hjt log- download. trojan detected - Page 2

[MAD_COW711]

okay, i ran that SFC thingy, and i'm guessing it did what it needed to... i left the computer for awhile while i did it and when i got back the thing was gone, so i guess it just ended and there isn't supposed to be another prompt?

anyways, after that i restarted my computer, and lo and behold that stupid blue error screen appeared again.
here is what it said:

"a problem ahs been detected and windows has been shut down to prevent any damage to your computer.

If this is the first time you've seen this stop error screen, restart your computer. If this screen appears again, follow these steps:

Sheck to be sure you have adequate disc space. If a driver is identified in hte stop message, disable the driver or check with the manufacturer for driver updates. Try changing video adapters.

Check with your hardware vendor for any BIOS updates. Disable BIOS memory options such as caching or shadowing. If you need to use safe mode to remove or disable componenets, restart your computer, press F8 to select advanced startup options, and then select safe mode.

Technical Information:
***Stop: 0X0000008E (0X0000005, 0XEF860c44, 0X00000000)

Begin dump of physical memory
physical memory dump complete
contact your system administrator or technical support group for further assistance."

ummm... translation?

[MAD_COW711]

i'm still looking for suggestions, possibly a translation of the previous error message....

[DMR]

OK- I'm assuming that none of the suggestions in the Blue Screen message apply. That is, you have plenty of free space on the drive, haven't installed/changed any hardware recently, haven't made any changes in the BIOS, and haven't tried to update any hardware drivers yet, right?

If the culprit isn't one of the things mentioned in the BSOD message, there are two other common causes for 0x8E errors: one is a conflict (usually memory-related) caused by a legit but malfunctioning startup program/process/service; malware would be the second culprit.

Is it at all possible to run another HJT scan and post the new log? I'd like to get a current list of your running programs and services from that log; we may be able to narrow down the suspect by disabling your non-critical software until we hit on something that, when disabled, changes or eliminates the problems.

[MAD_COW711]

well, i could run it, but in order to post it i would have to write it down and type it out on another computer :) as i have no way to get internet access at the moment, not to mention i think the error screen will pop up again, but maybe after a few restarts it will go away again.

any suggestions as to how to post a htj log without being able to use the internet on the affected computer? :)

and yes, i have plenty of space, i haven't installed or changed any hardware, i have no clue what BIOS is but i'm pretty sure that i didn't make any changes in it, and i haven't tried to update any drivers....

[DMR]

in order to post it i would have to write it down and type it out on another computer...

Assuming that you can dodge the Blue Screen of Death long enough, you could copy the hijackthis.log file to a floppy or CD and post it from another computer. If that isn't possible, I'll work from the last log you posted, but get us a new log if you can.

[MAD_COW711]

apparently safe mode is the only way to dodge the :evil: "blue screen of death" :evil:

but here's the log:

Logfile of HijackThis v1.99.1
Scan saved at 12:42:29 AM, on 4/20/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Common Files\Sonic Shared\Sonic Central\Main\Mediahub.exe
C:\Documents and Settings\Jessica Hortsch\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.accoona.com/search_assistant/accoona_search_assistant.jsp?&utm_id=400011&utm_content=leftnav&utm_source=wdz1&utm_medium=bund&utm_campaign=wdz0605a
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.accoona.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NI.UWAS5LP_0001_0811] "C:\Documents and Settings\Jessica Hortsch\Local Settings\Temporary Internet Files\Content.IE5\9EZF2TII\WAS5Scan[1].exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [StarSkin] C:\PROGRAM FILES\ROCKET DIVISION SOFTWARE\STARSKIN\STARSKIN.EXE -H
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: dlbcserv.lnk = C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: cfgmngr32 - C:\WINDOWS\system32\cfgmngr321.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

[DMR]

In one of my previous posts I asked you to run Spy Sweeper and post the resulting log. Any chance of doing that, and/or getting ewido to run? HijackThis alone isn't giving us enough feedback or removal "firepower", so I'd really like to see reports from at least one of the other utilities.

[MAD_COW711]

well, seing as i'm still getting the 'blue screen of death', it's not as easy to get on and run those programs as you make it out to be... but i'm still open for some suggestions...

my brother told me it is possible somehow to reinstall or repair windows with the driver disc without losing the entire contents of my hard drive... if this is possible, how do i do it?

really, i'm open to any suggestions that don't involve wiping out my hard drive, since i just sold my external hard drive since i hadn't been using it. now i'm screwed:mrgreen:

[DMR]

well, seing as i'm still getting the 'blue screen of death', it's not as easy to get on and run those programs as you make it out to be...

In your last post you said you could "dodge the Blue Screen of Death" in Safe Mode. I was hoping that the BSOD Gremlins might leave you alone long enough to run the utilities in Safe Mode, but I guess that isn't the case. Bummer...

my brother told me it is possible somehow to reinstall or repair windows with the driver disc without losing the entire contents of my hard drive... if this is possible, how do i do it?

It's possible, but not with the driver disk; you'll need the original XP installation disk.
A good walk-though of the Repair installation process can be found here, but if you decide to go that route, please read the instructions and warnings fully and carefully! There is always at least some risk of accidental data loss when performing such an operation, and there is also a chance that it will not fix the problems.

However- given what you've tried already, and the fact that you can't run diagnostic programs at this point, the Repair install is the next thing I would be trying if it were my system.

[MAD_COW711]

with finals week just around the bend i've found the need to revive this thread :eek:

i tried the repair install but nothing has changed. i'm still getting that darn BSoD and the little message at the bottom of it is the same. i haven't tried running an HJT log lately but i haven't even turned my computer on since the last time i ran it (with the exception of the repair install) so i'm guessing nothing has changed.

HELP!!!

[MAD_COW711]

with finals week just around the bend i've found the need to revive this thread :eek:

i tried the repair install but nothing has changed. i'm still getting that darn BSoD and the little message at the bottom of it is the same. i haven't tried running an HJT log lately but i haven't even turned my computer on since the last time i ran it (with the exception of the repair install) so i'm guessing nothing has changed.

HELP!!!

looks like i spoke too soon here... i was gonna reboot into safe mode and run some antivirus stuff, just to see what happens.... now i get the BSOD even in safe mode!!!!!!