Windows BBS The Place for Microsoft Windows Support! Windows, Support, Help Site

Go Back   Windows BBS > Security > General Security

General Security Post any general questions related to security, viruses or spyware here.

Register your FREE account to unlock additional features at WindowsBBS.com
Register
Welcome to WindowsBBS.com
Microsoft Windows Support

Mission Statement

WindowsBBS is an online community dedicated to easily accessible technical support for those using Microsoft operating systems and other Windows software.

Our goal is to become the leading resource for computer users that require assistance with their day-to-day computer usage, including full support for networking PC's, virus & malware removal, system upgrades and general support questions.


Discussion Forums
Operating Systems
Windows 7 Windows 7
Windows Vista Windows Vista
Windows XP Windows XP
Windows Server System Windows Server System
Windows 2000 Windows 2000
Windows 95/98/Me/NT Windows 95/98/Me/NT
Internet & Networking
Networking
Internet Explorer
Microsoft Mail
Firefox, Thunderbird
      & SeaMonkey

General Internet
Security
General Security
Malware and Virus
     Removal

Other
Other Software
Hardware
Test Posts
Community
Introductions
General Discussions
Comments
      & Suggestions

News @ WindowsBBS

Forum Sponsor
 Image

Closed Thread
 
LinkBack Thread Tools
Old 18th July 2004   #1
Inactive
 
Profile:
Join Date: Jun 2004
Location: PA
Posts: 84
Computer Experience:
Beginner
missmissy Reputation Level


System clean from trend micro

My computer was running slow so I ran my Ad-aware and spybot and found nothing but a recurring problem with spybot and a DOS exploit that I haven't been able to get rid of. I have mcafee security 6 completely updated, I also have my windows firewall up and running.

I found this trend micro system clean to use and ran it but it tells me all of these files that were access denied. I wanted to know if this is normal? I also ran it in safemode as admin to make sure that wasn't the problem and also got access denied.

I have windows xp home edition and I am connected to the internet through a linksy router for cable connection, there is 2 other computers on my home network but I cannot see them from my computer. I have my firewall set to not trust my local network.

Here is the log

/--------------------------------------------------------------\
| Trend Micro Sysclean Package |
| Copyright 2002, Trend Micro, Inc. |
| http://www.trendmicro.com |
\--------------------------------------------------------------/


2004-07-15, 16:18:54, Auto-clean mode specified.
2004-07-15, 16:18:54, Running scanner "C:\Documents and Settings\All Users\Documents\sysclean\TSC.BIN"...
2004-07-15, 16:19:43, Scanner "C:\Documents and Settings\All Users\Documents\sysclean\TSC.BIN" has finished running.
2004-07-15, 16:19:43, TSC Log:

Damage Cleanup Engine (DCE) 3.6(Build 1120)
Windows XP(Build 2600: Service Pack 1)

Start time : Thu Jul 15 2004 16:18:54

Load Damage Cleanup Template (DCT) "C:\Documents and Settings\All Users\Documents\sysclean\tsc.ptn" (version 373) [success]

Complete time : Thu Jul 15 2004 16:19:43
Execute pattern count(1015), Virus found count(0), Virus clean count(0), Clean failed count(0)

