I've been Hijacked! Please help!

Question

walton 0 Newbie Poster

18 Years Ago

Hello, this is Walton and I need help! None of my shortcuts or programs on my desktop work anymore and I can't get into add/remove programs. I ran Mcafee Virus Scan, Spybot Search and Destroy, and Ad-Aware scan, and I'm still having trouble. I also restored my computer to an earlier point, but that did no good. I don't know if I have a virus or if I chose to block these applications. This problem began after I blocked something that popped up on my Ad-Watch monitor (Lavasoft). I have Windows Xp and the computer is a new Dell XPS 400. Please help me! Below is my Hijack This Report.

Logfile of HijackThis v1.99.1
Scan saved at 12:38:24 AM, on 12/24/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http:///??
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: (no name) - _{4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1130266793890
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1132318523125
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by108fd.bay108.hotmail.msn.com/activex/HMAtchmt.ocx
O18 - Filter: text/html - (no CLSID) - (no file)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: SVCLOAD - Unknown owner - c:\windows\system32\dllcache\sys32\winlogon.exe
O23 - Service: SVCMGR - Unknown owner - c:\windows\system32\dllcache\sys32\winlogon.exe

windows-virus

3 Contributors
27 Replies
533 Views
1 Week Discussion Span
Latest Post 18 Years Ago Latest Post by DMR

jaishankar 0 Posting Whiz

18 Years Ago

Download ewido from the link http://www.ewido.net/en/
install it and update it

Update ur McAfee Antivirus and Ad-Aware.

Disable ur computer from Lan.

Restart ur computer go to safe mode by hitting F8 key at boot up

Disable System Restore (MyComputer-Properties-System Restore Check Turn off System Restore on all Drives)
Perform a complete System scan with Mcafee, ewido, Ad-Aware, and also with Spybot Search and Destroy.

Delete all the temporary internet files, empty recycle bin and restart ur computer

And don't 4get to post a reply

jaishankar 0 Posting Whiz

18 Years Ago

Thanks for you help, but I can't get into system restore to change the settings. The "My Computer" icon did not respond when I tried to get into its properties, and when I finally made my way to system restore settings, I had got a message saying that this function no longer exists and that I should contact my administrator. What does this mean. Help me please!

When u enter into safe mode by default there will another account i.e., the Administrator account. Enter into it and try to disable system restore and scan

jaishankar 0 Posting Whiz

18 Years Ago

I opened my computer in safe mode with the administrator and I still could not access system restore. However, I did run full systems scans with all of my scan programs including Ewido-Malware and I deleted all of my temporary internet files. Yet, my computer is still in a vegetative state, so I'm still in desperate need of help.

If the system is not infected with virus any more then try to repair it with the Window XP cd if u have one. As repairing sets the system to its default settings. You wont loose any of ur data or programs

Disable ur Antivirus, Boot from Windows XP CD, now press enter to continue setup and the F8 to accept the license agreement, now the setup will search for the previous versions of Operating System, select "Microsoft Windows XP Professional" from the list displayed and press 'r' to repair

jaishankar 0 Posting Whiz

18 Years Ago

What can I do if I don't have a Windows XP cd. My computer already had Windows XP installled on it, and no cd was provided. Can I get a cd from a website?

Either u have to purchase from u nearest computer store if u can afford it or have to borrow from ur friend

DMR 152 Wombat At Large

18 Years Ago

Hi walton,

A couple of things, before you resort to an entire system restore or reformat:

1.

This problem began after I blocked something that popped up on my Ad-Watch monitor

Can you tell us anything more specific about that? "Something that popped up" doesn't give us very much to go on at all.

2. The list of running processes at the top of your HijackThis log looks rather "light on content" for a normal XP system. Did you run that HijackThis scan in Safe Mode? If so (and if possible), run HijackThis while booted into Windows normally and post the log from that scan. The log you posted definitely shows signs of infections, but I'd expect to see more information in a log than exists in yours.

