A few problems

Out of the blue my computer started giving me a Messenger error upon startup. Also when I open Outlook Express. I haven't had Messenger enabled for months.

I know this isn't much info to go on but does it strike anyone as familiar, ie, similar to any problems that have been going around?

Also, and only related (as far as I know) insofar as it's the only other curious behaviour my machine is experiencing, I just purchased Warcraft3 and installed it without a hitch. Upon execution, however, I get the splash screen and then an error in war3.exe, code: 0xc0000005.

I'll apologize in advance for that last question: I realize this is not the right board for it, but I include it only because I've had some great luck with you guys helping me out in the past and I figured maybe someone who reads this might have some knowledge of WC3 issues.

Edit: a third symptom has come up -- my webcam isn't working anymore. Such a strange series of issues.

Can anyone recommend a program that will just do a general checkup on my system and TELL me if there's anything wrong? I can't figure out how to fix this because I can't figure out what the problem might even be. My virus scannings and scandisks don't come up with anything.

Edit again: ANOTHER issue... PC-Cillin gives me a "No Database Record" error when I try to update it...

 

Online virus scan - I like RAV (from my signature)

Download, immediately update, then run Ad-aware followed by the same with Spybot (my signature). Delete all that Ad-aware finds and any flagged by Spybot in red.

Download Hijackthis. Extract the file to a folder other than temp. Then run the .exe to create a log and post the log here.

What OS are you running and if 2K or XP, which of the recent security patches have you installed (MS04-011, 012, 013, 014)?

 

Newt: I've got RAV, Ad-Aware, and Spybot. I apologize for not mentioning that I ran them before posting with no indication of a problem.

Here's my Hijackthis log:

Logfile of HijackThis v1.97.7
Scan saved at 5:26:07 AM, on 06/05/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Icons\Seticon.exe
C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Trend Micro\PC-cillin 2002\WebTrap.EXE
C:\WINDOWS\System32\devldr32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Grisoft\AVG6\avgw.exe
C:\PROGRA~1\MOZILLA.ORG\MOZILLA\MOZILLA.EXE
C:\Program Files\Outlook Express\msimn.exe
E:\HijackThis.exe

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SetIcon] C:\Program Files\Icons\Seticon.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe "
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe "
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe "
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\RunServices: [Generic Service Process] serv1ces.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe "
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/threatinfo/virusinfo/webscan.cab
O16 - DPF: {B3872502-F9FD-4E96-93FF-0D37298F0689} (SOESysInfo Control) - http://everquest2.station.sony.com/beta_reg/soesysinfo.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Thanks so much for the response!

Paul: I'm well aware of the forum rules. As I noted in my edit before you even posted, the series of problems I was having seemed entirely unrelated to each other and I couldn't think of a valid way to link them all together. I'm just completely stumped.

 

Moving thread to our security area

Fix this
O4 - HKLM\..\RunServices: [Generic Service Process] serv1ces.exe
then reboot the pc
Reboot find and delete (ONLY THIS EXACT) file You might have to have windows show hidden file's and folder's in order to see them.
How to Show hidden files and folders.
serv1ces.exe anywhere its found, in orded to find it you will have to set search up to also look for hidden files
its probaly in the system 32 folder.

You mention RAV (what the online?) and I see you also have PC-cillin and AVG
Im most cases it's not even a good idea to have two much less three antivirus program installed at the same time let alone running at startup
I suggest you uninstal all but one. Keep the one your most comfortable with.

Next go get preferable two free onlines and it might be better to get a second opinion so dont use Mcaffees or Rav's
perhaps HouseCall unless you already have (today)
Or BitDefender AntiVirus
http://www.bitdefender.com/scan/licence.php

Make and Post a fresh Log please

 

Believe you still have some nasties onboard. Scan with HJT again, place a check next to this and fix.

O4 - HKLM\..\RunServices: [Generic Service Process] serv1ces.exe

Boot to safe mode, search for and delete this file. serv1ces.exe (may be hidden....notice the 1 where it should be i)

Download the Hosts File Reader (direct download) and scan for hosts files. If any are found with entries related to security sites with an address of 127.0.0.1, remove and set the default.

Scan again with Housecall.

EDIT
See you beat me to it while I was distracted, Lonny.

 

Nice to have confirmation, hadn't thought of a hosts problem.
I would hate to couse problems by deleting a lagit file.. dont suppose windows would let that happen in this case

 

In addition to Lonnie/noahdfear's comments, you said you haven't been running messenger for yonks.

In addition to the msnmessenger that you probably do want, how about:

O4 - HKCU\..\Run: [MSMSGS] "C:\Program files\Messenger\msmsgs.exe "
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)

And I completely agree with
- only having one onboard AV
- running ONLINE scans with a couple of engines since you may have a baddie that has disabled your onboard one(s) or they may have just beaten each other up to the point they aren't working so well.

 

Thanks so much for the replies, everyone.

Lonny: I meant AVG, not RAV, sorry

This might be a silly question but how do I get Hosts File Reader to scan drives other than C? The program is on E drive and it still only checks C. (No hosts files were found on C.)

Also, thanks for the advice about more than one AV program. I had AVG running because PC-Cillin was getting the "No database record" error and I wanted to make sure my definitions were updated.

Incidentally, I'm STILL getting this error ( "no database record ") in PC-Cillin.

Also, the Messenger error doesn't occur on startup anymore, but still happens when I open Outlook Express.

As you can see from my Highjackthis log file, I got rid of the serv1ces.exe file, and your other suggestions. The problems do not appear fixed, however.

Incidentally, I remember reading that serv1ces.exe was a version of a certain virus (sasser maybe?) that also sometimes made a file named microsoft.exe. I found THIS on my system a few days ago and cleaned it up. Now, I'm a bit concerned -- how did it get through again? It's possible my PC-Cillin firewall might have been down for a little while at some point; would that have likely been the cause? I'd like to think I can rely on my firewall.

Log:

Logfile of HijackThis v1.97.7
Scan saved at 4:35:54 PM, on 06/05/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Icons\Seticon.exe
C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Trend Micro\PC-cillin 2002\WebTrap.EXE
C:\WINDOWS\System32\devldr32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
E:\HijackThis.exe
C:\Program Files\mozilla.org\Mozilla\mozilla.exe

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SetIcon] C:\Program Files\Icons\Seticon.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe "
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe "
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe "
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/threatinfo/virusinfo/webscan.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {B3872502-F9FD-4E96-93FF-0D37298F0689} (SOESysInfo Control) - http://everquest2.station.sony.com/beta_reg/soesysinfo.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

 

Were you able to run any online scans?

The suggestion to search for a HOSTS file was based on the inability to update PC-cillan, and also I might have seen (??) in one of the search results something about a HOSTS file associated with that file. The HOSTS file is normally located on the OS drive, which unless you are dual booting would be C:, and the default path is C:\Windows\System32\drivers\etc in XP. There should have been one there that looked like this, named HOSTS


# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost



If you didn't find one with security sites such as the PC-cillan update site, you needn't worry about it further. My guess would be that you need to reinstall the program (PC-cillan). Possibly damaged by the virus, or a virus.

In answer to your questions concerning other files and what type of virus, here are my search results. The first link has a list of other possible files, but I cannot confirm it. Maybe a google on the other listed files will produce some results to verify. One of the other links identifies a specific virus, but further verification should be sought if you want to be sure.

For the messenger error, you could just uninstall Windows Messenger by pasting this command line in the run box.

RunDll32 advpack.dll,LaunchINFSection %windir%\INF\msmsgs.inf,BLC.Remove

It will produce an error box telling you it was unsuccessful or something to that effect. Just say OK. You should also type services.msc in the run box, locate Messenger in the list, right click and stop, then right click and properties, set to disable, if it hasn't been done already.

Incidentally, your log looks good. The only other things I would recommend are to clear all temp folders and TIFs, empty recycle bin, disable system restore, reboot, run some more online scans and if all clean, re-enable and set a manual restore point. Many viri will reinstall themselves from these files, and this will clear all of them.

Post back should you have further questions or problems.

 

I think your all good to go except for some reading and possibly some cleanup
by running a couple specialist tools
and getting Mcaffee back in good working order.

Configuration Loader X microsoft.exe Added as a result of the GAOBOT.JB VIRUS! http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.gaobot.jb.html
http://sysinfo.org/startuplist.php?filter=microsoft.exe

serv1ces.exe im unsure of except it was possibly a trojan

If it were on my system I would thoroughly check the links above and run a tool or two, gaobot is sometimes called agobot

and those onlines to, I think you have, what and where if anything did they find ?

Run a tool like stinger , if anything is found please do tell us where and what it found, if anything is in the restore folder dont worry about it for now.
Network Associates Inc.Stinger: http://vil.nai.com/vil/stinger/

and yes there are variations that can prevent av's and firewalls from working correctly. I do not think they couse harm to the program just prevent it from working correctly.
But ya never know.

http://fr.trendmicro-europe.com/enterprise/support/faq.php

Once its working correctly run a full system scan while in safe more.

humm if c:\ is where windows is then dont worry about it, since the hosts reader says there is not one.

Will deal with the webcam and Warcraft3 problem later if they still exist
I hope this game wasnt something obtained from a filesharring program

 

Is ZoneAlarm a better firewall than the PC-Cillin firewall?

Also, how much room should I allow for System Restore? It's currently set at the max, 12% of my hard drive.

I ran Stinger, CWShredder, PC-Cillin, Housecall, AdAware, and Spybot. No malware found anywhere.

I cleaned out my temp folders and manually uninstalled Messenger.

I also reinstalled PC-Cillin.

That fixes the following problems: Messenger error popup, "No Database Record" error in PC-Cillin.

Problems that still exist:
* Webcam not being recognized despite it showing up as working properly in device manager (no change after reinstall of webcam, webcam program, and webcam drivers)

* Warcraft 3 getting a 0xc0000005 error right after the splash screen (no change after reinstalling the game)

* Mozilla windows are taking a second or two to actually close when multiple instances are open (IE doesn't do this) (no change after reinstalling the program)

* Video files are not being recognized in Zoom player or WMP (only change after reinstalling zoom player and codecs is the type of error given)

WMP errors include "Class not registered" and "The specified protocol is not recognized ". Zoom Player error used to be something to the effect of "Filter or decoder could not be found" (can't remember exactly what it was, sorry) and is now "Unable to create the Direct-X interface ". Incidentally, only AVI files attempt to open with Zoom Player automatically -- if I force any other file type to open with Zoom Player I get a strange popup error OUTSIDE of Zoom Player that says "Windows cannot find 'C:\Documents and Settings\Pyrrhonic\My Documents\Ryzom_Trailer_sword_07_HIGH.wmv'. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search. "

I'm so terribly stumped by all this... I'm preparing myself for a reformat and reinstall but I really hate doing that. So time consuming.

(Oh, also Lonny, the WC3 is a legit copy -- but I'll admit, for the sake of everyone smirking wryly at my luck, that I had recently borrowed a burned copy from a friend, installed it, and liked it so much that I went out to purchase it. Karma doesn't appear to believe in the whole try-then-buy method because while the pirated copy worked fine, the legit copy won't even load )

My logfile hasn't changed I don't think but I'll post it anyway, in case I'm blind.

Logfile of HijackThis v1.97.7
Scan saved at 2:52:54 PM, on 08/05/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Icons\Seticon.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe
C:\WINDOWS\System32\devldr32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
C:\Program Files\mozilla.org\Mozilla\Mozilla.exe
C:\Documents and Settings\Pyrrhonic\Desktop\Security\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.fark.com/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SetIcon] C:\Program Files\Icons\Seticon.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe "
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe "
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe "
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/threatinfo/virusinfo/webscan.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {B3872502-F9FD-4E96-93FF-0D37298F0689} (SOESysInfo Control) - http://everquest2.station.sony.com/beta_reg/soesysinfo.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

 

Success!

I used Directx Eradicator, then reinstalled Directx 9.0b.

Upon reboot, WC3 works, video files are playing again, and Mozilla windows close properly. A reinstall of the webcam drivers fixed the last problem.

Thanks so much for all the help everyone! I hope this thread can aid others in the future.

A couple last questions, just for reference: Is ZoneAlarm a better firewall than the PC-Cillin firewall? Also, how much room should I allow for System Restore? It's currently set at the max, 12% of my hard drive.

 

Thas good to here
why the eradicator though, did you try simple applying all updates first ?

I have never uses ZA or PC-Cillin, Guessing I would think cillins would be a step up from ZA.
Hopefully the others will here will respond

Sytem restore, we have ours set to max also, but there is realy no need since I wouldnt want to use it to go back more than a mounth.
Having said that ours is still at max,
If space is a concern then yes adjust sysrestore useage of it

Nice to see you got XP's sp1 and IE's also. be sure to get updates for any software that uses the web.
I just spoted this
Secunia - Advisories - Sun Java Runtime Environment Unspecified Denial of Service Vulnerability: http://secunia.com/advisories/11570/