2004-07-15, 16:19:45, An error occurred while scanning file "C:\Documents and Settings\Administrator\NTUSER.DAT": Access is denied.
2004-07-15, 16:19:45, An error occurred while scanning file "C:\Documents and Settings\Administrator\ntuser.dat.LOG": Access is denied.
2004-07-15, 16:19:45, An error occurred while scanning file "C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat": Access is denied.
2004-07-15, 16:19:45, An error occurred while scanning file "C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG": Access is denied.
2004-07-15, 16:19:46, Could not set file for reading on "C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp": Access is denied.
2004-07-15, 16:19:48, An error occurred while scanning file "C:\Documents and Settings\LocalService\NTUSER.DAT": Access is denied.
2004-07-15, 16:19:48, An error occurred while scanning file "C:\Documents and Settings\LocalService\ntuser.dat.LOG": Access is denied.
2004-07-15, 16:19:48, An error occurred while scanning file "C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat": Access is denied.
2004-07-15, 16:19:48, An error occurred while scanning file "C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG": Access is denied.
2004-07-15, 16:20:09, An error occurred while scanning file "C:\Documents and Settings\NetworkService\NTUSER.DAT": Access is denied.
2004-07-15, 16:20:09, An error occurred while scanning file "C:\Documents and Settings\NetworkService\ntuser.dat.LOG": Access is denied.
2004-07-15, 16:20:09, An error occurred while scanning file "C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat": Access is denied.
2004-07-15, 16:20:09, An error occurred while scanning file "C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG": Access is denied.
2004-07-15, 16:21:10, An error was detected on "C:\System Volume Information\*.*": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB824141$\user32.dll": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB824141$\win32k.sys": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\accwiz.exe": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\crypt32.dll": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\cryptsvc.dll": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\hh.exe": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\hhctrl.ocx": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\hhsetup.dll": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\html32.cnv": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\locator.exe": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\magnify.exe": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\migwiz.exe": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\mrxsmb.sys": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\msconv97.dll": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\narrator.exe": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\newdev.dll": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\ntdll.dll": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\ntkrnlpa.exe": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\ntoskrnl.exe": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\osk.exe": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\pchshell.dll": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\raspptp.sys": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\shmedia.dll": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\srrstr.dll": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\srv.sys": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\sysmain.sdb": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\user32.dll": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\win32k.sys": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\winsrv.dll": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826939$\zipfldr.dll": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826942$\dhcpcsvc.dll": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826942$\ndis.sys": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on

missmissy is offline  
Didn't find the information you thought to find?
Check out these Similar Threads
Old 18th July 2004   #2
Inactive
 
Profile:
Join Date: Jun 2004
Location: PA
Posts: 84
Computer Experience:
Beginner
missmissy Reputation Level


It wouldn't fit in one post so here is more

"C:\WINDOWS\$NtUninstallKB826942$\ndisuio.sys": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826942$\netshell.dll": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826942$\wzcdlg.dll": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826942$\wzcsapi.dll": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB826942$\wzcsvc.dll": Access is denied.
2004-07-15, 16:21:15, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB828035$\msgsvc.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB828035$\wkssvc.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB828741$\catsrv.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB828741$\catsrvut.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB828741$\clbcatex.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB828741$\clbcatq.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB828741$\colbact.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB828741$\comadmin.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB828741$\comrepl.exe": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB828741$\comsvcs.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB828741$\comuid.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB828741$\es.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB828741$\migregdb.exe": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB828741$\msdtcprx.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB828741$\msdtctm.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB828741$\msdtcuiu.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB828741$\mtxclu.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB828741$\mtxoci.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB828741$\ole32.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallK B828741$\rpcrt4.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB828741$\rpcss.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB828741$\txflog.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB835732$\callcont.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB835732$\gdi32.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB835732$\h323.tsp": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB835732$\h323msp.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on
"C:\WINDOWS\$NtUninstallKB835732$\ipnathlp.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB835732$\lsasrv.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB835732$\mf3216.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB835732$\msasn1.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB835732$\msgina.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB835732$\mst120.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB835732$\nmcom.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallK B835732$\rtcdll.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB835732$\schannel.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB837001$\dao360.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB837001$\expsrv.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB837001$\msexch40.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB837001$\msexcl40.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB837001$\msjet40.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB837001$\msjetol1.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB837001$\msjetoledb40.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB837001$\msjint40.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB837001$\msjter40.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB837001$\msjtes40.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB837001$\msltus40.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB837001$\mspbde40.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB837001$\msrd2x40.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB837001$\msrd3x40.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB837001$\msrepl40.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB837001$\mstext40.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB837001$\mswdat10.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB837001$\mswstr10.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB837001$\msxbde40.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB837001$\vbajet32.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB839645$\fldrclnr.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB839645$\shell32.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB839645$\shlwapi.dll": Access is denied.
2004-07-15, 16:21:16, Could not set file for reading on "C:\WINDOWS\$NtUninstallKB839645$\sxs.dll": Access is denied.
2004-07-15, 16:21:17, Could not set file for reading on "C:\WINDOWS\$NtUninstallQ828026$\msdxm.ocx": Access is denied.
2004-07-15, 16:21:17, Could not set file for reading on "C:\WINDOWS\$NtUninstallQ828026$\wmpcore.dll": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\AIROBOFORM-BETA.EXE-03D16A9B.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\AIROBOFORM-NETSCAPE-ADAPTER[1-0AA45387.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\AIROBOFORM.EXE-10052ED1.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\CLEANMGR.EXE-1F86EA8E.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\CONTROL.EXE-013DBFB5.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on

missmissy is offline  
Old 18th July 2004   #3
Inactive
 
Profile:
Join Date: Jun 2004
Location: PA
Posts: 84
Computer Experience:
Beginner
missmissy Reputation Level


