Member Avatar for Montes

And no advansed options on folder options.

Tryed Hyjackthis:
Logfile of HijackThis v1.99.1
Scan saved at 16:32:52, on 29.05.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Temp\svchost1.exe
C:\WINDOWS\Temp\system.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Programfiler\Java\jre1.5.0_04\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programfiler\Java\jre1.5.0_04\bin\jucheck.exe
C:\Programfiler\QuickTime\qttask.exe
C:\Programfiler\D-Tools\daemon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\iexplorer.exe
C:\Programfiler\PopUp Killer\popupkiller.EXE
C:\PROGRA~1\PANICW~1\POP-UP~1\dpps2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programfiler\Messenger\msmsgs.exe
C:\Programfiler\Skype\Phone\Skype.exe
C:\Programfiler\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Programfiler\Windows Media Player\wmplayer.exe
C:\Programfiler\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\svchost.exe
C:\Programfiler\Internet Explorer\iexplore.exe
C:\Downloads\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startsiden.no/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - C:\WINDOWS\system32\mscastdb.dll
O3 - Toolbar: Nordnet Toolbar Norge - {A601B013-3DDB-4902-948A-9879E1F6A1A7} - C:\WINDOWS\Downloaded Program Files\CONFLICT.1\toolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programfiler\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programfiler\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [eDonkey2000] "C:\Programfiler\eDonkey2000\edonkey2000.exe" -t
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Iexplorer] C:\WINDOWS\iexplorer.exe
O4 - HKLM\..\Run: [PopUpKiller] C:\Programfiler\PopUp Killer\popupkiller.EXE
O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\PROGRA~1\PANICW~1\POP-UP~1\dpps2.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Programfiler\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programfiler\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Nordnet Toolbar sök - res://C:\WINDOWS\Downloaded Program Files\CONFLICT.1\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra button: Poker.com - {6FDD5236-C9F0-49ef-935D-385F5E21991A} - C:\Programfiler\Poker.com\poker.exe (HKCU)
O12 - Plugin for .spop: C:\Programfiler\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {92F02779-6D88-4958-8AD3-83C12D86ADC7} -
O17 - HKLM\System\CCS\Services\Tcpip\..\{8C29A5E9-7E05-44AD-8848-B49E4BF0DB26}: NameServer = ,
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: FireDaemon Service: ecure (ecure) - Unknown owner - C:\WINDOWS\Temp\FireDaemon.EXE
O23 - Service: Windows Installer (MSIServer) - Unknown owner - C:\DOCUME~1\demo\LOKALE~1\Temp\IXP001.TMP\MsiExec.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: FireDaemon Service: svchost1 (svchost1) - Unknown owner - C:\WINDOWS\Temp\FireDaemon.EXE
O23 - Service: FireDaemon Service: system (system) - Unknown owner - C:\WINDOWS\Temp\FireDaemon.EXE

Does I have someting that block it ?

  • 2 Contributors
  • 1 Reply
  • 185 Views
  • 9 Hours Discussion Span
  • Latest Post Latest Post by caperjack

Dani AI

Generated

reported the Security tab and the Advanced view options missing; correctly pointed out a suspicious startup item and suggested an anti‑malware scan. The HijackThis output shows several nonstandard startup/services running out of the Temp folder and a rogue “iexplorer” entry — those are common signs of malware that can flip UI policies or set registry values so Explorer hides the Security tab.

Common, non‑malicious reasons (quick checklist)

  • Windows XP Home: simple file sharing is always enabled in Explorer, so the Security tab won’t appear.
  • Drive formatted FAT/FAT32: these filesystems don’t support NTFS permissions, so no Security tab.
  • Group policy / registry values can hide the tab (for example values under Policies\Explorer).
  • Malware can both hide UI items and create the temp‑based services/startup entries seen in the log.

Practical troubleshooting (least invasive → most)

  1. Confirm edition and filesystem (My Computer → Properties; drive Properties → File system). If FAT32, convert only after backing up.
  2. Boot Safe Mode and run up‑to‑date anti‑malware scans (second‑opinion scanners in addition to an AV). @caperjack’s suggestion to scan is appropriate given the Temp/iexplorer indicators.
  3. Inspect startup/services with msconfig and Services (services.msc); use Autoruns for a deeper view and disable entries that point at Temp or unfamiliar EXEs.
  4. Back up the registry, then check for values that hide UI elements, e.g. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSecurityTab and the same under HKLM — delete only after export.
  5. If policies are in effect (XP Pro), check gpedit.msc Administrative Templates → Windows Components → Windows Explorer for any “remove security tab” type setting.
  6. After cleaning, run sfc /scannow and consider System Restore; a persistent infection may require data backup and a clean reinstall.

Caution: export the registry before edits, avoid deleting files blindly, and prioritize removing the Temp‑based services/startup entries first — they likely are the root cause of hidden UI elements.

Member Avatar for caperjack

this could be causing it .
O4 - HKLM\..\Run: [Iexplorer] C:\WINDOWS\iexplorer.exe
check what i found with goole.com .

Download and run ewido, update it first ,then run full scan of computer .
http://www.ewido.net/en/

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.