Help! My fonts look funnie and computer is slow

I had an infestation of malware (cwsearch and others) and I thought we had it all cleared up but my fonts are all ******* up and my computer is running slowly. The slowness I can attack a different way but the fonts have me beat. Everything is italics and my default fonts (even as I type this) have all changed. I had to go to IE-Tools-Accesibilty-Ignore font styles and sizes to get something I could read and post for help. I have tried using the tools to set the font style, etc. I also went back to the last good config. This happens not only in IE which is the major annoyance but even in programs like Word and Word Perfect. When I type it it looks normal but prints out italic. Can anyone help? Here is my HJT log but I can't find anything in here that looks like it oculd cause this. I need the experts!

have run the following:
Spybot S&D
Adaware6
EZ Antivirus
CWShredder

Thanks again for looking!
One more thing . . . Trojan Hunter found the following...

Registry scan
No suspicious entries found
Inifile scan
No suspicious entries found
Port scan
No suspicious open ports found
Memory scan
No trojans found in memory
File scan
Found possible trojan file: C:\WINNT\system32\Decode.exe (Suspicious: UPX-packed file in Windows System folder) Found possible trojan file: C:\WINNT\system32\Desire-uninstall.exe (Suspicious: UPX-packed file in Windows System folder) Found possible trojan file: C:\WINNT\system32\msfind.exe (Suspicious: UPX-packed file in Windows System folder) (Found possible trojan file: C:\WINNT\system32\NTREGOPT.EXE (Suspicious: UPX-packed file in Windows System folder)





HIJack This Log Below
Logfile of HijackThis v1.97.7
Scan saved at 7:47:58 AM, on 6/23/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\Program Files\Sygate\SPF\Smc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\VetMsgNT.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\CTHELPER.EXE
C:\WINNT\system32\EXSHOW95.EXE
C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE
C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
C:\WINNT\system32\EXSHOW.EXE
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe
C:\Program Files\Nokia\Nokia PC Suite 5\DataLayer.exe
C:\Program Files\Common Files\Nokia\Services\ServiceLayer.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Iomega\Tools\Imgicon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Disk Utilities\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.msn.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.msn.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http://proxy/:8080
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = www.msn.com
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINNT\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe "
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [EXSHOW95.EXE] EXSHOW95.EXE
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O5 "LPT1:" /M "Stylus C84 "
O4 - HKLM\..\Run: [VetTray] C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
O4 - HKLM\..\Run: [Pop-Up Stopper] "D:\Disk Utilities\Pop-Up Stopper\dpps2.exe "
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [Nokia Tray Application] C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Nokia\Nokia PC Suite 5\DataLayer.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe "
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [EPSON Stylus C84 Series] C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /M "Stylus C84" /EF "HKCU "
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Iomega Disk Icons.lnk = C:\Program Files\Iomega\Tools\IMGICON.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: PowerReg Scheduler.exe
O4 - Global Startup: twksup.lnk = D:\Disk Utilities\Tweak 3-1\twksup.exe
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa...director/sw.cab
O16 - DPF: {22D6F312-B0F6-11D0-94AB-0080C74C7E95} (Windows Media Player) - http://activex.microsoft.com/activex/contr...en/nsmp2inf.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200312...meInstaller.exe
O16 - DPF: {4B9F2C37-C0CF-42BC-BB2D-DCFA8B25CABF} (PopCapLoaderCtrl Class) - http://zone.msn.com/bingame/rock/default/popcaploader1.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033...all/xscan53.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://peeper.axisinc.com/AxisCamControl.ocx
O16 - DPF: {928626A3-6B98-11CF-90B4-00AA00A4011F} (SurroundVideoCtrl Object) - http://autos.msn.com/components/ocx/survid/MSSurVid.cab
O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://communities.msn.com/scr/MsnUpld.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://zone.msn.com/binGame/ZAxRcMgr.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/...7883.8742824074
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/controls/SassCln.CAB
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {BB47CA33-8B4D-11D0-9511-00C04FD9152D} (ExteriorSurround Object) - http://autos.msn.com/components/ocx/exterior/Outside.cab
O16 - DPF: {BC26D98E-4F8E-11D4-B523-94ED45C04971} (PrintQuickActiveXSetup Class) - http://www.pqvalet.com/plugin/win/ie/printQuick.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security2.norton.com/SSC/SharedCont...c/bin/cabsa.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://photos.msn.com/resources/neutral/co....cab?4,0,1009,0
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai.net/7/840/5805/v1503/...uditControl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shock...ash/swflash.cab
O16 - DPF: {D670D0B3-05AB-4115-9F87-D983EF1AC747} (AOL Downloader Plugin) - http://pak02.pictures.aol.com/ygp/aol/plug...oad.9.0.0.2.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://dgl.microsoft.com/downloads/outc.cab