3. If you can access your Administrative Tools control panel, open the Event Viewer utility in that control panel and look through your System and Application logs for entries flagged with "Error" or "Warning". Double-clicking on such an entry will open a window with more detailed information on the error; post that info here.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

walton 0 Newbie Poster · Answer 1 · 2005-12-25T15:23:05+00:00

Thanks for you help, but I can't get into system restore to change the settings. The "My Computer" icon did not respond when I tried to get into its properties, and when I finally made my way to system restore settings, I had got a message saying that this function no longer exists and that I should contact my administrator. What does this mean. Help me please!

walton 0 Newbie Poster · Answer 2 · 2005-12-26T01:45:22+00:00

I opened my computer in safe mode with the administrator and I still could not access system restore. However, I did run full systems scans with all of my scan programs including Ewido-Malware and I deleted all of my temporary internet files. Yet, my computer is still in a vegetative state, so I'm still in desperate need of help.

walton 0 Newbie Poster · Answer 3 · 2005-12-26T12:17:52+00:00

What can I do if I don't have a Windows XP cd. My computer already had Windows XP installled on it, and no cd was provided. Can I get a cd from a website?

walton 0 Newbie Poster · Answer 4 · 2005-12-27T01:22:07+00:00

This is a lengthy report. I used a Windows XP cd (Microsoft Windows XP Professional for OS 5.1.2600, which is compatible/identical with the original program on my PC) to reinstall Windows XP on my computer. However, when the startup wizard appeared which read "Welcome to Microsoft Windows XP, What do you want to do", I clicked "Install Windows XP", but nothing happened because my computer only responds to certain links now, which is all confusing to me. Since it responds to some links and not others, I've been having trouble connecting to shortcuts, programs, etc. and I definitely can't connect to my system restore settings option.

Here is a short story of how my computer came to be in the state that it's in: Before the Lavasoft Ad-watch pop-up encounter, I was trying to install my EA Sports MVP Baseball 2004 Demo (this is a demo of a baseball game for PC). However, One of the .exe files in the games folder read "MVP 2005", a newer edition so I decided to double click on it. It started to load the game's opening screen because a loading bar showed, but then it crashed (probably because it was trying to run all of the older version's applications since the games were in the same folder). This caused my computer to crash as well, so I rebooted my computer with a restart. I feared that this game cause a potential problem to my PC so I uninstalled it completely. Shortly after this incident (about 5-10 minutes later), "something" was detected on my Lavasoft Ad-watch monitor. I am unsure if there is any correlation between the two, but I'm just telling you the sequence of events of what happened.

As far as what happened with the Lavasoft Ad-watch pop-up, I can't really describe what happened. All I remember is that "something" was detected, which I don't have a name for, and the program asked me if I would like to block it or accept it. However, I was prompted to read more about this detection, before making a decision. I did not read because the report was somewhat lengthy like this one :D , and I chose to block whatever was detected to be on the safe side. Shortly after this, my computer started acting a fool, and it has remained in this vegetative state. I then ran a system restore at this time because this function was working propely at the time, but it did not change the functioning of my shortcuts, or programs back to normal.

You can see my HijackThis log below. I ran HijackThis again in Windows, normally (not Safe Mode) and my report probably is the exact same thing. Why it is short, I cannot explain.

As for the Administrative Tools control panel, I can get all the way to the Event Viewer, but it is a .LNK file like everything else is now. I have figured out a way to access other .LNK files/shortcuts by creating a shortcut for the file and then finding the program in a default list or its subfolder, by going through "My Computer". However, I can't get this procedure to work for the Event Viewer program, therefore I can't access any log info from it.

Thanks for the help thus far and I'm sorry for the lengthy detail, but I felt that this might be of some use, or not.

