Computer Support Forum

Help! Mysterious program keeps trying to access my program [HijackThis log included!

Question: Help! Mysterious program keeps trying to access my program [HijackThis log included!

Yeah, So basically I'm here to explain the problem I've been having with my laptop. These crazy pop-ups that have WinAntiVirus Pro 2006 and keeps trying to install itself onto my laptop. I try to get rid of it by using Ad-aware and Spybot S&D - First, It says it's gone but it still pops up every now and then.

Now, Lately, There's been a .exe's called "win478.tmp.exe" and "win204.tmp.exe" in my Temp folder that's been trying to reach a connection - but my firewall blocks the connection it's trying to make. My firewall program has this .exe's called "Microsoft Mediaload" and "Universa Application".

I have no clue on what these .exe's do.. Then I tried looking up for newer spyware/malware programs and found hijack this. I did a scan and a log. So, I'm gonna try my luck here and see if you people can help me. Thanks!

--------
Logfile of HijackThis v1.99.1
Scan saved at 2:37:34 PM, on 7/20/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\FireFly\WinDeBug.exe
C:\Program Files\FireFly\Serpent.Exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\EZ-DUB\EZ-DUB.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\TEMP\win17.tmp.exe
C:\Documents and Settings\Christine Moua\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R3 - Default URLSearchHook is missing
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe /disabled
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [OneTouch Monitor] C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [McRegWiz] C:\PROGRA~1\mcafee.com\agent\mcregwiz.exe /autorun
O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [PPWebCap] C:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe
O4 - HKCU\..\Run: [warez] "C:\Program Files\Warez P2P Client\warez.exe" -h
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: EZ-DUB Finder.lnk = C:\Program Files\EZ-DUB\EZ-DUB.exe
O8 - Extra context menu item: Copy to Semagic - C:\Program Files\Semagic\copy.htm
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Semagic - C:\Program Files\Semagic\link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FireFly - Unknown owner - C:\Program Files\FireFly\WinDeBug.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

Relevance 100%
Preferred Solution: Help! Mysterious program keeps trying to access my program [HijackThis log included!

I recommend downloading and running Reimage. It's a computer repair tool that has been proven to identify and fix many Windows problems with a high level of success.

I've used it in the past to identify and fix everything from blue screens (BSOD's), ActiveX errors, corrupt files and processes, dll/exe/sys errors, recover lost memory, Windows update problems, defragging, malware removal etc.

You can download it direct from this link http://downloadreimage.com/download.php. (This link will automatically start a download of Reimage that you can save to your computer.)

Answer: Help! Mysterious program keeps trying to access my program [HijackThis log included!

16 more replies
Relevance 82.82%

I have a program called 'whenusave' causing me problems. It was installed with Daemontools (Ididn't realise) and I can't uninstall it, even though I have removed Daemontools. I also had problems running hijackthis. My firewall (comodo) interrupted the scanning process a few times, saying that a program was trying to do something with a protected file, but I eventually got a logfile, hope it is ok. I could not download a new version of hijackthis either, or another spyware prog. Please help me!

Logfile of HijackThis v1.99.1
Scan saved at 20:45:13, on 10/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Comodo\Firewall\cfp.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\dlcxcoms.exe
C:\P... Read more

Answer:Hijackthis logfile included. Whenusave program causing me problems.

By the way, I have tried add/remove programs and the uninstall whenusave option but neither work. Adaware identified it and tried to delete on reboot, but it is still there. Spywareblaster and adaware and AVG all updated and run. It seems to be very stubborn.
 

2 more replies
Relevance 76.67%

Ok. So I am on step whatever of your guide to rid myself of Adware maxsearch. Everything up to the part where I need to run the HijackThis program is done. I still get the same error as before when Nortons picks up the Adware Maxsearch. I clicked the link you gave for the HijackThis file, unzipped it, but the program is not on my computer to run??????? After I click the HijackThis exe file saved to desktop, I get a message pop up for a few seconds and then go away without the program starting. I saved it in Paint, but dont know how to post it here. Any thoughts, please help. Getting tired of this.....

Rob K.

Answer:Cannot Access Hijackthis Program After Unzipping Please Help

Go here, scroll down to step #9 and follow the instructions for downloading HijackThis and creating a log. ([i]This is a self-extracting version which will automatically install HJT in the proper location.If you have a problem getting HijackThis to run, try renaming it to something else. If needed you can also change the .EXE to .BAT, .COM, .PIF, or .SCR. All all are valid for renaming it.

14 more replies
Relevance 74.62%

Hey guys,I've been struggling with this for a while now. My browser & computer processes have been running sluggish. My main source of protection comes from McAfee but since these issues started I've ran a ton of programs with varying results. Adaware & Spybot S&D, Spyware Doctor & Spyware Blaster, all with varying results, tracing back to tracking cookies. Sometimes they show up, sometimes they don't. I've cleared all my cookies on Firefox & IE (i never use IE), upped my security settings, enabled my firewall, defragged & did a disc cleanup.I ran trend micro housecall & these infections came up:POSSIBLE_DRPRSPYWARE_KEYL_PERFECTKEYLOGGERFREELOADER_SMITFRAUDADWARE_MEMWATCHERCookie_unicastcookie_tripodI just got a notification from google saying an attempt has been made to switch my default search away from Google to "unknown".I am very concerned about my computer privacy. I'm not sure if these issues are a serious threat or not but either way would like them gone! I would appreciate any help as soon as possible!Here is my hijack this log:Logfile of Trend Micro HijackThis v2.0.2Scan saved at 12:48:47 PM, on 1/15/2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16574)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS&#... Read more

Answer:Tracking Cookies, Mysterious Temp Files, Slow Browser... Help Please? Hijackthis Log Included.

Hello cmoncomeon Welcome to Bleeping Computer! Sorry about the delay. We're all volunteers here, and it's been very busy. If you still need help, please post a new HijackThis log to make sure nothing has changed. Before posting the log, please make sure you follow all the steps found in this topic: Preparation Guide For Use Before Posting A Hijackthis Log <--link And I'll be happy to take a look at it for you. ===== I also need to see a different type of log from Hijackthis: Run Hijackthis.Click on "Open the Misc Tools section".Next click on "Open uninstall manager".Press the button 'save list'. It will open a Notepad file.Place the content of that file here in your next reply.Thanks, for your patience. Stelios

1 more replies
Relevance 73.39%

Hello, I have Windows XP home ed, HP Pavilion Laptop. I had to reformat my drive due to problems. When I did this I made a Program File and put in under My Documents. It has the program files I used before I had to reformat my C drive.Now, when I try and access my normal Program File it tells me C:Program Files is not accessible. Access denied. I tried going through user account and set up 2 new accounts with Admin. My current 2 accounts have program admin. But I still can not access the Program Files on the C drive. I want to transfer the Program Files from My Documents to the Program Files in the C drive.Any suggestions?Thank you!

