Computers |
|
| | #1 (permalink) |
| Wizard Techie Join Date: Aug 2005
Posts: 3,323
| Logfile of HijackThis v1.99.1 Scan saved at 5:39:17 PM, on 4/4/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\RunDLL32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\explorer.exe D:\hijackthis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = 192.168.11.1:8080 F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe, explorer.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdmcks.dll O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Barsaka] explorer.exe O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/.../GAME_UNO1.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{461E4A33-4AAA-48C9-A3E4-A793F9959F90}: NameServer = 192.168.11.1 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
__________________ ![]() CPU: Core 2 Quad Q6600 MOBO: Intel DP35DP Video card: eVGA 8800GTS 320MB Hard drive: WD 500GB Monitor: Samsung 206BW 20" Wide OS: Windows XP Professional SP2 |
| |
| | #3 (permalink) |
| Wizard Techie Join Date: Aug 2005
Posts: 3,323
| Thank you But I have two "explorer.exe" process running in the Task Manager, is that normal ? http://img19.imageshack.us/img19/1549/untitledfo5.jpg
__________________ ![]() CPU: Core 2 Quad Q6600 MOBO: Intel DP35DP Video card: eVGA 8800GTS 320MB Hard drive: WD 500GB Monitor: Samsung 206BW 20" Wide OS: Windows XP Professional SP2 |
| |
| | #4 (permalink) |
| lvl Infinite Psychopath | No its not normal. Explorer.exe is the process that is responsible for your desktop and much of the GUI interface of windows. End one or both and see what happens. When your desktop disappears, in task manager, File, New task(Run), Then type in explorer.exe and hit enter. Edit: I found something on google that states that another process named explorer.exe can sometimes be a trojan. My guess would be that its the one using less memory. So end that one first. What AV Do you use? Ending the process will not get remove the trojan. You will have to find the file that is responsible for that trojan, probably named explorer.exe or something similar to it. Make sure its not the windows explorer, then use hijackthis's delete on reboot feature to delete it. (Incidently, its a nice way to keep ignorant people from using your computer, just end explorer.exe then run it again when you come back to it.)
__________________ Read The Rules!! Power Supply Guide Intel Overclocking Thread AMD Overclocking Thread Other Important Threads I'm sorry but I do not accept support requests via IM, email, or personal messages There will come a day, such a day when all will be told more than they wish to know, what one hears may explain the past, it may explain the future, but it has never made a difference either way and it will change nothing. Some day.... But that is not this day, and I don't know when, I just don't know. Last edited by Ste; 04-04-2007 at 10:40 AM. |
| |
| | #5 (permalink) | |||
| Wizard Techie Join Date: Aug 2005
Posts: 3,323
| Quote:
Quote:
Quote:
http://img129.imageshack.us/img129/2851/cccgw8.jpg
__________________ ![]() CPU: Core 2 Quad Q6600 MOBO: Intel DP35DP Video card: eVGA 8800GTS 320MB Hard drive: WD 500GB Monitor: Samsung 206BW 20" Wide OS: Windows XP Professional SP2 | |||
| |
| | #6 (permalink) |
| lvl Infinite Psychopath | Edit: Delete the one within the System32 folder as the real explorer is just in the windows folder.
__________________ Read The Rules!! Power Supply Guide Intel Overclocking Thread AMD Overclocking Thread Other Important Threads I'm sorry but I do not accept support requests via IM, email, or personal messages There will come a day, such a day when all will be told more than they wish to know, what one hears may explain the past, it may explain the future, but it has never made a difference either way and it will change nothing. Some day.... But that is not this day, and I don't know when, I just don't know. Last edited by Ste; 04-04-2007 at 11:42 AM. |
| |
| | #7 (permalink) |
| Master Techie Join Date: Jun 2004 Location: Newcastle-under-lyme, Staffordshire, United Kingdom.
Posts: 2,064
| Hello, Two or more explorer.exe processes running simultaneously is normal if the following setting is applied in folder options: http://img410.imageshack.us/img410/2...eparatedq9.jpg The same setting can be controlled in the registry by changing the value SeparateProcess in the key [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer\ Advanced]. Registry tweak here: Launch Folder Windows in a Separate Process at Registry Guide for Windows The benefit of enabling this option is that if one explorer window has an error and crashes, other windows won't be affected. However, consequently, having multiple explorer.exe processes running at the same time mean more use of system resources. Check to see if this option is enabled, by checking either folder options or the registry. If it's disabled, then there shouldn't be multiple explorer.exe processes running at the same time.
__________________ Alvin.C |Asus Eee PC 1000H (White)| |Windows Server 2003 Standard Edition| Last edited by Alvin.C; 04-04-2007 at 12:18 PM. |
| |
| | #8 (permalink) | |
| lvl Infinite Psychopath | Quote:
The real Explorer.exe is in the windows Folder and not in System32. Take a look for youself...
__________________ Read The Rules!! Power Supply Guide Intel Overclocking Thread AMD Overclocking Thread Other Important Threads I'm sorry but I do not accept support requests via IM, email, or personal messages There will come a day, such a day when all will be told more than they wish to know, what one hears may explain the past, it may explain the future, but it has never made a difference either way and it will change nothing. Some day.... But that is not this day, and I don't know when, I just don't know. | |
| |
| | #9 (permalink) | |
| Wizard Techie Join Date: Aug 2005
Posts: 3,323
| Quote:
So, what should I do now ? Should I delete explorer.exe in the System32 folder, as Ste said ?
__________________ ![]() CPU: Core 2 Quad Q6600 MOBO: Intel DP35DP Video card: eVGA 8800GTS 320MB Hard drive: WD 500GB Monitor: Samsung 206BW 20" Wide OS: Windows XP Professional SP2 Last edited by maroon1; 04-04-2007 at 12:37 PM. | |
| |
| | #10 (permalink) |
| lvl Infinite Psychopath | Yes, use Hijackthis's delete on reboot feature in misc tools. You will need to browse to the file location. restart once the file is selected and you hit ok/open.
__________________ Read The Rules!! Power Supply Guide Intel Overclocking Thread AMD Overclocking Thread Other Important Threads I'm sorry but I do not accept support requests via IM, email, or personal messages There will come a day, such a day when all will be told more than they wish to know, what one hears may explain the past, it may explain the future, but it has never made a difference either way and it will change nothing. Some day.... But that is not this day, and I don't know when, I just don't know. |
| |
| Thread Tools | |
| Display Modes | |
| |
Similar Threads | ||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Price Check: Selling My Rig | Greg | Other Computer HW Topics | 8 | 04-12-2007 11:16 PM |
| Gaming Computer Price Check | krazy_taco | Other Computer HW Topics | 7 | 04-06-2007 12:34 PM |
| disk check on boot up | pigmaster | Hardware Troubleshooting | 5 | 04-01-2007 11:46 PM |
| Which one is better Windows Xp OR Vista For playing Games!!! Check it out... | lekhi123 | Windows Operating Systems and Software | 13 | 04-01-2007 10:40 PM |