Logfile of HijackThis v1.99.1
Scan saved at 12:43:32 PM, on 12/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\WINDOWS\system32\ctfmon.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http:///??
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: (no name) - _{4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MPFEXE] "C:\Program Files\McAfee.com\Personal Firewall\MPFTray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1130266793890
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1132318523125
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by108fd.bay108.hotmail.msn.com/activex/HMAtchmt.ocx
O18 - Filter: text/html - (no CLSID) - (no file)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: SVCLOAD - Unknown owner - c:\windows\system32\dllcache\sys32\winlogon.exe
O23 - Service: SVCMGR - Unknown owner - c:\windows\system32\dllcache\sys32\winlogon.exe

DMR 152 Wombat At Large Team Colleague · Answer 5 · 2005-12-27T02:13:17+00:00

OK- your latest log looks more "normal", but I'm not sure A) how much of the following you can do, given the unstable state of your system, and B) how much of the damage was due to malicious infections and how much was due to the problems during the EA game installation. Let's see what kind of headway we can make...

1. Click on the "Run..." option in your Start menu, enter the following in the resulting "Open:" box, and hit OK:

services.msc

That should open the Services utility.

- In the list of services, locate the service named "Remote Packet Capture Protocol" or "rpcapd" and double-click on it.

- In the General tab of the Properties window that opens, click the Stop button if the service is not already stopped.

- Once the service is stopped, choose Disabled in the "Startup Type" drop-down menu and then click OK.

- Repeat the above steps for the SVCLOAD and SVCMGR
services. Close the Services utility after that.

2. Run HijackThis again and have it fix:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: (no name) - _{4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SVCLOAD - Unknown owner - c:\windows\system32\dllcache\sys32\winlogon.exe
O23 - Service: SVCMGR - Unknown owner - c:\windows\system32\dllcache\sys32\winlogon.exe

- Once HJT finishes the fix, click on the "Config" button in the lower right corner of HijackThis' main window. In the next window click on the "Misc Tools" button at the top then click the "Delete an NT service" button. Type the following in the box and click OK:

rpcapd

Repeat the above deletion for SVCLOAD and SVCMGR.

3. Reboot into Safe Mode and run ewido again.

When ewido finds the first malicious object on your system, it will ask you if it should clean it. When it asks this, put a checkmark in the lower left corner of the box that says "Perform action on all infections", then choose clean and click OK.
Save the log file that ewido will create after it finishes scanning; you'll be including that log in your next post here.

- Open Windows Explorer, and in the Folder Options->View settings under the Tools menu, select "show hidden files and folders", and uncheck "Hide protected operating system files" and "Hide extentions for known file types".

- Search for and delete the following file if found:

c:\windows\system32\dllcache\sys32\winlogon.exe

- If there are other files in the c:\windows\system32\dllcache\sys32\ folder, please take note of their names and post those in your next response here.

- Delete the following folder entirely:

C:\ProgramFiles\WinPcap

- Empty your Recycle Bin, reboot normally, and run HijackThis again.

4. Empty your Recycle Bin, reboot normally, run HijackThis again, and post the new log. Also post the log that ewido generated and the names of the files found in the c:\windows\system32\dllcache\sys32\ folder.

walton 0 Newbie Poster · Answer 6 · 2005-12-27T05:20:19+00:00

Whoa. Thanks for the help. I really feel like I'm actually making progress now. I also want to know if I have to do this process for the other user(s) on this computer which consist of: 1. The default administrator in safe mode and 2. My brother who has a separate log in user file than mine at Windows startup (none of his programs or shortcuts are working properly either). By any means, here is my HijackThis log, Ewido log, and sys32 additional files.

1. HIJACKTHIS LOG


Logfile of HijackThis v1.99.1
Scan saved at 5:51:30 PM, on 12/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)


Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
c:\program files\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HijackThis.exe


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http:///??
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MPFEXE] "C:\Program Files\McAfee.com\Personal Firewall\MPFTray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\PROGRA~1\mcafee\SPAMKI~1\mcapfbho.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1130266793890
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1132318523125
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by108fd.bay108.hotmail.msn.com/activex/HMAtchmt.ocx
O18 - Filter: text/html - (no CLSID) - (no file)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe


2. EWIDO


---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------


+ Created on:           5:16:00 PM, 12/26/2005
+ Report-Checksum:      C431A8BD


+ Scan result:


C:\Documents and Settings\Gordon\Cookies\gordon@rotator.adjuggler[1].txt -> Spyware.Cookie.Adjuggler : Cleaned with backup
C:\Documents and Settings\Gordon\Cookies\gordon@www.myaffiliateprogram[2].txt -> Spyware.Cookie.Myaffiliateprogram : Cleaned with backup
C:\Documents and Settings\Walton\Cookies\walton@rotator.adjuggler[1].txt -> Spyware.Cookie.Adjuggler : Cleaned with backup
C:\Documents and Settings\Walton\Cookies\walton@www.myaffiliateprogram[2].txt -> Spyware.Cookie.Myaffiliateprogram : Cleaned with backup



::Report End


3. C:\WINDOWS\system32\dllcache\sys32


Here are the Additional Files that were found in C:\WINDOWS\system32\dllcache\sys32:


upload (a folder with nothing in it)
hide.EXE
libeay32.dll
psshutdown.exe
ServUStartUpLog.txt
sys.dll
winmgtr.dll
cygcrypt-0.dll
hide.RBO
nfo.nfo (MSInfo document)
run.bat
spooldc.log
TzoLibr.dll
cygwin1.dll
hydrant.bat
pshut.bat
ServUDaemon.ini (Configuration Settings)
ssleay32.dll
welcome.txt

walton 0 Newbie Poster · Answer 7 · 2005-12-27T13:19:32+00:00

I cleaned out those files on my PC but it's still not back to normal. Help me please.

DMR 152 Wombat At Large Team Colleague · Answer 8 · 2005-12-28T03:14:08+00:00

1. The "sys32" folder and its contents are/were the work of backdoor trojan, but I doubt that the infection was the cause of your program and shortcut problems. Regardless, the entire folder should be deleted if you haven't done so already.

2. It would still be worth seeing if the Event Viewer holds any clues. See if you can access the utility this way:

- Click on the "Run..." option in your Start menu.
- In the resulting "Open:" dialog box, type the following and then click OK: eventvwr

If that works, look through the logs for errors and warnings and tell us if you find anything which might be relevant.

3. Run the System File Checker utility to see if Windows detects any inconsistencies in its system files:

- Click on the "Run..." option in your Start menu.
- In the resulting "Open:" dialog box, type the following and then click OK: cmd
- In the resulting DOS window, type the following at the command prompt and then hit enter: sfc /scannow

walton 0 Newbie Poster · Answer 9 · 2005-12-28T07:27:50+00:00

Part One of Long Document:

I deleted the "sys32 folder from the dllcache directory. I also ran the sfc/scannow, but it told me to insert my Windows XP Professional Cd 2 in order for files to be copied to the DLL Cache so that XP could run properly "???". I tried my Windows XP Cd for version 5.1.2600 which it asked for, but it told me that I have the wrong cd (I guess I only have disc #1 or something that is not compatible).

The good news is that I was able to access the event viewer and here is the lengthy log for the applications:
Applications log:

