Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

dr.watson error

Started by lazyboi , Feb 08 2005 08:26 PM

  • Please log in to reply

#1
lazyboi
Posted 08 February 2005 - 08:26 PM

lazyboi

    New Member

  • Member
  • Pip
  • 4 posts
i'm having problems with the dr.watson debugger thing.... please help me!!!!

here is my hijackthis log:

Logfile of HijackThis v1.99.0
Scan saved at 5:42:07 PM, on 2/8/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\msyi32.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\WINDOWS\appqf.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\system32\tibs5.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\AT&T Global Network Client\NetClient.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\WordPerfect Office 11\Programs\WPWIN11.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Larry Yee\My Documents\download\HijackThis.exe

R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {66EAF53C-344E-7E5B-5B7C-747E4BE0BAD3} - C:\WINDOWS\mseu32.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [netwi32.exe] C:\WINDOWS\system32\netwi32.exe
O4 - HKLM\..\Run: [crxl.exe] C:\WINDOWS\system32\crxl.exe
O4 - HKLM\..\Run: [ievx.exe] C:\WINDOWS\system32\ievx.exe
O4 - HKLM\..\Run: [appcv32.exe] C:\WINDOWS\system32\appcv32.exe
O4 - HKLM\..\Run: [crll32.exe] C:\WINDOWS\system32\crll32.exe
O4 - HKLM\..\Run: [mfcdg32.exe] C:\WINDOWS\system32\mfcdg32.exe
O4 - HKLM\..\Run: [d3zz32.exe] C:\WINDOWS\system32\d3zz32.exe
O4 - HKLM\..\Run: [mfcxp32.exe] C:\WINDOWS\system32\mfcxp32.exe
O4 - HKLM\..\Run: [javaxb.exe] C:\WINDOWS\system32\javaxb.exe
O4 - HKLM\..\Run: [iepy32.exe] C:\WINDOWS\system32\iepy32.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\Program Files\AIM\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [msro32.exe] C:\WINDOWS\system32\msro32.exe
O4 - HKLM\..\Run: [winbv32.exe] C:\WINDOWS\system32\winbv32.exe
O4 - HKLM\..\Run: [addsh32.exe] C:\WINDOWS\system32\addsh32.exe
O4 - HKLM\..\Run: [addri.exe] C:\WINDOWS\system32\addri.exe
O4 - HKLM\..\Run: [appqf.exe] C:\WINDOWS\appqf.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [tibs5] C:\WINDOWS\system32\tibs5.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aida] C:\Documents and Settings\Larry Yee\Application Data\ttuh.exe
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.EXE 1
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.05p.com
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.blazefind.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.musicmatch.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.scoobidoo.com
O15 - Trusted Zone: *.searchbarcash.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.slotch.com
O15 - Trusted Zone: *.static.topconverting.com
O15 - Trusted Zone: *.xxxtoolbar.com
O15 - Trusted Zone: *.05p.com (HKLM)
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.blazefind.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.flingstone.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.scoobidoo.com (HKLM)
O15 - Trusted Zone: *.searchbarcash.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.slotch.com (HKLM)
O15 - Trusted Zone: *.static.topconverting.com (HKLM)
O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: 206.161.125.149 (HKLM)
O17 - HKLM\System\CCS\Services\Tcpip\..\{FD341828-7946-49C5-A16D-168B4E808E53}: NameServer = 165.87.13.129 165.87.201.244
O23 - Service: AOL Connectivity Service - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: McAfee SecurityCenter Update Manager - Networks Associates Technology, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: Norton AntiVirus Client - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: WAN Miniport (ATW) Service - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Network Security Service - Unknown - C:\WINDOWS\system32\msyi32.exe


any help will do, thx
  • 0

Advertisements

#2
admin
Posted 09 February 2005 - 02:29 PM

admin

    Founder Geek

  • Community Leader
  • 24,639 posts
Welcome to Geeks to Go! :tazz:

You may wish to print out a copy of these instructions to follow while you complete this procedure.

Download: http://www.mvps.org/.../DelDomains.inf
To use: right-click and select: Install (no need to restart)
Note: This will remove all entries in the "Trusted Zone" and "Ranges" also.

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items, then click fix checked.

O2 - BHO: (no name) - {66EAF53C-344E-7E5B-5B7C-747E4BE0BAD3} - C:\WINDOWS\mseu32.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [netwi32.exe] C:\WINDOWS\system32\netwi32.exe
O4 - HKLM\..\Run: [crxl.exe] C:\WINDOWS\system32\crxl.exe
O4 - HKLM\..\Run: [ievx.exe] C:\WINDOWS\system32\ievx.exe
O4 - HKLM\..\Run: [appcv32.exe] C:\WINDOWS\system32\appcv32.exe
O4 - HKLM\..\Run: [crll32.exe] C:\WINDOWS\system32\crll32.exe
O4 - HKLM\..\Run: [mfcdg32.exe] C:\WINDOWS\system32\mfcdg32.exe
O4 - HKLM\..\Run: [d3zz32.exe] C:\WINDOWS\system32\d3zz32.exe
O4 - HKLM\..\Run: [mfcxp32.exe] C:\WINDOWS\system32\mfcxp32.exe
O4 - HKLM\..\Run: [javaxb.exe] C:\WINDOWS\system32\javaxb.exe
O4 - HKLM\..\Run: [iepy32.exe] C:\WINDOWS\system32\iepy32.exe
O4 - HKLM\..\Run: [msro32.exe] C:\WINDOWS\system32\msro32.exe
O4 - HKLM\..\Run: [winbv32.exe] C:\WINDOWS\system32\winbv32.exe
O4 - HKLM\..\Run: [addsh32.exe] C:\WINDOWS\system32\addsh32.exe
O4 - HKLM\..\Run: [addri.exe] C:\WINDOWS\system32\addri.exe
O4 - HKLM\..\Run: [appqf.exe] C:\WINDOWS\appqf.exe
O4 - HKLM\..\Run: [tibs5] C:\WINDOWS\system32\tibs5.exe
O4 - HKCU\..\Run: [Aida] C:\Documents and Settings\Larry Yee\Application Data\ttuh.exe
O23 - Service: Network Security Service - Unknown - C:\WINDOWS\system32\msyi32.exe

Please reboot into safe mode (continually tap the F8 key while your system is starting, select Safe Mode from the menu).

Be sure you're able to view hidden files, and remove the following files/folders (if found):

C:\WINDOWS\system32\msyi32.exe
C:\WINDOWS\appqf.exe
C:\WINDOWS\system32\tibs5.exe
C:\WINDOWS\mseu32.dll
C:\WINDOWS\system32\netwi32.exe
C:\WINDOWS\system32\crxl.exe
C:\WINDOWS\system32\ievx.exe
C:\WINDOWS\system32\appcv32.exe
C:\WINDOWS\system32\crll32.exe
C:\WINDOWS\system32\mfcdg32.exe
C:\WINDOWS\system32\d3zz32.exe
C:\WINDOWS\system32\mfcxp32.exe
C:\WINDOWS\system32\javaxb.exe
C:\WINDOWS\system32\iepy32.exe
C:\WINDOWS\system32\msro32.exe
C:\WINDOWS\system32\winbv32.exe
C:\WINDOWS\system32\addsh32.exe
C:\WINDOWS\system32\addri.exe
C:\Documents and Settings\Larry Yee\Application Data\ttuh.exe

Reboot your PC.

If you would please, rescan with HijackThis and post a fresh log in this same topic, and let us know how your system's working. ;)
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP