944,082 Members | Top Members by Rank

Ad:
You are currently viewing page 1 of this multi-page discussion thread
Sep 30th, 2004
0

Norton WMI Update doesn't work

Expand Post »
I had a little viruses attack on my computer. Did my best to get rid of them, but still some things, like Norton WMI Update, don't work. Would you be so kind to have a look in my Hjt log? (windows2000)

Logfile of HijackThis v1.98.2
Scan saved at 12:23:12, on 30/09/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINNT\system32\regsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\system32\ZONELABS\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\הפוך על הפוך\hebrew.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINNT\system32\ctfmon.exe
C:\dls\HijackThis.exe
C:\WINNT\system32\NOTEPAD.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ynet.co.il/home/0,7340,L-8,FF.html
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Hebrew] C:\Program Files\הפוך על הפוך\hebrew
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: &יצ×? ל- Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/tech...a/SymAData.dll
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/game...ploader_v5.cab
O16 - DPF: {E62A47D8-74B1-4A93-963A-E5E43B7CC5C2} (UCSearch.ucUCSearch) - http://www.zuvio.com/opnste/UCSearch.CAB
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/tech...ActiveData.cab
O16 - DPF: {EC9C20C4-FF24-11D3-81B7-00902776CF54} (InstallerActiveX Class) - http://www.netex.co.il/site/Installer.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{8D788EA0-403D-4FEE-A520-95B2284A14B0}: NameServer = 62.219.186.7 192.115.106.35
Similar Threads
Reputation Points: 10
Solved Threads: 0
Junior Poster in Training
Mady is offline Offline
92 posts
since Apr 2004
Oct 2nd, 2004
0

Re: Norton WMI Update doesn't work

Have you tried running Norton's Live Update to see if that would fix your WMI problem?

I don't see anything obvious (to me) in your log, maybe one of the pro's can spot something.
Team Colleague
Reputation Points: 63
Solved Threads: 213
Posting Maven
dlh6213 is offline Offline
2,962 posts
since Jul 2004
Oct 2nd, 2004
0

Re: Norton WMI Update doesn't work

Have you tried disabling ZoneAlarm temporarily, and then tried the update? Just a thought, as I've seen ZoneAlarm do some really odd things before.
Team Colleague
Reputation Points: 186
Solved Threads: 147
Cookie... That's it
alc6379 is offline Offline
2,519 posts
since Dec 2003
Oct 8th, 2004
0

Re: Norton WMI Update doesn't work

I've tried to uninstall norton antivirus, and than I uninstalled ZoneAlarm, and than I reinstalled Norton Antivirus, but still I have the WMI problem, and still the computer works too slow.

Here is a new log, this time without ZoneAlarm:

Logfile of HijackThis v1.98.2
Scan saved at 07:32:28, on 08/10/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINNT\system32\regsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINNT\system32\ctfmon.exe
C:\dls\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ynet.co.il/home/0,7340,L-8,FF.html
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Hebrew] C:\Program Files\הפוך על הפוך\hebrew
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: &יצ×? ל- Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/tech...a/SymAData.dll
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/game...ploader_v5.cab
O16 - DPF: {E62A47D8-74B1-4A93-963A-E5E43B7CC5C2} (UCSearch.ucUCSearch) - http://www.zuvio.com/opnste/UCSearch.CAB
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/tech...ActiveData.cab
O16 - DPF: {EC9C20C4-FF24-11D3-81B7-00902776CF54} (InstallerActiveX Class) - http://www.netex.co.il/site/Installer.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{8D788EA0-403D-4FEE-A520-95B2284A14B0}: NameServer = 62.219.186.7 192.115.106.35
Reputation Points: 10
Solved Threads: 0
Junior Poster in Training
Mady is offline Offline
92 posts
since Apr 2004
Oct 8th, 2004
0

Re: Norton WMI Update doesn't work

If the HJT looks ok, how comes that Norton Antivirus Scan finds:

