PCTech Forums

ok so yea my computer crashed yesterday ...... and so i wiped my hard disk and reinstalled WINXP Pro......everythin worked good for 2 hurs then i got this junk


Logfile of HijackThis v1.98.2
Scan saved at 6:29:29 PM, on 9/25/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\ass\Desktop\everything i need\Panicware\Pop-Up Stopper\dpps2.exe
C:\PROGRA~1\AIM\aim.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\spoolsvc.exe
C:\Documents and Settings\ass\Desktop\everything i need\Panicware\Pop-Up Stopper\dpps2.exe
C:\WINDOWS\System32\winhelpsv.exe
C:\Program Files\Messenger\msmsgs.exe
c:\windows\temp\G8kDLCEe.exe
C:\Documents and Settings\ass\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\Documents and Settings\ass\Desktop\everything i need\Panicware\Pop-Up Stopper\dpps2.exe"
O4 - HKLM\..\Run: [WINDOWSmssoi32] C:\WINDOWS\mssoi32.exe
O4 - HKLM\..\Run: [9C9E0523] C:\WINDOWS\System32\ncweymwasm.exe
O4 - HKLM\..\Run: [Sygate Personal Firewall] Win32e.exe
O4 - HKLM\..\Run: [Windows Help Service] winhelpsv.exe
O4 - HKLM\..\Run: [Windows media service] crvss.exe
O4 - HKLM\..\Run: [Win32 USB2 Driver] rofl.exe
O4 - HKLM\..\Run: [Win32 System Spool] spoolsvc.exe
O4 - HKLM\..\Run: [G8kDLCEe] c:\windows\temp\G8kDLCEe.exe
O4 - HKLM\..\RunServices: [Sygate Personal Firewall] Win32e.exe
O4 - HKLM\..\RunServices: [Windows Help Service] winhelpsv.exe
O4 - HKLM\..\RunServices: [50F34484] C:\WINDOWS\System32\ncweymwasm.exe
O4 - HKLM\..\RunServices: [Windows media service] crvss.exe
O4 - HKLM\..\RunServices: [Win32 USB2 Driver] rofl.exe
O4 - HKLM\..\RunServices: [Win32 System Spool] spoolsvc.exe
O4 - HKLM\..\RunOnce: [Win32 USB2 Driver] rofl.exe
O4 - HKLM\..\RunOnce: [Win32 System Spool] spoolsvc.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v ... 6056847201

I noticed you Downloaded HJT to a TEMP folder,always download to a folder OTHER than Temp/Temorary Internet Folders.

EG---- Open MyDocuments----Right click an empty spot and select NEW---Folder----Name the new folder HJT ---this is where you will want to save Hijackthis too, also, backups will be stored there.
Download a fresh copy from here:
http://www.spywareinfo.com/~merijn/files/HijackThis.exe
or here:
http://aumha.org/downloads/hijackthis.exe

Ok now...Set Windows to show Hidden files and folders
* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.

**(Always create a Folder for HiJackThis anywhere but your Temp/Temporary Internet Folders. This is where it will save the backup files needed if there's a problem.)**

Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following: (They may or may not be there)

winhelpsv.exe
G8kDLCEe.exe
ncweymwasm.exe
mssoi32.exe

Turn off System Restore. (Turn it back on after this is repaired and you've rebooted.) Close all other open Windows and have HiJackThis Fix:


O4 - HKLM\..\Run: [WINDOWSmssoi32] C:\WINDOWS\mssoi32.exe
O4 - HKLM\..\Run: [9C9E0523] C:\WINDOWS\System32\ncweymwasm.exe
O4 - HKLM\..\Run: [Windows Help Service] winhelpsv.exe
O4 - HKLM\..\Run: [G8kDLCEe] c:\windows\temp\G8kDLCEe.exe
O4 - HKLM\..\RunServices: [Windows Help Service] winhelpsv.exe
O4 - HKLM\..\RunServices: [50F34484] C:\WINDOWS\System32\ncweymwasm.exe

Go to Control Panel / Add/Remove Programs and remove the
following if they are there:

winhelpsv
Windows Help Service
G8kDLCEe
50F34484
WINDOWSmssoi32

Now delete these Folders or Files that are Highlighted: (You may need enable "Show all Files" and disable "Hide System Files" in Windows Explorer / Tools / Folder Options / View Tab) (You may have to boot to "Safe Mode" in order to delete some Files/Folders)

C:\WINDOWS\System32\winhelpsv.exe
c:\windows\temp\G8kDLCEe.exe
C:\WINDOWS\System32\ncweymwasm.exe
C:\WINDOWS\mssoi32.exe

Now, empty all your TEMP Folders (WinXp has up to 4 of them) / Temporary Internet Files Folder and then empty your "Recycle Bin" and Reboot.

Turn on System restore,before opening your browser goto TOOLS>INTERNET OPTIONS and make sure your Homepage is correct,if not ,type the URL you would like in the HomePage box.

Now re-run HJT and post a new logfile back here.


Cactus

Please follow these simple rules:

1. IMPORTANT! The Fact that you are posting here more than likely means you need some kind of help or support so DO NOT give your post a title of:

* HELP ME PLEASE!
* I NEED HELP!
* I have a question.
* BIG problem!
* NOOB needs help!
* Problems
* URGENT!
* HELP ME PLEASE
* Dont just use 2 word topics
* Anything similar to the above!

2. Instead be descriptive about the problem or use an error message if you have one. Give clear and descriptive titles that allow people to search the forum and find topics related to there problem in a fast and easy way.

LOL it crashed so u wiped it?? lol
strange!
hope its worked tho

Venney