1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

CD-ROM drive opens/closes of own accord

Discussion in 'PC Hardware' started by cindy20, 2006/07/08.

Page 1 of 2
  1. 2006/07/08
    cindy20

    cindy20 Inactive Thread Starter

    Joined:
    2006/06/20
    Messages:
    24
    Likes Received:
    0
    bizarre

    Hello Pete, I ran IEFix. I am not sure if the problem has been fixed. becos i am not able to use my computer at all. My Cd rom drive is behaving ina extremely bizarre way. It keeps opening and closing. I have not used any CD for more tahn 2 months. Even while I type this, it keeps opening and closing. Pls help.

    Cindy
     
    cindy20,
    #1
  2. 2006/07/08
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    Cindy

    Running IEFIx should not in any way result in this problem - I have moved this post to a new thread in the Hardware forum.

    For others the post originated from here ....

    http://www.windowsbbs.com/showthread.php?t=55247

    I suggest you go into Device Manager and remove the CD-ROM drive and reboot - let us know the result of doing that.
     
    PeteC,
    #2


  3. to hide this advert.

  4. 2006/07/09
    cindy20

    cindy20 Inactive Thread Starter

    Joined:
    2006/06/20
    Messages:
    24
    Likes Received:
    0
    Still closing and opening

    Hello Pete,
    I uninstalled the CD-Rom Drive however, as soon as the computer started to reboot, the Cd-drive is opening and closing by itself at least 25 times in 1 min. I have placed one hand on the drive to keep it from opening but it wont quiet it. Its struggling to open. Is it ok if i try to keep it from opening with my hand cause its driving me crazy. Even when the internet is off, as soon as the computer starts, the bizarre behaviour starts.

    I will be really glad if you can help me with this too.
    Cindy
     
    cindy20,
    #3
  5. 2006/07/09
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    Cindy

    I think the most likely explanation of the bizarre behaviour is that it is caused by a mechanical problem - probably the eject button is sticking or has failed.

    In theory this can be proved by going into Device Manager and disabling the drive and rebooting. If the behaviour continues the drive has a mechanical fault - if the drive stops opening and closing the source of the problem lies with Windows and we shall need to look further.
     
    PeteC,
    #4
  6. 2006/07/09
    Whiskeyman Lifetime Subscription

    Whiskeyman Inactive Alumni

    Joined:
    2005/09/10
    Messages:
    1,772
    Likes Received:
    37
    The eject button on the drive may have gone bad. Press the eject buuton to see if it is firm and you can feel it "click ". This could also be caused by a Trojan such as Sub7. I would read the stickies here Removing Spyware & Viruses, follow the directions and run the recommended programs then post a HijackThis log.
     
    Whiskeyman,
    #5
  7. 2006/07/10
    cindy20

    cindy20 Inactive Thread Starter

    Joined:
    2006/06/20
    Messages:
    24
    Likes Received:
    0
    AdAware SE report

    Hello Pete and Whiskeyman,
    As soon as I started the computer, the drive was quite for a while and then it started opening and closing again. I downloaded Adaware SE and updated and scanned. It found the following which i have quarantined.


    Ad-Aware SE Build 1.06r1
    Logfile Created on:Thursday, July 06, 2006 9:49:28 PM
    Created with Ad-Aware SE Personal, free for private use.
    Using definitions file:SE1R47 24.05.2005
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

    References detected during the scan:
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    Alexa(TAC index:5):10 total references
    Possible Browser Hijack attempt(TAC index:3):2 total references
    Tracking Cookie(TAC index:3):1 total references
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

    Ad-Aware SE Settings
    ===========================
    Set : Search for negligible risk entries
    Set : Safe mode (always request confirmation)
    Set : Scan active processes
    Set : Scan registry
    Set : Deep-scan registry
    Set : Scan my IE Favorites for banned URLs
    Set : Scan my Hosts file

    Extended Ad-Aware SE Settings
    ===========================
    Set : Unload recognized processes & modules during scan
    Set : Scan registry for all users instead of current user only
    Set : Always try to unload modules before deletion
    Set : During removal, unload Explorer and IE if necessary
    Set : Let Windows remove files in use at next reboot
    Set : Delete quarantined objects after restoring
    Set : Include basic Ad-Aware settings in log file
    Set : Include additional Ad-Aware settings in log file
    Set : Include reference summary in log file
    Set : Include alternate data stream details in log file
    Set : Play sound at scan completion if scan locates critical objects


