944,209 Members | Top Members by Rank

Ad:
Feb 13th, 2005
0

losing registration info on restart/startup

Expand Post »
I have windows xp home and everytime i shut down the computer or restart, programs(such as aim or kazaa)have to be re-registered.*Example*when i log on kazaa wants me to create a user name and certify my connection speed and copy shared files to a new location, thats ok but when I restart i have to do it again and again.Also any new file that i dont put in my shared file folder is deleted when I shut down. HELP PLEASE!!
Here is the hijackthis log:

Logfile of HijackThis v1.99.0
Scan saved at 2:22:35 PM, on 2/13/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\STOPzilla!\szntsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\SYSTEM32\GEARSEC.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\rundll32.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\S3apphk.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\PROGRA~1\INTRIG~1\pcbodyguard.exe
C:\Program Files\syslaunch.exe
C:\WINDOWS\mcedrhpb.exe
C:\windows\WinOldAp.exe
C:\Program Files\SafeSurfing\SafeSurfing.exe
C:\WINDOWS\System32\sxxyutwu.exe
C:\Program Files\Internet Optimizer\optimize.exe
C:\windows\system32\zsxcwiac.exe
C:\Program Files\Gdugq\Fozr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\windows\system32\calc.exe
C:\Program Files\Internet Optimizer\actalert.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Anders Kjersem\PopKiller\PopKiller.exe
C:\Program Files\Messenger Blocker\MessengerBlocker.exe
C:\Program Files\null\null.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\AIM95\aim.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Kazaa Lite\Kazaa.kpp
C:\WINDOWS\System32\cidaemon.exe
C:\Program Files\Web_Rebates\WebRebates1.exe
C:\Program Files\Web_Rebates\WebRebates0.exe
C:\Documents and Settings\TEMP.YOUR-M5D4U9R2UV.002\My Documents\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://red.clientapps.yahoo.com/cust...//my.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/cust...//my.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O1 - Hosts: 213.159.117.217 www.22469.com
O1 - Hosts: 213.159.117.217 www.3wisp.com
O1 - Hosts: 213.159.117.217 www.adult-cinema.org
O1 - Hosts: 213.159.117.217 www.adultfreehosting.com
O1 - Hosts: 213.159.117.217 www.adulthosting.com
O1 - Hosts: 213.159.117.217 www.adultlinks1.com
O1 - Hosts: 213.159.117.217 www.adultmegamovies.com
O1 - Hosts: 213.159.117.217 www.adultsexmovie.net
O1 - Hosts: 213.159.117.217 www.adultwall.com
O1 - Hosts: 213.159.117.217 www.afro-sex.com
O1 - Hosts: 213.159.117.217 www.agreathost.net
O1 - Hosts: 213.159.117.217 www.alehina.com
O1 - Hosts: 213.159.117.217 www.allnichestgp.com
O1 - Hosts: 213.159.117.217 www.allowednet.com
O1 - Hosts: 213.159.117.217 www.amateurlips.com
O1 - Hosts: 213.159.117.217 www.amateurnudephoto.com
O1 - Hosts: 213.159.117.217 www.amateursgonebad.com
O1 - Hosts: 213.159.117.217 www.ambersamateurhardcore.com
O1 - Hosts: 213.159.117.217 www.anyamateur.com
O1 - Hosts: 213.159.117.217 www.apornhost.com
O1 - Hosts: 213.159.117.217 www.findmodels.com
O1 - Hosts: 213.159.117.217 www.asianscum.com
O1 - Hosts: 213.159.117.217 www.awethumbs.com
O1 - Hosts: 213.159.117.217 www.badassxxx.com
O1 - Hosts: 213.159.117.217 www.badbimbo.com
O1 - Hosts: 213.159.117.217 www.beautifulbondage.com
O1 - Hosts: 213.159.117.217 www.bestpornhost.com
O1 - Hosts: 213.159.117.217 www.biggestdickinporn.net
O1 - Hosts: 213.159.117.217 www1.3wisp.com
O1 - Hosts: 213.159.117.217 www1.sexls.com
O1 - Hosts: 213.159.117.217 www1.toptgphost.com
O1 - Hosts: 213.159.117.217 www1.xfreehosting.com
O1 - Hosts: 213.159.117.217 www2.3wisp.com
O1 - Hosts: 213.159.117.217 www2.toptgphost.com
O1 - Hosts: 213.159.117.217 www2.xfreehosting.com
O1 - Hosts: 213.159.117.217 www2.zpornstars.com
O1 - Hosts: 213.159.117.217 www3.xfreehosting.com
O1 - Hosts: 213.159.117.217 www3.zpornstars.com
O1 - Hosts: 213.159.117.217 www4.xfreehosting.com
O1 - Hosts: 213.159.117.217 www4.zpornstars.com
O1 - Hosts: 213.159.117.217 www.bigpornvideos.com
O1 - Hosts: 213.159.117.217 www.big-xxx-movies.com
O1 - Hosts: 213.159.117.217 www.samplehosting.com
O1 - Hosts: 213.159.117.217 www.boyanxxx.com
O1 - Hosts: 213.159.117.217 www.bustyx.com
O1 - Hosts: 213.159.117.217 www.cleanpornhost.com
O1 - Hosts: 213.159.117.217 www.cyberxxxhost.com
O1 - Hosts: 213.159.117.217 www.dialcom.com
O1 - Hosts: 213.159.117.217 www.eldererotica.tv
O1 - Hosts: 213.159.117.217 www.exploitedblackteens.net
O1 - Hosts: 213.159.117.217 www.exscapeporn.com
O1 - Hosts: 213.159.117.217 www.fantasiegirl.com
O1 - Hosts: 213.159.117.217 www.filth-hostz.com
O1 - Hosts: 213.159.117.217 www.free-freeporn.com
O1 - Hosts: 213.159.117.217 www.free-xxx-server.com
O1 - Hosts: 213.159.117.217 www.freexxxvideoclip.com
O1 - Hosts: 213.159.117.217 www.fvotd.com
O1 - Hosts: 213.159.117.217 www.galaporn.com
O1 - Hosts: 213.159.117.217 www.18blowjobs.com
O1 - Hosts: 213.159.117.217 www.bigtitsroundasses.com
O1 - Hosts: 213.159.117.217 www.bikinivoyeur.com
O1 - Hosts: 213.159.117.217 www.blacksonblondes.com
O1 - Hosts: 213.159.117.217 www.easydrunkgirls.com
O1 - Hosts: 213.159.117.217 www.markscash.com
O1 - Hosts: 213.159.117.217 www.milfwhore.com
O1 - Hosts: 213.159.117.217 www.springbreakspycam.com
O1 - Hosts: 213.159.117.217 www.sweetmoney.com
O1 - Hosts: 213.159.117.217 www.wildclubvideos.com
O1 - Hosts: 213.159.117.217 www.gallys.camcorderxxx.com
O1 - Hosts: 213.159.117.217 www.gallys.nastydollars.com
O1 - Hosts: 213.159.117.217 www.gayhost4free.com
O1 - Hosts: 213.159.117.217 www.ghostgalleries.com
O1 - Hosts: 213.159.117.217 www.girls2.twistys.net
O1 - Hosts: 213.159.117.217 www.greatfreehost.com
O1 - Hosts: 213.159.117.217 www.hanksgalleries.com
O1 - Hosts: 213.159.117.217 www.hjemmesex.dk
O1 - Hosts: 213.159.117.217 www.hollyheartbreak.com
O1 - Hosts: 213.159.117.217 www.hot3movie.com
O1 - Hosts: 213.159.117.217 www.hot-adult-clips.com
O1 - Hosts: 213.159.117.217 www.hotfreehost.com
O1 - Hosts: 213.159.117.217 www.hottestbabes.net
O1 - Hosts: 213.159.117.217 www.hyperfree.com
O1 - Hosts: 213.159.117.217 www.instant-access.sex-explorer.com
O1 - Hosts: 213.159.117.217 www.lanaspornworld.com
O1 - Hosts: 213.159.117.217 www.libereco.net
O1 - Hosts: 213.159.117.217 www.link.siccash.com
O1 - Hosts: 213.159.117.217 www.liquidservers.com
O1 - Hosts: 213.159.117.217 www.literotica.com
O1 - Hosts: 213.159.117.217 www.logging.to
O1 - Hosts: 213.159.117.217 www.longsexvideos.com
O1 - Hosts: 213.159.117.217 www.magnaplza.com
O1 - Hosts: 213.159.117.217 www.maplebabe.com
O1 - Hosts: 213.159.117.217 www.maturebombs.com
O1 - Hosts: 213.159.117.217 www.maturitymovies.com
O1 - Hosts: 213.159.117.217 www.maxismut.com
O1 - Hosts: 213.159.117.217 www.maxkontakt.nu
O1 - Hosts: 213.159.117.217 www.movies.easy-dater.com
O1 - Hosts: 213.159.117.217 www.movies.vaginalcumshots.com
O1 - Hosts: 213.159.117.217 www.movies-etc.com
O1 - Hosts: 213.159.117.217 www.moviesgold.com
O1 - Hosts: 213.159.117.217 www.moviesheaven.com
O2 - BHO: ZServObj Class - {00000000-C1EC-0345-6EC2-4D0300000000} - C:\WINDOWS\ZServ.dll
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem220.dll
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll
O2 - BHO: msreph35 - {6F783E02-0455-1478-FD60-CD4BE6C46E69} - C:\WINDOWS\System32\msreph35.dll
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll (file missing)
O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINDOWS\wsem303.dll
O2 - BHO: SSIEHelperObj Class - {F9374DE1-E63C-4483-90F8-74F08041834F} - C:\PROGRA~1\SAFESU~1\SAFESU~1.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O3 - Toolbar: (no name) - {55910916-8B4E-4C1E-9253-CCE296EA71EB} - (no file)
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [S3apphk] S3apphk.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server /startmonitor /deaf
O4 - HKLM\..\Run: [SSRunScript] "C:\Program Files\Support.com\Charter\bin\SSRunScript.exe" /script "C:\Program Files\Support.com\Charter\vbs\verifyconnection.vbs" /args //b startupdelay
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AHOSYGGMT] C:\WINDOWS\AHOSYGGMT.exe
O4 - HKLM\..\Run: [GMTZAG] C:\WINDOWS\GMTZAG.exe
O4 - HKLM\..\Run: [FMSZCJ] C:\WINDOWS\FMSZCJ.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QKHREKUIO] C:\WINDOWS\QKHREKUIO.exe
O4 - HKLM\..\Run: [HDN] C:\WINDOWS\HDN.exe
O4 - HKLM\..\Run: [DKR] C:\WINDOWS\DKR.exe
O4 - HKLM\..\Run: [XFPSZVF] C:\WINDOWS\XFPSZVF.exe
O4 - HKLM\..\Run: [NUEL] C:\WINDOWS\NUEL.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [EOEL] C:\WINDOWS\EOEL.exe
O4 - HKLM\..\Run: [PCBG] C:\PROGRA~1\INTRIG~1\pcbodyguard.exe /start
O4 - HKLM\..\Run: [SpyBotSnD] "C:\Program Files\Spybot - Search & Destroy 1.1\SpybotSD.exe"
O4 - HKLM\..\Run: [iehelper] C:\Program Files\syslaunch.exe
O4 - HKLM\..\Run: [SafeSurfingUpdate] C:\WINDOWS\System32\SSUpdate.exe
O4 - HKLM\..\Run: [hkrhoah] rundll32 C:\WINDOWS\System32:hkrhoah.dll,Init 1
O4 - HKLM\..\Run: [ilayvroc] C:\WINDOWS\mcedrhpb.exe
O4 - HKLM\..\Run: [Belt] C:\WINDOWS\Belt.exe
O4 - HKLM\..\Run: [STOPzilla] "C:\Program Files\STOPzilla!\Stopzilla.exe" /autorun
O4 - HKLM\..\Run: [WinOldAp] c:\windows\WinOldAp.exe
O4 - HKLM\..\Run: [SafeSurfingEXE] C:\Program Files\SafeSurfing\SafeSurfing.exe
O4 - HKLM\..\Run: [gbfofsli] C:\WINDOWS\System32\sxxyutwu.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [zsxcwiac] c:\windows\system32\zsxcwiac.exe
O4 - HKLM\..\Run: [Cgbdwxhw] C:\Program Files\Gdugq\Fozr.exe
O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: [null ml710e] "C:\Program Files\null\null.exe"
O4 - HKLM\..\RunOnce: [*hkrhoah] rundll32 C:\WINDOWS\System32:hkrhoah.dll,Init 1
O4 - HKLM\..\RunOnce: [djtopr1150.exe] "C:\DOCUME~1\TEMPYO~1.002\LOCALS~1\Temp\djtopr1150.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Anders Kjersem: PopKiller] "C:\Program Files\Anders Kjersem\PopKiller\PopKiller.exe" /tray
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_40/QDow.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1108239915922
O16 - DPF: {DC187740-46A9-11D5-A815-00B0D0428C0C} - http://www.pcpowerscan.com/pcpowerscan.cab
O23 - Service: asurscsi - Unknown - C:\Program Files\Voyetra\AudioSurgeon 5\asurscsi.exe (file missing)
O23 - Service: F-Secure BackWeb - Unknown - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: F-Secure BackWeb LAN Access - Unknown - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - Unknown - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: F-Secure Authentication Agent - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXE
O23 - Service: F-Secure Management Agent - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\SYSTEM32\GEARSEC.EXE
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: STOPzilla Local Service - International Software Systems Solutions - C:\Program Files\STOPzilla!\szntsvc.exe
O23 - Service: WinTools for IE service - Unknown - C:\Program Files\Common Files\WinTools\WToolsS.exe (file missing)
Similar Threads
Reputation Points: 10
Solved Threads: 0
Newbie Poster
helpme64 is offline Offline
18 posts
since Feb 2005
Feb 13th, 2005
0

Re: losing registration info on restart/startup

You have several problems here:

First of all, as long as you use file sharing programs (aka P2P) such as Kazaa, you're likely to encounter problems such as the ones you now have.

Second, you need to go to Windows Update to get the Critical Updates for your system. Hold off on SP2, however, until your system gets cleaned up. These updates may have prevented some of your problems.

Third, you have hijackthis in a temp folder, it needs to be in it's own permanent folder so it, and it's backups, don't get deleted during the cleanup process.
Team Colleague
Reputation Points: 63
Solved Threads: 213
Posting Maven
dlh6213 is offline Offline
2,962 posts
since Jul 2004
Feb 16th, 2005
0

Re: losing registration info on restart/startup

Thanx but the critical updates didnt help any. More hel and what to remove please.
Reputation Points: 10
Solved Threads: 0
Newbie Poster
helpme64 is offline Offline
18 posts
since Feb 2005
Feb 16th, 2005
0

Re: losing registration info on restart/startup

Go
Here
and Get Trojan-Hunter Fully working trial! and run a full scan
,,,,,,,,,,,,,,,,,,,,,

Please delete your temporary files by deleting all files and folders that are in those folders (do not delete the temp folder itself) like for example
C:\WINDOWS\Temp\
C:\Temp\
C:\Documents and Settings\username\Local Settings\Temp\
Also delete your Temporary Internet Files, be sure to also select delete all offline content.

Do a virus scan here.
If you get report of files that can’t be cleaned / deleted please write down the filenames and locations and post that in your reply.
,,,,,,,,,,,,,,,,,,,,,,,,,,
Download then unzip and run CWShredder to clean up clicking "FIX" to have it remove all it finds.

CWShredder available from these places :-


http://www.aluriasoftware.com/tools/cwshredder.zip
Or this as a full download without any unzipping required
http://www.downloads.subratam.org/CWShredder.exe
http://www.spywareinfo.com/downloads...CWShredder.exe

We have found that some of the CWS infections can be removed better from safe mode, rather than normal mode.
To get to safe mode use the F8 key while booting the machine. Detailed instructions from :-
HERE
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
Then please do this since it’s better to use automated tools to get rid of the bad stuff use these 2 programs first before doing the final cleaning with HJT

First use Spybot S&D. (Version 1.3)
Spybot
Unzip, and update. Install the updates and run. Delete all that it marks in red.
Reboot

Then it’s time for Ad-Aware
Ad-Aware
Install and update by using the globe icon. Restart your computer and run Ad-Aware.
Press scan now and select drives and/or partitions to be scanned. When done select all and click next. Remove all checked items and then reboot your computer.

Please go to this page and read the instructions for how to configure Spybot S&D & Ad-Aware
How To Setup Spybot SD and Ad-Aware





Then post a HJT log as a reply to this topic.
Team Colleague
Reputation Points: 1056
Solved Threads: 792
I hate 20 Questions
caperjack is offline Offline
12,738 posts
since Aug 2003
Feb 17th, 2005
0

Re: losing registration info on restart/startup

I have used spyware search and destroy before to delete the red files and my internet stopped working, it kept saying cannot find and stuff on the home page. I reinstalled the stuff using its recovery thing and then the internet started working again.
Reputation Points: 10
Solved Threads: 0
Newbie Poster
helpme64 is offline Offline
18 posts
since Feb 2005
Feb 17th, 2005
0

Re: losing registration info on restart/startup

You have a lot of trash there that these automated apps can remove. If you do not wish to use Spybot S&D, then please use the others and post another hijackthis log after rebooting.
Moderator
Featured Poster
Reputation Points: 1142
Solved Threads: 982
Most Valuable Poster
crunchie is offline Offline
12,165 posts
since Feb 2004

This thread is more than three months old

No one has posted to this discussion for at least three months. Please let old threads die and do not reply to them unless you feel you have something new and valuable to contribute that absolutely must be added to make the discussion complete. Otherwise, please start a new thread in this forum instead.
Message:
Previous Thread in Viruses, Spyware and other Nasties Forum Timeline: This "Virus" is causing difficulties
Next Thread in Viruses, Spyware and other Nasties Forum Timeline: Can someone please help me with my highjackthis.log





About Us | Contact Us | Advertise | Acceptable Use Policy
Forum Index | Build Custom RSS Feed


Follow us on Twitter


© 2011 DaniWeb® LLC