[kakashi]

My computers keeps saying "scxhost.exe has generated errors and will be closed by Windows." and then when I click on hyperlinks it does'nt go anywhere. and my media player doesn't work (it's windows by the way) Please help.

[Advertisements]

Sounds like a virus. Please attach a hijackthis log file to your next reply (It will help us pin-point your problem). Follow the hijackthis guide link in my signature .

[Smokey]

Sounds like a virus. Please attach a hijackthis log file to your next reply (It will help us pin-point your problem). Follow the hijackthis guide link in my signature .

[kakashi]

huh?

[Smokey]

Sorry for the confusion . You need to follow the "HiJackThis Guide" link under my message. It will tell us exactly what is wrong with your system.

[kakashi]

k. i downloaded hijackthis. wut do i open it with?

[tazz1964]

hI
what you need to do is unzip the highjack this program. you will need a program like WinZip 8.0 or an other unzipping program. do you have one of these?

[kakashi]

yep and i unzipped it and opened it. but i don't understand everything on it now.

[kakashi]

never mind. i saved the log file but how do i send it to ya'll?

[kakashi]

Logfile of HijackThis v1.97.7
Scan saved at 10:39:10 AM, on 2/1/2004
Platform: Windows 2000 SP1 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\Navnt\navapsvc.exe
C:\PROGRA~1\Navnt\npssvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\wanmpsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\Explorer.exe
C:\PROGRA~1\Navnt\alertsvc.exe
C:\WINNT\System32\rundll32.exe
C:\WINNT\uptodate.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
E:\AABackup\FLEOK\msbb.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\System32\msblast.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\America Online 9.0\aoltray.exe
C:\Program Files\Navnt\navapw32.exe
C:\Program Files\AT&T Global Network Client\NetClient.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\AOL Companion\companion.exe
C:\Program Files\WinZip\WINZIP32.EXE
C:\PROGRA~1\WINZIP\wzqkpick.exe
C:\unzipped\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.startium....h.php?dst=DIST1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myaanet.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online
O1 - Hosts: 64.159.94.251 auto.search.msn.com
O2 - BHO: (no name) - {2CF0B992-5EEB-4143-99C0-5297EF71F443} - C:\WINNT\System32\stlbdist.dll
O2 - BHO: ezSearchBar Helper - {760A9DDE-1433-4A7C-8189-D6735BB5D3DD} - C:\WINNT\System32\ezSearch.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Search - {2CF0B992-5EEB-4143-99C0-5297EF71F444} - C:\WINNT\System32\stlbdist.dll
O3 - Toolbar: ez Search Bar - {CCE83E45-30B2-4BAE-B1F5-25D128D27A43} - C:\WINNT\System32\ezSearch.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [{2CF0B992-5EEB-4143-99C0-5297EF71F444}] rundll32.exe C:\WINNT\System32\stlbdist.dll,DllRunMain
O4 - HKLM\..\Run: [RunWindowsUpdate] C:\WINNT\uptodate.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [msbb] E:\AABackup\FLEOK\msbb.exe
O4 - HKLM\..\Run: [NPS Event Checker] C:\PROGRA~1\Navnt\npscheck.exe
O4 - HKLM\..\Run: [NAV DefAlert] C:\PROGRA~1\Navnt\defalert.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ADHKNR] C:\WINNT\ADHKNR.exe
O4 - HKLM\..\Run: [windows auto update] msblast.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\RunOnce: [NetSP - restore database] "C:\Program Files\AT&T Global Network Client\NetSP.exe" -show
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Norton AntiVirus AutoProtect.lnk = C:\Program Files\Navnt\navapw32.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://www.aol.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{ED832493-2B1D-476E-A3AA-8F2A372AC172}: NameServer = 165.87.13.129 165.87.201.244

[SIZE=14][COLOR=blue]never mind i pasted it on here

[Smokey]

My analogy was right, you're infected with the blaster worm . You need to update your anti-virus, do a full-system scan, and remove all viruses. If you don't have an anti-virus just use Symantec's Blaster Removal Tool. You will need to do additional adware removing after you're done by using SpyBot S&D.

[kakashi]

can you tell what type it is?

[Smokey]

All information about blaster is in the "blaster worm" link .

[lavoieste]

What lines gave you the info to tell that the problem was blaster?


Need help Bad.

1st post!!

[Smokey]

Welcome to GTG lavoieste

This line:

O4 - HKLM\..\Run: [windows auto update] msblast.exe

If you would please start a new topic and post a HJT log, we can help you with your problem.