[Daisypearl]

Hi--I have not done anything yet--wanted to check first with you all.

I am running Windows XP Pro with IE 6.0 [think I have the latest verson]. I updated my Norton Security package last month and have had nothing but problems--not sure it is all [or any] their fault but the system has really slowed down. I run a virus/spyware... with their software weekly as recommended. I also have spybot and adware and run them weekly. I get automatic updates with Norton and check for updates before running the other two. Weekly I clear my internet files [settings>control panel>internet options].

Tha said, I am just lost--I am not a techie and really need some help. I have downloaded the hijack tool and will run it later after seeing replies.

When I checked the results of my weekly virus scan--no viruses but 14 adware/spyware problems. Norton deleted 3 of them and I went to Symantec to get the "fix" for the others but have not yet done anything beyond capturing the file and putting it in wordpad.

What I cannot figure out--where am I getting this stuff??? I never open an attachment in e-mail from anyone I do not know and if there is an attached file from someone I do know I always ask first to make sure it is really from him/her. The ONLY attachments I open are from some genealogical lists to which I belong. However the server rootsweb.com has a strong firewall and I really doubt that the junk is coming from them.

I hate to speculate on this but could these files be coming from my use of e-bay I must confess to spending a lot of time there and plan to start selling things soon.

I do buy things onlne but only from sites with secure buying [amazon, etc].

Once this is cleared up I do not want it to return--it is driving me berserk.

thanks for listening--will post the hijack info later

daisypearl

[Advertisements]

Forgot to say that I also have RegRun--it was highly recommended by one of the magazines but I don't know if it is helping or screwing up my speed; to be perfectly honest, I am not sure what it even does.

I have several pieces of software I want to install [a new genealogy program, Mozilla and some upgrades to existing programs] and they are just sitting in a pile because I am afraid the computer will croak. Memory is not a problem--I have 312K.

daisypearl

[Daisypearl]

Forgot to say that I also have RegRun--it was highly recommended by one of the magazines but I don't know if it is helping or screwing up my speed; to be perfectly honest, I am not sure what it even does.

I have several pieces of software I want to install [a new genealogy program, Mozilla and some upgrades to existing programs] and they are just sitting in a pile because I am afraid the computer will croak. Memory is not a problem--I have 312K.

daisypearl

[coachwife6]

Hi Daisypearl. Welcome to Geeks to Go.

Let us take a closer look at what is running on your PC. We'll need you to use a free diagnostic tool (HiJackThis) and post a log back here with the results.

Click the HijackThis Guide in my signature, download it and follow the instructions in the guide.

Most of what it lists will be harmless or even essential, DO NOT delete or modify anything yet! Someone will be along to tell you what steps to take after you post the contents of the scan results.

[Daisypearl]

Here is my logfile from HijackThis. I have done nothing other than capture this info.
daisy

Logfile of HijackThis v1.98.2
Scan saved at 9:38:10 PM, on 10/11/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Windows SyncroAd\SyncroAd.exe
C:\PROGRA~1\Greatis\REGRUN~1\WatchDog.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\NMAIN.EXE
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Documents and Settings\Judith\My Documents\Downloaded files\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink...ton/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.refdesk.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.refdesk.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Windows SyncroAd] C:\Program Files\Windows SyncroAd\SyncroAd.exe
O4 - HKCU\..\Run: [Regrun2] C:\PROGRA~1\Greatis\REGRUN~1\WatchDog.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com...p/PCPitStop.CAB
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windup...7dcd18f40f02aed
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {75565ED2-1560-4F15-B841-20358DE6A0D1} (ImageControl Class) - http://content.ances...ll/MFImgVwr.cab
O16 - DPF: {861DB4B6-3838-11D2-8E50-002018200E57} (MrSIDI Control) - http://images.myfami...oads/MrSIDI.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.googl...gleActivate.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security1.nor...c/bin/cabsa.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.h.../qdiagh.cab?315

[coachwife6]

We can definitely help you, but first you need to help us. The first step in this process is to apply Service Pack 1a for Windows XP. Without this update, you're wide open to re-infection, and we're both just wasting our time.
Click here: http://www.microsoft...p1/default.mspx
Apply the update, reboot, and post a fresh Hijack This log.

Some hijacks interfere with the installation of Service Pack 2, so we'll hold of for now. When we're finished cleaning your computer we highly recommend installing SP2. Click here: http://windowsupdate.microsoft.com/.
-or-
It's a very large download, so if you're on dial-up, order a free CD here:
http://www.microsoft...default810.mspx

[Daisypearl]

I have the CD SP2; I was waiting to make sure there were no patches for it since it seems Microsoft frequently has to rewrite software. I thought I had all of SP1 since I had the automatic download turned on. Can I go with SP2 or is it not cumulative for both? Were only some of the fixes for SP1 on automatic download?

Sorry to be such a dummy; I am really out of my element on this and had thought I was doing just fine on the XP patches

thanks so much

daisypearl

[admin]

If you already have the SP2 CD go ahead and install it. Let us know if you have any trouble. Post a fresh log and reply when finished.

[Daisypearl]

We can definitely help you, but first you need to help us. The first step in this process is to apply Service Pack 1a for Windows XP. Without this update, you're wide open to re-infection, and we're both just wasting our time.
Click here: http://www.microsoft...p1/default.mspx
Apply the update, reboot, and post a fresh Hijack This log.

Some hijacks interfere with the installation of Service Pack 2, so we'll hold of for now. When we're finished cleaning your computer we highly recommend installing SP2. Click here: http://windowsupdate.microsoft.com/.
-or-
It's a very large download, so if you're on dial-up, order a free CD here:
http://www.microsoft...default810.mspx

[Daisypearl]

We can definitely help you, but first you need to help us. The first step in this process is to apply Service Pack 1a for Windows XP. Without this update, you're wide open to re-infection, and we're both just wasting our time.
Click here: http://www.microsoft...p1/default.mspx
Apply the update, reboot, and post a fresh Hijack This log.

Some hijacks interfere with the installation of Service Pack 2, so we'll hold of for now. When we're finished cleaning your computer we highly recommend installing SP2. Click here: http://windowsupdate.microsoft.com/.
-or-
It's a very large download, so if you're on dial-up, order a free CD here:
http://www.microsoft...default810.mspx

I guess I have a bigger problem than I thought!!! If I need to repost this to the software forum let me know.

As I said before I had the SP2 CD; have piddled with doing various things to the computer and getting it backed up, etc before installing since my last post. During that time when I was online I noticed there was a continuous download from Microsoft [I have automatic updates turned on]. Turns out it was SP2--so now I have it on my hard drive as well ad the CD.

Just tried to install it and it got as far as creating a 3d party driver inventory and aborted. Told me to go to MS and look at the how to tell page re: product code. They wanted to instal a utility program "ProductIDGatherer" to check my registration [I think]. I changed my security settings to allow it [the active X ones] and it still won't install.

I do not have a CD for my Windows XP Pro. I live in a rural area and went to the only person doing comuter work in 2001 and he put XP on my computer afer adding memory, etc. It has worked fine and I have 7 pages of updates that MS has automatically installed. I never did install SP1 because I got the same problem and thought that the ongoing updates would take care of it [duhhhhh--am I an idot or what]. Now I wonder if I have a legal copy or if I am just screwing up. It seems that they would not download any updates if the copy of the software were illegal but when I asked the kid about getting a CD when I wanted to do SP1 he said I would have to pay for a new OS. Think I may have answered my own question...