- This topic has 11 replies, 4 voices, and was last updated 21 years, 8 months ago by
.
-
Posts
-
My Os is windows xp and ever since the guy from comcast reconnected my internet, the system32 window has been opening up on startup, and slowing down my computer.
Heres a log from “hijackthis”:
Logfile of HijackThis v1.97.7
Scan saved at 6:00:51 PM, on 2/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesCommon FilesSymantec SharedccSetMgr.exe
C:Program FilesCommon FilesSymantec SharedSNDSrvc.exe
C:Program FilesCommon FilesSymantec SharedSPBBCSPBBCSvc.exe
C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:Program FilesSonyVAIO Update 2VAIOUpdt.exe
C:Program FilesCommon FilesSymantec SharedccApp.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesCommon FilesSymantec SharedccProxy.exe
C:WINDOWSehomeehSched.exe
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
C:Program FilesNorton AntiVirusnavapsvc.exe
C:Program FilesNorton AntiVirusIWPNPFMntor.exe
C:WINDOWSsystem32nvsvc32.exe
C:Program FilesSonySony TV Tuner LibrarySMceMan.exe
C:Program FilesCommon FilesSymantec SharedCCPD-LCsymlcsvc.exe
C:WINDOWSsystem32MsPMSPSv.exe
C:Program FilesCommon FilesSymantec SharedSecurity CenterSymWSC.exe
C:Program FilesNorton AntiVirusSAVScan.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesNorton AntiVirusOPScan.exe
C:Documents and SettingsYasharDesktopHijackThis.exe
C:WINDOWSsystem32wuauclt.exeR0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.comcast.net/
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://www.comcast.net
R0 – HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://www.imageshack.us/index4.php
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Window Title = Microsoft Internet Explorer provided by Comcast
R1 – HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.r2.attbi.com
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page_bak = http://www.comcast.net/
R3 – URLSearchHook: (no name) – _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} – (no file)
O2 – BHO: (no name) – {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} – C:Program FilesAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll
O2 – BHO: Web assistant – {9ECB9560-04F9-4bbc-943D-298DDF1699E1} – C:Program FilesCommon FilesSymantec SharedAdBlockingNISShExt.dll
O2 – BHO: (no name) – {AA58ED58-01DD-4d91-8333-CF10577473F7} – c:program filesgooglegoogletoolbar1.dll
O2 – BHO: NAV Helper – {BDF3E430-B101-42AD-A544-FADC6B084872} – C:Program FilesNorton AntiVirusNavShExt.dll
O3 – Toolbar: (no name) – {BA52B914-B692-46c4-B683-905236F6F655} – (no file)
O3 – Toolbar: &Google – {2318C2B1-4965-11d4-9B18-009027A5CD4F} – c:program filesgooglegoogletoolbar1.dll
O3 – Toolbar: Web assistant – {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} – C:Program FilesCommon FilesSymantec SharedAdBlockingNISShExt.dll
O3 – Toolbar: Norton AntiVirus – {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} – C:Program FilesNorton AntiVirusNavShExt.dll
O4 – HKLM..Run: [NvCplDaemon] “RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup”
O4 – HKLM..Run: [VAIO Update 2] “C:Program FilesSonyVAIO Update 2VAIOUpdt.exe” /Stationary
O4 – HKLM..Run: [VAIO Recovery] “C:WINDOWSSonysysVAIO RecoveryPartSeal.exe”
O4 – HKLM..Run: [NvMediaCenter] “RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit”
O4 – HKLM..Run: [ccApp] “C:Program FilesCommon FilesSymantec SharedccApp.exe”
O4 – HKLM..Run: [Symantec NetDriver Monitor] “C:PROGRA~1SYMNET~1SNDMon.exe”
O4 – HKLM..Run: [SAClient] “C:Program FilesComcastBBClientProgramsRegCon.exe” /admincheck
O4 – HKLM..Run: [SAUpdate] “C:Program FilesComcastBBClientProgramsSAUpdate.exe”
O4 – HKLM..Run: [ComcastSUPPORT] C:Program FilesSupport.combintgkill.exe /cleaneahtioga /start
O4 – HKLM..Run: [QuickTime Task] “C:Program FilesQuickTimeqttask.exe” -atboottime
O4 – HKCU..Run: [Steam] “”
O4 – HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O8 – Extra context menu item: &Anonymization – C:WINDOWSsystem32sys32.htm
O8 – Extra context menu item: &Google Search – res://c:program filesgoogleGoogleToolbar1.dll/cmsearch.html
O8 – Extra context menu item: Backward Links – res://c:program filesgoogleGoogleToolbar1.dll/cmbacklinks.html
O8 – Extra context menu item: Cached Snapshot of Page – res://c:program filesgoogleGoogleToolbar1.dll/cmcache.html
O8 – Extra context menu item: E&xport to Microsoft Excel – res://C:PROGRA~1MICROS~3OFFICE11EXCEL.EXE/3000
O8 – Extra context menu item: Similar Pages – res://c:program filesgoogleGoogleToolbar1.dll/cmsimilar.html
O8 – Extra context menu item: Sothink SWF Catcher – C:Program FilesCommon FilesSourceTecSWF CatcherInternetExplorer.htm
O8 – Extra context menu item: Translate into English – res://c:program filesgoogleGoogleToolbar1.dll/cmtrans.html
O9 – Extra ‘Tools’ menuitem: Sun Java Console (HKLM)
O9 – Extra button: Anonymization.Net (HKLM)
O9 – Extra button: Research (HKLM)
O9 – Extra button: AIM (HKLM)
O9 – Extra button: Sothink SWF Catcher (HKLM)
O9 – Extra ‘Tools’ menuitem: Sothink SWF Catcher (HKLM)
O9 – Extra button: Help (HKCU)
O9 – Extra button: ComcastHSI (HKCU)
O9 – Extra button: Support (HKCU)
O14 – IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 – DPF: cpcScanner – http://www.crucial.com/controls/cpcScanner.cab
O16 – DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) – http://www.apple.com/qtactivex/qtplugin.cab
O16 – DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) – http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 – DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} – http://www.musicnotes.com/download/mnviewer.cab
O16 – DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) – http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 – DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) – http://office.microsoft.com/officeupdate/content/opuc.cab
O16 – DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) – http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 – DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) – http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 – DPF: {64D01C7F-810D-446E-A07E-365764235644} (AtlAtomadersCtlAttrib Class) – http://kraisoft.com/files/realone/atomaders.cab
O16 – DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) – https://brewx.qualcomm.com/bws/content/gi/products/sdktools/1.0/en/1.0.0.6/web_install/isetup.cab
O16 – DPF: {AF087E66-838E-4A97-8A0B-0DDDA5DEA239} (OTAutoInstall Class) – https://streaming.endeavors.com/microsoft/encarta_rl/clientdownloads/OTAI.CAB
O16 – DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) – http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 – DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} – http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab
O16 – DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) – http://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 – DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) – http://cdn.digitalcity.com/_media/dalaillama/ampx.cabi’m not sure what this entry is for:
O8 – Extra context menu item: &Anonymization – C:WINDOWSsystem32sys32.htm
it might have something to do with it, but probably doesnt.otherwise i cant really see anything in the log that would cause an explorer window to pop up, have you checked your startup folders?
Tigerblade wrote:i’m not sure what this entry is for:
O8 – Extra context menu item: &Anonymization – C:WINDOWSsystem32sys32.htm
it might have something to do with it, but probably doesnt.otherwise i cant really see anything in the log that would cause an explorer window to pop up, have you checked your startup folders?
yea there was nothing in the startup folders, and that anonymization is just a toolbar button.
what about the administrator account? check the “all users” folder too… most new installations try putting something in there
the name i scanned this was on the administrator, but i rescanned again:
Logfile of HijackThis v1.97.7
Scan saved at 7:34:25 PM, on 2/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://www.comcast.net
R0 – HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://www.imageshack.us/index4.php
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Window Title = Microsoft Internet Explorer provided by Comcast
R1 – HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.r2.attbi.com
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page_bak = http://www.comcast.net/
R3 – URLSearchHook: (no name) – _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} – (no file)
O2 – BHO: (no name) – {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} – C:Program FilesAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll
O2 – BHO: Web assistant – {9ECB9560-04F9-4bbc-943D-298DDF1699E1} – C:Program FilesCommon FilesSymantec SharedAdBlockingNISShExt.dll
O2 – BHO: (no name) – {AA58ED58-01DD-4d91-8333-CF10577473F7} – c:program filesgooglegoogletoolbar1.dll
O2 – BHO: NAV Helper – {BDF3E430-B101-42AD-A544-FADC6B084872} – C:Program FilesNorton AntiVirusNavShExt.dll
O3 – Toolbar: (no name) – {BA52B914-B692-46c4-B683-905236F6F655} – (no file)
O3 – Toolbar: &Google – {2318C2B1-4965-11d4-9B18-009027A5CD4F} – c:program filesgooglegoogletoolbar1.dll
O3 – Toolbar: Web assistant – {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} – C:Program FilesCommon FilesSymantec SharedAdBlockingNISShExt.dll
O3 – Toolbar: Norton AntiVirus – {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} – C:Program FilesNorton AntiVirusNavShExt.dll
O4 – HKLM..Run: [NvCplDaemon] “RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup”
O4 – HKLM..Run: [VAIO Update 2] “C:Program FilesSonyVAIO Update 2VAIOUpdt.exe” /Stationary
O4 – HKLM..Run: [VAIO Recovery] “C:WINDOWSSonysysVAIO RecoveryPartSeal.exe”
O4 – HKLM..Run: [NvMediaCenter] “RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit”
O4 – HKLM..Run: [ccApp] “C:Program FilesCommon FilesSymantec SharedccApp.exe”
O4 – HKLM..Run: [Symantec NetDriver Monitor] “C:PROGRA~1SYMNET~1SNDMon.exe”
O4 – HKLM..Run: [SAClient] “C:Program FilesComcastBBClientProgramsRegCon.exe” /admincheck
O4 – HKLM..Run: [SAUpdate] “C:Program FilesComcastBBClientProgramsSAUpdate.exe”
O4 – HKLM..Run: [ComcastSUPPORT] “C:Program FilesSupport.combintgkill.exe ” /cleaneahtioga /start
O4 – HKLM..Run: [QuickTime Task] “C:Program FilesQuickTimeqttask.exe” -atboottime
O4 – HKCU..Run: [Steam] “”
O4 – HKCU..Run: [ctfmon.exe] “C:WINDOWSsystem32ctfmon.exe”
O8 – Extra context menu item: &Anonymization – C:WINDOWSsystem32sys32.htm
O8 – Extra context menu item: &Google Search – res://c:program filesgoogleGoogleToolbar1.dll/cmsearch.html
O8 – Extra context menu item: Backward Links – res://c:program filesgoogleGoogleToolbar1.dll/cmbacklinks.html
O8 – Extra context menu item: Cached Snapshot of Page – res://c:program filesgoogleGoogleToolbar1.dll/cmcache.html
O8 – Extra context menu item: E&xport to Microsoft Excel – res://C:PROGRA~1MICROS~3OFFICE11EXCEL.EXE/3000
O8 – Extra context menu item: Similar Pages – res://c:program filesgoogleGoogleToolbar1.dll/cmsimilar.html
O8 – Extra context menu item: Sothink SWF Catcher – C:Program FilesCommon FilesSourceTecSWF CatcherInternetExplorer.htm
O8 – Extra context menu item: Translate into English – res://c:program filesgoogleGoogleToolbar1.dll/cmtrans.html
O9 – Extra ‘Tools’ menuitem: Sun Java Console (HKLM)
O9 – Extra button: Anonymization.Net (HKLM)
O9 – Extra button: Research (HKLM)
O9 – Extra button: AIM (HKLM)
O9 – Extra button: Sothink SWF Catcher (HKLM)
O9 – Extra ‘Tools’ menuitem: Sothink SWF Catcher (HKLM)
O9 – Extra button: Help (HKCU)
O9 – Extra button: ComcastHSI (HKCU)
O9 – Extra button: Support (HKCU)
O14 – IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 – DPF: cpcScanner – http://www.crucial.com/controls/cpcScanner.cab
O16 – DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) – http://www.apple.com/qtactivex/qtplugin.cab
O16 – DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) – http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 – DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} – http://www.musicnotes.com/download/mnviewer.cab
O16 – DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) – http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 – DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) – http://office.microsoft.com/officeupdate/content/opuc.cab
O16 – DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) – http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 – DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) – http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 – DPF: {64D01C7F-810D-446E-A07E-365764235644} (AtlAtomadersCtlAttrib Class) – http://kraisoft.com/files/realone/atomaders.cab
O16 – DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) – https://brewx.qualcomm.com/bws/content/gi/products/sdktools/1.0/en/1.0.0.6/web_install/isetup.cab
O16 – DPF: {AF087E66-838E-4A97-8A0B-0DDDA5DEA239} (OTAutoInstall Class) – https://streaming.endeavors.com/microsoft/encarta_rl/clientdownloads/OTAI.CAB
O16 – DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) – http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 – DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} – http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab
O16 – DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) – http://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 – DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) – http://cdn.digitalcity.com/_media/dalaillama/ampx.cabWhy don’t you switch to Unix? Windows is only good for graphics and games… if u want to have a computer experience without dumb errors get on Unix and buy another pc if u wanna game and keep it away from all the bs on the net.. cuz windows security is a joke…
SubStream wrote:Why don’t you switch to Unix? Windows is only good for graphics and games… if u want to have a computer experience without dumb errors get on Unix and buy another pc if u wanna game and keep it away from all the bs on the net.. cuz windows security is a joke…No it wasnt a prob. with security. it was just i removed a critical file that windows opened the folder for me to find it.
oh ok… well I hope u take the right precautions because it has more security holes than any other os…
Substream, stop insulting Windows. We are all well aware of its problems, and don’t need you running around repeating it randomly in different topics. Besides, its not all horrible and dangerous like you make it look. All someone needs is Anti-Spyware, Anti-Virus, and a firewall, and they are good to go.
security isnt always the ultimate do-all and end-all priority on a machine. as i pointed out to eedok in another thread, what’s the point of having a perfectly secure system if you cant run any programs on it? most mainstream programs today are written specifically for windows, or even for macs. there are very few programs that will work on linux, and i think that’s more important to the average user than security. yes we want to have a secure box, but there are limits.
security isnt always the do-all and end-all purpose of a computer. as i pointed out to eedok in another thread, what’s the point of having a perfectly secure computer when you cant run any programs on it? most mainstream decent programs are written for windows or even macs; most wont even begin to run on a linux machine. when it really comes down to it, usability is much more important to most users than security.
- You must be logged in to reply to this topic.