Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

WinNT/explorer.exe error


  • Please log in to reply

#1
jeiveecee

jeiveecee

    New Member

  • Member
  • Pip
  • 1 posts
Hello there... Please support me about this issue.

"Microsoft Visual C++ runtime error"

Runtime Error
Program: WINNT\Explorer.exe

This is my log...


Logfile of HijackThis v1.99.1
Scan saved at 2:46:40 PM, on 4/15/2005
Platform: Windows 2000 SP1 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\rundll32.exe
C:\WINNT\System32\Promon.exe
C:\PROGRA~1\NavNT\vptray.exe
C:\WINNT\$$$QND.TMP\bin\QNDLOGON.EXE
C:\winnt\system32\fbnwsz.exe
C:\Documents and Settings\nca.NCAHDQ\My Documents\MEDIA\iridium.exe
C:\winnt\system32\calc.exe
C:\WINNT\System32\rundll32.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINNT\System32\rundll32.exe
C:\WINNT\System32\rundll32.exe
C:\WINNT\System32\rundll32.exe
C:\WINNT\System32\rundll32.exe
C:\WINNT\System32\rundll32.exe
C:\WINNT\System32\rundll32.exe
C:\WINNT\System32\rundll32.exe
C:\WINNT\System32\rundll32.exe
C:\WINNT\System32\rundll32.exe
C:\WINNT\Explorer.exe
C:\WINNT\System32\rundll32.exe
D:\$HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://(i intentionally hide it)
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://(i intentionally hide it)
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http://(i intentionally hide it)
O2 - BHO: BTGrabObj Class - {00000000-F09C-02B4-6EC2-AD0300000000} - C:\WINNT\BTGrab.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {FFFFDA2C-A0D5-4D60-8EE1-1B7F8929E24D} - C:\Program Files\Lycos\sst.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NavNT\vptray.exe
O4 - HKLM\..\Run: [QNDLOGON] C:\WINNT\$$$QND.TMP\bin\QNDLOGON.EXE
O4 - HKLM\..\Run: [AcpcdLogon] "C:\WINNT\$$$QND.TMP\acpc\logonnotify.exe"
O4 - HKLM\..\Run: [CMESys] "C:\Program Files\Common Files\CMEII\CMESys.exe"
O4 - HKLM\..\Run: [fbnwsz] c:\winnt\system32\fbnwsz.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [IridiumTimeWizard] C:\Documents and Settings\nca.NCAHDQ\My Documents\MEDIA\iridium.exe
O4 - Startup: Forget Me Not.lnk = C:\Program Files\Mindscape\AGPrint\PMREMIND.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .swf: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npswf32.dll
O16 - DPF: Uts60 Emulator - http://crwview.ana.c...aClient/Uts.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.co...wnload/cult.cab
O16 - DPF: {DDFFA75A-E81D-4454-89FC-B9FD0631E726} - http://www.bundlewar...veX/BM2/BM2.dll
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = intra.nca.aero
O17 - HKLM\System\CCS\Services\Tcpip\..\{276907E3-FFE1-4CB9-96A0-907C44F35432}: NameServer = (i intentionally hide it)
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = intra.nca.aero
O17 - HKLM\System\CS1\Services\Tcpip\..\{276907E3-FFE1-4CB9-96A0-907C44F35432}: NameServer = (i intentionally hide it)
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = intra.nca.aero
O17 - HKLM\System\CS2\Services\Tcpip\..\{276907E3-FFE1-4CB9-96A0-907C44F35432}: NameServer = (i intentionally hide it)
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - Service: ACPCdaemon - System Intelligent Corp. - C:\WINNT\$$$QND.TMP\acpc\acpcd.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: QP Option (qndd) - - C:\WINNT\$$$QND.TMP\bin\QNDD.EXE
O23 - Service: Switch User Daemon (swusrd) - - C:\WINNT\SWUSRD\swusrd.exe


Thanks alot. Anyway i need a chat mate, im 24 year old guy, please refer me if you have a friend. I prefer a girl, of my same age bracket. Im here at the Philippines.. jeiveecee@yahoo.com

KUDOS!!!

Edited by jeiveecee, 15 April 2005 - 03:26 AM.

  • 0

Advertisements


#2
gerryf

gerryf

    Retired Staff

  • Retired Staff
  • 11,365 posts
You're posting in the wrong forum mate

In the future, please post in the malware section

First
This is bad
O2 - BHO: BTGrabObj Class - {00000000-F09C-02B4-6EC2-AD0300000000} - C:\WINNT\BTGrab.dll
Since hijack does not always get this one
Try getting this tool to remove it
http://securityrespo...erinternet.html


This should be removed in hijack
O2 - BHO: (no name) - {FFFFDA2C-A0D5-4D60-8EE1-1B7F8929E24D} - C:\Program Files\Lycos\sst.dll
O4 - HKLM\..\Run: [fbnwsz] c:\winnt\system32\fbnwsz.exe
O4 - HKCU\..\Run: [IridiumTimeWizard] C:\Documents and Settings\nca.NCAHDQ\My Documents\MEDIA\iridium.exe


I am unfamiliar with these...does QND Pro sound familiar to you as a program you installed?
O4 - HKLM\..\Run: [QNDLOGON] C:\WINNT\$$$QND.TMP\bin\QNDLOGON.EXE
O4 - HKLM\..\Run: [AcpcdLogon] "C:\WINNT\$$$QND.TMP\acpc\logonnotify.exe"
O23 - Service: ACPCdaemon - System Intelligent Corp. - C:\WINNT\$$$QND.TMP\acpc\acpcd.exe
O23 - Service: QP Option (qndd) - - C:\WINNT\$$$QND.TMP\bin\QNDD.EXE

This is also unknown to me....did you install something intended to switch user/accounts?
O23 - Service: Switch User Daemon (swusrd) - - C:\WINNT\SWUSRD\swusrd.exe



Thanks alot. Anyway i need a chat mate, im 24 year old guy, please refer me if you have a friend. I prefer a girl, of my same age bracket. Im here at the Philippines.. jeiveecee@yahoo.com

KUDOS!!!

View Post


  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP