1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

windows components screweing up

Discussion in 'Malware and Virus Removal Archive' started by got_no_life, 2004/12/19.

Thread Status:
Not open for further replies.
  1. 2004/12/19
    got_no_life

    got_no_life Inactive Thread Starter

    Joined:
    2004/10/29
    Messages:
    17
    Likes Received:
    0
    hi,
    I posted on here quite a while ago asking what I had done when I accidentally started removing all the windows components and then aborted half-way through. people didn't think it was much of a problem, but ever since i went through them all and re-installed them, they have been randomly un-installing.
    There is always one windows component un-installed - either IE, Windows Media Player, or Accessories. And as soon as i re-install the component, ANOTHER one un-installs itself!
    As you can imagine this gets extremely annoying and my windows CD is starting to get very scratched as i have to repeatedly put in when I want to re-install the 'Accessories' component.
    I wish there was a way to just make them all installed and stay like that. I can't use windows system restore because it wasn't on.
    Any help would be appreciated!
     
    got_no_life,
    #1
  2. 2004/12/19
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    What you are seeing could be the result of viral activity so I suggest you run an online virus scan from RAV or Housecall, or both - see Quicklinks in my sig for direct links. Also worthwhile running an online Trojan Scan

    If this fails to resolve the problem you should run System File Checker ....

    Start > Run - type in sfc /scannow - note the space and have your XP CD handy. SFC will run and exit - to see which files, if any have been replaced look in Event Viewer.


    If this fails to resolve the problem I suggest you download HijackThis via Quicklinks in my sig, save it to a folder on your hard drive. Post the log file here and we will move it to the Spyware & Virus Removal forum.
     
    PeteC,
    #2


  3. to hide this advert.

  4. 2004/12/19
    got_no_life

    got_no_life Inactive Thread Starter

    Joined:
    2004/10/29
    Messages:
    17
    Likes Received:
    0
    hi thanks for the help.
    im pretty sure i dont have any viruses because Norton Anti-virus couldn't find anything and neither could ad-aware or spybot. this is what hijack found:

    Logfile of HijackThis v1.99.0
    Scan saved at 10:08:13 a.m., on 20/12/2004
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
    C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
    C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_SICN03.EXE
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_SICN03.EXE
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\WinMX\WinMX.exe
    C:\Documents and Settings\Julian\My Documents\My Downloads\Flash\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.gmail.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.0.1
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {6291957C-8CE9-4c90-BEFF-12D9E68CFF30} - C:\WINDOWS\iDonate.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
    O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe "
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
    O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
    O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: messenger.hotmail.com
    O15 - Trusted Zone: loginnet.passport.com
    O15 - Trusted Zone: login.passport.net
    O15 - Trusted Zone: memberservicesnet.passport.net
    O16 - DPF: {3AF4DACE-36ED-42EF-9DFC-ADC34DA30CFF} (PatchInstaller.Installer) - file://D:\content\include\XPPatchInstaller.CAB
    O16 - DPF: {E123BED4-B8C7-42BB-958F-F13CA77EF95D} (Anark Client ActiveX Control) - http://install.anark.com/client/version2/windows-ie/en/AMClient.cab
    O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
    O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Kerio Personal Firewall 4 - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
    O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
     
    got_no_life,
    #3
  5. 2004/12/20
    Newt

    Newt Inactive

    Joined:
    2002/01/07
    Messages:
    10,974
    Likes Received:
    2
    I'm betting that folks didn't think it was still a problem since you failed to post again after the last suggestion given you on The thread you speak of.

    Did you take any of the suggestions on this thread from PeteC?

    The online scan one was because some virus infections can disable your onboard AV so it appears to scan but in reality will only report a clean system to you. The online scanners can't be fooled that way.
     
    Newt,
    #4
  6. 2004/12/20
    got_no_life

    got_no_life Inactive Thread Starter

    Joined:
    2004/10/29
    Messages:
    17
    Likes Received:
    0
    it is very strange because it appears the programs are actually there, my shortcuts just can't open it. Because my shortcuts had always randomly stopped working and then after i re-installed the component, they worked again. Just now though, when my IE shortcut wasn't working, i didn't re-install the component but instead copied a shortcut from another users desktop on to my desktop and then I could acces IE. It doesn't make any sense to me... :confused:
     
    got_no_life,
    #5
  7. 2004/12/20
    Newt

    Newt Inactive

    Joined:
    2002/01/07
    Messages:
    10,974
    Likes Received:
    2


    ...
     
    Newt,
    #6
  8. 2004/12/20
    got_no_life

    got_no_life Inactive Thread Starter

    Joined:
    2004/10/29
    Messages:
    17
    Likes Received:
    0
    hi, i am taking the scans right now.i will post back soon.
     
    got_no_life,
    #7
  9. 2004/12/20
    got_no_life

    got_no_life Inactive Thread Starter

    Joined:
    2004/10/29
    Messages:
    17
    Likes Received:
    0
    Starting scan at 10:49:10:00...
    Scan Memory
    Memory not infected
    Scan folder: 'C:\', recursive
    Unable to scan C:\System Volume Information - Access is denied.
    Finished scan at 11:31:25:437
    Total number of files is 125024, number of infected files is 0
    Average files per second is 49, average file size is 3201288
     
    got_no_life,
    #8
  10. 2004/12/21
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    OK, so the online virus scan was clear - have you run System File Checker yet ?
     
    PeteC,
    #9
  11. 2004/12/22
    got_no_life

    got_no_life Inactive Thread Starter

    Joined:
    2004/10/29
    Messages:
    17
    Likes Received:
    0
    yeah that was fine too. i have run lots of different scans lately and all of them have been clear, so I don't think my computer is infected. Formatting the computer might be the only solution
     
    got_no_life,
    #10
  12. 2004/12/22
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    If you have a complete back up of all your data - as you will obviously need for a format and reinstall it would be worth your while trying a Repair of XP
     
    PeteC,
    #11
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...