« previous next »
Pages: [1]

Author Topic: weird disconection  (Read 739 times)

Offline jayyap

  • Jr. Member
  • **
  • Posts: 60
  • Karma: +0/-0
    • View Profile
weird disconection
« on: November 08, 2008, 07:18:42 AM »
recently my connection will suddenly disconnect itself without any notice on the display.i only realize i saw my modem is not blinking as usual & i cant continue surfing the web.
therefore, i need to discontinue my work and restart my computer again.
i would like to know what is the problem with my computer.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:18:23 PM, on 11/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Documents and Settings\jay yap\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\jay yap\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{7221DA52-A43A-497C-A64A-EBCF2DEB14C8}: NameServer = 202.188.0.133 202.188.1.5
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

--
End of file - 8344 bytes
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
weird disconection
« Reply #1 on: November 08, 2008, 02:07:03 PM »
How are you connected to the Internet?
Cable, DSL

What kind of connection to the computer?
USB>Cat5
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline jayyap

  • Jr. Member
  • **
  • Posts: 60
  • Karma: +0/-0
    • View Profile
weird disconection
« Reply #2 on: November 09, 2008, 06:45:50 AM »
DSL
cat5
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
weird disconection
« Reply #3 on: November 09, 2008, 03:19:47 PM »
I should of also asked, are you running through a router?
If so, make/model

What make is the modem?
May be able to find some answers on the net
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline jayyap

  • Jr. Member
  • **
  • Posts: 60
  • Karma: +0/-0
    • View Profile
weird disconection
« Reply #4 on: November 09, 2008, 10:12:52 PM »
yup. the model is billion.it is provided by the company when i register for the internet.
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
weird disconection
« Reply #5 on: November 09, 2008, 11:14:14 PM »
The make of the Modem/Router is Billion
That is not the Model
Model would be as eg... BiPAC 5100

Have you checked your connections to ensure they are all tight
No loose connections anywhere
Anything in the area, such as a phone that can cause interference
You could try unplugging all phones and see if the connection still drops

Are filters in line properly in place
Have you had your ISP check your line?

I know there is a problem with some models of Billion when updating to Service Pack 3
I see your still at Service Pack 2
But they have a firmware update to resolve the issue

How long has this been happening?
Any new program installed just beforehand?
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline jayyap

  • Jr. Member
  • **
  • Posts: 60
  • Karma: +0/-0
    • View Profile
weird disconection
« Reply #6 on: November 11, 2008, 03:23:14 AM »
sorry about that. that. the model is BiPAC 5112S
i have everything checked but not yet call to ISP
this has been happen since last week.
new program i install is the software for my camera and handphones
can i just want to know, is this problem cause by virus?
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
weird disconection
« Reply #7 on: November 11, 2008, 12:53:49 PM »
Are you running any filesharing programs when the disconnects happen?

I don't believe it's viral related, but it may be

First, can you do the following
Do a fresh reboot on your computer

When Windows loads
Open your Task Manager, End process on some entries you don't need running to troubleshoot

I'm curious about the first on
End Process on
epmworker.exe

Continue do the same for all the following
jusched.exe
realsched.exe
OpwareSE4.exe
Application Launcher.exe
NMBgMonitor.exe
GoogleUpdate.exe
msmsgs.exe
ccc.exe
igfxsrvc.exe
NMIndexingService.exe
NMIndexStoreSvr.exe

Not all, or any could be causing the problem
But use your computer with those apps. stopped and see if you disconnect
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline jayyap

  • Jr. Member
  • **
  • Posts: 60
  • Karma: +0/-0
    • View Profile
weird disconection
« Reply #8 on: November 11, 2008, 09:14:59 PM »
yup.but it's also happen when i just simply checking my mail and browse websites
Logged

Offline jayyap

  • Jr. Member
  • **
  • Posts: 60
  • Karma: +0/-0
    • View Profile
weird disconection
« Reply #9 on: November 11, 2008, 10:19:16 PM »
i just end process for all of it, but it still happen.
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
weird disconection
« Reply #10 on: November 11, 2008, 10:25:14 PM »
We can check for malware, just to be on the safe side

If you have a previous version of ComboFix, delete it
Download this file - Combofix.exe and save it ONLY to your desktop

Temporarily disable McAfee so it won't interfere with the next step

Double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you.
By default it will save a copy to C:\Combofix.txt
I'll need to see this log later
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Post that log from ComboFix
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline jayyap

  • Jr. Member
  • **
  • Posts: 60
  • Karma: +0/-0
    • View Profile
weird disconection
« Reply #11 on: November 12, 2008, 11:19:37 PM »
here is the log. by the way, the combofix still need to store in my computer? and why my computer will flash through the OS option screen when i restart my computer? this is occur after i run the combofix

ComboFix 08-11-11.01 - jay yap 2008-11-13 10:42:25.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1252.1.1033.18.1516 [GMT 8:00]
Running from: c:\documents and settings\jay yap\Desktop\ComboFix.exe
 * Created a new restore point
.

(((((((((((((((((((((((((   Files Created from 2008-10-13 to 2008-11-13  )))))))))))))))))))))))))))))))
.

2008-11-11 08:23 . 2008-11-11 08:23   <DIR>   d--------   c:\documents and settings\jay yap\Application Data\PC Suite
2008-11-10 21:27 . 2008-11-10 21:27   <DIR>   d--------   c:\documents and settings\lihhorng\Application Data\Nokia Multimedia Player
2008-11-10 21:17 . 2008-11-10 21:17   <DIR>   d--------   c:\documents and settings\All Users\Application Data\PC Suite
2008-11-10 21:11 . 2008-11-10 21:11   <DIR>   d--------   c:\documents and settings\lihhorng\Application Data\Nokia
2008-11-10 21:10 . 2008-11-10 21:10   <DIR>   d--------   c:\program files\PC Connectivity Solution
2008-11-10 21:10 . 2008-11-10 21:10   <DIR>   d--------   c:\program files\DIFX
2008-11-10 21:10 . 2008-11-10 21:10   <DIR>   d--------   c:\program files\Common Files\PCSuite
2008-11-10 21:10 . 2008-11-10 21:10   <DIR>   d--------   c:\program files\Common Files\Nokia
2008-11-10 21:10 . 2008-11-10 21:10   <DIR>   d--------   c:\documents and settings\lihhorng\Application Data\PC Suite
2008-11-10 21:10 . 2007-02-22 11:15   12,288   --a------   c:\windows\system32\drivers\nmwcdcm.sys
2008-11-10 21:10 . 2007-02-22 11:15   12,288   --a------   c:\windows\system32\drivers\nmwcdcj.sys
2008-11-10 21:10 . 2007-02-22 11:15   8,320   --a------   c:\windows\system32\drivers\nmwcdc.sys
2008-11-10 21:09 . 2008-11-10 21:10   <DIR>   d--------   c:\program files\Nokia
2008-11-10 21:09 . 2007-02-22 11:15   137,216   --a------   c:\windows\system32\drivers\nmwcd.sys
2008-11-10 21:09 . 2007-02-22 11:15   90,624   --a------   c:\windows\system32\nmwcdcls.dll
2008-11-10 21:09 . 2007-02-22 11:15   65,536   --a------   c:\windows\system32\nmwcdcocls.dll
2008-11-08 20:18 . 2008-11-08 20:18   <DIR>   d--------   c:\program files\Trend Micro
2008-11-06 17:07 . 2008-11-06 17:07   <DIR>   d--------   c:\program files\PIXELA
2008-11-06 17:06 . 2005-01-06 10:18   67,584   ---------   c:\windows\system32\bilw32.dll
2008-11-06 14:20 . 2008-11-06 14:20   268   --ah-----   C:\sqmdata05.sqm
2008-11-06 14:20 . 2008-11-06 14:20   244   --ah-----   C:\sqmnoopt05.sqm

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-07 15:53   ---------   d-----w   c:\program files\Common Files\Adobe
2008-11-06 09:07   ---------   d--h--w   c:\program files\InstallShield Installation Information
2008-10-03 09:09   ---------   d-----w   c:\program files\AviSynth 2.5
2008-10-03 09:07   ---------   d-----w   c:\program files\eRightSoft
2008-09-18 10:57   ---------   d-----w   c:\program files\eMule
2006-05-03 09:06   163,328   --sh--r   c:\windows\system32\flvDX.dll
2007-02-21 10:47   31,232   --sh--r   c:\windows\system32\msfDX.dll
2007-12-17 12:43   27,648   --sh--w   c:\windows\system32\Smab0.dll
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 153136]
"Google Update"="c:\documents and settings\jay yap\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-03 133104]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2006-10-15 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 44032]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 1443072]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-06-14 185896]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 271360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2007-08-13 c:\windows\system32\advpack.dll]

c:\documents and settings\lihhorng\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

c:\documents and settings\jay yap\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 110592]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i420vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\Administrator\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-06-01 10:21 153136 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-04 14:56 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 2006-10-27 00:47 31016 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
-ra------ 2007-09-17 15:10 162584 c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
-ra------ 2007-09-17 15:10 142104 c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--------- 2006-12-05 22:55 54832 c:\program files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 15:57 153136 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
-ra------ 2007-09-17 15:10 138008 c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2006-11-23 15:10 56928 c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
-r------- 2007-09-17 15:08 69632 c:\windows\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
-r------- 2007-09-17 15:08 16132608 c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=

R0 iastor76;iastor76;c:\windows\system32\drivers\iastor76.sys [2007-09-20 305176]
R0 mv61xx;mv61xx;c:\windows\system32\DRIVERS\mv61xx.sys [2007-02-09 91520]
R1 epfwtdir;epfwtdir;c:\windows\system32\DRIVERS\epfwtdir.sys [2008-02-20 33800]
S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2001-08-23 3584]
S3 SetupNTGLM7X;SetupNTGLM7X;E:\NTGLM7X.sys [ ]
S3 Usblink;Usblink Driver;c:\windows\system32\Drivers\ulink.sys [2005-04-30 37708]

*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder

2008-11-13 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\documents and settings\jay yap\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-03 18:16]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\jay yap\Application Data\Mozilla\Firefox\Profiles\10rylu9a.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com/
FF -: plugin - c:\documents and settings\jay yap\Local Settings\Application Data\Google\Update\1.2.131.25\npGoogleOneClick6.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-13 10:43:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-11-13 10:43:21
ComboFix-quarantined-files.txt  2008-11-13 02:43:15

Pre-Run: 3,623,526,400 bytes free
Post-Run: 3,970,613,248 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

167
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
weird disconection
« Reply #12 on: November 13, 2008, 12:24:53 AM »
Quote
here is the log. by the way, the combofix still need to store in my computer? and why my computer will flash through the OS option screen when i restart my computer? this is occur after i run the combofix
I have no idea what you mean by that??

Do you mean, do you need to have combofix remain on your computer?
No you don't but just don't delete it
Instead, go to START>>RUN
Copy and paste the next command

ComboFix /u

Then click OK, this will uninstall ComboFix


Quote
and why my computer will flash through the OS option screen when i restart my computer?
Chances are, ComboFix prompts to install the Recovery Console, this is a good thing
It's only a 2 second delay in startup, but it's benefits outdo the negatives
If you are ever in trouble and need the Recovery Console, you now don't need a Disc inserted to the drive
If you don't prefer to have RC installed, let me know, but I would let it remain

Anyways, whenever you disconnect, are any file sharing programs running
Close them all down, if you don't disconnect, you found the culprit
If you disconnect, even without them open
Time to phone your ISP and have them help figure out the problem
« Last Edit: November 16, 2008, 01:52:47 PM by guestolo »
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline jayyap

  • Jr. Member
  • **
  • Posts: 60
  • Karma: +0/-0
    • View Profile
weird disconection
« Reply #13 on: November 15, 2008, 07:23:30 PM »
thax.i guess the problem has been solved
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
weird disconection
« Reply #14 on: November 16, 2008, 01:51:53 PM »
[quote name=\'jayyap\' post=\'447080\' date=\'Nov 15 2008, 04:23 PM\']thax.i guess the problem has been solved[/quote]

What solved it?
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline jayyap

  • Jr. Member
  • **
  • Posts: 60
  • Karma: +0/-0
    • View Profile
weird disconection
« Reply #15 on: November 16, 2008, 10:24:48 PM »
nothing. i just did what u ask me to do last time.thatz all i did.
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
weird disconection
« Reply #16 on: November 16, 2008, 11:12:00 PM »
Could of been a bad registry file, I'm not sure
Do you purposely have Security Centers notifications turned off warning of disable AntiVirus, Firewall?
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Pages: [1]
« previous next »