Sure hope someone out there can help!
JIM

 

My first thought is to confirm that you do in fact have the fonts you think you have. If you navigate to C:\WINDOWS\FONTS, what do you see compared to a non-hosed machine? Should be 15-50 fonts in there, including some of the usual System, Ariel, etc..

Have you tried resetting your Appearence Style to something else? perhaps its hosed and using no-longer-present fonts, and the system is guessing a substitute?

 

Thanks for the reply

I do have the fonts - Just Arial and Times New Roman are what I use on IE and Outlook Express. I will try the appearance fix. This thing has got me majorly ticked off. I can go to tools in IE and then options then accessiblity and tick ignore font sizes and make it work but then some things are too huge to read and others stay small.
Thanks again,
Jim

 

No idea about the cause or the 'fix' but I routinely have my browser set to ignore font sizes and font styles. Gives me more control over type size and very few web pages behave badly with those settings.

 

Hi

Those Suspicious upx packed files,, check the properties>version manufacturer information, ? and you might ask at there forum also.
Trojan hunter will say any upx packed files are suspicious, I think.
Though this is probably not anything to do with a fonts problem.
If you have the registered version I'm sure you can submit the files and get a fast reply


How recent was the Cws infection ? and what did you do to clean it up.
Just cwsredder ?
are you currently fixing anything with HijackThis ?
Dave another of our forum members might ask for a pv log, he will be by

 

CWSearch

I used CWShredder in the safe mode and HiJack This both. I went to www.spywareinfo.com and posted a HJT log and several "Helpers" were able to tell me what to do. I also ran Spybot Search and Destroy and Adaware6. (Still do regularly) and a program I found called Spyware Blaster that is more of a preventative. One REALLY strange thing that this particular version I had did was to alter the date in my system clock so my virus scan thought it had expired and that left me more vulnerable. I just happened to stumble on to this symptom. That is a good web site as well to go to for help. I learned a tremendous amount just reading the posts of others. Thanks for your insight and help!
Jim

 

Hi Herd

Fix this
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab
and update then protect against all with SpywareBlaster, That one is on its list as a nastie


You have both sygate and etrusts firewall installed and running.?

What program is it thats using proxy settings ?

If you would link us to the thread at Spywareinfo ?

Meanwhile the others here might be able to instruct you on how to replace all the normal fonts if they think it will help.

 

Hi Jim,

Thanks for the SWI link, although some of us were already very familiar with the forum, and are members also. Many of the folks in the spyware/adware/malware/virus removal area share information, so that we are able to help others in our own 'home' forum, with what works elsewhere. Please do share a link to the thread where you recieved the help you sought. All I was able to find was this one, which obviously isn't the right one. Which means you would have re-registered with a different username (which isn't allowed there, or here), and doing a search with keywords from your previous posts and logs (like the infected filenames), didn't produce a positive hit either. If you still need/want help with this, please provide the information previously requested. There is good, qualified help here, and a bit of co-operation is generally all that's needed to get the help you seek.

