|
| ||
| startup problem Ok this is a pretty recent problem i am having with my windows xp. When i load the operating system a program called cisvc.exe or someting close to that runs.for a while everything is alright but then this program starts eating up my cpu ussage. If i shut off the program then everything is fine but if i shut it off to early my windows won't load properly. I tried scanning this program with mcafee it doesn't appear to a virus, and i did a scan with microsoft anitspyware and it doesnt seem to be spyware either. What should i do about this. here is my hjt log Logfile of HijackThis v1.99.1 Scan saved at 11:01:56 AM, on 3/13/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alias\Maya6.0\docs\Wrapper.exe C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe D:\CFusionMX\db\slserver52\bin\swagent.exe C:\Program Files\Alias\Maya6.0\docs\jre\bin\java.exe D:\CFusionMX\db\slserver52\bin\swstrtr.exe D:\CFusionMX\db\slserver52\bin\swsoc.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Executive Software\Diskeeper\DkService.exe c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\tcpsvcs.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE C:\Program Files\Microsoft Hardware\Mouse\point32.exe C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\Program Files\Java\jre1.5.0\bin\jusched.exe C:\WINDOWS\nwcfp.exe C:\WINDOWS\system32\ctfmon.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\WINDOWS\system32\rundll32.exe c:\progra~1\mcafee.com\vso\mcvsftsn.exe C:\Program Files\ISTsvc\istsvc.exe C:\Program Files\iPod\bin\iPodService.exe D:\Program Files\TechSmith\Camtasia Studio 2\TSCHelp.exe D:\Program Files\Trillian\trillian.exe C:\Program Files\iTunes\iTunes.exe C:\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google .com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google .com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = The world wide web mofo R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 R3 - Default URLSearchHook is missing O1 - Hosts: 62.75.224.159 www.bns1.net O1 - Hosts: 62.75.224.159 www.bns2.net O1 - Hosts: 62.75.224.159 www.bns3.net O1 - Hosts: 62.75.224.159 www.bns4.net O1 - Hosts: 62.75.224.159 www.bns5.net O1 - Hosts: 62.75.224.159 www.bns6.net O1 - Hosts: 62.75.224.159 www.bns7.net O1 - Hosts: 62.75.224.159 www.bns8.net O1 - Hosts: 62.75.224.159 www.cms1.net O1 - Hosts: 62.75.224.159 www.cms2.net O1 - Hosts: 62.75.224.159 www.cms3.net O1 - Hosts: 62.75.224.159 www.cms4.net O1 - Hosts: 62.75.224.159 www.cms5.net O1 - Hosts: 62.75.224.159 www.cms6.net O1 - Hosts: 62.75.224.159 www.cms7.net O1 - Hosts: 62.75.224.159 www.cms8.net O1 - Hosts: 62.75.224.159 www.rg1.com O1 - Hosts: 62.75.224.159 www.rg2.com O1 - Hosts: 62.75.224.159 www.rg3.com O1 - Hosts: 62.75.224.159 www.rg4.com O1 - Hosts: 62.75.224.159 www.rg5.com O1 - Hosts: 62.75.224.159 www.rg6.com O1 - Hosts: 62.75.224.159 www.rg7.com O1 - Hosts: 62.75.224.159 www.rg8.com O1 - Hosts: 62.75.224.159 jcms.cydoor.com O1 - Hosts: 62.75.224.159 cydoor.com O1 - Hosts: 62.75.224.159 jnova.cjt1.net O1 - Hosts: 62.75.224.159 jcontent.bns1.m7z.net O1 - Hosts: 62.75.224.159 j.2004CMS.com O1 - Hosts: 62.75.224.159 2004CMS.com O1 - Hosts: 62.75.224.159 bns1.m7z.net O1 - Hosts: 62.75.224.159 m7z.net O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll O3 - Toolbar: (no name) - {5F1ABCDB-A875-46c1-8345-B72A4567E486} - (no file) O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [POINTER] point32.exe O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe" O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\Program Files\AIM\\DeadAIM.ocm",ExportedCheckODLs O4 - HKLM\..\Run: [8cA05rGB] C:\WINDOWS\nwcfp.exe O4 - HKLM\..\Run: [sais] c:\program files\180solutions\sais.exe O4 - HKLM\..\Run: [<°ÜZJ�YM�lY«Q°aÆ+À¼C:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\nwcfp.exe O4 - HKLM\..\Run: [svchost.] C:\WINDOWS\system32\svchost..exe O4 - HKLM\..