Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Need A Little Help!


  • Please log in to reply
2 replies to this topic

#1 dogzero

dogzero

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:03:19 AM

Posted 10 February 2008 - 05:37 PM

I've lost my start bar and the desktop icons are frozen. IMy wireless network has also stopped working. 've tried using VundoFix but all I get is a runtime error message stating that the RPC Server is Unavailable.

Thanks for the help.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:34, on 2008-02-10
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ISS\Proventia Desktop\blackd.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\ISS\Proventia Desktop\RapApp.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\Program Files\ISS\Proventia Desktop\vpatch.exe
C:\WINDOWS\system32\CCM\CLICOMP\RemCtrl\Wuser32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\BHODemon 2\BHODemon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://myportal.officemax.omx.com:50000/ir...auncher.default
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://myportal.officemax.omx.com:50000/ir...auncher.default
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = omxproxy.omx.com:8002
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 10.*;89.*;*.officemax.com;*.omx.com;*.boiseoffice.com;*.bcop.com;<local>
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [ioloDelayModule] C:\Program Files\iolo\System Mechanic Professional 6\delay.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ClearCacheProd] "c:\program files\ClearCacheProd\ClearCachePROD.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-21-79331101-135464247-1257837781-65333\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe" (User '?')
O4 - HKUS\S-1-5-21-79331101-135464247-1257837781-65333\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-79331101-135464247-1257837781-65333\..\Run: [ClearCacheProd] "c:\program files\ClearCacheProd\ClearCachePROD.exe" (User '?')
O4 - HKUS\S-1-5-21-79331101-135464247-1257837781-65333\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" (User '?')
O4 - HKUS\S-1-5-21-79331101-135464247-1257837781-65333\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User '?')
O4 - HKUS\.DEFAULT\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'Default user')
O4 - S-1-5-21-79331101-135464247-1257837781-65333 Startup: BHODemon 2.0.lnk = C:\Program Files\BHODemon 2\BHODemon.exe (User '?')
O4 - S-1-5-21-79331101-135464247-1257837781-65333 Startup: Sakina Privacy Protector.lnk = C:\Program Files\Sakina Privacy Protector\Sakina Privacy Protector.exe (User '?')
O4 - Startup: BHODemon 2.0.lnk = C:\Program Files\BHODemon 2\BHODemon.exe
O4 - Startup: Sakina Privacy Protector.lnk = C:\Program Files\Sakina Privacy Protector\Sakina Privacy Protector.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O15 - Trusted Zone: officemaxsavings.csplans.com
O15 - Trusted Zone: *.officemax.omx.com
O15 - Trusted Zone: officemaxsavings.csplans.com (HKLM)
O15 - Trusted Zone: *.officemax.omx.com (HKLM)
O16 - DPF: {819F8533-D935-4183-B692-587F8D56AC3C} (iolo.AV.OnlineVirusScanner) - http://www.iolo.com/threatcenter/App/ocx/AVCheckUp.ocx
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://aramark.webex.com/client/T23LSP33EP...bex/ieatgpc.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = officemax.omx.com
O17 - HKLM\Software\..\Telephony: DomainName = officemax.omx.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = officemax.omx.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = officemax.omx.com,boiseoffice.com,omx.com,int.bcop.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = officemax.omx.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = officemax.omx.com,boiseoffice.com,omx.com,int.bcop.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = officemax.omx.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: SearchList = officemax.omx.com,boiseoffice.com,omx.com,int.bcop.com
O17 - HKLM\System\CS4\Services\Tcpip\Parameters: Domain = officemax.omx.com
O17 - HKLM\System\CS4\Services\Tcpip\Parameters: SearchList = officemax.omx.com,boiseoffice.com,omx.com,int.bcop.com
O17 - HKLM\System\CS5\Services\Tcpip\Parameters: Domain = officemax.omx.com
O17 - HKLM\System\CS5\Services\Tcpip\Parameters: SearchList = officemax.omx.com,boiseoffice.com,omx.com,int.bcop.com
O17 - HKLM\System\CS6\Services\Tcpip\Parameters: Domain = officemax.omx.com
O17 - HKLM\System\CS6\Services\Tcpip\Parameters: SearchList = officemax.omx.com,boiseoffice.com,omx.com,int.bcop.com
O17 - HKLM\System\CS7\Services\Tcpip\Parameters: Domain = officemax.omx.com
O17 - HKLM\System\CS7\Services\Tcpip\Parameters: SearchList = officemax.omx.com,boiseoffice.com,omx.com,int.bcop.com
O17 - HKLM\System\CS8\Services\Tcpip\Parameters: Domain = officemax.omx.com
O17 - HKLM\System\CS8\Services\Tcpip\Parameters: SearchList = officemax.omx.com,boiseoffice.com,omx.com,int.bcop.com
O17 - HKLM\System\CS9\Services\Tcpip\Parameters: Domain = officemax.omx.com
O17 - HKLM\System\CS9\Services\Tcpip\Parameters: SearchList = officemax.omx.com,boiseoffice.com,omx.com,int.bcop.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = officemax.omx.com,boiseoffice.com,omx.com,int.bcop.com
O20 - AppInit_DLLs:
O20 - Winlogon Notify: awvvw - C:\WINDOWS\
O20 - Winlogon Notify: hggfffd - hggfffd.dll (file missing)
O23 - Service: Access Manager Event Service (AM.EventService) - Unknown owner - C:\Program Files\Remote Services\AM.utEventServer.exe (file missing)
O23 - Service: Access Manager Install Service (AM.InstallService) - Unknown owner - C:\Program Files\Remote Services\AM.InstallService.exe (file missing)
O23 - Service: Access Manager Script Service (AM.ScriptService) - Unknown owner - C:\Program Files\Remote Services\AM.blScriptEngine.exe (file missing)
O23 - Service: iSeries Access for Windows Remote Command (Cwbrxd) - IBM Corporation - C:\WINDOWS\CWBRXD.EXE
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Contivity VPN Service (ExtranetAccess) - Nortel Networks NA, Inc. - C:\Program Files\Nortel Networks\Extranet_serv.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: MCI Monitor Service (MCIMonitor) - Unknown owner - C:\Program Files\Remote Services\WENGINE\wmonitor.exe (file missing)
O23 - Service: Network Associates McShield (McShield) - McAfee, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

--
End of file - 9834 bytes

BC AdBot (Login to Remove)

 


m

#2 dogzero

dogzero
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:03:19 AM

Posted 11 February 2008 - 10:25 AM

I still need help. Also, my network adapter are disabled and I can't start them. Thanks again for looking at this.

Here's an updated Hijack This log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:19, on 2008-02-11
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ISS\Proventia Desktop\blackd.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\ISS\Proventia Desktop\RapApp.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\Program Files\ISS\Proventia Desktop\vpatch.exe
C:\WINDOWS\system32\CCM\CLICOMP\RemCtrl\Wuser32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\BHODemon 2\BHODemon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://myportal.officemax.omx.com:50000/ir...auncher.default
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://myportal.officemax.omx.com:50000/ir...auncher.default
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = omxproxy.omx.com:8002
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 10.*;89.*;*.officemax.com;*.omx.com;*.boiseoffice.com;*.bcop.com;<local>
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [ioloDelayModule] C:\Program Files\iolo\System Mechanic Professional 6\delay.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ClearCacheProd] "c:\program files\ClearCacheProd\ClearCachePROD.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKUS\S-1-5-21-79331101-135464247-1257837781-65333\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe" (User '?')
O4 - HKUS\S-1-5-21-79331101-135464247-1257837781-65333\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-79331101-135464247-1257837781-65333\..\Run: [ClearCacheProd] "c:\program files\ClearCacheProd\ClearCachePROD.exe" (User '?')
O4 - HKUS\S-1-5-21-79331101-135464247-1257837781-65333\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe" (User '?')
O4 - HKUS\S-1-5-18\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User '?')
O4 - HKUS\.DEFAULT\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'Default user')
O4 - S-1-5-21-79331101-135464247-1257837781-65333 Startup: BHODemon 2.0.lnk = C:\Program Files\BHODemon 2\BHODemon.exe (User '?')
O4 - S-1-5-21-79331101-135464247-1257837781-65333 Startup: Sakina Privacy Protector.lnk = C:\Program Files\Sakina Privacy Protector\Sakina Privacy Protector.exe (User '?')
O4 - Startup: BHODemon 2.0.lnk = C:\Program Files\BHODemon 2\BHODemon.exe
O4 - Startup: Sakina Privacy Protector.lnk = C:\Program Files\Sakina Privacy Protector\Sakina Privacy Protector.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O15 - Trusted Zone: officemaxsavings.csplans.com
O15 - Trusted Zone: *.officemax.omx.com
O15 - Trusted Zone: officemaxsavings.csplans.com (HKLM)
O15 - Trusted Zone: *.officemax.omx.com (HKLM)
O16 - DPF: {819F8533-D935-4183-B692-587F8D56AC3C} (iolo.AV.OnlineVirusScanner) - http://www.iolo.com/threatcenter/App/ocx/AVCheckUp.ocx
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://aramark.webex.com/client/T23LSP33EP...bex/ieatgpc.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = officemax.omx.com
O17 - HKLM\Software\..\Telephony: DomainName = officemax.omx.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = officemax.omx.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = officemax.omx.com,boiseoffice.com,omx.com,int.bcop.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = officemax.omx.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = officemax.omx.com,boiseoffice.com,omx.com,int.bcop.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = officemax.omx.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: SearchList = officemax.omx.com,boiseoffice.com,omx.com,int.bcop.com
O17 - HKLM\System\CS4\Services\Tcpip\Parameters: Domain = officemax.omx.com
O17 - HKLM\System\CS4\Services\Tcpip\Parameters: SearchList = officemax.omx.com,boiseoffice.com,omx.com,int.bcop.com
O17 - HKLM\System\CS5\Services\Tcpip\Parameters: Domain = officemax.omx.com
O17 - HKLM\System\CS5\Services\Tcpip\Parameters: SearchList = officemax.omx.com,boiseoffice.com,omx.com,int.bcop.com
O17 - HKLM\System\CS6\Services\Tcpip\Parameters: Domain = officemax.omx.com
O17 - HKLM\System\CS6\Services\Tcpip\Parameters: SearchList = officemax.omx.com,boiseoffice.com,omx.com,int.bcop.com
O17 - HKLM\System\CS7\Services\Tcpip\Parameters: Domain = officemax.omx.com
O17 - HKLM\System\CS7\Services\Tcpip\Parameters: SearchList = officemax.omx.com,boiseoffice.com,omx.com,int.bcop.com
O17 - HKLM\System\CS8\Services\Tcpip\Parameters: Domain = officemax.omx.com
O17 - HKLM\System\CS8\Services\Tcpip\Parameters: SearchList = officemax.omx.com,boiseoffice.com,omx.com,int.bcop.com
O17 - HKLM\System\CS9\Services\Tcpip\Parameters: Domain = officemax.omx.com
O17 - HKLM\System\CS9\Services\Tcpip\Parameters: SearchList = officemax.omx.com,boiseoffice.com,omx.com,int.bcop.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = officemax.omx.com,boiseoffice.com,omx.com,int.bcop.com
O20 - AppInit_DLLs:
O23 - Service: Access Manager Event Service (AM.EventService) - Unknown owner - C:\Program Files\Remote Services\AM.utEventServer.exe (file missing)
O23 - Service: Access Manager Install Service (AM.InstallService) - Unknown owner - C:\Program Files\Remote Services\AM.InstallService.exe (file missing)
O23 - Service: Access Manager Script Service (AM.ScriptService) - Unknown owner - C:\Program Files\Remote Services\AM.blScriptEngine.exe (file missing)
O23 - Service: iSeries Access for Windows Remote Command (Cwbrxd) - IBM Corporation - C:\WINDOWS\CWBRXD.EXE
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Contivity VPN Service (ExtranetAccess) - Nortel Networks NA, Inc. - C:\Program Files\Nortel Networks\Extranet_serv.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: MCI Monitor Service (MCIMonitor) - Unknown owner - C:\Program Files\Remote Services\WENGINE\wmonitor.exe (file missing)
O23 - Service: Network Associates McShield (McShield) - McAfee, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

--
End of file - 9434 bytes

#3 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,389 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:03:19 AM

Posted 19 February 2008 - 01:27 PM

Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users