    7-6-2006 9:49:28 PM - Scan started. (Full System Scan)

    Listing running processes
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

    #:1 [smss.exe]
    FilePath : \SystemRoot\System32\
    ProcessID : 516
    ThreadCreationTime : 7-6-2006 3:58:33 PM
    BasePriority : Normal


    #:2 [csrss.exe]
    FilePath : \??\C:\WINDOWS\system32\
    ProcessID : 580
    ThreadCreationTime : 7-6-2006 3:58:36 PM
    BasePriority : Normal


    #:3 [winlogon.exe]
    FilePath : \??\C:\WINDOWS\system32\
    ProcessID : 604
    ThreadCreationTime : 7-6-2006 3:58:36 PM
    BasePriority : High


    #:4 [services.exe]
    FilePath : C:\WINDOWS\system32\
    ProcessID : 648
    ThreadCreationTime : 7-6-2006 3:58:37 PM
    BasePriority : Normal
    FileVersion : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion : 5.1.2600.0
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Services and Controller app
    InternalName : services.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : services.exe

    #:5 [lsass.exe]
    FilePath : C:\WINDOWS\system32\
    ProcessID : 660
    ThreadCreationTime : 7-6-2006 3:58:37 PM
    BasePriority : Normal
    FileVersion : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion : 5.1.2600.0
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : LSA Shell (Export Version)
    InternalName : lsass.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : lsass.exe

    #:6 [svchost.exe]
    FilePath : C:\WINDOWS\system32\
    ProcessID : 824
    ThreadCreationTime : 7-6-2006 3:58:37 PM
    BasePriority : Normal
    FileVersion : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion : 5.1.2600.0
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Generic Host Process for Win32 Services
    InternalName : svchost.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : svchost.exe

    #:7 [svchost.exe]
    FilePath : C:\WINDOWS\System32\
    ProcessID : 1020
    ThreadCreationTime : 7-6-2006 3:58:40 PM
    BasePriority : Normal
    FileVersion : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion : 5.1.2600.0
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Generic Host Process for Win32 Services
    InternalName : svchost.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : svchost.exe

    #:8 [svchost.exe]
    FilePath : C:\WINDOWS\System32\
    ProcessID : 1180
    ThreadCreationTime : 7-6-2006 3:58:42 PM
    BasePriority : Normal
    FileVersion : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion : 5.1.2600.0
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Generic Host Process for Win32 Services
    InternalName : svchost.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : svchost.exe

    #:9 [svchost.exe]
    FilePath : C:\WINDOWS\System32\
    ProcessID : 1200
    ThreadCreationTime : 7-6-2006 3:58:42 PM
    BasePriority : Normal
    FileVersion : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion : 5.1.2600.0
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Generic Host Process for Win32 Services
    InternalName : svchost.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : svchost.exe

    #:10 [explorer.exe]
    FilePath : C:\WINDOWS\
    ProcessID : 1368
    ThreadCreationTime : 7-6-2006 3:58:43 PM
    BasePriority : Normal
    FileVersion : 6.00.2600.0000 (xpclient.010817-1148)
    ProductVersion : 6.00.2600.0000
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Windows Explorer

    InternalName : explorer
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : EXPLORER.EXE

    #:11 [ccsetmgr.exe]
    FilePath : C:\Program Files\Common Files\Symantec Shared\
    ProcessID : 1420
    ThreadCreationTime : 7-6-2006 3:58:43 PM
    BasePriority : Normal
    FileVersion : 103.0.5.2
    ProductVersion : 103.0.5.2
    ProductName : Client and Host Security Platform
    CompanyName : Symantec Corporation
    FileDescription : Symantec Settings Manager Service
    InternalName : ccSetMgr
    LegalCopyright : Copyright (c) 2000-2004 Symantec Corporation. All rights reserved.
    OriginalFilename : ccSetMgr.exe

    #:12 [sndsrvc.exe]
    FilePath : C:\Program Files\Common Files\Symantec Shared\
    ProcessID : 1432
    ThreadCreationTime : 7-6-2006 3:58:43 PM
    BasePriority : Normal
    FileVersion : 5.5.1.6
    ProductVersion : 5.5
    ProductName : Symantec Security Drivers
    CompanyName : Symantec Corporation
    FileDescription : Network Driver Service
    InternalName : SndSrvc
    LegalCopyright : Copyright 2002, 2003, 2004 Symantec Corporation
    OriginalFilename : SndSrvc.exe

    #:13 [spbbcsvc.exe]
    FilePath : C:\Program Files\Common Files\Symantec Shared\SPBBC\
    ProcessID : 1468
    ThreadCreationTime : 7-6-2006 3:58:44 PM
    BasePriority : Normal
    FileVersion : 1,0,1,47
    ProductVersion : 1,0,1,47
    ProductName : SPBBC
    CompanyName : Symantec Corporation
    FileDescription : SPBBC Service
    InternalName : SPBBCSvc
    LegalCopyright : Copyright (c) 2004 Symantec Corporation. All rights reserved.
    OriginalFilename : SPBBCSvc.exe

    #:14 [dslagent.exe]
    FilePath : C:\Program Files\Huawei\MT882\
    ProcessID : 1520
    ThreadCreationTime : 7-6-2006 3:58:45 PM
    BasePriority : Normal


    #:15 [ccapp.exe]
    FilePath : C:\Program Files\Common Files\Symantec Shared\
    ProcessID : 1528
    ThreadCreationTime : 7-6-2006 3:58:45 PM
    BasePriority : Normal
    FileVersion : 103.0.5.2
    ProductVersion : 103.0.5.2
    ProductName : Client and Host Security Platform
    CompanyName : Symantec Corporation
    FileDescription : Symantec User Session
    InternalName : ccApp
    LegalCopyright : Copyright (c) 2000-2004 Symantec Corporation. All rights reserved.
    OriginalFilename : ccApp.exe

    #:16 [realsched.exe]
    FilePath : C:\Program Files\Common Files\Real\Update_OB\
    ProcessID : 1564
    ThreadCreationTime : 7-6-2006 3:58:46 PM
    BasePriority : Normal
    FileVersion : 0.1.0.3018
    ProductVersion : 0.1.0.3018
    ProductName : RealPlayer (32-bit)
    CompanyName : RealNetworks, Inc.
    FileDescription : RealNetworks Scheduler
    InternalName : schedapp
    LegalCopyright : Copyright © RealNetworks, Inc. 1995-2004
    LegalTrademarks : RealAudio(tm) is a trademark of RealNetworks, Inc.
    OriginalFilename : realsched.exe

    #:17 [jusched.exe]
    FilePath : C:\Program Files\Java\jre1.5.0_06\bin\
    ProcessID : 1572
    ThreadCreationTime : 7-6-2006 3:58:46 PM
    BasePriority : Normal


    #:18 [apdproxy.exe]
    FilePath : C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\
    ProcessID : 1580
    ThreadCreationTime : 7-6-2006 3:58:46 PM
    BasePriority : Normal


    #:19 [msmsgs.exe]
    FilePath : C:\Program Files\Messenger\
    ProcessID : 1592
    ThreadCreationTime : 7-6-2006 3:58:46 PM
    BasePriority : Normal
    FileVersion : 4.0.0155
    ProductVersion : Version 4.0
    ProductName : Messenger
    CompanyName : Microsoft Corporation
    FileDescription : Messenger Client
    InternalName : msmsgs
    LegalCopyright : Copyright (c) Microsoft Corporation 1997-2001
    LegalTrademarks : Microsoft(R) is a registered trademark of Microsoft Corporation in the U.S. and/or other countries.
    OriginalFilename : msmsgs.exe

    #:20 [msnmsgr.exe]
    FilePath : C:\Program Files\MSN Messenger\
    ProcessID : 1600
    ThreadCreationTime : 7-6-2006 3:58:46 PM
    BasePriority : Normal
    FileVersion : 7.5.0306
    ProductVersion : 7.5.0306
    ProductName : MSN Messenger
    CompanyName : Microsoft Corporation
    FileDescription : MSN Messenger
    InternalName : msnmsgr
    LegalCopyright : Copyright (c) Microsoft Corporation 1997-2004
    LegalTrademarks : Microsoft(R) is a registered trademark of Microsoft Corporation in the U.S. and/or other countries.
    OriginalFilename : msnmsgr.exe

    #:21 [ccevtmgr.exe]
    FilePath : C:\Program Files\Common Files\Symantec Shared\
    ProcessID : 1616
    ThreadCreationTime : 7-6-2006 3:58:47 PM
    BasePriority : Normal
    FileVersion : 103.0.5.2
    ProductVersion : 103.0.5.2
    ProductName : Client and Host Security Platform
    CompanyName : Symantec Corporation
    FileDescription : Symantec Event Manager Service
    InternalName : ccEvtMgr
    LegalCopyright : Copyright (c) 2000-2004 Symantec Corporation. All rights reserved.
    OriginalFilename : ccEvtMgr.exe

