[jeiveecee]

Hello there... Please support me about this issue.

"Microsoft Visual C++ runtime error"

Runtime Error
Program: WINNT\Explorer.exe

This is my log...


Logfile of HijackThis v1.99.1
Scan saved at 2:46:40 PM, on 4/15/2005
Platform: Windows 2000 SP1 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\rundll32.exe
C:\WINNT\System32\Promon.exe
C:\PROGRA~1\NavNT\vptray.exe
C:\WINNT\$$$QND.TMP\bin\QNDLOGON.EXE
C:\winnt\system32\fbnwsz.exe
C:\Documents and Settings\nca.NCAHDQ\My Documents\MEDIA\iridium.exe
C:\winnt\system32\calc.exe
C:\WINNT\System32\rundll32.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINNT\System32\rundll32.exe
C:\WINNT\System32\rundll32.exe
C:\WINNT\System32\rundll32.exe
C:\WINNT\System32\rundll32.exe
C:\WINNT\System32\rundll32.exe
C:\WINNT\System32\rundll32.exe
C:\WINNT\System32\rundll32.exe
C:\WINNT\System32\rundll32.exe
C:\WINNT\System32\rundll32.exe
C:\WINNT\Explorer.exe
C:\WINNT\System32\rundll32.exe
D:\$HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://(i intentionally hide it)
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://(i intentionally hide it)
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http://(i intentionally hide it)
O2 - BHO: BTGrabObj Class - {00000000-F09C-02B4-6EC2-AD0300000000} - C:\WINNT\BTGrab.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {FFFFDA2C-A0D5-4D60-8EE1-1B7F8929E24D} - C:\Program Files\Lycos\sst.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NavNT\vptray.exe
O4 - HKLM\..\Run: [QNDLOGON] C:\WINNT\$$$QND.TMP\bin\QNDLOGON.EXE
O4 - HKLM\..\Run: [AcpcdLogon] "C:\WINNT\$$$QND.TMP\acpc\logonnotify.exe"
O4 - HKLM\..\Run: [CMESys] "C:\Program Files\Common Files\CMEII\CMESys.exe"
O4 - HKLM\..\Run: [fbnwsz] c:\winnt\system32\fbnwsz.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [IridiumTimeWizard] C:\Documents and Settings\nca.NCAHDQ\My Documents\MEDIA\iridium.exe
O4 - Startup: Forget Me Not.lnk = C:\Program Files\Mindscape\AGPrint\PMREMIND.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .swf: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npswf32.dll
O16 - DPF: Uts60 Emulator - http://crwview.ana.c...aClient/Uts.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.co...wnload/cult.cab
O16 - DPF: {DDFFA75A-E81D-4454-89FC-B9FD0631E726} - http://www.bundlewar...veX/BM2/BM2.dll
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = intra.nca.aero
O17 - HKLM\System\CCS\Services\Tcpip\..\{276907E3-FFE1-4CB9-96A0-907C44F35432}: NameServer = (i intentionally hide it)
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = intra.nca.aero
O17 - HKLM\System\CS1\Services\Tcpip\..\{276907E3-FFE1-4CB9-96A0-907C44F35432}: NameServer = (i intentionally hide it)
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = intra.nca.aero
O17 - HKLM\System\CS2\Services\Tcpip\..\{276907E3-FFE1-4CB9-96A0-907C44F35432}: NameServer = (i intentionally hide it)
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - Service: ACPCdaemon - System Intelligent Corp. - C:\WINNT\$$$QND.TMP\acpc\acpcd.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: QP Option (qndd) - - C:\WINNT\$$$QND.TMP\bin\QNDD.EXE
O23 - Service: Switch User Daemon (swusrd) - - C:\WINNT\SWUSRD\swusrd.exe


Thanks alot. Anyway i need a chat mate, im 24 year old guy, please refer me if you have a friend. I prefer a girl, of my same age bracket. Im here at the Philippines.. [email protected]

KUDOS!!!

Edited by jeiveecee, 15 April 2005 - 03:26 AM.

[Advertisements]

You're posting in the wrong forum mate

In the future, please post in the malware section

First
This is bad
O2 - BHO: BTGrabObj Class - {00000000-F09C-02B4-6EC2-AD0300000000} - C:\WINNT\BTGrab.dll
Since hijack does not always get this one
Try getting this tool to remove it
http://securityrespo...erinternet.html


This should be removed in hijack
O2 - BHO: (no name) - {FFFFDA2C-A0D5-4D60-8EE1-1B7F8929E24D} - C:\Program Files\Lycos\sst.dll
O4 - HKLM\..\Run: [fbnwsz] c:\winnt\system32\fbnwsz.exe
O4 - HKCU\..\Run: [IridiumTimeWizard] C:\Documents and Settings\nca.NCAHDQ\My Documents\MEDIA\iridium.exe


I am unfamiliar with these...does QND Pro sound familiar to you as a program you installed?
O4 - HKLM\..\Run: [QNDLOGON] C:\WINNT\$$$QND.TMP\bin\QNDLOGON.EXE
O4 - HKLM\..\Run: [AcpcdLogon] "C:\WINNT\$$$QND.TMP\acpc\logonnotify.exe"
O23 - Service: ACPCdaemon - System Intelligent Corp. - C:\WINNT\$$$QND.TMP\acpc\acpcd.exe
O23 - Service: QP Option (qndd) - - C:\WINNT\$$$QND.TMP\bin\QNDD.EXE

This is also unknown to me....did you install something intended to switch user/accounts?
O23 - Service: Switch User Daemon (swusrd) - - C:\WINNT\SWUSRD\swusrd.exe

Thanks alot. Anyway i need a chat mate, im 24 year old guy, please refer me if you have a friend. I prefer a girl, of my same age bracket. Im here at the Philippines.. [email protected]

KUDOS!!!

[gerryf]

You're posting in the wrong forum mate

In the future, please post in the malware section

First
This is bad
O2 - BHO: BTGrabObj Class - {00000000-F09C-02B4-6EC2-AD0300000000} - C:\WINNT\BTGrab.dll
Since hijack does not always get this one
Try getting this tool to remove it
http://securityrespo...erinternet.html


This should be removed in hijack
O2 - BHO: (no name) - {FFFFDA2C-A0D5-4D60-8EE1-1B7F8929E24D} - C:\Program Files\Lycos\sst.dll
O4 - HKLM\..\Run: [fbnwsz] c:\winnt\system32\fbnwsz.exe
O4 - HKCU\..\Run: [IridiumTimeWizard] C:\Documents and Settings\nca.NCAHDQ\My Documents\MEDIA\iridium.exe


I am unfamiliar with these...does QND Pro sound familiar to you as a program you installed?
O4 - HKLM\..\Run: [QNDLOGON] C:\WINNT\$$$QND.TMP\bin\QNDLOGON.EXE
O4 - HKLM\..\Run: [AcpcdLogon] "C:\WINNT\$$$QND.TMP\acpc\logonnotify.exe"
O23 - Service: ACPCdaemon - System Intelligent Corp. - C:\WINNT\$$$QND.TMP\acpc\acpcd.exe
O23 - Service: QP Option (qndd) - - C:\WINNT\$$$QND.TMP\bin\QNDD.EXE

This is also unknown to me....did you install something intended to switch user/accounts?
O23 - Service: Switch User Daemon (swusrd) - - C:\WINNT\SWUSRD\swusrd.exe

Thanks alot. Anyway i need a chat mate, im 24 year old guy, please refer me if you have a friend. I prefer a girl, of my same age bracket. Im here at the Philippines.. [email protected]

KUDOS!!!