Answer:Cannot access program file, have 2 program files, one normal, one in My Document

You need to take ownership: http://support.microsoft.com/kb/308421

7 more replies
Relevance 72.57%

This may be nothing but it is worrying me.

When pressing Alt and Tab to cycle through the active programs, I notice one logo (standard to windows) that has no title. So I'm wondering what is this, and why is it not named. Could it be malicious?

I have often cycled round to it and pressed Alt and F4 and it will disapear (with no obvious consequences) for a while, but it usually reapears after a short while.

Should I be concerned?

Any help would be appreciated.

Answer:Mysterious item or program

Take a screenshot of it. "A Mystery Program" doesnt really tell us squat.

Also, when closing it, check which process disappears if you could do that.

2 more replies
Relevance 72.57%

I suddenly noticed in my control panel this entry called "att-prt22" which was never there before. Anybody know what in the world this is? In programfiles/att-prt22, there was a file called McciBrowser, which I had never heard of, either.

Answer:Mysterious program - att-prt22

HiHere are a couple of answers from a Google searchhttp://answers.yahoo.com/question/index?qi...21215914AAsJC3Ehttp://spywarefiles.prevx.com/RRHHHD546960...ROWSER.EXE.html

1 more replies
Relevance 72.57%

HiI was rebooting one day on my XP machine and noticed a strange program being ended by windows unlike I've ever seen before. Impossible to find via search engine cause usually if you find a program you don't know you just enter it in the search string and you can find out if it is legit and what it does but, since this mysterious program has unkown CHRS I've been unable to search for it.I've tried using Trendmicro PC-Cillin, hijack this, my own searches through registry, housecall (free trendmicro scan), 2 different rootkit detectors (including GMER) and even run ComboFix. I've used independant process viewers, port explorer, task manager (though rarely helpful), and Port Explorer to see if it is connecting to a port/internet. Nothing has revealed the source of this mysterious program. The only way I could show this program name is by taking a picture with my digital camera while I was shutting down. So anyone out there able to figure this one out would be great.

Answer:A Mysterious Suspicious Program

The only thing I can tell you about that image is that the last character after the 'W' looks like the Russian letter (ZH)http://www.ithaca.edu/faculty/sallen/nato/...ic-alphabet.gifOr 2 characters of the Cryllic alphabethttp://www.google.com/imgres?imgurl=http:/...=image&cd=2

2 more replies
Relevance 71.75%

i keep getting error messages like this:Event Type: ErrorEvent Source: WinDefendRtpEvent Category: NoneEvent ID: 3003Date: 4/24/2008Time: 4:22:59 PMUser: N/AComputer: JEFF-LAPTOPDescription:Windows Defender Real-Time Protection checkpoint has encountered an error and failed to start. User: JEFF-LAPTOP\Jeff Checkpoint ID: 1 Error Code: 0x80070005 Error description: Access is denied. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.Event Type: ErrorEvent Source: WinDefendRtpEvent Category: NoneEvent ID: 3003Date: 4/24/2008Time: 4:22:59 PMUser: N/AComputer: JEFF-LAPTOPDescription:Windows Defender Real-Time Protection checkpoint has encountered an error and failed to start. User: JEFF-LAPTOP\Jeff Checkpoint ID: 1 Error Code: 0x8000ffff Error description: Catastrophic failure For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.Event Type: WarningEvent Source: UserenvEvent Category: NoneEvent ID: 1524Date: 4/24/2008Time: 4:21:21 PMUser: JEFF-LAPTOP\JeffComputer: JEFF-LAPTOPDescription:Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.Event Type: WarningEvent Source: UserenvEvent Category: NoneEvent ID: 1517Date: 4/24/2008Time: 4:21:25 PMUser: NT AUTHORITY�... Read more

Answer:Mysterious Program Crashes And Errors?

Hello Booman. to BleepingComputer.comMy name is Billy O'Neal and I will be helping you. (Billy or Bill is fine, if you like.)Please give me some time to look over your computer's log(s).Please take note of the following:In the meantime, please refrain from making any changes to your computer.Also, even if things appear to be running better, there is no guarantee that everything is finished. Please continue to check this forum post in order to ensure we get your system completely clean. We do not want to clean you part-way up, only to have the system re-infect itself. If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.Finally, please reply using the button in the lower left hand corner of your screen.See you soon,Billy3

70 more replies
Relevance 71.75%

I have a strange folder in C:\Program Files (x86) called "My Company Name" and inside it another one called "My Product Name". This one is empty. My ESET Smart Security found nothing. I can't figure it out where it came from. Is this malware?

Answer:Mysterious Folder in Program Files

Yes. Win+X->Programs & Features and uninstall these 2's: ph & bh

2 more replies
Relevance 71.75%

Hi.

My computer is running pretty slow. But more importantly, I think there may be a program running in the background all the time. Every few minutes or so a new program pops up on the taskbar. It's just the generic windows blue and white, no name. And i can't click on it. It stays for about 2 seconds and then goes away. I've run anti-virus and various spyware/malware programs and haven't found anything.

Here is my HJT log. Hope you can help me.... thanks.



Logfile of HijackThis v1.99.1
Scan saved at 3:23:53 PM, on 4/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc3... Read more

Answer:Mysterious program running in background

Hi.

I posted this problem about a week ago and didn't get a response. Gonna try posting again.

I have a mysterious program that seems to be running in the background. It pops up in the task bar about every hour, lasts for a couple seconds then disappears from the taskbar. There is no title and i can't click on it. I think this may have to do with the incredible slowness and random errors on my computer. also, there are a couple of programs when I shut down that I have to "end program" for. I think one of them is called ccApp.

I'd really appreciate is someone can help me. thanks...



here is my HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 2:51:30 PM, on 4/16/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe... Read more

4 more replies
Relevance 71.34%

Yesterday I noticed that I couldn't launch a program since my computer couldn't find the file "LIBEAY32.dll" and checked what could cause this.
Then I noticed that my antivirus "System Center Endpoint Protection" wasn't running, tried to start it, but no matter what methods I tried I could not launch it. The only thing that happens is that I get an error saying that it couldn't find "C:\Program Files\Microsoft Security Client\msseces.exe". The same happens when I try to run Windows Defender.
I can't uninstall most programs from my computer since all that happens are that Windows Installer tells me "The feature you are trying to use is on a network resource that is unavailable", which prevents me from installing another antivirus to check if that can solve the problem. (I did manage to install Advanced System Care 8 pro, but after a scan and repair the problem is still unsolved.)

All folders in C: is "read only" and I've tried setting myself as owner and give me full authority to every file on the computer (a few hundred/thousand files didn't set me as owner unless i did it file by file, only .dll files in different as far as I know (C:\Program Files\Common Files\Microsoft Shared\ink\InkDIV.dll for example)), remove the read only and nothing changes.
I noticed that an unknown user named "S-1-15-2-1" had access to most of these files. Don't know if this has anything to do with it, googled around on this and it ma... Read more

Answer:Can't access most programs from program (x86)/Program/ProgramData

I think your system is has been damaged by a malware program,that removed some of your program/system files and know the computer can't run those programs without those lost files. You should try to restore your computer to an earlier time,or reinstall windows.

3 more replies
Relevance 71.34%

Hello!

I'm pretty sure this is a dumb question, but here goes:


So I've finally upgraded to Win7x86 Pro. But I've noticed something kinda odd. I've found that some programs' configuration settings are not being saved. I've also noticed that in each instance, the configs are being stored in appdata/roaming or in the "program files" subdirectories for the given app.

What to do besides installing all my software outside "program files"? And what to do about programs that save configs in appdata?

I'm pretty sure something can be done in Security (I'm familiar with setting permissions/ownership/etc, but I'd rather not tinker until someone drops me a line on this).

I'm an experienced user, so I'll probably get any instructions easily, so don't feel the need to over-explain =)

Thanks so much for reading, and thanks for the help!

-Wolf

Answer:Program Access in Appdata; Program Files

Hi, welcome to the new world of computing what you see is by design and very effective it is too. I could wear my fingers out trying to explain how this works and why I support it, however, easier if I just give you a link:- (references Vista applies to Seven as well)

Managing Roaming User Data Deployment Guide

2 more replies
Relevance 70.93%

So, today while I was playing World of Warcraft, my computer started making strange noises at me. At first I thought I had left an internet tab open or something because I kept hearing commercials and pop news highlights coming through my speakers. But after making sure that everything was shut off, the noises kept coming. Upon further inspection through my volume mixer I found this strange program producing noise but it had a "No Name Available" as a descriptor.

I have run Malwarebytes Pro and Combo and uninstalled everything that I had run today but it still persists. I even did a full system restore dating back a couple weeks yet the noises keep coming. PLEASE HELP! I have no idea what's causing this and it is literally driving me batty. Any ideas?

Desperate for answers,

ArcadianPhoenix

Answer:Strange sounds Coming from Mysterious program

So, today while I was playing World of Warcraft, my computer started making strange noises at me. At first I thought I had left an internet tab open or something because I kept hearing commercials and pop news highlights coming through my speakers. But after making sure that everything was shut off, the noises kept coming. Upon further inspection through my volume mixer I found this strange program producing noise but it had a "No Name Available" as a descriptor.I have run Malwarebytes Pro and Combo and uninstalled everything that I had run today but it still persists. I even did a full system restore dating back a couple weeks yet the noises keep coming. PLEASE HELP! I have no idea what's causing this and it is literally driving me batty. Any ideas?Desperate for answers,ArcadianPhoenix'Strange sound' is not very indicative of the type of sound you're hearing. Could you be a little more precise? Is it for example, a buzzing noise, a high pitched whine or what?

8 more replies
Relevance 66.01%

Ok I've seen this quite a bit on the forums and no one has been able to sovle it as far as I can tell. So I go into my Control Panel and I click Add or Remove Program and I get this Run a DLL as an App has encountered a problem and needs to close. We are sorry for the inconvenience. With this extra info:
AppName: rundll32.exe AppVer: 5.1.2600.2180 ModName: unknown
ModVer: 0.0.0.0 Offset: 00750063

I have already gone under MSConfig and unchecked the rundll32.exe from start up.

Here is my HJT log:
Logfile of HijackThis v1.99.1
Scan saved at 11:07:16 PM, on 2/17/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
J:\WINDOWS\System32\smss.exe
J:\WINDOWS\system32\winlogon.exe
J:\WINDOWS\system32\services.exe
J:\WINDOWS\system32\lsass.exe
J:\WINDOWS\system32\svchost.exe
J:\Program Files\Windows Defender\MsMpEng.exe
J:\WINDOWS\System32\svchost.exe
J:\WINDOWS\system32\ZoneLabs\vsmon.exe
J:\WINDOWS\system32\spoolsv.exe
J:\Program Files\AntiVir PersonalEdition Classic\sched.exe
J:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
J:\WINDOWS\System32\svchost.exe
J:\WINDOWS\system32\nvsvc32.exe
J:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
J:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
J:\Program Files\UPHClean\uphclean.exe
J:\Program Files\Wireless-G USB Network Adapter with RangeBooster\WLService.exe
J:\Program Files\Wireless-G USB Network Adapter with RangeBooster\W... Read more

Answer:Run a DLL as an App Add or Remove Program: HJT Included

Also my startup time is getting insanley long it'll give me the bootup screen and then my screen will go black for about... o I guess about 5 min. Anyways I started it up in SafeMode and ran HJT:
Logfile of HijackThis v1.99.1
Scan saved at 7:35:23 AM, on 2/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
J:\WINDOWS\System32\smss.exe
J:\WINDOWS\system32\winlogon.exe
J:\WINDOWS\system32\services.exe
J:\WINDOWS\system32\lsass.exe
J:\WINDOWS\system32\svchost.exe
J:\Program Files\Windows Defender\MsMpEng.exe
J:\WINDOWS\system32\svchost.exe
J:\WINDOWS\system32\userinit.exe
J:\WINDOWS\Explorer.EXE
J:\Documents and Settings\Kevin\Desktop\Anti-Everything & Fix\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://rd.yahoo.com/customize/sbcydsl/defaults/*http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://rd.yahoo.com/customize/sbcydsl/defaults/su/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/customize/sbcydsl/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://rd.yahoo.com/customize/sbcydsl/defaults/sp/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default)... Read more

1 more replies
Relevance 65.19%

my new Toshiba Sat came with XP Home preinstalled. I have a MS XP book which says that Backup is not installed automatically by the Home Edition but is on the XP disc in a Ntbackup folder. It goes on to say that if the OS is pre-installed to contact the manufacturer for help in finding it on the 'recovery cd'. I've looked but can't find it...

Answer:Where is Backup program included on WXP Home CD?

I am not sure but I presume in Windows explorer under drive C you will find folder i386. Every time if system wants to pick up some files from Microsoft installations CD please browse into this folder.

This folder is copied purposely to help users if system needs Microsoft installations CD to copy some files.

2 more replies
Relevance 65.19%

I have been trying to uninstall Roxio Easy media Creator, and I can't seem to delete it all the way. It also seems like when I installed Roxio, it automatically installed something called Sonic Cineplayer DVD Decoder. I searched for all the files I can on this, and there are some I still can't delete. I really need help because an install prompt for Cineplayer keeps coming up and I can't get it to stop. I followed instructions from someone else's post and pasted a hijack this log. Also there is an icon for Cineplayer DVD Decoder in my Control Panel, but it does not have an option for me to delete it. Is there a way to get rid of it? Thank you in advance for any help.

Hijack This Log

C:\Program Files\Trend Micro\Antivirus\TMOAgent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6... Read more

Answer:Solved: Need Help, can't delete Program (HJT log included)

12 more replies
Relevance 65.19%

Hi, just recently my PC starting having a strange delay when starting any program. I didn't use to have this problem. Once the programs are started they run fine, but this delay is starting to drive me nuts. It's been more than a year since I built the PC, so I'm thinking about doing a complete re-install anyways, but I will probably by a new SATA drive first, so I would like to fix this problem if possible.

I'm running:

Athlon 64 3200+
Western Digital 160GB Ultra IDE HD
1GB Patriot RAM
Winfast Geforce 6600GT
Foxconn Mobo

Here's my log:
Logfile of HijackThis v1.99.1
Scan saved at 9:35:44 PM, on 5/14/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\NVIDIA\NetworkAccessManager\bin\nSvcIp.exe
C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\NVIDIA\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\WIBUKEY\Server\WkSvW32.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\NVIDIA\NetworkAcces... Read more

Answer:Program start delay - HJT log included

15 more replies
Relevance 65.19%

I was talking to a tech friend about Macrium Reflect and he said that there is a disc imaging app. included with Windows 10. Is this true? (don't think so).

Answer:Is there a disc imagining program included in Win 10?

Yes - it is in control panel and called, for some reason, "Backup and Restore (Windows 7)".

Macrium is much faster though.

4 more replies
Relevance 65.19%

I have an unfamiliar program showing on my taskbar that I'm unable to close. The bar says"& Additional devices:"

I'm running Windows 98 SE

Logfile of HijackThis v1.97.7
Scan saved at 8:35:48 PM, on 12/31/04
Platform: Windows 98 SE (Win9x 4.10.2222B)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\GRXP4EXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\KEYBOARD\SPEEDKEY.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\NUTS & BOLTS\COMDLGEX.EXE
C:\WINDOWS\SYSTEM\3CMLNKW.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
E:\WINDOWBLINDS\WBLOAD.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\WEBSHOTS\WEBSHOTSTRAY.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
E:\HJT\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.bellsouth.net/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.... Read more

Answer:Unfamiliar program on taskbar (HJT log included)

9 more replies
Relevance 64.78%

Hi, Just like to say great site and I think its so good that people give up their time for others in need here.

My HP laptop logs in as normal,

First of all some programs normally on start up in the bottom right hand corner like printer and anti-virus do not start.

Then whenever I click on a program it says, 'windows cannot access the specified device, path or file. you may not have the appropriate permissions to access the item'.

When I tried to open Word it says; 'This file does not have a file associated with it for performing this action. Create an association in the set associations control panel.'

The wireless says its connected in networking but will not display in the bottom right.

Finally the firewall is not open, internet isn't working and when I try to shut down it says; 'you do not have permission to shut down and restart this computer.'

I am logged in as administrator.

A virus scan in safe mode shows nothing, programs and internet open with no problem in safemode with networking.

I can launch all programs by ctrlaltdel and then launching them manually through task manager. I guess this means something is messing with explorer.....


Here is the DDS.txt


DDS (Ver_09-03-16.01) - NTFSx86
Run by Sean at 19:34:04.83 on 23/03/2009
Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_12
Microsoft? Windows Vista? Home Premium 6.0.6001.1.1252.44.1033.18.2045.1051 [GMT 0:00]

AV: Avira AntiVir PersonalEdition *On-access sc... Read more

Answer:Program launching problem, logs included. Many thanks

Hello and welcome to TSF.

We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/comb...o-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

How to disable your security applications

Please include the C:\ComboFix.txt in your next reply for further review.

Note: Please make sure that your AntiVirus and AntiSpyware applications are re-enabled. A reboot should have done

19 more replies
Relevance 64.78%

Hi Bleeping Computer Staff, Heres a little more info about my problem that just started this morning out of nowhere after turing my computer on...When I log in to Windows XP after I put my password in and hit enter if gives me some error message about the time not being correct or something. Then when everything is loading I keep getting Error messages that iTunes and some other programs must be bleep down and then it gives me the option to 'Send Error', 'Dont Send', or 'Debug'. It does that for like 3 or 4 of my programs. Everytime I go to a site where I need to enter my password I get this....There is a problem with this website's security certificate. "The security certificate presented by this website has expired or is not yet valid.Security certificate problems may indicate an attempt to fool you or intercept any data you send to the server. We recommend that you close this webpage and do not continue to this website. Click here to close this webpage. Continue to this website (not recommended). More information " Everytime I tried running Adware and the other programs you told me to run before posting a log file, I get the same error message just after clicking scan that I did with itunes and the other programs. I just dont know what to do. Can you please help me?Here is the logfile:Logfile of Trend Micro HijackThis v2.0.2Scan saved at 6:20:23 PM, on 4/2/1601Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.... Read more

Answer:Windows Error When Trying To Run Spyware Program Etc. (log Included)

Sorry for the delay. If you are still having problems please post a brand new HijackThis log as a reply to this topic. Before posting the log, please make sure you follow all the steps found in this topic:Preparation Guide For Use Before Posting A Hijackthis LogPlease also post the problems you are having.

1 more replies
Relevance 64.78%

Hey there.

I currently have a problem with my computer and I don't know if it is due to a virus, trojan, spyware, or anything else.

Symptoms:
Slow program start up. When I select an Icon from my desktop, no response is shown for about 20 seconds.

Also while I have Firefox open, I occassionally get popups opened in internet explorer.

I've run AVG Anti-spyware 7.5, Spybot search and destroy(both safemode and not), Ad-aware, Trend Micro PC-cillin, and SmitFraudFix(in safe mode), and CCleaner. Non of these has managed to catch or clean out the problem.

Here is the HJT log. And thanks ahead for anyone who helps out.
 

Answer:Slow Program Start and IExplore pop ups. HJT log included

16 more replies
Relevance 64.78%

Hello, all.

Thanks to the wonderful help I've received on this site in the past, I haven't had to post here in quite a while. Unfortunately, I am having a series of small problems now.

I am running a Dell PIII 800 mhz, with 80 G hard drive and XP SP 2. I recently downloaded a program from Handango.com for my wife's PDA called "Body Pro Desktop 2005". Soon after installing this program, the following problems occurred:

1. Norton Antivirus 2006 crashed.
2. Body Pro would not run.
3. Cannot reinstall Norton Antivirus.
4. Cannot download updates for my Spybot S&D (bad checksum error).

I am also having problems with my wireless network, but that's for another post. Additional info, I also downloaded the Body Pro program for me and put it on my laptop. It is a Dell Inspiron PIV, and the program works just fine. My Norton also crashed, but I was able to uninstall and reinstall it. However, I am having the same Spybot problems. I am including my HJT log in this post. Just need someone to point me in the right direction.
Logfile of HijackThis v1.99.1
Scan saved at 7:33:23 PM, on 3/6/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EX... Read more

Answer:Several Program Problems including Norton (HJT log included)

Have you tried using System Restore to revert your computer back to a date PRIOR to when the problem occurred?

It's pretty obvious that "Body Pro Desktop 2005" doesn't work well with Norton, since it's crashed it in both computers.

When you get the bad checksum error when getting updates with Spybot, you need to use a different location. One of the Safer Networking locations usually works fine.

-------------------------------------------------------------------------------------
 

1 more replies
Relevance 64.78%

Dear fellow pc users please help me. my pc has been in a terrible status...... a program called runouce has appeared in the taskmanager and applications like firefox, realplayer etc are blocked from being executed. what shud i do?

Hijack this log is attached to the post
 

More replies
Relevance 64.78%

hey, I've some how managed to get adz galore onto my pc, I read that I needed to run Micro HijackThis but have no idea what to do next. Thanks for your help.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:14:05, on 20/07/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 SP3 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
C:\Apps\Powercinema\PCMService.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Common Fi... Read more

More replies
Relevance 64.78%

Hi, I've posted here a few times and each times gotten exceptional help back. I appreciate anyone who takes the time to read this and reply.

I'm not exactly sure why, or what, started this problem but I can't access my volume control at all.

Here is the error message I get.



Please help me lol,

Thanks.
- Brandon
 

Answer:Volume Control Program Error?!!! Help lol (Pic included)

9 more replies
Relevance 63.96%

Hallo,

I have Windows 7 (32-bit).

I recently uninstalled and re-installed two programs of mine which use Flash (IWisoft SWF to Video Converter and Moyea SWF to Video Converter Pro). I've used these programs in the past with no problems.

When I now try and open them I get the following error message:

"This program requires flash.ocx, which is no longer included in this version of Windows".

A popular solution is to change an .ocx file in WINDOWS/SYSTEM32/MACROMEDIA/FLASH to "flash.ocx". This doesn't work for me.

I use Firefox and have the latest version of Flash installed. I've also uninstalled and re-installed Flash, but to no avail.

Any help is appreciated!

Answer:Error: This program requires flash.ocx, which is no longer included...

Here is a good read on your error message.

Download Flash.ocx download and how to fix the 'Cannot find the file flash.ocx' error Windows Tips - Software Patch.


One solution is a reinstall. Which you have already tried. Bit prior to the install after uninstalling you should get the uninstall file from the flash site.

http://helpx.adobe.com/flash-player/...r-windows.html

5 more replies
Relevance 63.96%

Hi. I just reformatted my PC and I was on no suspicious sites, suddenly I got attacked by a Trojan and some software that was called sometihng like "Spyware Hunter 2009" or sometihng like that. The Virus AVG picked up and put in the vault was "Trojan Horse Generic13.AWVT. Please help. HiJackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:27:18, on 28/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\arservice.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\ARPWRMSG.EXE
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\HP\KBD\KBD.EXE
c:\windows\system\hpsysdrv.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\... Read more

Answer:Trojan and fake spyware program - HJThis Log included!

16 more replies
Relevance 63.96%

I downloaded and installed this free download.com program called "Acoustica MP3 to WAV Converter PLUS" and I did what I needed to do with it. I uninstall and and realize that it left this stupid extra menu option when I right click a folder.

Here's a picture of what it looks like and the undeletable file that was left in the program folder. I created a test folder so you can see what I'm talking about. Neither of the choices I'm given work (nothing happens).



I tried checking the startup process (though I was pretty sure I wouldn't find anything). I've tried starting up in safe mode and deleting it. I've never had much experience with problems like this so I'm really sure what to do. It's not that important, but little things like this bug me.

Any help would be appreciated. Thanks in advance.
 

Answer:After program uninstall, menu still left in XP shell (*pic included*)....help

browse to here and uncheck it



if its not there ull have to manuly search regedit for ids or whatever and del each one

nothing is undeletable in xp

u couldnt delete the dll in safe mode? end explorer.exe in taskmanager then file, new task, explorer.exe and now delete it
 

9 more replies
Relevance 63.55%

Hey there, folks. I'm sure this is a fairly common issue to you guys (I've already browsed a few similar topics on this very site). Basically, I am unable to connect to a few websites. No, they are not down - I can access them just fine using a web proxy site like VTunnel or Anonymouse (just incase you were curious, tvtropes.org is among the sites I cannot access at the moment).

First off, I've already grabbed HijackThis and gotten a log file. It's at the bottom of this post.

Secondly, I've ran tracert in the command prompt, at least for tvtropes.org. I've also included its log at the bottom of this post. It times out ... quiet a bit.

Lastly, I've already went and checked on my hosts file. I even downloaded and ran the Microsoft Fixit for it.

I've already Googled around - I'm pretty much at my wits end here. Heard a friend suggest to me that it may be an issue with my DNS, but I can't access the websites even if I try via their IPs, so I'm not sure if that's the case.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:21:00 AM, on 2/3/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Dell Support C... Read more

Answer:Cannot access certain sites, even if they're not down. [hijackthis log included]

12 more replies
Relevance 63.14%

Hello! I just came home from a vacation I went on (wasn't really much of a vacation though, long story short there were some rude people that sort of ruined it for me) to find out that there is now malware on the family computer, and I'm the only tech-savvy guy in this house, so I'm also the one that has to find a way to remove it!
 
To sum up what he basically did, he wanted a video recording application that was, I quote, "better than fraps." So, instead of waiting a few minutes to ask his tech-savvy brother who knows a few good recording applications, or even waiting to ask for approval on a program, what does he do? HE DOWNLOADS THE FIRST THING HE SEES ON A GOOGLE AD. (Sorry for the unnecessary caps lock, just sort of pissed off.) The program he downloaded was named ezvid (obviously, don't download it.) He said he likes it. I don't think it was worth the cruddy malware, myself. Looking at my Task Manager window, I see a few new foreign programs that don't look like they belong...
- OtShot (which is now alerting me it was "unable to load skin" or something)
- "DefaultTabSearch.exe" and an additional tab labeled "DefaultTab Update Service"
- "Optimizer Pro Smart Scan" and "Optimizer Pro Speed Guard"
- (This one REALLY, REALLY pissed me off when iI saw it) Search Protect by Conduit
- PEV.DAT (just seems a bit foreign and not-belonging-on-my-task-manager-ish)
- (May be legit, but seems unfamiliar to my eyes) WMI Provider Host
 
I tried to run dds.com, however the sc... Read more

Answer:Brother installed program from a Google ad, malicious programs included

Please download TDSSKiller from here and save it to your DesktopDoubleclick on TDSSKiller.exe to run the application, then click on Change parameters
Check Loaded Modules and Detect TDLFS file system. Do not check Verify file digital signatures (even though it is checked in the example)If you are asked to reboot because an "Extended Monitoring Driver is required" please click Reboot now
Click Start Scan and allow the scan process to runIf threats are detected select Skip for all of them unless I instruct you otherwiseClick Continue
Click Reboot computerPlease post the contents of TDSSKiller.[Version]_[Date]_[Time]_log.txt found in your root directory (typically c:\)in your replyDue to forum upgrade you may face issues posting the TDSSkiller log.Just last few lines of log is sufficient===================================================RKILLPlease download Rkill by Grinler from one of the 4 links below (if one of them does not work try another.) and save it to your desktop:Link 1Link 2In order for Rkill to run properly you must disable your anti-malware software. Please refer to this page if you are not sure how.Double-click on Rkill. (If you are using Windows Vista, please right-click on it and select Run As Administrator)Note: You may have to run Rkill a few times before it is successful. You may also have to download Rkill from a different link which will save it as a different file name.A black screen will appear and then disappear. Please do not worry, that is normal... Read more

10 more replies
Relevance 63.14%

Hi. I'm looking for some help with this pesky wow-access.com. i reformatted my computer and left it on over night. when i woke up, wow-access was popped up in a few windows on the desktop. wow-access pops up once an hour about. this is strange and don't know how this happened. my hijackthis log is below. plz help me, it will be greatly appreciated.

Logfile of HijackThis v1.97.7
Scan saved at 8:28:54 PM, on 1/16/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
... Read more

Answer:wow-access.com pops up when not in browser hijackthis log included plz help thx

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are following the procedures below.

You have an outdated version of HijackThis. Click here to get the latest version of HijackThis and run it.

Before you give us a new log here, if we gave you instructions for a fix, please do the fixes first and then post the new log with this updated version.

1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'.
2. If you don't get the intro screen, just hit Scan and then click on Save log.
3. Get HijackThis Analyzer and save it to the same folder as the hijackthis.log file. Run HijackThis Analyzer and type in y if you agree. The result.txt file will open up in Notepad. Copy the whole result.txt log and post it in the forum. We do not need the original hijackthis.log (unless we ask for it). Do not fix anything in HijackThis since they may be harmless.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that Display the contents of System Folders' is checked. Windows XP's search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' ... Read more

15 more replies
Relevance 62.32%

Every now and then (every 5 minutes or so) my cursor will turn into the hourglass for a split second, then turn back. I'm assuming this means something is being initiated in the background periodically. Over time, this slows down my computer. At the very least, it makes me lag tremendously in online games for a few seconds (which makes CS and UT2004 pretty much unplayable).

I've tried running the latest AdAware and Spybot: Search and Destroy. Neither solved the problem. These seem like symptoms of generic spyware, but I've still been unable to put an end to it. Can anyone help? Thanks in advance.

(I'm using windows XP, if that makes any difference)
 

Answer:Mysterious program runs periodically runs in the background...help!

Try this, go to Panda and run a scan, and see if it can find anything and delete it. http://www.pandasoftware.com/activescan/com/
 

2 more replies
Relevance 61.09%

Hi,

I have recently done a clean Windows XP Install followed by installing Service Pack 1 then 3.

Everything was running smoothly and I was able to log into the desktop.

However when I tried to check for updates via Windows update, in Internet explorer however it always says the 'Internet Explorer cannot display this webpage'

After diagnosing the issue, it found no problems.

I can browse any other website but sometimes when I click on an item through doing a google search, it sometimes sends me to a random search engine page!!

I then installed spybot, fully updated it however it showed nothing in the scan results.

I think that my browser maybe hijacked because when I opened internet explorer today, a webpage immediately loaded up with the address:

http://chinabytemail.com/search.php

Sometimes Eset Smart Security reports that addresses have been blocked and I have attached a screenshot of the message it displays.

I have attached a hijackthis log below.

Please reply

Thanks
 

Answer:Clean XP Install, unable to access WIndows Update!! hijackthis log included

10 more replies
Relevance 60.68%
Question: hijackthis program

Logfile of Trend Micro HijackThis v2.0.2Scan saved at 9:19:06 AM, on 2/13/2010Platform: Windows Vista SP2 (WinNT 6.00.1906)MSIE: Internet Explorer v8.00 (8.00.6001.18882)Boot mode: NormalRunning processes:c:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exeC:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exeC:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exeC:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exeC:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exeC:\Program Files (x86)\Java\jre6\bin\jusched.exeC:\Program Files (x86)\HP\QuickPlay\QPService.exeC:\Program Files (x86)\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXEC:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exeC:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cnnbR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/R1 - HKLM\So... Read more

Answer:hijackthis program

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. Please include a clear description of the problems you're having, along with any steps you may have performed so far.Please refrain from running tools or applying updates other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.Even if you have already provided information about your PC, we need a new log to see what has changed since you originally posted your problem.We need to create an OTL ReportPlease download OTL from one of the following mirrors:This is THE MirrorSave it to your desktop.Double click on the icon on your desktop.Click the "Scan All Users" checkbox.In the custom scan box paste the following:CODEnetsvcsmsconfigsafebootminimalsafebootnetworkactivexdrivers32%systemroot%�... Read more

8 more replies
Relevance 60.68%

anytime i try to open media player or a spybot search or malware program my computer freezes. luckily my hijack doesnt freeze the comp and i was able to get a log of what was found. please let me know what i need to delete

___________________

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:46:54 AM, on 12/15/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\system32\spoolsv.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\Explorer.EXE
I:\Program Files\Bonjour\mDNSResponder.exe
I:\Program Files\tinyproxy\tinyproxy.exe
I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
I:\Program Files\Java\jre6\bin\jqs.exe
I:\WINDOWS\system32\nvsvc32.exe
I:\Program Files\Viewpoint\Common\ViewpointService.exe
I:\Program Files\WebMediaViewer\qttask.exe
I:\WINDOWS\AGRSMMSG.exe
I:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
I:\Program Files\Common Files\Real\Update_OB\realsched.exe
I:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe
I:\Program Files\Java\jre6\bin\jusched.exe
I:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
I:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
I:\Program Files\WebMediaViewer\qttaskm.exe
I:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Micro... Read more

Answer:hijackthis is the only program i can run :(

16 more replies
Relevance 60.68%

My operating system is: Win98 se

I was wondering if you could help me out of this sort of problerm, i used "hijackthis" program and i did the scan, now i don't know what to remove from the list,could you tell me what i need to remove?

my hijackthis list:

Logfile of HijackThis v1.97.7
Scan saved at 12:34:05, on 25.8.2004
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\MESSENGER PLUS! 3\MSGPLUS.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\CREATIVE\SBLIVE\AUDIOHQ\AHQTB.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\MY DOCUMENTS\LOTTA\HP VALOKUVA OHJELMA\HP SHARE-TO-WEB\HPGS2WND.EXE
C:\MY DOCUMENTS\LOTTA\HP VALOKUVA OHJELMA\DIGITAL IMAGING\UNLOAD\HPQCMON.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\LOADQM.EXE
C:\MY DOCUMENTS\LOTTA\HP VALOKUVA OHJELMA\HP SHARE-TO-WEB\HPGS2WNF.EXE
C:\PROGRAM FILES\SIDE WINDER\COMMON\SWTRAYV4.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM\MMTRAYLSI.EXE
C:\WINDOWS\SYSTEM\MMTRAY2K.EXE
C:\PROGRAM FILES\WINAMP\WINAMPA.EXE
C:\PROGRAM FILES\REFMPEGACID\DATE WAIT.EXE
C:\WINDOWS\SYSTEM\MMTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:... Read more

Answer:Hijackthis - program

9 more replies
Relevance 60.68%

Hi guys, hope you can help.

I have recently installed XP and am having problems. Lots of programs seem to load at startup (having looked at msconfig), but i dont know which ones to keep and whihc ones to block, so having read another thread, i have installed and ran hijackthis.

here are the results:

Logfile of HijackThis v1.94.0
Scan saved at 22:48:59, on 30/05/2003
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://srng.net/search/9885/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://search.shopnav.com/apps/epa/epa?cid=shnv9885&s=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://gk.myway.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://search.shopnav.com/apps/epa/epa?cid=shnv9885&s=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://srng.net/search/9885/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\System32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=%SystemRoot%\system32\blank.htm
O2 - BHO: (no name) - {00000EF1-0786-4633-87C6-1AA7A44296DA} - C:\WINDOWS\System32\Gr02.dll
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O2 - BHO: (no name) - {14b3d246-6274-40... Read more

Answer:Just ran hijackthis program - what do i do now

Hi, and welcome to the board!

Do the following:

In Hijack This, check ALL of the following items. Doublecheck so as to be sure not to miss a single one.
Next, shut down all browser Windows, and have HT fix all checked.

You NEED to restart your computer when you're done.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://srng.net/search/9885/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://search.shopnav.com/apps/epa/epa?cid=shnv9885&s=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://search.shopnav.com/apps/epa/epa?cid=shnv9885&s=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://srng.net/search/9885/search.html

O2 - BHO: (no name) - {00000EF1-0786-4633-87C6-1AA7A44296DA} - C:\WINDOWS\System32\Gr02.dll
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O2 - BHO: (no name) - {14b3d246-6274-40b5-8d50-6c2ade2ab29b} - C:\Program Files\Srng\SNHelper.dll

O3 - Toolbar: &My Way Speedbar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL

O4 - HKLM\..\Run: [TVTMD] C:\WINDOWS\TVTMD.exe
O4 - HKLM\..\Run: [srng] \Program Files\Srng\Srng.exe
O4 - HKLM\..\Run: [RVP] "C:\Program Files\RVP\bpc.exe"
O4 - HKLM\..\Run: [msbb] C:\WINDOWS\System32\msbb.exe
O4 - HKCU\..\Run: [ContentService] C:\WINDOWS\System32\winservn.exe

After rebooting, delete the C:\WINDOWS\TVTMD.ex... Read more

1 more replies
Relevance 60.68%

hi all, i saw a post referring to downlading this utility, i downloaded it and i was wondering if any of you guys could take a look and tell me if i shoudl fix anything in it. Thanks in advance.
Logfile of HijackThis v1.90.0
Scan saved at 12:24:15 AM, on 1/2/2003
Platform: Windows 9x 4.90.3000
MSIE version: 5.50.4134.0600

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://search.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://search.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.nitrosim.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar=http://search.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://search.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://search.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride=localhost
O3 - Toolbar: @msdxmLC.dll,[email protected],&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\MY DOCUMENTS\DREW\DRIVERS\RIVATUNER\RIVATUNER.EXE" /S
O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~5\OFFICE\1033\PHDINTL.DLL/phdContext.htm
O9 - Extra button: AIM (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://hp.my.yahoo.com
O16 - DPF: {D27CDB6E-AE6D-11C... Read more

Answer:HiJackThis...program

I actually found something about everything there and it looks pretty good. Are you having trouble?
 

2 more replies
Relevance 60.27%

Okay, again I'm seeking your expert help
Anyway, I was trying to see if someone has been looking at files on my computer, but unfortunately, whenever you try to check the last access date on a file, it automatically becomes an access and thus shows the current date and time as of when you look at it. Is there any program that will allow you to check a file's last access without it counting as an access? I've already found a couple programs that specialize in being able to view access, and it still has the same thing. That's retarded. I sure hope this is possible because it would help a lot.

Thanks again!
 

More replies
Relevance 59.86%
Answer:Denied Access To Set Program Access And Defaults By Rundll32.exe

Hi and welcome.rundll32.exe is a process which executes DLL's and places their libraries into the memory, so they can be used more efficiently by applications. This program is important for the stable and secure running of your computer and should not be terminated.Note: rundll32.exe is a process registered as a backdoor vulnerability which may be installed for malicious purposes by an attacker allowing access to your computer from remote locations, stealing passwords, Internet banking and personal data. This process is a security risk and should be removed from your system.This is strange, this might be a malware or it might just be some promblem with the rundll32.exeI would run a scan and see what the scanners find. DON'T remove rundll32.exe, because it is most likely a legitimate file.Regards,ExtremeboyGreat that you figured it out. Can you tell us how you fixed the promblem?

1 more replies
Relevance 59.86%

Hello, I ran my HiJackThis and for reasons unknown, I checked box O20, and hit the delete button. Everything still seems to run okay, but I still have a lot of things to check. Is there any hope for me? Can I do anything to fix this mistake or am I doomed to another XP re-install? I have win XP sp2 installed. IE6 and Firefox for browsers. Mcafee antivirus and firewall. I have to many anti-spyware programs to list (ad-aware, spy bot s&d, pest patrol, x-block, ect....). 1 gig ram, 80 gig hd, Pentium 4. If you need anymore info on my system just let me know. Learning how to us a computer the hard way is to much fun. My first hard lesson was how to format my hard drive and how to back up all my documents, in that order.................. Carl

Answer:HiJackThis Program Problem

Start hijackthis, click on config, click on backups, look for your entry that you deleted, and restore it

2 more replies
Relevance 59.86%

Im a Windows XP user.

Lately, everytime I when I tried to turn my computer off, I get a "End Program" message about a program called Intermute.

I looked Intermute up and I see that its not spyware but rather a useful anti-spyware program. But I really want this message to stop coming up. Should I uninstall it or could it be something else?

Here's my Hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 3:04:27 PM, on 4/4/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\HP\KBD\KBD.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\PROGRA~1\Yahoo!\YOP\yop.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\2Wire Wireless\Client Manager\CMTWO.EXE
... Read more

Answer:Keep getting an End Program message (Hijackthis log)

You might try reinstalling SpamSubtract.
 

3 more replies
Relevance 59.86%

i had nod32, and it just stopped working a week ago.
cant run hijackthis, cant install any other antivirus.
cant run in safemode.
plz help me.
thx

Answer:Cant Run Antivirus, Hijackthis Or Any Other Program Like That

Hello and welcome to BC itsariDo you get any kind of error message when trying to run these programs?

3 more replies
Relevance 59.86%

This is a log for one of my laptops, the main problem is that everytime I try to shutdown I get a dialog box that says "End program - Sample." Once the process has ended the computer turns off.

I have run Ad-Aware, Spybot, and Spyware Doctor and they all come up with no traces.