    #:22 [spoolsv.exe]
    FilePath : C:\WINDOWS\system32\
    ProcessID : 1972
    ThreadCreationTime : 7-6-2006 3:58:55 PM
    BasePriority : Normal
    FileVersion : 5.1.2600.0 (XPClient.010817-1148)
    ProductVersion : 5.1.2600.0
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Spooler SubSystem App
    InternalName : spoolsv.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : spoolsv.exe

    #:23 [alg.exe]
    FilePath : C:\WINDOWS\System32\
    ProcessID : 164
    ThreadCreationTime : 7-6-2006 3:58:56 PM
    BasePriority : Normal
    FileVersion : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion : 5.1.2600.0
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Application Layer Gateway Service
    InternalName : ALG.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : ALG.exe

    #:24 [guard.exe]
    FilePath : C:\Program Files\ewido anti-spyware 4.0\
    ProcessID : 156
    ThreadCreationTime : 7-6-2006 3:58:56 PM
    BasePriority : Normal
    FileVersion : 4, 0, 0, 172
    ProductVersion : 4, 0, 0, 172
    ProductName : ewido anti-spyware
    CompanyName : Anti-Malware Development a.s.
    FileDescription : ewido anti-spyware guard
    InternalName : ewido anti-spywareguard
    LegalCopyright : Copyright © 2005 Anti-Malware Development a.s.
    OriginalFilename : guard.exe

    #:25 [inetinfo.exe]
    FilePath : C:\WINDOWS\System32\inetsrv\
    ProcessID : 384
    ThreadCreationTime : 7-6-2006 3:58:57 PM
    BasePriority : Normal
    FileVersion : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion : 5.1.2600.0
    ProductName : Internet Information Services
    CompanyName : Microsoft Corporation
    FileDescription : Internet Information Services
    InternalName : INETINFO.EXE
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : INETINFO.EXE

    #:26 [navapsvc.exe]
    FilePath : C:\Program Files\Norton AntiVirus\
    ProcessID : 480
    ThreadCreationTime : 7-6-2006 3:58:58 PM
    BasePriority : Normal
    FileVersion : 11.0.16.2
    ProductVersion : 11.0.16
    ProductName : Norton AntiVirus
    CompanyName : Symantec Corporation
    FileDescription : Norton AntiVirus Auto-Protect Service
    InternalName : NAVAPSVC
    LegalCopyright : Norton AntiVirus 2005 for Windows 98/ME/2000/XP Copyright © 2004 Symantec Corporation. All rights reserved.
    OriginalFilename : NAVAPSVC.EXE

    #:27 [ymsgr_tray.exe]
    FilePath : C:\PROGRA~1\Yahoo!\MESSEN~1\
    ProcessID : 932
    ThreadCreationTime : 7-6-2006 3:59:00 PM
    BasePriority : Normal


    #:28 [npfmntor.exe]
    FilePath : C:\Program Files\Norton AntiVirus\IWP\
    ProcessID : 992
    ThreadCreationTime : 7-6-2006 3:59:00 PM
    BasePriority : Normal
    FileVersion : 11.0.16.2
    ProductVersion : 11.0.16
    ProductName : Norton AntiVirus
    CompanyName : Symantec Corporation
    FileDescription : Norton AntiVirus Firewall Install Monitor
    InternalName : NPFMonitor
    LegalCopyright : Norton AntiVirus 2005 for Windows 98/ME/2000/XP Copyright © 2004 Symantec Corporation. All rights reserved.
    OriginalFilename : NPFMonitor.EXE

    (continued)
    Thank you,
    Cindy
     
    cindy20,
    #6
  8. 2006/07/10
    cindy20

    cindy20 Inactive Thread Starter

    Joined:
    2006/06/20
    Messages:
    24
    Likes Received:
    0
    Continuing part of Adaware report

    This is the remaining part of the AdAware report

    #:29 [tcpsvcs.exe]
    FilePath : C:\WINDOWS\System32\
    ProcessID : 1288
    ThreadCreationTime : 7-6-2006 3:59:01 PM
    BasePriority : Normal
    FileVersion : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion : 5.1.2600.0
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : TCP/IP Services Application
    InternalName : TCPSVCS.EXE
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : TCPSVCS.EXE