 

That was not the thread

The SWIforum was changed to a new BBS system a couple of weeks ago. I am not sure if it go hacked or if they just changed BBS's. The old thread is gone I'm afraid. Thanks for the advice I have fixed the 'nasty! "
Jim

 

One More Question . . .

I am not reqally sure which program is using the proxy settings. Could it be WinMx? When I looked at that I also noticed in the HJT log that there is a space in the word Internet that should not be there. Could that be significant?
Thanks,
Jim

 

Scan again with HijackThis and place a check next to the following entries. Close ALL other windows and click fix.


R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = http://proxy/:8080
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE<<<<<<info below
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - Global Startup: PowerReg Scheduler.exe<<<<info below


Enables special mouse features. Fix if you don't use them.
O4 - HKLM\..\Run: [EXSHOW95.EXE] EXSHOW95.EXE

Added by soundcard software to remind you to update. Not needed at startup. Fix.
O4 - HKLM\..\Run: [UpdReg] C:\WINNT\UpdReg.EXE

Added by sound card software for auto detection of headphones. Not needed at startup. Fix.
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe "

This shows you are synchronizing web pages at logon. Can be disabled in IE>tools>IE options>synchronize>setup and uncheck boxes on logon/logoff tab.
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon

Quicktime will run when it's needed. Not needed at startup. Fix.
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

Not needed if you remember to check for updates. Control panel>Java Plug-in>update tab. Click the cache tab and clear while you're there.
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe


Reboot.

You will want to set your backups to zero.
Open C:\Program Files\Common Files\Real\Update_OB and rename realsched.exe to realsched.old
[hr][/hr]
PowerReg Scheduler
Pest Patrol says it is adware and should be fixed, and all files searched for and deleted.

Remove files

powerregschedulerv3.exe
profilepath+\start menu\programs\startup\powerreg scheduler.exe
profilepath+\start menu\programs\startup\powerreg schedulerv2.exe
programfilesdir+\powerreg
systemroot+\start menu\programs\startup\powerreg scheduler.exe
[hr][/hr]
Open C:\Windows\Temp, select all and delete.
Open C:\Documents and settings\username\Local Settings\temp, select all and delete. Do this for all usernames.
Open C:\Windows\Prefetch, select all and delete.
I recommend in IE click tools>IE Options>Settings button in TIF section>view objects>select all and delete. They will be replaced as needed.
Open My Computer and right click Local Disk C:, then choose disk cleanup. Check all except compress old files and OK.
[hr][/hr]
Information below about this process, taken from answersthatwork.com. C:\WINDOWS\System32\nvsvc32.exe

NVIDIA Driver Helper Service which gets installed under Windows NT4/2000/XP/2003 by the NVIDIA drivers for some of their graphics cards (or graphics cards based on an NVIDIA chipset). We do not at this stage know what this process does except consume memory ! And we also have no idea as to what a “Driver Helper Service†is supposed to do !!

Recommendation :
This service is often responsible for various glitches, from significant shutdown delays to excessive memory usage. Disabling it, however, does not result in our experience in any ill-effect as regards the proper operation of your NVIDIA or NVIDIA chipset graphics card, so we recommend that you definitely set the Startup Mode of this service to Disabled. You can Do this by going to start>run, type services.msc, hit enter. Locate the service in the list and right click>properties.
[hr][/hr]
CTHELPER is a background task that is a plug-in manager for Creative drivers. It first appeared with Creative’s SoundBlaster Live and Audigy soundcards. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers, add-on features, and fixes that will integrate with a tighter fit with Creative’s sound drivers and utilities. One of the very first uses of this interface has been for InterVideo’s WinDVD in the shape of a fix called "WinDVDPatch" and, at the time of writing 12-Jan-2003, there have not been other uses for it yet.

Recommendation :
Given its purpose CTHELPER would normally be classified as a "leave alone" background task. Unfortunately, as with many other Creative background tasks in these pages, there are often problems with CTHELPER. The most common complaint is random excess CPU utilization, up to 100% ! We have also had complaints of PCs freezing when CTHELPER is around, although that is probably also 100% CPU utilization. Additionally, on PCs running Intel’s Pentium 4 Hyper-Threading CPUs, the sound stutters. In short : CTHELPER is far more trouble than it is a help.
[hr][/hr]

Right click My Computer and select manage. Expand the event viewer and look for errors that might indicate a font problem. You could also open the boot.ini file (with notepad, probably located in C and add the line /bootlog, then save, which will create a log on reboot (probably also in C:, open with notepad), and might show whether the fonts are loading. Example;

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINNT= "Microsoft Windows 2000 Advanced Server" /fastdetect /bootlog

Make sure to leave a space behind fastdetect.

Assume you have already taken care of the trojan dialer Desire-uninstall.exe and it's dialer folder in Program Files. msfind.exe is a CoolWebSearch component and should be removed by running CWShredder. NTREGOPT.EXE and Decode.exe are both valid Windows files.

 

Thanks Dave - One more thing . . .

I did all of the things you mentioned except:

I left the ouse features alone - (I Use em)

I was unable to find the following:
Remove files

powerregschedulerv3.exe
profilepath+\start menu\programs\startup\powerreg scheduler.exe
profilepath+\start menu\programs\startup\powerreg schedulerv2.exe
programfilesdir+\powerreg
systemroot+\start menu\programs\startup\powerreg scheduler.exe

I was unable to do :Open C:\Windows\Prefetch, select all and delete.
Could this be because I have Win200SP instead of XP?

and ...Right click My Computer and select manage. Expand the event viewer and look for errors that might indicate a font problem. You could also open the boot.ini file (with notepad, probably located in C and add the line /bootlog, then save, which will create a log on reboot (probably also in C:, open with notepad), and might show whether the fonts are loading. Example;

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINNT= "Microsoft Windows 2000 Advanced Server" /fastdetect /bootlog

Make sure to leave a space behind fastdetect.

I have no "manage" is that also because of Win2000?


Here is fresh HJT log -
Logfile of HijackThis v1.97.7
Scan saved at 12:17:35 PM, on 6/26/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\Program Files\Sygate\SPF\Smc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\VetMsgNT.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\EXSHOW95.EXE
C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe
C:\WINNT\system32\EXSHOW.EXE
C:\Program Files\Nokia\Nokia PC Suite 5\DataLayer.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Nokia\Services\ServiceLayer.exe
C:\Program Files\Iomega\Tools\Imgicon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Disk Utilities\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.msn.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.msn.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = www.msn.com
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EXSHOW95.EXE] EXSHOW95.EXE
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O5 "LPT1:" /M "Stylus C84 "
O4 - HKLM\..\Run: [VetTray] C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
O4 - HKLM\..\Run: [Pop-Up Stopper] "D:\Disk Utilities\Pop-Up Stopper\dpps2.exe "
O4 - HKLM\..\Run: [Nokia Tray Application] C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Nokia\Nokia PC Suite 5\DataLayer.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe "
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [EPSON Stylus C84 Series] C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /M "Stylus C84" /EF "HKCU "
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Iomega Disk Icons.lnk = C:\Program Files\Iomega\Tools\IMGICON.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: twksup.lnk = D:\Disk Utilities\Tweak 3-1\twksup.exe
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {22D6F312-B0F6-11D0-94AB-0080C74C7E95} (Windows Media Player) - http://activex.microsoft.com/activex/controls/mplayer/en/nsmp2inf.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...pple.com/mickey/us/win/QuickTimeInstaller.exe
O16 - DPF: {4B9F2C37-C0CF-42BC-BB2D-DCFA8B25CABF} (PopCapLoaderCtrl Class) - http://zone.msn.com/bingame/rock/default/popcaploader1.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://peeper.axisinc.com/AxisCamControl.ocx
O16 - DPF: {928626A3-6B98-11CF-90B4-00AA00A4011F} (SurroundVideoCtrl Object) - http://autos.msn.com/components/ocx/survid/MSSurVid.cab
O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://communities.msn.com/scr/MsnUpld.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://zone.msn.com/binGame/ZAxRcMgr.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37883.8742824074
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/controls/SassCln.CAB
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {BC26D98E-4F8E-11D4-B523-94ED45C04971} (PrintQuickActiveXSetup Class) - http://www.pqvalet.com/plugin/win/ie/printQuick.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security2.norton.com/SSC/SharedContent/sc/bin/cabsa.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://photos.msn.com/resources/neutral/controls/MsnPUpld.cab?4,0,1009,0
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai.net/7/840/5805...ch.com/audit/includes/ContentAuditControl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://dgl.microsoft.com/downloads/outc.cab