Type Date Time Source Category Event User Computer
Error 12/27/2005 6:34:26 PM Application Error None 1000 N/A FLASHGORDON
Error 12/27/2005 6:33:24 PM Application Error None 1001 N/A FLASHGORDON
Error 12/27/2005 6:33:18 PM Application Error None 1000 N/A FLASHGORDON
Warning 12/27/2005 3:26:55 AM Userenv None 1517 SYSTEM FLASHGORDON
Error 12/26/2005 10:02:30 AM Application Hang None 1001 N/A FLASHGORDON
Error 12/26/2005 10:02:28 AM Application Hang None 1001 N/A FLASHGORDON
Error 12/26/2005 10:02:18 AM Application Hang (101) 1002 N/A FLASHGORDON
Error 12/26/2005 10:02:16 AM Application Hang (101) 1002 N/A FLASHGORDON
Error 12/25/2005 1:21:04 PM Application Error None 1001 N/A FLASHGORDON
Error 12/25/2005 1:20:57 PM Application Error None 1000 N/A FLASHGORDON
Warning 12/25/2005 12:30:44 PM Userenv None 1517 SYSTEM FLASHGORDON
Error 12/25/2005 10:41:42 AM Application Error None 1001 N/A FLASHGORDON
Error 12/25/2005 10:41:36 AM Application Error None 1000 N/A FLASHGORDON
Error 12/25/2005 5:09:38 AM Application Error None 1000 N/A FLASHGORDON
Error 12/25/2005 5:08:19 AM Application Error None 1000 N/A FLASHGORDON
Warning 12/24/2005 9:01:07 PM Userenv None 1517 SYSTEM FLASHGORDON
Warning 12/24/2005 2:23:16 PM Userenv None 1517 SYSTEM FLASHGORDON
Error 12/24/2005 9:51:34 AM Application Hang (101) 1002 N/A FLASHGORDON
Error 12/24/2005 1:32:27 AM McLogEvent None 5022 SYSTEM FLASHGORDON
Error 12/24/2005 12:34:31 AM McLogEvent None 5022 SYSTEM FLASHGORDON
Error 12/23/2005 8:34:46 PM McLogEvent None 5022 SYSTEM FLASHGORDON
Error 12/23/2005 8:16:03 PM McLogEvent None 5022 SYSTEM FLASHGORDON
Warning 12/23/2005 4:56:29 PM Userenv None 1517 SYSTEM FLASHGORDON
Error 12/23/2005 3:47:38 PM MpfService None 2 Walton FLASHGORDON
Error 12/23/2005 11:53:14 AM Application Error None 1000 N/A FLASHGORDON
Error 12/23/2005 11:51:10 AM Application Error None 1001 N/A FLASHGORDON
Error 12/23/2005 11:51:03 AM Application Error None 1000 N/A FLASHGORDON
Error 12/23/2005 11:50:35 AM Application Error None 1000 N/A FLASHGORDON
Error 12/23/2005 11:50:06 AM Application Error None 1000 N/A FLASHGORDON
Error 12/23/2005 11:49:49 AM Application Error None 1000 N/A FLASHGORDON
Error 12/23/2005 11:45:35 AM Application Error None 1000 N/A FLASHGORDON
Error 12/23/2005 11:32:37 AM Application Hang None 1001 N/A FLASHGORDON
Error 12/23/2005 11:32:35 AM Application Hang (101) 1002 N/A FLASHGORDON
Error 12/23/2005 11:31:33 AM Application Error None 1001 N/A FLASHGORDON
Error 12/23/2005 11:31:29 AM Application Error None 1000 N/A FLASHGORDON
Error 12/23/2005 11:27:29 AM Application Hang (101) 1002 N/A FLASHGORDON
Error 12/23/2005 11:25:47 AM Application Error None 1001 N/A FLASHGORDON
Error 12/23/2005 11:25:42 AM Application Error None 1000 N/A FLASHGORDON
Error 12/23/2005 1:16:47 AM Application Hang None 1001 N/A FLASHGORDON
Error 12/23/2005 1:16:43 AM Application Hang (101) 1002 N/A FLASHGORDON
Error 12/23/2005 12:30:58 AM Application Hang (101) 1002 N/A FLASHGORDON
Error 12/22/2005 11:46:33 PM Application Hang None 1001 N/A FLASHGORDON
Error 12/22/2005 11:46:29 PM Application Hang (101) 1002 N/A FLASHGORDON
Warning 12/22/2005 5:27:08 PM Userenv None 1517 SYSTEM FLASHGORDON
Error 12/22/2005 3:37:05 PM Application Hang (101) 1002 N/A FLASHGORDON
Error 12/22/2005 1:57:05 PM Application Error None 1001 N/A FLASHGORDON
Error 12/22/2005 1:56:32 PM Application Error (100) 1000 N/A FLASHGORDON
Error 12/22/2005 4:17:29 AM Application Error None 1001 N/A FLASHGORDON
Error 12/22/2005 4:17:26 AM Application Error None 1000 N/A FLASHGORDON
Warning 12/22/2005 3:53:34 AM Userenv None 1517 SYSTEM FLASHGORDON
Error 12/21/2005 5:52:00 AM Application Error None 1000 N/A FLASHGORDON
Error 12/21/2005 5:49:11 AM Application Error None 1000 N/A FLASHGORDON
Error 12/21/2005 5:48:53 AM Application Error None 1000 N/A FLASHGORDON
Error 12/21/2005 5:48:48 AM Application

[Mod's note: log snipped for brevity]

DMR 152 Wombat At Large Team Colleague · Answer 10 · 2005-12-28T08:25:35+00:00

Yoiks! :eek: :eek:

I wasn't after the entire log, just the details from some of the entries flagged with "error" or "warning":

... look through your System and Application logs for entries flagged with "Error" or "Warning". Double-clicking on such an entry will open a window with more detailed information on the error; post that info here.

Your log shows entries with application errors 1000, 1001, and 1002, as well as error entries related to DCOM; I'd like to see the details of one of each of those. Here's how to post the full details of a given entry:

- Double-click on an entry to open the entry's Properties window.

- In the Properties window, click on the button with the graphic of two pieces of paper on it; the button is at the right of the window just below the up arrow/down arrow buttons. You won't see anything happen when you click the button, but it will copy all of the details to the Windows clipboard.

- You can then paste the details into your next post in the same way that you paste your HijackThis log- by choosing "Paste" from the "File" menu or by hitting CTRL+V.

walton 0 Newbie Poster · Answer 11 · 2005-12-28T11:06:33+00:00

I included the activity before and after my MVP Baseball mishap.

Here are the new logs for my System and Application from Eventviewer:

System Log:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 12/24/2005
Time: 1:32:43 AM
User: N/A
Computer: FLASHGORDON
Description:
The McAfee.com McShield service terminated with service-specific error 5022 (0x139E).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 12/24/2005
Time: 1:31:19 AM
User: NT AUTHORITY\SYSTEM
Computer: FLASHGORDON
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7026
Date: 12/24/2005
Time: 12:38:37 AM
User: N/A
Computer: FLASHGORDON
Description:
The following boot-start or system-start driver(s) failed to load:
AFD
Aspi32
Fips
intelppm
IPSec
MPFIREWL
MRxSmb
NetBIOS
NetBT
RasAcd
Rdbss
Tcpip

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 12/24/2005
Time: 12:38:37 AM
User: N/A
Computer: FLASHGORDON
Description:
The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error:
A device attached to the system is not functioning.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 12/24/2005
Time: 12:38:37 AM
User: N/A
Computer: FLASHGORDON
Description:
The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error:
A device attached to the system is not functioning.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 12/24/2005
Time: 12:38:37 AM
User: N/A
Computer: FLASHGORDON
Description:
The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error:
A device attached to the system is not functioning.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 12/24/2005
Time: 12:38:37 AM
User: N/A
Computer: FLASHGORDON
Description:
The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error:
A device attached to the system is not functioning.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 12/24/2005
Time: 12:37:32 AM
User: NT AUTHORITY\SYSTEM
Computer: FLASHGORDON
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 12/24/2005
Time: 12:37:22 AM
User: FLASHGORDON\Walton
Computer: FLASHGORDON
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service netman with arguments "" in order to run the server:
{BA126AE5-2166-11D1-B1D0-00805FC1270E}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: Dhcp
Event Category: None
Event ID: 1003
Date: 12/24/2005
Time: 12:34:19 AM
User: N/A
Computer: FLASHGORDON
Description:
Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 00123F7769BE. The following error occurred:
The operation was canceled by the user. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: c7 04 00 00 Ç...

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 12/23/2005
Time: 8:43:52 PM
User: FLASHGORDON\Walton
Computer: FLASHGORDON
Description:
The server {692E988D-1057-4C57-8078-26CF7AE54263} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 12/23/2005
Time: 8:37:23 PM
User: FLASHGORDON\Walton
Computer: FLASHGORDON
Description:
The server {692E988D-1057-4C57-8078-26CF7AE54263} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 12/23/2005
Time: 8:31:40 PM
User: NT AUTHORITY\SYSTEM
Computer: FLASHGORDON
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: Tcpip
Event Category: None
Event ID: 4226
Date: 12/23/2005
Time: 8:27:38 PM
User: N/A
Computer: FLASHGORDON
Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.