    #:30 [snmp.exe]
    FilePath : C:\WINDOWS\System32\
    ProcessID : 1332
    ThreadCreationTime : 7-6-2006 3:59:01 PM
    BasePriority : Normal
    FileVersion : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion : 5.1.2600.0
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : SNMP Service
    InternalName : snmp.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : snmp.exe

    #:31 [svchost.exe]
    FilePath : C:\WINDOWS\System32\
    ProcessID : 2460
    ThreadCreationTime : 7-6-2006 3:59:34 PM
    BasePriority : Normal
    FileVersion : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion : 5.1.2600.0
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Generic Host Process for Win32 Services
    InternalName : svchost.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : svchost.exe

    #:32 [wuauclt.exe]
    FilePath : C:\WINDOWS\System32\
    ProcessID : 3876
    ThreadCreationTime : 7-6-2006 4:00:20 PM
    BasePriority : Normal
    FileVersion : 5.8.0.2469 built by: lab01_n(wmbla)
    ProductVersion : 5.8.0.2469
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Automatic Updates
    InternalName : wuauclt.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : wuauclt.exe

    #:33 [iexplore.exe]
    FilePath : C:\Program Files\Internet Explorer\
    ProcessID : 2108
    ThreadCreationTime : 7-6-2006 4:01:19 PM
    BasePriority : Normal
    FileVersion : 6.00.2600.0000 (xpclient.010817-1148)
    ProductVersion : 6.00.2600.0000
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Internet Explorer
    InternalName : iexplore
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : IEXPLORE.EXE

    #:34 [ad-aware.exe]
    FilePath : C:\PROGRA~1\LAVASOFT\AD-AWA~1\
    ProcessID : 2804
    ThreadCreationTime : 7-6-2006 4:15:48 PM
    BasePriority : Normal
    FileVersion : 6.2.0.236
    ProductVersion : SE 106
    ProductName : Lavasoft Ad-Aware SE
    CompanyName : Lavasoft Sweden
    FileDescription : Ad-Aware SE Core application
    InternalName : Ad-Aware.exe
    LegalCopyright : Copyright © Lavasoft AB Sweden
    OriginalFilename : Ad-Aware.exe
    Comments : All Rights Reserved

    #:35 [hh.exe]
    FilePath : C:\WINDOWS\
    ProcessID : 1284
    ThreadCreationTime : 7-6-2006 4:15:49 PM
    BasePriority : Normal
    FileVersion : 5.2.3644.0
    ProductVersion : 5.2.3644.0
    ProductName : HTML Help
    CompanyName : Microsoft Corporation
    FileDescription : Microsoft® HTML Help Executable
    InternalName : HH 1.4
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : HH.exe

    Memory scan result:
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    New critical objects: 0
    Objects found so far: 0


    Started registry scan
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

    Alexa Object Recognized!
    Type : Regkey
    Data :
    TAC Rating : 5
    Category : Data Miner
    Comment :
    Rootkey : HKEY_LOCAL_MACHINE
    Object : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}

    Alexa Object Recognized!
    Type : RegValue
    Data :
    TAC Rating : 5
    Category : Data Miner
    Comment :
    Rootkey : HKEY_LOCAL_MACHINE
    Object : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
    Value : MenuStatusBar

    Alexa Object Recognized!
    Type : RegValue
    Data :
    TAC Rating : 5
    Category : Data Miner
    Comment :
    Rootkey : HKEY_LOCAL_MACHINE
    Object : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
    Value : Script

    Alexa Object Recognized!
    Type : RegValue
    Data :
    TAC Rating : 5
    Category : Data Miner
    Comment :
    Rootkey : HKEY_LOCAL_MACHINE
    Object : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
    Value : clsid

    Alexa Object Recognized!
    Type : RegValue
    Data :
    TAC Rating : 5
    Category : Data Miner
    Comment :
    Rootkey : HKEY_LOCAL_MACHINE
    Object : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
    Value : Icon

    Alexa Object Recognized!
    Type : RegValue
    Data :
    TAC Rating : 5
    Category : Data Miner
    Comment :
    Rootkey : HKEY_LOCAL_MACHINE
    Object : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
    Value : HotIcon

    Alexa Object Recognized!
    Type : RegValue
    Data :
    TAC Rating : 5
    Category : Data Miner
    Comment :
    Rootkey : HKEY_LOCAL_MACHINE
    Object : software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}
    Value : ButtonText

    Alexa Object Recognized!
    Type : RegValue
    Data :
    TAC Rating : 5
    Category : Data Miner
    Comment : "{c95fe080-8f5d-11d2-a20b-00aa003c157a} "
    Rootkey : HKEY_USERS
    Object : .DEFAULT\software\microsoft\internet explorer\extensions\cmdmapping
    Value : {c95fe080-8f5d-11d2-a20b-00aa003c157a}

    Alexa Object Recognized!
    Type : RegValue
    Data :
    TAC Rating : 5
    Category : Data Miner
    Comment : "{c95fe080-8f5d-11d2-a20b-00aa003c157a} "
    Rootkey : HKEY_USERS
    Object : S-1-5-18\software\microsoft\internet explorer\extensions\cmdmapping
    Value : {c95fe080-8f5d-11d2-a20b-00aa003c157a}

    Alexa Object Recognized!
    Type : RegValue
    Data :
    TAC Rating : 5
    Category : Data Miner
    Comment : "{c95fe080-8f5d-11d2-a20b-00aa003c157a} "
    Rootkey : HKEY_USERS
    Object : S-1-5-21-1229272821-1957994488-323289731-500\software\microsoft\internet explorer\extensions\cmdmapping
    Value : {c95fe080-8f5d-11d2-a20b-00aa003c157a}

    Registry Scan result:
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    New critical objects: 10
    Objects found so far: 10


    Started deep registry scan
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    Possible Browser Hijack attempt : {E6A3C1E2-F792-483E-9133-596215172BE9} (http://runonce.msn.com/setacceptlang.cab)

    Possible Browser Hijack attempt Object Recognized!
    Type : Regkey
    Data :
    TAC Rating : 5
    Category : Vulnerability
    Comment : Possible Browser Hijack attempt : http://runonce.msn.com/setacceptlang.cab
    Rootkey : HKEY_LOCAL_MACHINE
    Object : SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E6A3C1E2-F792-483E-9133-596215172BE9}

    Possible Browser Hijack attempt Object Recognized!
    Type : RegValue
    Data :
    TAC Rating : 5
    Category : Vulnerability
    Comment : Possible Browser Hijack attempt : http://runonce.msn.com/setacceptlang.cab
    Rootkey : HKEY_LOCAL_MACHINE
    Object : SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E6A3C1E2-F792-483E-9133-596215172BE9}
    Value : Installer

    Deep registry scan result:
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    New critical objects: 2
    Objects found so far: 12


    Started Tracking Cookie scan
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


    Tracking Cookie Object Recognized!
    Type : IECache Entry
    Data : administrator@tribalfusion[2].txt
    TAC Rating : 3
    Category : Data Miner
    Comment : Hits:4
    Value : Cookie:administrator@tribalfusion.com/
    Expires : 1-1-2038 5:30:00 AM
    LastSync : Hits:4
    UseCount : 0
    Hits : 4

    Tracking cookie scan result:
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    New critical objects: 1
    Objects found so far: 13



    Deep scanning and examining files (C:)
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

    Disk Scan Result for C:\
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    New critical objects: 0
    Objects found so far: 13


    Deep scanning and examining files (D:)
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

    Disk Scan Result for D:\
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    New critical objects: 0
    Objects found so far: 13


    Deep scanning and examining files (E:)
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

    Disk Scan Result for E:\
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    New critical objects: 0
    Objects found so far: 13


    Scanning Hosts file......
    Hosts file location: "C:\WINDOWS\system32\drivers\etc\hosts ".
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

    Hosts file scan result:
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    1 entries scanned.
    New critical objects:0
    Objects found so far: 13




    Performing conditional scans...
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

    Conditional scan result:
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    New critical objects: 0
    Objects found so far: 13

    10:01:53 PM Scan Complete

    Summary Of This Scan
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    Total scanning time:00:12:24.651
    Objects scanned:101086
    Objects identified:13
    Objects ignored:0
    New critical objects:13

    Next I will post the hijackthis log

    Thanks, Cindy
     
    cindy20,
    #7
  9. 2006/07/10
    cindy20

    cindy20 Inactive Thread Starter

    Joined:
    2006/06/20
    Messages:
    24
    Likes Received:
    0
    Hijackthis log