Thanks again for all your help!
Jim

 

Yes. Sorry. I copied that text from cleanup instructions I use for XP and missed editing that out.

Hmmm.......could be a leftover entry from previously removed.......but that should cause a missing file entry on startup ..........did you do a search for the filenames? powerreg *.* should do it.

I would say yes. I was on a Win 2000 Pro machine the other day using the Computer Management Console (right click>manage), and just assumed it was native to the other Win 2000 versions. Since you don't have that, you will need to edit the boot.ini file to produce a bootlog. Do a sarch for it.

Log looks good. Still have all the 016's I see. Did you at least go to 'view objects' and make sure none of them say 'damaged' or 'corrupted' and all are installed?

Did doing any of this help with the fonts and/or the slow running PC?

I also suggest you rescan with RAV.

 

Follow up

I found some of the PowerReg files (PowerReg scheduler V3, PowerReg and backup 2004626-11323) will delete them as per instructions.
Which of the "16's" do you think are causing the problem?
I took out the "media search" one - do any others look suspicious?

Yes the fonts are better and the computer seems to be running faster.
I will scan with RAV as well and then post a HJT log again as soon as I am done.
One last thing, When I open Outlook Express it takes a lot longer to open than any other program. I only have 2 accts. set up so it shouldn't take it that long to check or anything.
Thanks again for all the help and I will post the log shortly.

Jim

 

Seems I recently read something about the sasser update control causing some problems.
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/controls/SassCln.CAB
But really, not that I so much suspect them as like to clear mine from time to time. They get reinstalled the next time they're needed, and I look at it as an update, in case it was changed. Some will never be used again and are just sitting there, doing nothing, like the one mentioned above.

Glad to hear things are better. Are the fonts back to normal then, or just better?

Best to search the IE/OE forum for slow loading. There have been numerous threads on it. I stopped mine from automatically send/recieve when opened and uninstalled Windows Messenger, and noticed a huge improvement in load time. WM was the biggest culprit.

 

Latest Log and other stuff!

I did all that you said and will remove the Sasser fix (16). When I scanned with the RAV online it found 9 viruses. Mostly in the java cache - exploit trojans, some in netmeeting and one in WinNt System. I set it to autoclean and ran it again. It said it found them but I don't think it cleaned them because I ran it again not on autoclean and it still found them. I ran E-Z Trust and it found the ones in the Java cache and fixed 2 but left the rest - only it found 16! I then erased the cache completely with CLean Disk Security and ran the E-z Trust again and it found nothing. I still have to do the one in WinNT and the ones in Netmeeting - E-Z trust did not find them but RAV did. Anyway here is the latest log. My wife uses Messenger all the time as she has brothers and sisters scattered over the USA so I needed to leave it alone. I will fix the Sasser and get back to you. Once again, thanks for all your time. Someday I hope to be knowlegeble enough to be able to help folks with problems like these!

