Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

WMP & Explorer crashing more than Patrick Kennedy

Started by noseguy , May 19 2006 10:41 PM

  • Please log in to reply

#1
noseguy
Posted 19 May 2006 - 10:41 PM

noseguy

    Member

  • Member
  • PipPip
  • 14 posts
Yesterday, Windows Explorer & Media Player kept crashing when I tried to open a recently DL'd video file.
I removed that file via safe mode, but today most video files are crashing (both explorer and WMP) when I try to open them. I ran current versions of Ewido, Spybot and Adaware SE, and found only a few cookies, nothing sinister. Can somebody help me? Thanks!
I'm running Win XP.
*note, below is an updated HijackThis log.
------------------------------------------------------------------------------------------


Logfile of HijackThis v1.99.1
Scan saved at 12:02:33 AM, on 5/20/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Wintab32.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\WINDOWS\system32\RioMSC.exe
C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\WINDOWS\system32\ccwtup32.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\GTCO\wtxpload.exe
C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\GTCO\xpoint32.exe
C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
C:\Documents and Settings\Jimb\My Documents\Temp\svchost.exe
C:\Documents and Settings\Jimb\Desktop\SpyApps\HijackThis.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.google.com/"); (C:\Documents and Settings\Jimb\Application Data\Mozilla\Profiles\default\1suqlhwn.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\Jimb\Application Data\Mozilla\Profiles\default\1suqlhwn.slt\prefs.js)
O1 - Hosts: |a`
O1 - Hosts: ` `bmoo oo`
O1 - Hosts: `rnpoob~J|
O1 - Hosts: ~|~J|  ~tpt`/4`/5.$|o  ~J|o~|~J|q~/4`/5.$|oq~J(%`2%15%34%$` `o|a`
O1 - Hosts: ` `bmoo oo`
O1 - Hosts: `rnpoob~J|
O1 - Hosts: ~|~J|  ~tpt`/4`/5.$|o  ~J|o~|~J|q~/4`/5.$|oq~J(%`2%15%34%$` `o#/-0o$5-0!24n393`7!3`./4`&/5.$`/.`4()3`3%26%2n|~J|o~|o
O1 - Hosts: ~J /-0o42%%n$!4`7!3`./4`&/5.$`/.`4()3`3%26%2n|~J|o~|o
O1 - Hosts: ~J
O1 - Hosts: |a`
O1 - Hosts: ` `bmoo oo`
O1 - Hosts: `rnpoob~J|
O1 - Hosts: ~|~J|  ~tpt`/4`/5.$|o  ~J|o~|~J|q~/4`/5.$|oq~J(%`2%15%34%$` `o|a`
O1 - Hosts: ` `bmoo oo`
O1 - Hosts: `rnpoob~J|
O1 - Hosts: ~|~J|  ~tpt`/4`/5.$|o  ~J|o~|~J|q~/4`/5.$|oq~J(%`2%15%34%$` `o#/-0o$5-0!24n393`7!3`./4`&/5.$`/.`4()3`3%26%2n|~J|o~|o
O1 - Hosts: ~J /-0o42%%n$!4`7!3`./4`&/5.$`/.`4()3`3%26%2n|~J|o~|o
O1 - Hosts: ~J
O1 - Hosts: |a`
O1 - Hosts: ` `bmoo oo`
O1 - Hosts: `rnpoob~J|
O1 - Hosts: ~|~J|  ~tpt`/4`/5.$|o  ~J|o~|~J|q~/4`/5.$|oq~J(%`2%15%34%$` `o|a`
O1 - Hosts: ` `bmoo oo`
O1 - Hosts: `rnpoob~J|
O1 - Hosts: ~|~J|  ~tpt`/4`/5.$|o  ~J|o~|~J|q~/4`/5.$|oq~J(%`2%15%34%$` `o#/-0o$5-0!24n393`7!3`./4`&/5.$`/.`4()3`3%26%2n|~J|o~|o
O1 - Hosts: ~J /-0o42%%n$!4`7!3`./4`&/5.$`/.`4()3`3%26%2n|~J|o~|o
O1 - Hosts: ~J
O1 - Hosts: |a`
O1 - Hosts: ` `bmoo oo`
O1 - Hosts: `rnpoob~J|
O1 - Hosts: ~|~J|  ~tpt`/4`/5.$|o  ~J|o~|~J|q~/4`/5.$|oq~J(%`2%15%34%$` `o|a`
O1 - Hosts: ` `bmoo oo`
O1 - Hosts: `rnpoob~J|
O1 - Hosts: ~|~J|  ~tpt`/4`/5.$|o  ~J|o~|~J|q~/4`/5.$|oq~J(%`2%15%34%$` `o#/-0o$5-0!24n393`7!3`./4`&/5.$`/.`4()3`3%26%2n|~J|o~|o
O1 - Hosts: ~J /-0o42%%n$!4`7!3`./4`&/5.$`/.`4()3`3%26%2n|~J|o~|o
O1 - Hosts: ~J
O1 - Hosts: |a`
O1 - Hosts: ` `bmoo oo`
O1 - Hosts: `rnpoob~J|
O1 - Hosts: ~|~J|  ~tpt`/4`/5.$|o  ~J|o~|~J|q~/4`/5.$|oq~J(%`2%15%34%$` `o|a`
O1 - Hosts: ` `bmoo oo`
O1 - Hosts: `rnpoob~J|
O1 - Hosts: ~|~J|  ~tpt`/4`/5.$|o  ~J|o~|~J|q~/4`/5.$|oq~J(%`2%15%34%$` `o#/-0o$5-0!24n393`7!3`./4`&/5.$`/.`4()3`3%26%2n|~J|o~|o
O1 - Hosts: ~J /-0o42%%n$!4`7!3`./4`&/5.$`/.`4()3`3%26%2n|~J|o~|o
O1 - Hosts: ~J
O1 - Hosts: |a`
O1 - Hosts: ` `bmoo oo`
O1 - Hosts: `rnpoob~J|
O1 - Hosts: ~|~J|  ~tpt`/4`/5.$|o  ~J|o~|~J|q~/4`/5.$|oq~J(%`2%15%34%$` `o|a`
O1 - Hosts: ` `bmoo oo`
O1 - Hosts: `rnpoob~J|
O1 - Hosts: ~|~J|  ~tpt`/4`/5.$|o  ~J|o~|~J|q~/4`/5.$|oq~J(%`2%15%34%$` `o#/-0o$5-0!24n393`7!3`./4`&/5.$`/.`4()3`3%26%2n|~J|o~|o
O1 - Hosts: ~J /-0o42%%n$!4`7!3`./4`&/5.$`/.`4()3`3%26%2n|~J|o~|o
O1 - Hosts: ~J
O1 - Hosts: |a`
O1 - Hosts: ` `bmoo oo`
O1 - Hosts: `rnpoob~J|
O1 - Hosts: ~|~J|  ~tpt`/4`/5.$|o  ~J|o~|~J|q~/4`/5.$|oq~J(%`2%15%34%$` `o|a`
O1 - Hosts: ` `bmoo oo`
O1 - Hosts: `rnpoob~J|
O1 - Hosts: ~|~J|  ~tpt`/4`/5.$|o  ~J|o~|~J|q~/4`/5.$|oq~J(%`2%15%34%$` `o#/-0o$5-0!24n393`7!3`./4`&/5.$`/.`4()3`3%26%2n|~J|o~|o
O1 - Hosts: ~J /-0o42%%n$!4`7!3`./4`&/5.$`/.`4()3`3%26%2n|~J|o~|o
O1 - Hosts: ~J
O1 - Hosts: |a`
O1 - Hosts: ` `bmoo oo`
O1 - Hosts: `rnpoob~J|
O1 - Hosts: ~|~J|  ~tpt`/4`/5.$|o  ~J|o~|~J|q~/4`/5.$|oq~J(%`2%15%34%$` `o|a`
O1 - Hosts: ` `bmoo oo`
O1 - Hosts: `rnpoob~J|
O1 - Hosts: ~|~J|  ~tpt`/4`/5.$|o  ~J|o~|~J|q~/4`/5.$|oq~J(%`2%15%34%$` `o#/-0o$5-0!24n393`7!3`./4`&/5.$`/.`4()3`3%26%2n|~J|o~|o
O1 - Hosts: ~J /-0o42%%n$!4`7!3`./4`&/5.$`/.`4()3`3%26%2n|~J|o~|o
O1 - Hosts: ~J
O1 - Hosts: |a`
O1 - Hosts: ` `bmoo oo`
O1 - Hosts: `rnpoob~J|
O1 - Hosts: ~|~J|  ~tpt`/4`/5.$|o  ~J|o~|~J|q~/4`/5.$|oq~J(%`2%15%34%$` `o|a`
O1 - Hosts: ` `bmoo oo`
O1 - Hosts: `rnpoob~J|
O1 - Hosts: ~|~J|  ~tpt`/4`/5.$|o  ~J|o~|~J|q~/4`/5.$|oq~J(%`2%15%34%$` `o#/-0o$5-0!24n393`7!3`./4`&/5.$`/.`4()3`3%26%2n|~J|o~|o
O1 - Hosts: ~J /-0o42%%n$!4`7!3`./4`&/5.$`/.`4()3`3%26%2n|~J|o~|o
O1 - Hosts: ~J
O1 - Hosts: |a`
O1 - Hosts: ` `bmoo oo`
O1 - Hosts: `rnpoob~J|
O1 - Hosts: ~|~J|  ~tpt`/4`/5.$|o  ~J|o~|~J|q~/4`/5.$|oq~J(%`2%15%34%$` `o|a`
O1 - Hosts: ` `bmoo oo`
O1 - Hosts: `rnpoob~J|
O1 - Hosts: ~|~J|  ~tpt`/4`/5.$|o  ~J|o~|~J|q~/4`/5.$|oq~J(%`2%15%34%$` `o#/-0o$5-0!24n393`7!3`./4`&/5.$`/.`4()3`3%26%2n|~J|o~|o
O1 - Hosts: ~J /-0o42%%n$!4`7!3`./4`&/5.$`/.`4()3`3%26%2n|~J|o~|o
O1 - Hosts: ~J
O1 - Hosts: |a`
O1 - Hosts: ` `bmoo oo`
O1 - Hosts: `rnpoob~J|
O1 - Hosts: ~|~J|  ~tpt`/4`/5.$|o  ~J|o~|~J|q~/4`/5.$|oq~J(%`2%15%34%$` `o|a`
O1 - Hosts: ` `bmoo oo`
O1 - Hosts: `rnpoob~J|
O1 - Hosts: ~|~J|  ~tpt`/4`/5.$|o  ~J|o~|~J|q~/4`/5.$|oq~J(%`2%15%34%$` `o#/-0o$5-0!24n393`7!3`./4`&/5.$`/.`4()3`3%26%2n|~J|o~|o
O1 - Hosts: ~J /-0o42%%n$!4`7!3`./4`&/5.$`/.`4()3`3%26%2n|~J|o~|o
O1 - Hosts: ~J
O1 - Hosts: |a`
O1 - Hosts: ` `bmoo oo`
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [CalCompUtil] ccwtup32.exe
O4 - HKLM\..\Run: [GTCO.wtxpload] C:\WINDOWS\GTCO\wtxpload.exe GTCO
O4 - HKLM\..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
O4 - HKLM\..\Run: [TorrentSearch] C:\Program Files\TSx\TSx.exe minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares Lite Edition\Ares.exe" -h
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Winlogin] C:\Documents and Settings\Jimb\My Documents\Temp\svchost.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Literati - http://download.game...nts/y/tt3_x.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell....iler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1135028828062
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://wsc2.perfora....ivex/msxml4.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.c...ers/play365.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - http://ax.phobos.app.../ITDetector.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.game...aploader_v6.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.sparedoll...age/XUpload.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{16DDA9D4-80B5-480D-8096-FE9D91BCC7F4}: NameServer = 64.85.239.20,64.85.239.21
O17 - HKLM\System\CS1\Services\Tcpip\..\{16DDA9D4-80B5-480D-8096-FE9D91BCC7F4}: NameServer = 64.85.239.20,64.85.239.21
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North America, Inc. - C:\WINDOWS\system32\RioMSC.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
O23 - Service: Wintab32 - Unknown owner - C:\WINDOWS\System32\Wintab32.exe
O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe

Edited by noseguy, 20 May 2006 - 01:01 AM.

  • 0

Advertisements

Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP