1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

messed up computer

Discussion in 'Windows XP' started by sweetcheekies, Sep 14, 2004.

Thread Status:
Not open for further replies.
Advertisement
  1. sweetcheekies

    sweetcheekies Thread Starter

    Joined:
    Aug 23, 2001
    Messages:
    1,218
    I am posting this for my friend. she is running windows xp
    Lately she is having a ton of trouble with her computer.. she is not able to do much when she is connected under normal mode.. she cant access her comcast things.. msn, yahoo etc.. she has uninstalled and reinstalled all of those.. after running virus scans, adaware,,, trojan scans etc.. ( housecalls, bit defender etc ) she keeps finding a whole slew of things.. she gets rid of them the way she tells them to.. or they say they fixed them .. but she is getting worse.. her computer is running worse each day.. she can do what ever she wants in safe mode / networking.. every thing runs fine. she is not able to run norton anti virus in safe mode.. it says its not able to. attatched is her hijack this log.. she had downloaded SP2 but uninstalled cause that is since when she has had even more trouble.. she cannot restore to a earlier time.. it says its not able to do that either any help with this would be greatly appreciated.. and she can use the help ASAP cause hubby is ready to throw the puter out lol Please explain things simply as she is not very good with computers.

    Logfile of HijackThis v1.98.2
    Scan saved at 12:42:42 PM, on 9/14/2004
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\BCMSMMSG.exe
    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    C:\WINDOWS\system32\cisvc.exe
    C:\WINDOWS\System32\CTsvcCDA.exe
    C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    C:\Documents and Settings\Scott & Rachel\My Documents\My Received Files\HijackThis.exe
    C:\WINDOWS\system32\wuauclt.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.comcast.net
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr*http://my.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
    R3 - URLSearchHook: (no name) - _{1C78AB3F-A857-482e-80C0-3A1E5238A565} - (no file)
    O2 - BHO: (no name) - SOFTWARE - (no file)
    O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\System32\nvms.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
    O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\System32\mscb.dll
    O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
    O16 - DPF: All-Star Football Challenge by pogo - http://allstarfb2.pogo.com/applet-5.9.3.38/allstarfb2/allstarfb2-ob-assets.cab
    O16 - DPF: Yahoo! Spades - http://download.games.yahoo.com/games/clients/y/st2_x.cab
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

    thanks SweetC
     
  2. Flrman1

    Flrman1

    Joined:
    Jul 26, 2002
    Messages:
    46,329
    Run Hijack This again and put a check by these. Close ALL windows except HijackThis and click "Fix checked"

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

    R3 - URLSearchHook: (no name) - _{1C78AB3F-A857-482e-80C0-3A1E5238A565} - (no file)

    O2 - BHO: (no name) - SOFTWARE - (no file)

    O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)

    O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\System32\nvms.dll

    O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\System32\mscb.dll

    O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll


    Restart your computer.

    Also I see Norton, but I do not see that Auto-Protect or Email scanning are enabled. These need to be running.
     
  3. Flrman1

    Flrman1

    Joined:
    Jul 26, 2002
    Messages:
    46,329
    The HJT log shows that SP2 is installed! :confused:
     
  4. sweetcheekies

    sweetcheekies Thread Starter

    Joined:
    Aug 23, 2001
    Messages:
    1,218
    sp2 does not show up in add remove programs.. how else can she uninstall it.. ? also why does system config say she has xp pro when she has the home edition?
     
  5. sweetcheekies

    sweetcheekies Thread Starter

    Joined:
    Aug 23, 2001
    Messages:
    1,218
  6. sweetcheekies

    sweetcheekies Thread Starter

    Joined:
    Aug 23, 2001
    Messages:
    1,218
    okay well that didnt work.. she has uninstalled everything .. i mean windows messanger and msn6.. plus yahoo.. and now she cant even reinstall them.. it gives her the message of can't connect.. yet she can go anywhere on the internet.. I am totally stumped as to why she cant.. she can't do a windows update because it gives her the message that the update could not be completed.... she cant repair winxp.. she cant reinstall xp nothing ..
     
