[stevlo]

Im sorry if this is not the right area,because it involves my hardware, and antivirus software.Anyway,I turned on my pc,and performed my normal pc diagnostics tests and i noticed my pc running so slow.The first thing i thought was spyware,or a virus.I performed a spyware test and it was clean.I performed a virus check with 4 different top rated antivirus scanners and they displayed no viruses.I even tried running the tests with the pc on safe mode,but it wouldnt except my administrator password.It would only except my password on a normal windows xp pro bootup.I checked my hardisk drives through norton utilities to see if my hdd`s were in need of a defragment,and when i ran a test they were badly in need a a fragment.so i did fragment both my drives,and upon fragmenting drive D:,my F-prot antivirus popped up and warned me that i had 8 viruses in my system volume,and the name of the viruses were all the same as stated (w32:msearch.a)...So i performed some more virus scans and they came up clean..now im really confused. My F-prot antivirus would only warn me that i had viruses when i performed a defragment of hdd (D:) only.My C: drive was clean of viruses according to F-prot. Now it gets more confusing.I tried restarting my pc a few times because windows was in a deep freeze,and when i did have a bootup,the bios stated that my CDROM failed the test.So i tested it,and it wouldnt work at all.When i put a cd in the drive it stated that i have to put a cd in the drive. ,and it wouldnt play any cds.Anyway,sorry for the long story,but i was wondering if anyone can shed some light...thank you

[Advertisements]

Hi
I was looking at the other post that was about checking your virus programs Virus Post and you download the files. Did your problems started after you run this? If you read the red at the bottom of the page it says:
Important note: cannot be held responsible when these files or your AV scanner in combination with these files cause any damage to your computer. You download these files at your own risk. Download these files only if you are sufficiently secure in the usage of your AV scanner. cannot and will not provide any help to get rid of these files from your computer. Please contact the manufacturer/vendor of your AV scanner to provide such help.
If your problems started after you download this most likely thats where you got these problems so I would make sure that you get it completely removed and try a restore before you did the download.

[tazz1964]

Hi
I was looking at the other post that was about checking your virus programs Virus Post and you download the files. Did your problems started after you run this? If you read the red at the bottom of the page it says:
Important note: cannot be held responsible when these files or your AV scanner in combination with these files cause any damage to your computer. You download these files at your own risk. Download these files only if you are sufficiently secure in the usage of your AV scanner. cannot and will not provide any help to get rid of these files from your computer. Please contact the manufacturer/vendor of your AV scanner to provide such help.
If your problems started after you download this most likely thats where you got these problems so I would make sure that you get it completely removed and try a restore before you did the download.

[stevlo]

No,i was having the problems before the virus test.And i removed the eicar file test.I did the test with the problems to see if my antivirus was working,and it caught the eicar file test,but it displayed that i have 8 viruses,( only when im fragmenting drive D:)Anyway,I beleive my cdrom is toast,and i was wondering if that could be causing the problems? When i boot up,bios test of the cdrom states that its failed,and it doesnt spin or play any cds.I always have the weird things happin to my pc for some reason.lol

[Smokey]

I was wondering, how'd you get rid of the eicar test file?

[admin]

I can't find a virus or worm W32.msearch.a in any standard references (although it sure looks like a legitimate name). Let's try a HiJack This scan. Please click the "HiJack This Guide" link in my signature. Follow the directions and paste the log back to this topic (don't make any changes).

It does sound as though your CD-ROM may have failed, but let's eliminate this virus concern first.

[stevlo]

Well,i had to get a new cdrom today,and I installed the cdrom and it fixed some of my pc problems.I noticed once again that my hdd ( D:) was badly fragmented for some reason,so i performed a defrag, and F-prot aV once warned that i had 2 viruses instead of 8 from yesterday. :wacko.So i performed some more virus scans and they came up clean. So now i have decided to uninstall Fprot, and install a brand new av software norton 2004 pro to see if Fprot has gone wacko on me.Anyway ill send the hijack post tonight when i get home from work and ill post it so you guys can help me out.Thanks! guys for your help.

[stevlo]

Here is my post...........................
Logfile of HijackThis v1.97.7
Scan saved at 1:56:35 AM, on 1/21/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\BulletProofSoft.com\SpywareRemover\SpyWatch.exe
C:\Program Files\BulletProofSoft.com\SpywareRemover\3FA49ED2.DLL
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Utilities\NPROTECT.EXE
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Speed Disk\nopdb.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\unzipped\hijackthis[1]\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.ca/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Guard-IE - {D2F719F3-106A-402B-9996-3A5B12ACA564} - C:\Program Files\Failsafe\GuardIE\PnIE.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Guard-IE - {37C8204D-97C3-4127-BB28-1BFF3FA2F7DA} - C:\Program Files\Failsafe\GuardIE\PnIE.dll
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~2\AdvTools\ADVCHK.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SPYWATCH] C:\Program Files\BulletProofSoft.com\SpywareRemover\SpyWatch.exe /STARTUP
O9 - Extra button: @C:\Program Files\Failsafe\GuardIE\PnIE.dll,-100 (HKLM)
O9 - Extra 'Tools' menuitem: @C:\Program Files\Failsafe\GuardIE\PnIE.dll,-100 (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://active.macrom...tor/cabs/sw.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupd...7976.5064930556
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivi...n/ravonline.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real...ArcadeRdxIE.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2A98C72D-74AB-4962-80BD-FB2D5FC8E493}: NameServer = 207.236.176.12 198.235.216.110
O17 - HKLM\System\CS1\Services\Tcpip\..\{2A98C72D-74AB-4962-80BD-FB2D5FC8E493}: NameServer = 207.236.176.12 198.235.216.110

[admin]

Looks Good!

My only comment is on your choice of anti-spyware software. Spybot S&D has accused Bulletprooof Spywatch of stealing and modifying it's code without permission. Hard to say what else they may have included. Just to be safe, I'd probably uninstall Spywatch, and install Spybot.

[stevlo]

Thanks! for the tip,but i have used spybot in the past and had problems getting rid of spyware.Since i have used bulletproof i have never had those problems.I honestly dont understand 100% what you are trying to say to unistall bulletproof and use spybot?I understand that spybot is accusing bulletproof of stealing and modifing its code,but i dont understand the part of getting rid of bulletproof? Thanks!