Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows scrolls by itself


  • This topic is locked This topic is locked
7 replies to this topic

#1 rosie

rosie

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:34 AM

Posted 27 July 2004 - 10:41 PM

Hello, I recently downloaded hijackthis.exe from this url http://www.sherrylynn.us/privacypolicy.htm I installed it and ran it. Since I already had adaware & spybot and mcafee antivirus and really didn't have much spyware so I decided to run hijackthis. After the report, I read several suggestions that said something about 'extra buttons' so I so stupidly removed those extra button things. It was not until I removed hijackthis that I noticed that my windows screens would scroll on its own up & down histerically. I guess my windows shell needed those extra buttons because now I don't know how to fix this issue. Can someone please help me with this annoying problem? :thumbsup:

BC AdBot (Login to Remove)

 


#2 JEservices

JEservices

    helping hand


  • Members
  • 1,700 posts
  • OFFLINE
  •  
  • Location:Texas
  • Local time:03:34 AM

Posted 27 July 2004 - 10:52 PM

Did you tell HiJack This to make a backup, when you ran it?
We are all curious like a cat. We wonder, we ask, we learn.
Please post back when a suggestion works, so that others may learn.

#3 Papakid

Papakid

    Guru at being a Newbie


  • Malware Response Team
  • 6,595 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:34 AM

Posted 27 July 2004 - 11:12 PM

Hi rosie,
First, not to rub it in, but you should never fix anything with HijackThis without guidance from someone who knows what they are doing. Nuff said on that.

HijackThis makes backups automatically so let's try to use them. Hope you didn't delete them--that happens too. Do this:

Run HijackThis. Click the Scan button. It will turn into a Save Log button. Click that and then copy the entire contents (use Edit>Select All) and paste it into your reply to this post.

Now click the Config button, then the Backups button. You should see a list of what you deleted in the main pane. Click to select (highlight) every entry there, then make sure you don't have any other windows open, just HijackThis, then click Restore. Close HijackThis and reboot.

I hope that will fix your problem, but even if it doesn't I want you to run HijackThis again. Do another scan, make another log and post that one too.

The thing about people

is they change

when they walk away.--Mipso


#4 rosie

rosie
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:34 AM

Posted 27 July 2004 - 11:16 PM

After hijackthis gave me a report & after I removed some things that said 'extra button' I completely removed hijackthis from my computer. So I don't think I have a backup of what I did.

#5 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,541 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:05:34 AM

Posted 28 July 2004 - 09:33 AM

Then there is no way to restore those buttons that are missing. If we knew what they were, MAYBE, we could help, but no promises.

#6 Papakid

Papakid

    Guru at being a Newbie


  • Malware Response Team
  • 6,595 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:34 AM

Posted 28 July 2004 - 09:35 AM

Well, Grinler posted while I was writing the following. You can still try what I suggest below, but as he says, there are no guarantees. If you ONLY fixed extra buttons it might work--System Restore is mostly a backup of your registry and the extra buttons I believe are registry entries. But if any files were deleted...???
--------------------------------------------------------------------------------------------------

Mmmm, I was afraid of that. It would be better to restore from backups, but in your case what you should try is a system restoration. You haven't mentioned which Operating System you're using, but if it's XP or ME, you can use System Restore to go back to a day or two before you fixed anything with HJT. If not one of those OS's we'll have to try something else. See the following tutorials on instructions for using System Restore.
Windows XP System Restore Guide.
Managing Windows Millenium System Restore

This is a really unfortunate situation borne from a basic misunderstanding of how HijackThis works and how it should be used. A pet peeve of mine is seeing people saying something like this: "To get rid of spyware, run Spybot S&D, AdAware and HijackThis." HJT doesn't work like Spybot and AdAware--you don't just run it and then fix whatever you please. More on that later. This is just to say that HJT is a tool used to investigate and troubleshoot. I would strongly suggest that even if a System Restore works or not that you download HijackThis again and just post the log here. Don't fix anything. We may be able to tell from the log what else needs to be done to get your system back to normal.

The thing about people

is they change

when they walk away.--Mipso


#7 rosie

rosie
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:34 AM

Posted 28 July 2004 - 02:41 PM

Hello guys

I downloaded hijackthis from Cnet. Here is my log:

Logfile of HijackThis v1.98.0
Scan saved at 2:37:59 PM, on 7/28/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\system32\cisvc.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HJT\hijackthis\HijackThis.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot\DESTIN~1.200\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] C:\Program Files\McAfee.com\Agent\mcagent.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CleanUp] C:\PROGRA~1\McAfee.com\Shared\mcappins.exe /v=3 /cleanup
O4 - HKCU\..\Run: [Dancer] "C:\Program Files\Microsoft Plus! Digital Media Edition\Dancer\Dancer.exe"
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m...81/mcinsctl.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/2865d31fee2044...ip/RdxIE601.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m...,19/mcgdmgr.cab

#8 Papakid

Papakid

    Guru at being a Newbie


  • Malware Response Team
  • 6,595 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:34 AM

Posted 28 July 2004 - 06:57 PM

Well, at least you are malware free. :thumbsup:

Was this log done after running System Restore?

After hijackthis gave me a report & after I removed some things that said 'extra button' I completely removed hijackthis from my computer. So I don't think I have a backup of what I did.


Did you check your Recycle Bin or has it been emptied? We could get lucky and find your HJT backups there. I deleted a useless file and following is what was put in the backup folder--look for a similar pattern of numbers and let me know.

backup-20040629-194515-489
backup-20040629-194515-489.dll
backup-20040629-194515-489.inf

Just let me know if they are there for now and if you've tried System Restore.

The thing about people

is they change

when they walk away.--Mipso





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users