TheTechGuide Forum

General Category => Tech Clinic => Topic started by: Guest_Google.com_* on August 27, 2005, 03:28:38 PM

Title: Check up.
Post by: Guest_Google.com_* on August 27, 2005, 03:28:38 PM

Just doing a check up.

Logfile of HijackThis v1.99.1
Scan saved at 4:28:50 PM, on 8/27/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Gigabyte\Gigabyte GN-WPKG Wireless PCI Adapter SoftAP\Installer\WINXP\RaConfig2500.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Hijackthis\HJT.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://cgi.verizon.net/bookmarks/bmredir.a....1&bm=ho_search (http://\"http://cgi.verizon.net/bookmarks/bmredir.asp?region=all&bw=dsl&cd=6.1&bm=ho_search\")
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://aimtoday.Email (http://\"http://aimtoday.Email\") Removed/_ads/adsPopup2.htm?0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\PROGRA~1\AIM\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: GN-WPKG Utility.lnk = C:\Program Files\Gigabyte\Gigabyte GN-WPKG Wireless PCI Adapter SoftAP\Installer\WINXP\RaConfig2500.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Word Racer - http://download.games.yahoo.com/games/clients/y/wt1_x.cab (http://\"http://download.games.yahoo.com/games/clients/y/wt1_x.cab\")
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 (http://\"http://go.microsoft.com/fwlink/?linkid=39204\")
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab (http://\"https://signup.msn.com/pages/MsnInstC.cab\")
O16 - DPF: {82F2D6B2-6C58-4404-A930-9DB0FD90D4B1} (Driver_Detective_v43_Non_Member.DD_v43) - http://www.drivershq.com/cab/prod/Driver_D..._Non_Member.CAB (http://\"http://www.drivershq.com/cab/prod/Driver_Detective_v43_Non_Member.CAB\")
O16 - DPF: {DB0474CC-8EF6-47FC-905B-23FC58A70817} (RegPropsCtrl Class) - http://download.verizon.net/sfp/Cabs/hst/w...tWebInstall.cab (http://\"http://download.verizon.net/sfp/Cabs/hst/webinstall/HstWebInstall.cab\")
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Title: Check up.
Post by: guestolo on August 27, 2005, 07:03:45 PM

Looks good
You should sign into the forum when you post a hijackthis log  /smile.gif\' class=\'bbc_emoticon\' alt=\':)\' />
Which Anti-Virus software are you running?
Do you need a free solution?

Title: Check up.
Post by: Not-the-Google on August 27, 2005, 07:49:49 PM

I used to have AVG, but it was making my computer VERY slow.  EXTREMELY.  Is there possibly a different one?

Title: Check up.
Post by: guestolo on August 28, 2005, 10:46:45 AM

I've never seen problems with using AVG
It usually doesn't take up much resources

You could try the free version of Avast
Here's a link
http://www.avast.com/eng/down_home.html (http://\"http://www.avast.com/eng/down_home.html\")

After installation it will load all scanners
Some of which you may not need
Right click the Avast Icon by the system clock and open the program
Check it's scanners to see what you don't need running
You can terminate a scanner if unneeded
Of course you will want to leave the Standard scanner and Email scanner running

The Internet Email scanner is for OE and others

Title: Check up.
Post by: Not-the-Google on August 29, 2005, 08:32:50 PM

Okay, so I tried AVG again, and it is working now.  But the thing that is driving me insane right now, is that every second, my computer "freezes" if you will.  Literally every second.  When I listen, or try to listen, to music, every second, my speakers make a static sound and a very short pause to the music.  My mouse stops, and ends up in the direction I was going in a very short amount, but it is driving me insane.  Do you by chance know what is going on?

Title: Check up.
Post by: guestolo on August 29, 2005, 10:01:34 PM

This is almost sounding like a hardware problem
How much Ram installed on the system?
What processor do you have?

Title: Check up.
Post by: Not-the-Google on August 29, 2005, 10:57:48 PM

Okay, how woudl I find those?

Sorry, I'm not a hardware person!

Title: Check up.
Post by: guestolo on August 29, 2005, 11:42:14 PM

Right click "MyComputer" and then left click properties
the info is under the General tab

Eg... This comp has a 2.66 Ghz + 512 mb Ram

Title: Check up.
Post by: Not-the-Google on August 29, 2005, 11:45:41 PM

AMD Athlon(tm) XP 2200+
1.79GHz, 512MB of RAM

Title: Check up.
Post by: guestolo on August 29, 2005, 11:53:03 PM

You have plenty of Horse power
Hmm, can you do something please
Open your task manager by right click the bottom task bar and selecting Task Manager
Select the Processes tab

With the task manager open try playing music again
What's to you seems to be taking up all the CPU usage, if any?

Title: Check up.
Post by: Not-the-Google on August 29, 2005, 11:57:00 PM

The System Idle Process.  A WHOLE LOT.  90 to 99.  Then the others are around 2 to 3 which were lsass.exe and wmplayer.exe.

Title: Check up.
Post by: guestolo on August 30, 2005, 12:05:55 AM

Quote

The System Idle Process. A WHOLE LOT. 90 to 99

That's good
No problem there

Can you try something for me, hijackthis makes backups, so I want to disable an entry related to your SoundMax card, this entry is reported to cause problems
But I'm not sure if disabling it will help

So could you do the following

Run another scan with Hijackthis and with all other windows closed fix checked this entry
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe

Restart your computer

I won't see if it was any help until tomorrow, but if it doesn't help we can replace that entry
So don't remove your backups that hijackthis makes

Title: Check up.
Post by: Not-the-Google on August 30, 2005, 12:14:43 AM

Hm, that wasn't under here:

Logfile of HijackThis v1.99.1
Scan saved at 1:12:17 AM, on 8/30/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\eDonkey2000\eDonkey2000.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Gigabyte\Gigabyte GN-WPKG Wireless PCI Adapter SoftAP\Installer\WINXP\RaConfig2500.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis.exe

O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [eDonkey2000] "C:\Program Files\eDonkey2000\eDonkey2000.exe" -t
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\Emulator\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: GN-WPKG Utility.lnk = C:\Program Files\Gigabyte\Gigabyte GN-WPKG Wireless PCI Adapter SoftAP\Installer\WINXP\RaConfig2500.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1125273941597 (http://\"http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1125273941597\")
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1125274484062 (http://\"http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1125274484062\")
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Title: Check up.
Post by: guestolo on August 30, 2005, 12:25:09 AM

What happened to it?
And where did Edonkey come from, did you just install it?

Here some reading

Quote

The following file-swappers are confirmed to have spyware or other unwanted parasites bundled into them:
E-Donkey AKA Overnet (Versions prior to 1.2 available on June 1, '05 bundle adware. 1.2 is clean)

I'm confused whey that entry I asked you to remove with Hijackthis was already missing
If your fixing entries with Hijackths before I get to see your whole log that won't be much help
Also if your are disabling startup entries with MSCONFIG
Please enable them all and then supply a fresh hijackthis log

Title: Check up.
Post by: Not-the-Google on August 30, 2005, 12:31:06 AM

I did have it.  I just didn't have it running at the time.  Hm, I uninstalled a lot of things from that other log, but not from the log, from the Add/Remove Programs menu.  Also, I have version 1.4 for eDonkey, so does that mean it's safe?  I don't understand, what's MSConfig?

Title: Check up.
Post by: guestolo on August 30, 2005, 11:26:25 PM

If you did fix some entries with Hijackthis earlier
Can you do the following please just to make sure

Open Hijackthis>>View a list of Backups
Select and Restore all backups

Next:Go to START>>RUN>>Type in msconfig
Hit OK
Under the General tab Select Normal Startup

Apply it and close out and then Restart your computer

Post back a fresh Hijackthis log