"C:\WINDOWS\Prefetch\IE6SETUP.EXE-034D6C64.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on
"C:\WINDOWS\Prefetch\IE6WZD.EXE-01867599.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\IEXPLORE.EXE-27122324.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\IMAPI.EXE-0BF740A4.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\Layout.ini": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\LEAKTEST.EXE-0BACFBF5.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\LOGON.SCR-151EFAEA.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\LOGONUI.EXE-0AF22957.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\MCAGENT.EXE-03DA6B71.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\MCAGENT.EXE-168D195B.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\MCDASH.EXE-26506D96.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\MCINFO.EXE-35A0A279.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\MCMNHDLR.EXE-25682BF9.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\MCUPDATE.EXE-19916285.pf": Access is denied.

sorry if I am messing up this log it is huge

missmissy is offline  
Old 18th July 2004   #4
Inactive
 
Profile:
Join Date: Jun 2004
Location: PA
Posts: 84
Computer Experience:
Beginner
missmissy Reputation Level


"C:\WINDOWS\Prefetch\MCVSFTSN.EXE-28693C17.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\MCVSMAP.EXE-155ED7D3.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\MCVSRTE.EXE-0CAB2150.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\MEADCO_NEPTUNE.EXE-1091DA00.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\MEADCO_NEPTUNE.EXE-306C254B.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\MGHTML.EXE-31D79FA5.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\MPFAGENT.EXE-324931EB.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\MPFCONSOLE.EXE-1A2CE790.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\MPFSERVICE.EXE-037A8F95.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\MPFWIZARD.EXE-01FC7CA3.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\MSGR6SUITE.EXE-215C0ED7.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\MSIEXEC.EXE-2F8A8CAE.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\MSMSGS.EXE-2B6052DE.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\MVTX.EXE-2A248D18.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\NOTEPAD.EXE-336351A9.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\NTOSBOOT-B00DFAAD.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\REGEDIT.EXE-1B606482.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\REGSVR32.EXE-25EEFE2F.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\RFWIPEOUT.EXE-2D28C389.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\RFWIPEOUT.EXE-354B60B0.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\RHAPSODY.EXE-00B14A12.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\ROBOTASKBARICON.EXE-05368BA4.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\RUNDLL32.EXE-1744E7BE.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\RUNDLL32.EXE-185D7EDF.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\RUNDLL32.EXE-1C525E98.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\RUNDLL32.EXE-253CF9E9.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\RUNDLL32.EXE-35BB92D4.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\RUNDLL32.EXE-3AFD7129.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\RUNDLL32.EXE-3FA7EA68.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\RUNDLL32.EXE-451FC2C0.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\RUNDLL32.EXE-4CB89D1F.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\RUNONCE.EXE-2803F297.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\SHMGRATE.EXE-1BA69E68.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\SHOOTTHEMESSENGER.EXE-1531C607.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\SVCHOST.EXE-3530F672.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\SYSCLEAN.EXE-047A9559.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\SYSOCMGR.EXE-31169C54.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\TALKBACK.EXE-159FA0B2.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\TASKMGR.EXE-20256C55.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\TSC.BIN-175206AB.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\UNPNP.EXE-05708A82.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\VSCANTM.BIN-12E72C48.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\WMIADAP.EXE-2DF425B2.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\WMIPRVSE.EXE-28F301A9.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\WUPDMGR.EXE-2F30BEAB.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\XUNZIP.EXE-0769C161.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\YMSGRIE.EXE-147FDFB9.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\YMSGR_~1.EXE-167A1811.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\YPAGER.EXE-2F89F868.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\YPAGER.EXE-31587640.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\YSERVER.EXE-21015EB1.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\YUPDATER.EXE-278A4587.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\YUPDATER.EXE-3946FDDF.pf": Access is denied.
2004-07-15, 16:21:58, Could not set file for reading on "C:\WINDOWS\Prefetch\ZCLIENTM.EXE-25C31104.pf": Access is denied.
2004-07-15, 16:22:36, An error occurred while scanning file "C:\WINDOWS\system32\config\default": Access is denied.
2004-07-15, 16:22:36, An error occurred while scanning file "C:\WINDOWS\system32\config\default.LOG": Access is denied.
2004-07-15, 16:22:36, An error occurred while scanning file "C:\WINDOWS\system32\config\SAM": Access is denied.
2004-07-15, 16:22:36, An error occurred while scanning file "C:\WINDOWS\system32\config\SAM.LOG": Access is denied.
2004-07-15, 16:22:37, An error occurred while scanning file "C:\WINDOWS\system32\config\SECURITY": Access is denied.
2004-07-15, 16:22:37, An error occurred while scanning file "C:\WINDOWS\system32\config\SECURITY.LOG": Access is denied.
2004-07-15, 16:22:37, An error occurred while scanning file "C:\WINDOWS\system32\config\software": Access is denied.
2004-07-15, 16:22:37, An error occurred while scanning file "C:\WINDOWS\system32\config\software.LOG": Access is denied.
2004-07-15, 16:22:37, An error occurred while scanning file "C:\WINDOWS\system32\config\system": Access is denied.
2004-07-15, 16:22:37, An error occurred while scanning file "C:\WINDOWS\system32\config\system.LOG": Access is denied.
2004-07-15, 16:23:26, Running scanner "C:\Documents and Settings\All Users\Documents\sysclean\VSCANTM.BIN"...
2004-07-15, 16:26:29, Files Detected:
Copyright (c) 1990 - 2002 Trend Micro Inc.
Report Date : 7/15/2004 16:23:26
VSAPI Engine Version : 6.810-1005
VSCANTM Version : 1.0-11111728
Virus Pattern Version : 937 (65960 Patterns) (2004/07/14) (193709)
Command Line: C:\Documents and Settings\All Users\Documents\sysclean\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\Documents and Settings\All Users\Documents\sysclean

missmissy is offline  
Old 18th July 2004   #5
Inactive
 
Profile:
Join Date: Jun 2004
Location: PA
Posts: 84
Computer Experience:
Beginner
missmissy Reputation Level


13794 files have been read.
13794 files have been checked.
10706 files have been scanned.
17053 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 7/15/2004 16:26:29
---------*---------*---------*---------*---------*---------*---------*---------*
2004-07-15, 16:26:29, Files Clean:
Copyright (c) 1990 - 2002 Trend Micro Inc.
Report Date : 7/15/2004 16:23:26
VSAPI Engine Version : 6.810-1005
VSCANTM Version : 1.0-11111728
Virus Pattern Version : 937 (65960 Patterns) (2004/07/14) (193709)
Command Line: C:\Documents and Settings\All Users\Documents\sysclean\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\Documents and Settings\All Users\Documents\sysclean

13794 files have been read.
13794 files have been checked.
10706 files have been scanned.
17053 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 7/15/2004 16:26:29 3 minutes 2 seconds (181.81 seconds) has elapsed.

---------*---------*---------*---------*---------*---------*---------*---------*
2004-07-15, 16:26:29, Clean Fail:
Copyright (c) 1990 - 2002 Trend Micro Inc.
Report Date : 7/15/2004 16:23:26
VSAPI Engine Version : 6.810-1005
VSCANTM Version : 1.0-11111728
Virus Pattern Version : 937 (65960 Patterns) (2004/07/14) (193709)
Command Line: C:\Documents and Settings\All Users\Documents\sysclean\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\Documents and Settings\All Users\Documents\sysclean

13794 files have been read.
13794 files have been checked.
10706 files have been scanned.
17053 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 7/15/2004 16:26:29 3 minutes 2 seconds (181.81 seconds) has elapsed.

---------*---------*---------*---------*---------*---------*---------*---------*
2004-07-15, 16:26:29, Scanner "C:\Documents and Settings\All Users\Documents\sysclean\V SCANTM.BIN" has finished running.

missmissy is offline  
Old 18th July 2004   #6
Staff
 
noahdfear's Avatar
 
Profile:
Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
~@<*+
noahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Level

My System

Not unusual that those files can't be accessed. So that we can see what is running on the PC, download HijackThis from the CWShredder link in my signature, in the Official Downloads section. Save it to a permanent folder (I create a new folder in C:\ named HJT). Open and hit scan, then save log. Once it is saved it will open in notepad. Select all from the edit button, copy and paste the results here. Don't fix anything with it yet! Someone experienced with the logs will advise you.
noahdfear is offline  
Old 18th July 2004   #7
Inactive
 
Profile:
Join Date: Jun 2004
Location: PA
Posts: 84
Computer Experience:
Beginner
missmissy Reputation Level


Here it is and thank you.

Logfile of HijackThis v1.98.0
Scan saved at 2:49:27 PM, on 7/18/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\CTsvcCDA.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\WINDOWS\BCMSMMSG.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Internet Security Alliance\pcInternet Patrol\ipatrol.exe
C:\Program Files\Dell AIO Printer A940\dlbabmon.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\svchost.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Messenger\msmsgs.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\System32\wisptis.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\HJT\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll
O2 - BHO: McAfee Privacy Service - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Program Files\McAfee\McAfee Privacy Service\GDIEHELP.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [McAfee Guardian] C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe /SU
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [MPFTray] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [PCIP] C:\Program Files\Internet Security Alliance\pcInternet Patrol\ipatrol.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: Customize Menu &4 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: RoboForm &2 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm &2 - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Privacy Bar - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Program Files\McAfee\McAfee Privacy Service\GDIEHELP.DLL
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...3/mcinsctl.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yaho...tocomplete.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/sh...20/mcgdmgr.cab

missmissy is offline  
Old 18th July 2004   #8
Inactive
 
Profile:
Join Date: Jun 2004
Location: PA
Posts: 84
Computer Experience:
Beginner
missmissy Reputation Level


Also, i had forgotten due to the access denied stuff. Something called mghtml.exe was using like 80% in my task manager. Now that disappeared from my task manager and my computer is faster, but I didn't do anything to remove it.
missmissy is offline  
Old 18th July 2004   #9
Staff
 
Christer's Avatar
 
Profile:
Join Date: Dec 2002
Location: Sweden
Posts: 5,162
Computer Experience:
I'm trying!
Christer Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation LevelChrister Reputation Level


Quote:
... a recurring problem with spybot and a DOS exploit that I haven't been able to get rid of.
This is a bug in Spybot S&D which will probably be fixed in due course but it has been there for a while now.

Christer

Christer is offline  
Old 18th July 2004   #10
Staff
 
noahdfear's Avatar
 
Profile:
Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
~@<*+
noahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Level

My System

mghtml.exe is a Mcafee file, and is OK if found running on your system.

You will most likely need to disable Spybot's Tea-Timer for registry changes to be allowed or take. (fixing things with HJT makes registry changes)

Scan again with HijackThis and place a check next to the following entries. Close ALL other windows and click fix.

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe

Go to start>run and type msconfig, hit enter. On the boot.ini tab, check the box next to /safeboot and OK. Yes to restart. This will restart your computer in safe mode.

Now in safe mode, you will need to show hidden files and folders.

Open C:\Program Files\Common Files\Real\Update_OB and rename realsched.exe to realsched.old
Open C:\Windows\Temp, select all and delete.
Open C:\Documents and settings\username\Local Settings\temp, select all and delete. Do this for all usernames.
Open C:\Windows\Prefetch, select all and delete.
Open My Computer, right click Local disk C: and choose properties, then disk cleanup. Check all boxes except compress old files and OK.
Uncheck the /safeboot box in msconfig and ok to reboot.


Manually download the latest update for Sun Java JRE.
http://java.sun.com/j2se/1.4.2/download.html


Information about this process, C:\WINDOWS\System32\wisptis.exe, below. Make sure you take note of the very last post and BACKUP THE REGISTRY FIRST if you decide to fix it.

http://www.boredguru.com/modules/new...e=flat&order=0

Information below about this process, taken from answersthatwork.com. C:\WINDOWS\System32\nvsvc32.exe

NVIDIA Driver Helper Service which gets installed under Windows NT4/2000/XP/2003 by the NVIDIA drivers for some of their graphics cards (or graphics cards based on an NVIDIA chipset). We do not at this stage know what this process does except consume memory ! And we also have no idea as to what a “Driver Helper Service” is supposed to do !!

Recommendation :
This service is often responsible for various glitches, from significant shutdown delays to excessive memory usage. Disabling it, however, does not result in our experience in any ill-effect in regards to the proper operation of your NVIDIA or NVIDIA chipset graphics card, so we recommend that you definitely set the Startup Mode of this service to Disabled. You can do this by going to start>run, type services.msc, hit enter. Locate the service in the list and right click>properties.

