Help with system lock-ups.

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by lotuspod, May 28, 2004.

  1. lotuspod

    lotuspod Private E-2

    First I want to say hello to everyone since this is my first post on these boards. Second, I'd like to ask for a bit of help. Lately my system has been sporadically locking up for brief periods of time then eventually freezing up all together. I had one identified worm on my system that I took care of but I am still experiencing problems. I would appreciate any help anyone can give me.

    I have the following log;
    Code:
     Logfile of HijackThis v1.97.7
    Scan saved at 4:45:18 PM, on 5/28/2004
    Platform: Windows ME (Win9x 4.90.3000)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\WINDOWS\SYSTEM\CTFMON.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZONEALARM.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\WINDOWS\SYSTEM\SPOOL32.EXE
    C:\MY DOCUMENTS\HIJACKTHIS.EXE
    C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url="http://v4.windowsupdate.microsoft.com/"]http://v4.windowsupdate.microsoft.com/[/url]
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer
    O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: (no name) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - (no file)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
    O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [Mirabilis ICQ] C:\Program Files\ICQ\ICQNet.exe
    O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
    O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
    O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
    O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
    O4 - HKCU\..\Run: [AIM] C:\PROGRAM FILES\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRAM FILES\YAHOO!\MESSENGER\ypager.exe -quiet
    O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
    O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
    O4 - HKCU\..\RunOnce: [ICQ] C:\PROGRAM FILES\ICQ\ICQ.EXE -trayboot
    O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
    O8 - Extra context menu item: &IE Toolbar search - res://C:\WINDOWS\SYSTEM\TOOLBAR.DLL/SEARCH.HTML
    O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
    O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
    O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
    O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
    O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
    O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - [url="http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37872.5228125"]http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37872.5228125[/url]
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - [url="http://pcpitstop.com/pcpitstop/PCPitStop.CAB"]http://pcpitstop.com/pcpitstop/PCPitStop.CAB[/url]
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - [url="http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab"]http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab[/url]
    O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - [url="http://support.dell.com/us/en/systemprofiler/SysProfLCD.CAB"]http://support.dell.com/us/en/systemprofiler/SysProfLCD.CAB[/url]
    O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - [url="http://fdl.msn.com/zone/datafiles/heartbeat.cab"]http://fdl.msn.com/zone/datafiles/heartbeat.cab[/url]
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - [url="http://www.apple.com/qtactivex/qtplugin.cab"]http://www.apple.com/qtactivex/qtplugin.cab[/url]
    O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - [url="http://www.cult3d.com/download/cult.cab"]http://www.cult3d.com/download/cult.cab[/url]
    O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - [url="http://www.comcastsupport.com/sdccommon/download/tgctlcm.cab"]http://www.comcastsupport.com/sdccommon/download/tgctlcm.cab[/url]
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - [url="http://a840.g.akamai.net/7/840/537/bff3af7d050da5/housecall.antivirus.com/housecall/xscan53.cab"]http://a840.g.akamai.net/7/840/537/bff3af7d050da5/housecall.antivirus.com/housecall/xscan53.cab[/url]
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - [url="http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab"]http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab[/url]
    O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} (IObjSafety.DemoCtl) - [url="http://cabs.roings.com/cabs/downplug.cab"]http://cabs.roings.com/cabs/downplug.cab[/url]
    O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - [url="http://www.pestscan.com/scanner/axscanner.cab"]http://www.pestscan.com/scanner/axscanner.cab[/url]
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - [url="http://download.yahoo.com/dl/installs/yinst0401.cab"]http://download.yahoo.com/dl/installs/yinst0401.cab[/url]
    O16 - DPF: {0191ABF4-9421-435E-9FFD-CD827A2A82D8} (SBITAX7Ctrl Class) - [url="http://directplugin.com/tl7000_cert1.dll"]http://directplugin.com/tl7000_cert1.dll[/url]
    O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - [url="http://pcpitstop.com/mhLbl.cab"]http://pcpitstop.com/mhLbl.cab[/url]
    
    Thanks in advance for your time,

    Rob
     
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Have you downloaded, installed, updated and run Ad-aware and SpyBot S&D? If not you can find links in this: http://www.majorgeeks.com/vb/showthread.php?t=26149.

    After running and fixing anything Ad-aware and SpyBot find, download and run the below tool (you must remain online while running it):

    http://zerosrealm.com/downloads/uninst.exe

    Now shut everthing you can down and run HiJaak This again, fix the below lines if they still exist:

    O2 - BHO: (no name) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - (no file)
    O8 - Extra context menu item: &IE Toolbar search - res://C:\WINDOWS\SYSTEM\TOOLBAR.DLL/SEARCH.HTML

    O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} (IObjSafety.DemoCtl) - http://cabs.roings.com/cabs/downplug.cab
     
  3. lotuspod

    lotuspod Private E-2

    I did as you said and it's definately improved. I really appreciate it man. Can't thank you enough. :)
     
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    That's good news! Glad I could help! ;)
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds