Tech Support Guy banner
Status
Not open for further replies.

XP Stop error on shutdown

4K views 9 replies 4 participants last post by  steamwiz 
#1 ·
Hi,

I ran AVG yesterday and it found the trojan horse musicsearch. got rid of those files having never executed them. i'm wondering if any of my files could have been corrupted by this anyway? i am using xp professional

I also downloaded ad-aware after reading up on trojan horses, but when i try to scan my pc, it restarts my pc shortly after starting the scan. Any suggestions??

Thanks
 
#4 ·
Hi kat07

To double check your other scan

Do an 0n-line scan for viruses here :-

http://housecall.trendmicro.com/

or here :-

http://www.pandasoftware.com/activescan/

If you post your startup list we may be able to spot something

Please post your startup list by doing the following :-

Please go here and download startuplist 1.51 :-

http://www.lurkhere.com/~nicefiles/

Download to any folder or your desktop
Unzip the zipfile
Double click the exe file
go to Edit - select all - copy - and paste the results in a new post here

steam
 
#5 ·
Hi,

i was finally able to finish scanning with spybot, fixed everything it said to, but now noticed that my pc is restarting for no apparent reason. any ideas?

here is my startup list:

StartupList report, 27/01/2003, 3:17:15 PM
StartupList version: 1.51
Started from : C:\DOCUME~1\Kathleen\LOCALS~1\Temp\StartupList.EXE
Detected: Windows XP (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 (6.00.2600.0000)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MightyFax NT\MFNTCTL.EXE
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
C:\Program Files\3web\system\launcher.exe
C:\Program Files\3web\system\cydial95.exe
C:\Program Files\Juno\bin\juno.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\WINZIP\winzip32.exe
C:\DOCUME~1\Kathleen\LOCALS~1\Temp\StartupList.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
ADOBE GAMMA LOADER.LNK = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
MightyFAX Controller.lnk = C:\Program Files\MightyFax NT\MFNTCTL.EXE

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

SystemTray = SysTray.Exe
TkBellExe = C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
AVG_CC = C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
POINTER = point32.exe
AdaptecDirectCD = "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

CTFMON.EXE = C:\WINDOWS\System32\ctfmon.exe
msnmsgr = "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - (no file) - {CBB0A6A0-8430-11D4-814D-0050047090B1}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Tune-up Application Start.job
PCHealth Scheduler for Data Collection.job
Maintenance-Defragment programs.job
Maintenance-Disk cleanup.job

--------------------------------------------------

Enumerating Download Program Files:

[Win32 Classes]

[Yahoo! Audio Conferencing]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\YACSCOM.DLL
CODEBASE = http://cs5.chat.sc5.yahoo.com/v43/yacscom.cab

[RdxIE Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\RDXIE.DLL
CODEBASE = http://207.188.25.41/18a3c393ccb4353bcb02/netzip/RdxIE.cab

[RdxIE Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\CONFLICT.2\RDXIE.DLL
CODEBASE = http://207.188.7.150/014f9bf0b09465228700/netzip/RdxIE6.cab

[HouseCall Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\xscan53.ocx
CODEBASE = http://a840.g.akamai.net/7/840/537/2003011601/housecall.antivirus.com/housecall/xscan53.cab

[{8522F9B3-38C5-4AA4-AE40-7401F1BBC851}]
CODEBASE = http://www.trinsic.org/download_serial.exe

[MSN File Upload Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\MSNUPLD.DLL
CODEBASE = http://sc.communities.msn.com/controls/FileUC/MsnUpld.cab

[Update Class]
InProcServer32 = C:\WINDOWS\System32\iuctl.dll
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37607.1994560185

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

--------------------------------------------------
End of report, 5,058 bytes
Report generated in 1.402 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
 
#7 ·
Hi Steamwiz,

thanks for the help, but i think i have a major prob. now when my pc shuts down on it's own i get a blue screen with some instructions to run chkdsk f/ and the following :

stop: 0x00000023 (0x000E0100, 0xFA27E894, 0XFA27E594,0x80536BA7)

i have no clue what this means, but i do know a blue screen is not a good thing!!

forgot to mention i recently had a friend install a cd-rw/ dvd combo drive, could this be causing the problem?

thanks,

kat07
 
Status
Not open for further replies.
You have insufficient privileges to reply here.
Top