CTHELPER is a background task that is a plug-in manager for Creative drivers. It first appeared with Creative’s SoundBlaster Live and Audigy soundcards. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers, add-on features, and fixes that will integrate with a tighter fit with Creative’s sound drivers and utilities. One of the very first uses of this interface has been for InterVideo’s WinDVD in the shape of a fix called "WinDVDPatch" and, at the time of writing 12-Jan-2003, there have not been other uses for it yet.

Recommendation :
Given its purpose CTHELPER would normally be classified as a "leave alone" background task. Unfortunately, as with many other Creative background tasks in these pages, there are often problems with CTHELPER. The most common complaint is random excess CPU utilization, up to 100% ! We have also had complaints of PCs freezing when CTHELPER is around, although that is probably also 100% CPU utilization. Additionally, on PCs running Intel’s Pentium 4 Hyper-Threading CPUs, the sound stutters. In short : CTHELPER is far more trouble than it is a help.

Added by soundcard software to remind you to update. O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE Not needed at startup.

Hopefully after seeing to some of the processes mentioned above and a reboot, your PC will be performing more like the way it should. If not, please do post back. (I'd like to know what/if anything helps too.)

noahdfear is offline  
Old 19th July 2004   #11
Inactive
 
Profile:
Join Date: Jun 2004
Location: PA
Posts: 84
Computer Experience:
Beginner
missmissy Reputation Level


Logfile of HijackThis v1.98.0
Scan saved at 1:12:56 AM, on 7/19/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\CTsvcCDA.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Internet Security Alliance\pcInternet Patrol\ipatrol.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\Dell AIO Printer A940\dlbabmon.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\HJT\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll
O2 - BHO: McAfee Privacy Service - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Program Files\McAfee\McAfee Privacy Service\GDIEHELP.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [McAfee Guardian] C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe /SU
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [MPFTray] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [PCIP] C:\Program Files\Internet Security Alliance\pcInternet Patrol\ipatrol.exe
O4 - HKLM\..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O8 - Extra context menu item: Customize Menu &4 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: RoboForm &2 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm &2 - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Privacy Bar - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Program Files\McAfee\McAfee Privacy Service\GDIEHELP.DLL
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...3/mcinsctl.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yaho...tocomplete.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/sh...20/mcgdmgr.cab


I tried to do everything you had listed, I hope that it worked. It did start faster. I removed windows journal viewer since I didn't use it anyways.

I couldn't use misconfig for some reason. I will look into that, I used to be able to access it. I just did f8 to get into safe mode.

Thank you!

missmissy is offline  
Old 19th July 2004   #12
Inactive
 
Profile:
Join Date: Jun 2004
Location: PA
Posts: 84
Computer Experience:
Beginner
missmissy Reputation Level


Quote:
Originally Posted by Christer
This is a bug in Spybot S&D which will probably be fixed in due course but it has been there for a while now.

Christer
Thank you!

missmissy is offline  
Old 19th July 2004   #13
Staff
 
noahdfear's Avatar
 
Profile:
Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
~@<*+
noahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Levelnoahdfear Reputation Level

My System

Quote:
I couldn't use misconfig for some reason.
If you typed misconfig rather than msconfig, that would be the problem.

noahdfear is offline  
Old 19th July 2004   #14
Inactive
 
Profile:
Join Date: Jun 2004
Location: PA
Posts: 84
Computer Experience:
Beginner
missmissy Reputation Level


Quote:
Originally Posted by noahdfear
If you typed misconfig rather than msconfig, that would be the problem.
LOL, yep that would be it. TY!

missmissy is offline  
Closed Thread

Thread Tools


Similar Threads
Thread Thread Starter Forum Replies Last Post
Win ME locks up since media player stopped working Ozgt General Security 40 17th August 2004 04:37
Housecall - Trend Micro ActiveX Warning Alice General Security 0 3rd July 2003 12:05
System Restore - Suspended !!??? PeteC Windows XP 6 10th May 2003 12:04
Trend Micro, House Call, stops Update at 95 Chris General Security 4 5th November 2002 23:57
some system files have been erased heikki Windows XP 2 23rd January 2002 22:50


All times are GMT +1. The time now is 04:46.






Advertisements do not imply our endorsement of the product or service advertised.
Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2009, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.3.2
Copyright © 2002 - 2009 WindowsBBS.com. All rights reserved.
Terms of Use, Legal Information & Privacy Policy
[]