Member Avatar for Rookie1

I have been having afew problems with Blue Screens of Death, windows telling me i have a bunch of spyware and possible viruses. I open up IE explorer and get popups that add an icon on my desktop called "Best online casino" and i'm just really getting tired of all of these things so i was wondering if you could tell me what i am to delete.

heres the logfile from hijack this

Logfile of HijackThis v1.97.7
Scan saved at 8:11:53 PM, on 06/07/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\taskmgn.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Peter\Desktop\Keep Out\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {85CBFDE0-B26B-4EE5-BD3C-4DE111DE763E} - C:\WINDOWS\System32\winnet.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Scan Spyware] "C:\Program Files\ScanSpyware v3.7\Scanner.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{124CC453-6398-4559-8CD7-FD63C35A64D6}: NameServer = ,
O17 - HKLM\System\CS1\Services\Tcpip\..\{124CC453-6398-4559-8CD7-FD63C35A64D6}: NameServer = ,

Please help me

  • 4 Contributors
  • 5 Replies
  • 206 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by Zachery

Dani AI

Generated

reported repeated crashes, intrusive browser popups and an unwanted desktop shortcut. Replies here have already taken useful first steps: suggested stopping a suspicious running process and checking autostart items, warned that some on‑screen "cleaners" produce false positives to push purchases, and correctly pointed out that more than one resident antivirus engine can cause problems. Below are concise, practical next steps and cautions.

Immediate actions: disconnect the PC from the network and back up personal files to an external drive (documents, photos, mail). Boot into Safe Mode (no networking) before attempting removals. Run a full system scan with an up‑to‑date, reputable anti‑malware engine (if needed, download the scanner from another machine). Use a trusted autorun/startup viewer to inspect and remove clearly malicious startup entries; if any entry is uncertain, capture a current process list and startup listing before deleting so it can be reviewed. Check the hosts file and the network adapter DNS settings; restore them to automatic or ISP defaults if they were changed.

Warnings and cleanups: be cautious of programs that show dramatic alerts and demand payment — these are often scareware and should be uninstalled rather than paid. Do not run two real‑time antivirus products at the same time; pick one for resident protection and use other tools as on‑demand scanners. After removal, reset browser settings to defaults and clear temporary files.

When to reinstall: if crashes, popups or DNS/redirect symptoms persist after careful cleaning, a clean OS reinstall is the safest option. Backup data, wipe the disk, install a clean OS, apply all updates, then install security software before reconnecting. For further help, post a fresh list of running processes and current startup/autostart entries plus a short note on which symptoms remain after each cleanup step.

Recommended Answers

All 5 Replies

Member Avatar for crunchie

Open Task Manager & end process on the following:

taskmgn.exe

Then delete the file C:\WINDOWS\System32\taskmgn.exe

Close all (browser) windows & rescan with hijackthis. When the scan is finished place a check in the box to the left of the following entries & click 'fix checked':

R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {85CBFDE0-B26B-4EE5-BD3C-4DE111DE763E} - C:\WINDOWS\System32\winnet.dll

Once done please download the following & run it.
Registry Search Tool. Close to the bottom of the page.
http://www.billsway.com/vbspage/

When it starts, you will be prompted to enter a search phrase. Enter taskmgn.exe and go have a cup of coffee.
When you get back, a message box will be there on the desktop. Say yes to open the results. Copy and paste the contents into a reply here. Once you close that file, it will be deleted, so please save it as results.txt. We may need it again.

Another hijackthis log too plz.

Member Avatar for Rookie1

well i did it all but before i did it i had norton come up and tell me that the script that i was running was malcious. I ran it just in case that it was just making an assumption but i hope i don' have a virus now.

When it was done it told me that it couldn't find taskmgn.exe.
My HJT Log

Logfile of HijackThis v1.97.7
Scan saved at 12:13:49 PM, on 07/07/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Peter\Desktop\Keep Out\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Scan Spyware] "C:\Program Files\ScanSpyware v3.7\Scanner.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{124CC453-6398-4559-8CD7-FD63C35A64D6}: NameServer = ,
O17 - HKLM\System\CS1\Services\Tcpip\..\{124CC453-6398-4559-8CD7-FD63C35A64D6}: NameServer = ,

Member Avatar for DMR

ScanSpyware is a questionable product; it is believed to return "false positives" to entice you to purchase/upgrade. The company that makes ScanSpyware also apparently advertizes on sites known to distribute the CoolWebSearch trojan. Use only trusted anti-spyware programs such as Ad Aware and SpyBot.

Member Avatar for Rookie1

I don't know how to close it the post. But i'm telling you all that i'm downgrading to another windows to see if that works any better.

Done

Member Avatar for Zachery

One of your problems is you have 2 AV softwares running from what i see, that will kill prefomance on any pc.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.