\Run: [8cA0ºÃd+ú],ª»o8�üžõgC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\nwcfp.exe O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [svchost.] C:\WINDOWS\system32\svchost..exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Explore with &Instant Source - C:\Program Files\Instant Source\context.html O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll O9 - Extra button: Instant Source - {8BD5271D-69C9-4467-882D-5139952D7754} - C:\Program Files\Instant Source\isrc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider 'xfire_lsp_10650.dll' missing O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Alias Documentation Server (aliasdocserver) - Unknown owner - C:\Program Files\Alias\Maya6.0\docs\Wrapper.exe" -s "C:\Program Files\Alias\Maya6.0\docs/Wrapper.conf (file missing) O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: ColdFusion MX Application Server - Macromedia Inc. - D:\CFusionMX\runtime\bin\jrunsvc.exe O23 - Service: ColdFusion MX ODBC Agent - Unknown owner - D:\CFusionMX\db\slserver52\bin\swagent.exe O23 - Service: ColdFusion MX ODBC Server - Unknown owner - D:\CFusionMX\db\slserver52\bin\swstrtr.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing) O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe |
| ||
| Re: startup problem Well you got a few thinks need fixing , do the following first . ,,,,,,,,,,,,,,,,,,, Go Here and Get Trojan-Hunter Fully working trial! and run a full scan ,,,,,,,,,,,,,,,,,,,,, To remove trojans there is a tool which needs to be downloaded and run. 1. Please download Stinger and save it to your desktop 2. Double-click on the stinger.exe file and open the tool 3. Choose your entire hard drive to scan. 4. Choose Scan Now 5. Stinger will fix anything that it finds 6. Click the File menu and select Save report to file 7. Post the log file results here in this thread. STINGER ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, Reboot to SAFE mode to delete files How to start computer in safe mode Please delete your temporary files by deleting all files and folders that are in those folders (do not delete the temp folder itself) like for example C:\WINDOWS\Temp\ C:\Temp\ C:\Documents and Settings\username\Local Settings\Temp\ Also delete your Temporary Internet Files, be sure to also select delete all offline content. Do a virus scan Please do an online scan, 2 would be better, Micro World http://www.mwti.net/antivirus/free_utilities.asp Trend Micro http://housecall.trendmicro.com/hous...start_corp.asp Make sure that you choose "fix" or "clean". . ,,,,,,,,,,,,,,,,,,,,,,,,,, Download then unzip and run CWShredder to clean up clicking "FIX" to have it remove all it finds. CWShredder available from these places :- http://www.aluriasoftware.com/tools/cwshredder.zip Or this as a full download without any unzipping required http://www.downloads.subratam.org/CWShredder.exe http://www.spywareinfo.com/downloads...CWShredder.exe We have found that some of the CWS infections can be removed better from safe mode, rather than normal mode. To get to safe mode use the F8 key while booting the machine. Detailed instructions from :- HERE ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, Then please do this since it’s better to use automated tools to get rid of the bad stuff use these 2 programs first before doing the final cleaning with HJT First use Spybot S&D. (Version 1.3) Spybot Unzip, and update. Install the updates and run. Delete all that it marks in red. Reboot Then it’s time for Ad-Aware Ad-Aware Install and update by using the globe icon. Restart your computer and run Ad-Aware. Press scan now and select drives and/or partitions to be scanned. When done select all and click next. Remove all checked items and then reboot your computer. Please go to this page and read the instructions for how to configure Spybot S&D & Ad-Aware How To Setup Spybot SD and Ad-Aware ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, Then post a HJT log as a reply to this topic. |
| All times are GMT -4. The time now is 2:19 am. |
Forum system based on vBulletin Copyright ©2000 - 2009, Jelsoft Enterprises Ltd.
©2003 - 2009 DaniWeb® LLC