 

OOPS - Forgot the log!

ogfile of HijackThis v1.97.7
Scan saved at 9:57:45 PM, on 6/26/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\Program Files\Sygate\SPF\Smc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\VetMsgNT.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\EXSHOW95.EXE
C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe
C:\WINNT\system32\EXSHOW.EXE
C:\Program Files\Nokia\Nokia PC Suite 5\DataLayer.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Nokia\Services\ServiceLayer.exe
C:\Program Files\Iomega\Tools\Imgicon.exe
C:\WINNT\system32\svchost.exe
D:\Disk Utilities\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.msn.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.msn.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = www.msn.com
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EXSHOW95.EXE] EXSHOW95.EXE
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O5 "LPT1:" /M "Stylus C84 "
O4 - HKLM\..\Run: [VetTray] C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
O4 - HKLM\..\Run: [Pop-Up Stopper] "D:\Disk Utilities\Pop-Up Stopper\dpps2.exe "
O4 - HKLM\..\Run: [Nokia Tray Application] C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Nokia\Nokia PC Suite 5\DataLayer.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe "
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [EPSON Stylus C84 Series] C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /M "Stylus C84" /EF "HKCU "
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Iomega Disk Icons.lnk = C:\Program Files\Iomega\Tools\IMGICON.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: twksup.lnk = D:\Disk Utilities\Tweak 3-1\twksup.exe
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {22D6F312-B0F6-11D0-94AB-0080C74C7E95} (Windows Media Player) - http://activex.microsoft.com/activex/controls/mplayer/en/nsmp2inf.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...pple.com/mickey/us/win/QuickTimeInstaller.exe
O16 - DPF: {4B9F2C37-C0CF-42BC-BB2D-DCFA8B25CABF} (PopCapLoaderCtrl Class) - http://zone.msn.com/bingame/rock/default/popcaploader1.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://peeper.axisinc.com/AxisCamControl.ocx
O16 - DPF: {928626A3-6B98-11CF-90B4-00AA00A4011F} (SurroundVideoCtrl Object) - http://autos.msn.com/components/ocx/survid/MSSurVid.cab
O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://communities.msn.com/scr/MsnUpld.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://zone.msn.com/binGame/ZAxRcMgr.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37883.8742824074
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/controls/SassCln.CAB
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {BC26D98E-4F8E-11D4-B523-94ED45C04971} (PrintQuickActiveXSetup Class) - http://www.pqvalet.com/plugin/win/ie/printQuick.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security2.norton.com/SSC/SharedContent/sc/bin/cabsa.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://photos.msn.com/resources/neutral/controls/MsnPUpld.cab?4,0,1009,0
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai.net/7/840/5805...ch.com/audit/includes/ContentAuditControl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://dgl.microsoft.com/downloads/outc.cab

JIM

 

Dont worry about the sunjava cache,as long as the scaners repaired or delete the other items, and Suns java is up to date.
Java Technology Help - Virus found in Java Plug-in cache directory: http://java.com/en/download/help/cache_virus.jsp
Simply clear sunjava's cache manualy

If you could go get another one(online)and give us a look at the report, that is if its unable to delete it.

Regards

 

Delete all System Restore points, reboot, create a new one, THEN run another virus/trojan scans, per Lonny's & Dave's advice.

You can stop Windows Messenger from turning on with Outlook Express.

How do the fonts look now?

By the way, nice to meet you, Herd. My name is Johanna, and I like to look over Dave & Lonny's shoulders from time to time. You have done a great job of following their expert advice, and I hope you are well on your way to a healthy happy computer!

Johanna

 

All appears well . . .

My fonts all seem back to normal and the computer is running faster or so it seems. I found the nasty in the WINNT folder and deleted it by using Clean Disk (35 overwrites! - What a feeling of power) and even located an infected mp3 (1st time I've heard of one of those!) and deleted it. I have run AdAware, Spybot S&D, SpySweeper and both virus scans and come up clean. I hope the firewall does a better job of keeping them out! That darn CoolWeb Search was a bear to clean out but nothing was as bad as the time I was hit by Cherbobyl way back when. Many thanks to Newt, JoeHobart, and especially to noahdfear and Lonny Jones! and to you Johanna, it's nice to meet you as well. I will be lurking and reading trying to learn all I can and I hope I will have little to burden you guys with in the future!

Jim in WV