  7. Bob Cerelli

    Bob Cerelli

    Joined:
    Nov 2, 2002
    Messages:
    22,468
    You can always do a repair install of XP if you have the CD. This will put it back to SP1.

    But is the problem the service pack or all the spyware that keeps showing up.

    Also what programs have you used to remove it. I have yet to find one that gets them all.
     
  8. sweetcheekies

    sweetcheekies Thread Starter

    Joined:
    Aug 23, 2001
    Messages:
    1,218
    we have tried several.. if u have some that work please let me know .. also we tried the cd thing and that didnt work either and she has had the problems since she installed sp2.. so we are figuring its that.
     
  9. pfurball

    pfurball

    Joined:
    Aug 26, 2004
    Messages:
    310
    Howdy sweetcheekies, I had a similar problem and running in safe mode means that there is NO protection when online and just about anything can get in and stuff the puter.Try Spybot to see if there are more malware things clogging but sounds more like a trojan/worm/virus. I ended up having to reformat my drives and totally reinstall XP and all my (fortunately)backed up programmes. Never did find the exact cause, but puter runs fine now. Haven't installed SP2 yet....not game!!!
     
  10. Bob Cerelli

    Bob Cerelli

    Joined:
    Nov 2, 2002
    Messages:
    22,468
    Generally I like to use Ad-Aware Pro, Spybot and SpySweeper. Spyware Blaster helps a lot in preventing getting infected in the first place.

    Get all the updates.

    Then boot to safe mode and scan. This way you at least have a chance at minimizing how much will be in memory at that time.

    Then boot normally and scan again.

    Also, in the first post you mention that there were programs that kept coming back that you were trying to remove. What were those and how would they be related to XP2 ?

    What CD thing did you try. The specifics.

    If you have FAT32 on the computer, you don't need to reinstall to get the benefits of a clean install. Just boot to DOS and rename the c:\windows and c:\progra~1 (program files from DOS), directories. Then just reinstall Windows. This way all the data will still be there and if there are any files in either of those two directories you need, you can retrieve them as well. But any spyware won't get install or loaded.
     
  11. sweetcheekies

    sweetcheekies Thread Starter

    Joined:
    Aug 23, 2001
    Messages:
    1,218
    yea we have ran spybot.. that was one of the first things we did.. we ran adaware.. removed what was needed there.. then ran housecalls.. removed what we could there.. then rebooted..ran spybot removed there.. posted the hijack log here did that.. tried to uninstall sp2. via add/remove programs that supposedly worked.. but we find out it didnt lol .. then we removed via $nt$ that i guess didnt work either cause hijack log says its still there.. so its stuck lol
     
  12. Bob Cerelli

    Bob Cerelli

    Joined:
    Nov 2, 2002
    Messages:
    22,468
    Sorry for a typo in the prevous post.

    Should have read:
    If you have FAT32 on the computer, you don't need to REFORMAT to get the benefits of a clean install.
     
  13. Bob Cerelli

    Bob Cerelli

    Joined:
    Nov 2, 2002
    Messages:
    22,468
    I'm not clear at this point if all the spyware was removed or not. From the original post it didn't sound like it was.

    Did you try updating and rescanning from safe mode.
     
  14. sweetcheekies

    sweetcheekies Thread Starter

    Joined:
    Aug 23, 2001
    Messages:
    1,218
    okay reran bit defender.. nothing shows.. rerunning spybot.. and we tried the running windows xp pro disk for a repair.. that didnt work.. and have no clue on how to do the dos thing and I dont think she is gonna be able to get that .. and will have her update from safe mode once these are done.. will post back ASAP thanks for any advice
     
  15. Bob Cerelli

    Bob Cerelli

    Joined:
    Nov 2, 2002
    Messages:
    22,468
    What steps were taken for the repair install and what were the error messages.

    Also, the post I made was not to update from safe mode but to scan from safe mode.
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Similar Threads - messed computer
  1. Buffalo19
    Replies:
    1
    Views:
    490
  2. Marcella253
    Replies:
    2
    Views:
    555
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/273889

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice