I just had to unplug the dsl and router boxes for a bit. It doesn't suffice to shut them down.

So, I got back online (while I was off I uninstalled sym a-v) and reinstalled sym a-v. It wasn't as glitch-free, but it worked. then I downloaded sym firewall, dumped the sygate firewall and now I'm running smoothly. I should maybe do a general clean up a la timber soon, but for today (and maybe all week), I'll just enjoy my computer again.

Timber, you're a guiding light! Thanks a million more times.

0 Replies

My current HJT log - Thank You!

Related Topics

Quick Links

My Account

able2know