    I checked the eject button of the CD ROM drive with a pin. But I am not sure whether it is ok or not. Then, I ran hijack this in safe mode. Then I unistalled the CD Rom drive and rebooted the computer. The drive kept opening and closing even while restarting the computer. Then i was just holding it closed with my hand foe 1 min while restarting, and now for the last 10 mins, there has been no sign of activity from the CD ROM drive. I am posting the hijackthis log here:

    Logfile of HijackThis v1.99.1
    Scan saved at 10:13:55 PM, on 7/6/2006
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\hijackthis\HijackThis.exe

    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
    O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\Huawei\MT882\dslagent.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
    O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe "
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
    O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
    O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
    O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe



    Thank you, Cindy
     
    cindy20,
    #8
  10. 2006/07/10
    charlesvar

    charlesvar Inactive Alumni

    Joined:
    2002/02/18
    Messages:
    7,024
    Likes Received:
    0
    Hello Cindy,

    This still may be a mechanical problem with the CD player.

    I did spot RealPlayer, which does use the CD Player, so my suggestion is to stop RealPlayer and the RealPlayer Scheduler from starting up at boot up. They shouldn't be starting up anyway.

    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

    O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot

    From the Start menu, click on run.
    Type msconfig and ok.

    Then in the System Configuration utility, click on the Start tab.

    Uncheck RealPlayer and its schedular if the schedular is listed seperately and reboot.

    Afterwards when you boot up, you'll get a message from the System that you have changed the startups, tick the box on the left to shut the message off.

    Regards - Charles
     
    charlesvar,
    #9
  11. 2006/07/10
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    Cindy I did suggest ...
    rather than uninstalling it. Simply uninstalling it allows Windows to find it again on reboot.
     
    PeteC,
    #10
  12. 2006/07/10
    Whiskeyman Lifetime Subscription

    Whiskeyman Inactive Alumni

    Joined:
    2005/09/10
    Messages:
    1,772
    Likes Received:
    37
    The eject button I was referring to was the one you push with your finger not the hole you stick a pin into. Also HijackThis should be run in Normal mode not Safe Mode. You want any malware programs running so HJT can list them.

    These are the directions for HijackThis that I go by.

    If you have disabled any programs in msconfig or used another program which disables Startup programs please reverse this action.

    Please go to Control Panel > Folder Options > View and select show hidden and system files
    Also uncheck "hide file extensions of known file types "

    Download Hijack This. After downloading HijackThis do the following.

    Put HijackThis in a Permanent folder.

    Click My Computer, then C:\

    In the menu bar, File->New->Folder.

    That will create a folder named New Folder, which you can rename to "HJT" or "HijackThis ". Now you have C:\HJT.

    Put your HijackThis.exe there, and double click to run it.

    This will allow backups to be made and saved By Hijack This in case something goes wrong.


    HijackThis 1.99.1
     
    Last edited: 2006/07/10
    Whiskeyman,
    #11
  13. 2006/07/11
    cindy20

    cindy20 Inactive Thread Starter

    Joined:
    2006/06/20
    Messages:
    24
    Likes Received:
    0
    Disabled drive

    Hello Pete and Whiskeyman,
    I have disabled the drive and rebooted, but the behaviour continues. I suppose that this is a mechanical fault then? I know the eject button is the one you press with the finger. I thought I should check if it was stuck in some way and did so with a pin. I have not really meddled much with it. The eject button seems to be ok, though I cant be very sure. I am posting the hijackthis log.

    Logfile of HijackThis v1.99.1
    Scan saved at 11:54:15 AM, on 7/11/2006
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Huawei\MT882\dslagent.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    C:\WINDOWS\System32\inetsrv\inetinfo.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\WINDOWS\System32\tcpsvcs.exe
    C:\WINDOWS\System32\snmp.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\WINDOWS\System32\wuauclt.exe
    C:\hijackthis\HijackThis.exe

    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
    O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\Huawei\MT882\dslagent.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
    O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe "
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
    O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
    O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
    O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{C1D6859E-982B-42A3-AA8E-C55D2BAB71AC}: NameServer = 218.248.255.145 61.1.96.69
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

    The page seems to still be jumping at times.

    Thanks again, Cindy
     
    cindy20,
    #12
  14. 2006/07/11
    cindy20

    cindy20 Inactive Thread Starter

    Joined:
    2006/06/20
    Messages:
    24
    Likes Received:
    0
    System configuration

    Hello Charles,
    I unchecked the eal time and the real schedule in the system configuration utility

    Thank you,
    Cindy
     
    cindy20,
    #13
  15. 2006/07/11
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    Cindy

    There is nothing of concern in your HJT log.

    IMO the drive has a mechanical problem - it has failed :( and you should be thinking about replacing it. They are not expensive and easy to fit yourself. We can help out here, of course.

    In the short term you can stop that behaviour by opening the case, identifying the back of the drive and pulling out the power supply to it.
     
    PeteC,
    #14
  16. 2006/07/12
    cindy20

    cindy20 Inactive Thread Starter

    Joined:
    2006/06/20
    Messages:
    24
    Likes Received:
    0
    Cd Drive

    Hello Pete, I dont know much about hardware so I will have to contact someone to come home and replace the disk. Would it be possible to replace a certain portion of it, if faulty or failed, or would you suggest replacing the entire drive? Thank you for helping with the problem.

    Thank you,
    Cindy
     
    cindy20,
    #15
  17. 2006/07/13
    Whiskeyman Lifetime Subscription

    Whiskeyman Inactive Alumni

    Joined:
    2005/09/10
    Messages:
    1,772
    Likes Received:
    37
    You would replace the entire drive. They are very reasonable in price.
     
    Whiskeyman,
    #16
  18. 2006/07/13
    cindy20

    cindy20 Inactive Thread Starter

    Joined:
    2006/06/20
    Messages:
    24
    Likes Received:
    0
    Cd Drive

    Hello,
    I called the hardware person yesterday. The CD drive suddenly stopped creating a problem... In short .. it worked fine suddenly. I told him to look into it... but the hardware guy told me that he could not check unless it exhited the same bizarre behaviour. So, I tried restarting thrice and every time the CD drive worked fine. In fact, the entire day yesterday.. it worked ok. And now, today, when I switched on the computer, its exhibiting the same bizarre behaviour, but not as much. The hardware guy kept insisting that there could been a virus in the memory though I told him thre were surely not any. Also, now I am certain the eject button works fine. Earlier, it would eject 25 times or so in 1 min. but now, it ejects once every 5 mins.

    thank you,
    Cindy
     
    cindy20,
    #17
  19. 2006/07/14
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    A virus is possible although we checked all that out in your other thread.

    Do an online scan through Quicklinks in my signature and see if anything comes up.
     
    PeteC,
    #18
  20. 2006/07/23
    cindy20

    cindy20 Inactive Thread Starter

    Joined:
    2006/06/20
    Messages:
    24
    Likes Received:
    0
    Hello Pete,
    Sorry for the delay in replying. Had been out of town. So came home and switched on the computer and the CD ROM drive was quiet for over an hr. During which time, I ran the eTrust AntiVirus Web Scan and Trend Micro House scan. Now it opens and closes occasionally. the eTrust Antivirus scan gave the following results:

    Anima.class-2c12fd96-227db677.class Java/ByteVerify!exploit infected C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\


    kvmzayg.exe Win32/Wintrim.CU infected
    C:\!KillBox\

    The TrendMicro House scan gave the following results:

    (MS01-056) Windows Media Player .ASF Processor Contains Unchecked Buffer




    Vulnerability Identifier: CVE-2001-0719
    Discovery Date: Nov 20, 2001
    Risk: Critical
    Vulnerability Assessment Pattern File: 008
    Related Malware: ASF_MANYMIZE.A,WORM_MANYMIZE.A
    Affected Software:
    Microsoft Windows Media Player (Microsoft Windows XP)
    Microsoft Windows Media Player 6.4
    Microsoft Windows Media Player 7.0
    Microsoft Windows Media Player 7.1

    Description:

    This vulnerability enables a remote attacker to execute arbitrary code through the use of a malformed Advanced Streaming Format (ASF) file. It is caused by a buffer overflow in Microsoft Windows Media Player 6.4.



    It contained other vulnerabilities as well. But I am not able to provide the list because that IE window closed by itself. Probably because the CD ROM drive is very active now.


    Thank you, Cindy
     
    cindy20,
    #19
  21. 2006/07/23
    cindy20

    cindy20 Inactive Thread Starter

    Joined:
    2006/06/20
    Messages:
    24
    Likes Received:
    0
    Hello Pete, I ws not able to cure those files in eTrust scan. So I am going to try and run the scan again and cure those files or should I delete it? I suppose the killbox quarantine contains something and thats what the scan is showing. Pls let me know.

    Thank you,
    Cindy
     
    cindy20,
    #20
Page 1 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...