Category: Threat alerts
Date,Feature,Threat Name,Action Taken,Item Type,Target,Suspicious Action,Virus Definition Version,Product Version,User Name,Computer Name,Details
08/10/2004 14:34:52,Virus scanner,Hacktool.Keygen.151552,Delete failed,File,N/A,N/A,200410060020,10.0.1.13,smaddar,PC-HOME,",Threat category: Hack toolSource: E:\RECYCLED\De1.exe,Description: The file E:\RECYCLED\De1.exe is a Hack tool threat."
08/10/2004 14:34:52,Virus scanner,Hacktool.Keygen.151552,Delete failed,File,N/A,N/A,200410060020,10.0.1.13,smaddar,PC-HOME,",Threat category: Hack toolSource: Symantec.Norton.Antivirus.2004.Professional.v10.0.0.109.WinAll.Incl.Keygenerator-TMG\keygen.exe,Description: The compressed file keygen.exe within C:\Program Files\eMule\incoming\ntnaivs.2004.Pro.Final.With.Crack.[oshrinu].[LioNetwork.net].rar is a Hack tool threat."
08/10/2004 13:26:43,Virus scanner,W32.Netsky.D@mm,Automatically deleted,File,N/A,N/A,200410060020,10.0.1.13,smaddar,PC-HOME,",Threat category: VirusSource: document_full.pif,Description: The email attachment document_full.pif is infected with the W32.Netsky.D@mm virus."
08/10/2004 12:14:28,Virus scanner,W32.Netsky.P@mm!enc,Quarantined,File,N/A,N/A,200410060020,10.0.1.13,smaddar,PC-HOME,",Threat category: VirusSource: C:\DOCUME~1\SMADDA~1.PC-\LOCALS~1\Temp\CC249.tmp,Description: The file C:\Documents and Settings\smaddar.PC-HOME\Local Settings\Temp\CC249.tmp is infected with the W32.Netsky.P@mm!enc virus."
08/10/2004 12:14:28,Virus scanner,W32.Netsky.P@mm,Automatically deleted,File,N/A,N/A,200410060020,10.0.1.13,smaddar,PC-HOME,",Threat category: VirusSource: message.scr,Description: The email attachment message.scr is infected with the W32.Netsky.P@mm virus."
08/10/2004 12:04:32,Virus scanner,W32.Netsky.P@mm,Automatically deleted,File,N/A,N/A,200410060020,10.0.1.13,smaddar,PC-HOME,",Threat category: VirusSource: data.pif,Description: The email attachment data.pif is infected with the W32.Netsky.P@mm virus."
08/10/2004 12:04:32,Virus scanner,W32.Netsky.P@mm!enc,Quarantined,File,N/A,N/A,200410060020,10.0.1.13,smaddar,PC-HOME,",Threat category: VirusSource: C:\DOCUME~1\SMADDA~1.PC-\LOCALS~1\Temp\CC247.tmp,Description: The file C:\Documents and Settings\smaddar.PC-HOME\Local Settings\Temp\CC247.tmp is infected with the W32.Netsky.P@mm!enc virus."
08/10/2004 10:51:13,Auto-Protect,Backdoor.Sdbot.AC,Automatically deleted,File,N/A,N/A,200410060020,10.0.1.13,Administrator,PC-HOME,Source: C:\WINNT\system32\svchos.exe
08/10/2004 10:49:45,Auto-Protect,Backdoor.Sdbot.AC,Automatically deleted,File,N/A,N/A,200410060020,10.0.1.13,Administrator,PC-HOME,Source: C:\WINNT\system32\svchos.exe
08/10/2004 10:20:47,Virus scanner,W32.Netsky.D@mm,Automatically deleted,File,N/A,N/A,200410060020,10.0.1.13,smaddar,PC-HOME,",Threat category: VirusSource: your_file.pif,Description: The email attachment your_file.pif is infected with the W32.Netsky.D@mm virus."
08/10/2004 10:11:49,Auto-Protect,W32.Randex,Automatically deleted,File,N/A,N/A,200410060020,10.0.1.13,Administrator,PC-HOME,Source: C:\WINNT\system32\msnmsgr.exe
08/10/2004 09:12:58,Auto-Protect,W32.Randex.BLD,Automatically deleted,File,N/A,N/A,200410060020,10.0.1.13,Administrator,PC-HOME,Source: C:\WINNT\system32\rcf.exe
08/10/2004 07:48:13,Auto-Protect,W32.Spybot.Worm,Automatically deleted,File,N/A,N/A,200410060020,10.0.0.109,Administrator,PC-HOME,Source: C:\WINNT\system32\svchosts.exe

and Panda ActiveScan finds:


Incident Status Location
Virus:W32/Sdbot.gen.worm Disinfected C:\WINNT\system32\payload.dat
Virus:W32/Sdbot.gen.worm Disinfected C:\WINNT\system32\MSsrvs32.exe

Everytime I scan my computer I find some threads. Do you think you can help me get my computer back?


And by the way, does it makes sense that the size of the folder "WINNT" is 1.25 GB?
Reputation Points: 10
Solved Threads: 0
Junior Poster in Training
Mady is offline Offline
92 posts
since Apr 2004
Oct 9th, 2004
0

Re: Norton WMI Update doesn't work

I scaned again with Panda ActiveScan. This time 5 threats were found:


Incident Status Location
Virus:W32/Sdbot.gen.worm No disinfected Operating system
Virus:W32/Sdbot.gen.worm Disinfected C:\WINNT\system32\payload.dat
Virus:W32/Sdbot.gen.worm No disinfected C:\WINNT\system32\MSsrvs32.exe
Virus:W32/Sdbot.gen.worm Disinfected C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\C9QZCL2R\new2[1].exe
Virus:W32/Sdbot.gen.worm Disinfected C:\Documents and Settings\smaddar.PC-HOME\payload.dat
Virus:W32/Sdbot.gen.worm Disinfected C:\nuevo23.exe
Reputation Points: 10
Solved Threads: 0
Junior Poster in Training
Mady is offline Offline
92 posts
since Apr 2004
Oct 9th, 2004
0

Re: Norton WMI Update doesn't work

If you find the time, when you find the time, here is a new HJT as well:

Logfile of HijackThis v1.98.2
Scan saved at 16:09:11, on 09/10/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINNT\system32\filtax.exe
C:\WINNT\SYSTEM32\hgdhp.exe
C:\WINNT\system32\mxxcva.exe
C:\WINNT\system32\ctfmon.exe
C:\WINNT\system32\filtax.exe
C:\WINNT\system32\mxxcva.exe
C:\dls\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ynet.co.il/home/0,7340,L-8,00.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.ynet.co.il/home/0,7340,L-8,FF.html
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Hebrew] C:\Program Files\הפוך על הפוך\hebrew
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [Microsoft Video Capture Controls] MVCC.exe
O4 - HKLM\..\Run: [Synchronization Data Schedul] filtax.exe
O4 - HKLM\..\Run: [VQVQEVXfxcX] C:\WINNT\SYSTEM32\hgdhp.exe
O4 - HKLM\..\Run: [sdfwfq] mxxcva.exe
O4 - HKLM\..\Run: [cftmon] cftmon.exe
O4 - HKLM\..\RunServices: [Microsoft Video Capture Controls] MVCC.exe
O4 - HKLM\..\RunServices: [Synchronization Data Schedul] filtax.exe
O4 - HKLM\..\RunServices: [sdfwfq] mxxcva.exe
O4 - HKLM\..\RunServices: [cftmon] cftmon.exe
O4 - HKLM\..\RunOnce: [LUSETUP-LT] C:\PROGRA~1\Symantec\LIVEUP~1\LUSETU~1.EXE -s -a -q -log
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Documents and Settings\smaddar.PC-HOME\Local Settings\Temp\FreeRAM XP Pro 1.40.exe" -win
O4 - HKCU\..\Run: [Synchronization Data Schedul] filtax.exe
O4 - HKCU\..\Run: [sdfwfq] mxxcva.exe
O8 - Extra context menu item: &יצ×? ל- Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/tech...a/SymAData.dll
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/game...ploader_v5.cab
O16 - DPF: {E62A47D8-74B1-4A93-963A-E5E43B7CC5C2} (UCSearch.ucUCSearch) - http://www.zuvio.com/opnste/UCSearch.CAB
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/tech...ActiveData.cab
O16 - DPF: {EC9C20C4-FF24-11D3-81B7-00902776CF54} (InstallerActiveX Class) - http://www.netex.co.il/site/Installer.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{8D788EA0-403D-4FEE-A520-95B2284A14B0}: NameServer = 192.115.106.31 192.115.106.35
Reputation Points: 10
Solved Threads: 0
Junior Poster in Training
Mady is offline Offline
92 posts
since Apr 2004
Oct 9th, 2004
0

Re: Norton WMI Update doesn't work

I beleave in you, and I know that sooner or later you will help me

meanwhile, I have a new message when I restart the computer:

WINUSER32.EXE
access to the specified device, path, or file, is denied.

alot of other strange things happen to this machine. As if it is out of its mind

Waiting for your advice.
Reputation Points: 10
Solved Threads: 0
Junior Poster in Training
Mady is offline Offline
92 posts
since Apr 2004
Oct 9th, 2004
0

Re: Norton WMI Update doesn't work

Download sysclean (free) from Trend Micro, allow it to clean up any bad files it finds. It may take a while, so have a cuppa whilst it's running .

http://www.trendmicro.com/download/dcs.asp

Be sure to download and install the latest pattern file. There's a link to it at the lower left-hand colum of the page. It will not run without the pattern file.

From Trend:

Note that for the Trend Micro Sysclean Package to be effective, you must download and place the latest pattern file in the same folder as the Trend Micro Sysclean Package.
Moderator
Featured Poster
Reputation Points: 1142
Solved Threads: 982
Most Valuable Poster
crunchie is offline Offline
12,165 posts
since Feb 2004
Oct 10th, 2004
0

Re: Norton WMI Update doesn't work

Thank you, Crunchie.

I followed you advice, but it seems (to me) that nothing was found:


/--------------------------------------------------------------\
| Trend Micro Sysclean Package |
| Copyright 2002, Trend Micro, Inc. |
| http://www.trendmicro.com |
\--------------------------------------------------------------/

2004-10-10, 08:03:00, Auto-clean mode specified.
2004-10-10, 08:03:00, Running scanner "C:\dls\sysclean\TSC.BIN"...
2004-10-10, 08:03:42, Scanner "C:\dls\sysclean\TSC.BIN" has finished running.
2004-10-10, 08:03:42, TSC Log:
Damage Cleanup Engine (DCE) 3.6(Build 1120)
Windows 2000(Build 2195: Service Pack 4)
Start time : ×? ×?וקטובר 10 2004 08:03:01
Load Damage Cleanup Template (DCT) "C:\dls\sysclean\tsc.ptn" (version 430) [success]
Complete time : ×? ×?וקטובר 10 2004 08:03:42
Execute pattern count(1275), Virus found count(0), Virus clean count(0), Clean failed count(0)
2004-10-10, 08:13:36, An error occurred while scanning file "C:\WINNT\system32\config\software.LOG": Access is denied.
2004-10-10, 08:13:36, An error occurred while scanning file "C:\WINNT\system32\config\default.LOG": Access is denied.
2004-10-10, 08:13:37, An error occurred while scanning file "C:\WINNT\system32\config\SECURITY": Access is denied.
2004-10-10, 08:13:37, An error occurred while scanning file "C:\WINNT\system32\config\SECURITY.LOG": Access is denied.
2004-10-10, 08:13:37, An error occurred while scanning file "C:\WINNT\system32\config\SYSTEM.ALT": Access is denied.
2004-10-10, 08:13:37, An error occurred while scanning file "C:\WINNT\system32\config\SAM": Access is denied.
2004-10-10, 08:13:37, An error occurred while scanning file "C:\WINNT\system32\config\SAM.LOG": Access is denied.
2004-10-10, 08:13:37, An error occurred while scanning file "C:\WINNT\system32\config\SYSTEM": Access is denied.
2004-10-10, 08:13:37, An error occurred while scanning file "C:\WINNT\system32\config\SOFTWARE": Access is denied.
2004-10-10, 08:13:37, An error occurred while scanning file "C:\WINNT\system32\config\DEFAULT": Access is denied.
2004-10-10, 08:37:01, An error occurred while scanning file "C:\Documents and Settings\smaddar.PC-HOME\NTUSER.DAT": Access is denied.
2004-10-10, 08:37:01, An error occurred while scanning file "C:\Documents and Settings\smaddar.PC-HOME\NTUSER.DAT.LOG": Access is denied.
2004-10-10, 08:37:43, An error occurred while scanning file "C:\Documents and Settings\smaddar.PC-HOME\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat": Access is denied.
2004-10-10, 08:37:43, An error occurred while scanning file "C:\Documents and Settings\smaddar.PC-HOME\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG": Access is denied.
2004-10-10, 08:43:50, An error occurred while scanning file "C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsys.dll": Access is denied.
2004-10-10, 09:06:04, Running scanner "C:\dls\sysclean\VSCANTM.BIN"...
2004-10-10, 10:37:51, Files Detected:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 10/10/2004 09:06:08
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Virus Pattern Version : 192 (72764 Patterns) (2004/10/08) (219200)
Command Line: C:\dls\sysclean\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\dls\sysclean
62852 files have been read.
62852 files have been checked.
28763 files have been scanned.
41092 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 10/10/2004 10:37:51
---------*---------*---------*---------*---------*---------*---------*---------*
2004-10-10, 10:37:51, Files Clean:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 10/10/2004 09:06:07
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Virus Pattern Version : 192 (72764 Patterns) (2004/10/08) (219200)
Command Line: C:\dls\sysclean\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\dls\sysclean
62852 files have been read.
62852 files have been checked.
28763 files have been scanned.
41092 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 10/10/2004 10:37:51 1 hour 31 minutes 42 seconds (5502.12 seconds) has elapsed.
---------*---------*---------*---------*---------*---------*---------*---------*
2004-10-10, 10:37:51, Clean Fail:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 10/10/2004 09:06:08
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Virus Pattern Version : 192 (72764 Patterns) (2004/10/08) (219200)
Command Line: C:\dls\sysclean\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\dls\sysclean
62852 files have been read.
62852 files have been checked.
28763 files have been scanned.
41092 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 10/10/2004 10:37:51 1 hour 31 minutes 42 seconds (5502.12 seconds) has elapsed.
---------*---------*---------*---------*---------*---------*---------*---------*
2004-10-10, 10:37:51, Scanner "C:\dls\sysclean\VSCANTM.BIN" has finished running.
2004-10-10, 10:41:31, Running scanner "C:\dls\sysclean\VSCANTM.BIN"...
2004-10-10, 10:41:53, Files Detected:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 10/10/2004 10:41:33
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Virus Pattern Version : 192 (72764 Patterns) (2004/10/08) (219200)
Command Line: C:\dls\sysclean\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 D:\*.* /P=C:\dls\sysclean
380 files have been read.
380 files have been checked.
166 files have been scanned.
166 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 10/10/2004 10:41:53
---------*---------*---------*---------*---------*---------*---------*---------*
2004-10-10, 10:41:53, Files Clean:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 10/10/2004 10:41:33
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Virus Pattern Version : 192 (72764 Patterns) (2004/10/08) (219200)
Command Line: C:\dls\sysclean\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 D:\*.* /P=C:\dls\sysclean
380 files have been read.
380 files have been checked.
166 files have been scanned.
166 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 10/10/2004 10:41:53 18 seconds (17.43 seconds) has elapsed.
---------*---------*---------*---------*---------*---------*---------*---------*
2004-10-10, 10:41:53, Clean Fail:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 10/10/2004 10:41:33
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Virus Pattern Version : 192 (72764 Patterns) (2004/10/08) (219200)
Command Line: C:\dls\sysclean\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 D:\*.* /P=C:\dls\sysclean
380 files have been read.
380 files have been checked.
166 files have been scanned.
166 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 10/10/2004 10:41:53 18 seconds (17.43 seconds) has elapsed.
---------*---------*---------*---------*---------*---------*---------*---------*
2004-10-10, 10:41:53, Scanner "C:\dls\sysclean\VSCANTM.BIN" has finished running.
2004-10-10, 10:46:03, Running scanner "C:\dls\sysclean\VSCANTM.BIN"...
2004-10-10, 10:47:24, Files Detected:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 10/10/2004 10:46:05
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Virus Pattern Version : 192 (72764 Patterns) (2004/10/08) (219200)
Command Line: C:\dls\sysclean\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 E:\*.* /P=C:\dls\sysclean
1270 files have been read.
1270 files have been checked.
505 files have been scanned.
509 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 10/10/2004 10:47:24
---------*---------*---------*---------*---------*---------*---------*---------*
2004-10-10, 10:47:24, Files Clean:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 10/10/2004 10:46:05
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Virus Pattern Version : 192 (72764 Patterns) (2004/10/08) (219200)
Command Line: C:\dls\sysclean\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 E:\*.* /P=C:\dls\sysclean
1270 files have been read.
1270 files have been checked.
505 files have been scanned.
509 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 10/10/2004 10:47:24 1 minute 17 seconds (77.53 seconds) has elapsed.
---------*---------*---------*---------*---------*---------*---------*---------*
2004-10-10, 10:47:24, Clean Fail:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 10/10/2004 10:46:05
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Virus Pattern Version : 192 (72764 Patterns) (2004/10/08) (219200)
Command Line: C:\dls\sysclean\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 E:\*.* /P=C:\dls\sysclean
1270 files have been read.
1270 files have been checked.
505 files have been scanned.
509 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 10/10/2004 10:47:24 1 minute 17 seconds (77.53 seconds) has elapsed.
---------*---------*---------*---------*---------*---------*---------*---------*
2004-10-10, 10:47:24, Scanner "C:\dls\sysclean\VSCANTM.BIN" has finished running.
2004-10-10, 10:58:19, Running scanner "C:\dls\sysclean\VSCANTM.BIN"...
2004-10-10, 11:06:28, Files Detected:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 10/10/2004 10:58:20
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Virus Pattern Version : 192 (72764 Patterns) (2004/10/08) (219200)
Command Line: C:\dls\sysclean\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 F:\*.* /P=C:\dls\sysclean
6396 files have been read.
6396 files have been checked.
3894 files have been scanned.
4126 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 10/10/2004 11:06:28
---------*---------*---------*---------*---------*---------*---------*---------*
2004-10-10, 11:06:28, Files Clean:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 10/10/2004 10:58:20
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Virus Pattern Version : 192 (72764 Patterns) (2004/10/08) (219200)
Command Line: C:\dls\sysclean\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 F:\*.* /P=C:\dls\sysclean
6396 files have been read.
6396 files have been checked.
3894 files have been scanned.
4126 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 10/10/2004 11:06:28 8 minutes 6 seconds (485.46 seconds) has elapsed.
---------*---------*---------*---------*---------*---------*---------*---------*
2004-10-10, 11:06:28, Clean Fail:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 10/10/2004 10:58:20
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Virus Pattern Version : 192 (72764 Patterns) (2004/10/08) (219200)
Command Line: C:\dls\sysclean\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 F:\*.* /P=C:\dls\sysclean
6396 files have been read.
6396 files have been checked.
3894 files have been scanned.
4126 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 10/10/2004 11:06:28 8 minutes 6 seconds (485.46 seconds) has elapsed.
---------*---------*---------*---------*---------*---------*---------*---------*
2004-10-10, 11:06:28, Scanner "C:\dls\sysclean\VSCANTM.BIN" has finished running.


What should I do now?
Reputation Points: 10
Solved Threads: 0
Junior Poster in Training
Mady is offline Offline
92 posts
since Apr 2004

This thread is more than three months old

No one has posted to this discussion for at least three months. Please let old threads die and do not reply to them unless you feel you have something new and valuable to contribute that absolutely must be added to make the discussion complete. Otherwise, please start a new thread in this forum instead.
Message:
Previous Thread in Viruses, Spyware and other Nasties Forum Timeline: Not sure ??
Next Thread in Viruses, Spyware and other Nasties Forum Timeline: RUNDLL error. nothing from previous threads helped.





About Us | Contact Us | Advertise | Acceptable Use Policy
Forum Index | Build Custom RSS Feed


Follow us on Twitter


© 2011 DaniWeb® LLC