Here is my log:

Logfile of HijackThis v1.98.2
Scan saved at 3:18:05 PM, on 9/21/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\Syste... Read more

More replies
Relevance 59.86%

During the last 2 years the program HijackThis has not been renewed. How come?

Some analysers of malware is using a new program WinPFind3U to do the work.

You cannot find much information about it.

Can you supply the information.

Answer:Hijackthis Still A Functioning Program?

There has not been much of a need to update HijackThis as the tool still does what it was designed to do. However, in mid-August, Merijn posted that he is working on a new version (1.99.2). See here.WinPFind3U is one part of a two part tool. One designed for the user getting help and one designed for the analyst who is assisting. It is an advanced tool created by OldTimer that should only be used under the guidance and supervision of a malware removal expert.

1 more replies
Relevance 59.86%

I've been trying to run hijack this but the problem I'm having is before it finishes scaning it lockes up any ideas on how some one can help me on this?????
Is there a free registry cleaner out there that is (easy) to run
 

Answer:hijackthis program is locking up

9 more replies
Relevance 59.04%

I am experiencing a rundll32.exe end program error when I try to shut down my computer. I have tried to use the "run" "msconfig" and have closed down all of the start up applications but then when I try to use the internet- websites like hotmail and facebook won't let me log in and the sites appears as if they are shut down, however the rundll32.exe End program error disappears upon shutdown in this mode. The rundll32.exe file is in the location on my computer where it needs to be so I don't believe I have a virus, but am not technically versed enough to know why/ what exactly is happening here.The bottom start bar (Windows XP for Windows) is also turning grey and appearing to slip into classic mode now and again. Not sure if this is related.Please help!I ran a hijack this log and this is what has appeared:Logfile of Trend Micro HijackThis v2.0.2Scan saved at 3:09:29 PM, on 7/6/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.18702)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exec:\Program Files\Common Files\Symantec Shared\ccProxy.exec:\Program Files\Common Files\Symantec Shared\ccSetMgr.exec:\Program Files\Norton Internet Security\ISSVC.exec:\... Read more

Answer:hijackthis log- rundll32.exe end program error

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Foll... Read more

2 more replies
Relevance 59.04%

heyo,

i am having some nasty spyware problems lately and downloaded ?hijackthis? and this is the logfile. can anyone help me figure out what to delete? i cant tell whats spyware and not. i tried posting this on a few computer forums but no ones replied yet and these spyware pop-ups are driving me insane!!

thanks!


Logfile of HijackThis v1.99.1
Scan saved at 3:57:24 PM, on 4/19/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSSystem32S24EvMon.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSsystem32ZCfgSvc.exe
C:WINDOWSExplorer.EXE
C:WINDOWSBCMSMMSG.exe
C:Program FilesIntelPROSetWirelessNCSPROSetPRONoMgr.exe
C:WINDOWSsystem32dlatfswctrl.exe
C:Program FilesViewpointViewpoint ManagerViewMgr.exe
C:Program FilesMusicMatchMusicMatch Jukeboxmmtask.exe
C:Program FilesMUSICMATCHMUSICMATCH Jukeboxmm_tray.exe
C:Program FilesCommon FilesRealUpdate_OBrealsched.exe
C:Program FilesCommon FilesAOLACSAOLDial.exe
C:Program FilesQuickTimeqttask.exe
C:PROGRA~1COMMON~1AOLAOLSPY~1AOLSP Scheduler.exe
C:Program FilesXdwqqLkbkqm.exe
C:PROGRA~1GrisoftAVGFRE~1avgcc.exe
C:PROGRA~1GrisoftAVGFRE~1avgemc.exe
C:WINDOWSSystem32winupdt.exe
C:windowssystem32ijqxdrkq.exe
C:WINDOWSSystem32RUNDLL32.exe
C:WINDOWSNKHZDLL.EXE
C:WINDOWS... Read more

Answer:problems with spyware and hijackthis program

Greetings, and welcome to TSF!
You got some stuff there that is known to be stubborn, but let's see how lucky we get.

Run HiJackThis then:

1. Click "Config..."
2. Click "Misc Tools"
3. Click "Open Process manager"

-

Next, while holding down the CTRL key, locate (if present) and click on (highlight) each of the following:

ManagerViewMgr.exe
FilesXdwqqLkbkqm.exe

Now double-check and make sure that only those item(s) above are highlighted, then click "Kill process". Now, click "Refresh", check again, and repeat this step if any remain.

===============

Before we begin, let's move HiJackThis to it's own folder; like c:\HJT. When we're done 'cleaning' off your system, we're going to 'flush' the temporary folders which, with HiJackThis in it's current location, we'll lose both the program and the backups it creates. These backups are important in case we need to restore any 'fixed' entry(s) later.

Also move the "Backups" folder, for HiJackThis, if present.

===============

Run HiJackThis and click "Scan", then check(tick) the following, if present:


O4 - HKLM..Run: [ViewMgr] C:Program FilesViewpointViewpoint ManagerViewMgr.exe
O4 - HKLM..Run: [Lfnebnfo] C:Program FilesXdwqqLkbkqm.exe
O4 - HKLM..Run: [winupdtl] C:WINDOWSSystem32winupdt.exe
O4 - HKLM..Run: [ijqxdrkq] c:windowssystem32ijqxdrkq.exe
O4 - HKLM..Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,[email protected] ... Read more

1 more replies
Relevance 59.04%

I'm running an HP Pavilion Laptop using Windows XP Media version. This fake antivirus program appeared out of nowhere. Originally, it was blocking every executable I tried to launch. Now, I've managed to get some control and run hijack this below:Logfile of Trend Micro HijackThis v2.0.2Scan saved at 2:08:57 PM, on 2/10/2010Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.18702)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exeC:\WINDOWS\system32\inetsrv\inetinfo.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Common Files\LightScribe\LSSrvc.exeC:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exeC:\WINDOWS\Sy... Read more

Answer:HijackThis Log - Fake Antivirus Program

Hello! My name is Sam and I will be helping you. In order to see what's going on with your computer I will ask for you to post various logs from the tools that we will use to resolve your issue. Please also share with me any information about how your computer is reacting and behaving each step of the way as we work through this process.Please download Malwarebytes Anti-Malware and save it to your desktop.alternate download link 1alternate download link 2Make sure you are connected to the Internet.Double-click on Download_mbam-setup.exe to install the application.When the installation begins, follow the prompts and do not make any changes to default settings.When installation has finished, make sure you leave both of these checked:Update Malwarebytes' Anti-MalwareLaunch Malwarebytes' Anti-MalwareThen click Finish.MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.On the Scanner tab:Make sure the "Perform Quick Scan" option is selected.Then click on the Scan button.If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.The scan will begin and "Scan in progress" will show at the to... Read more

2 more replies
Relevance 59.04%

As the title states, I've run webroot spy sweeper, adaware, spyware doctor, windows defender, and ashampoo anti spyware lol. I have found nothing except for some cookies. Its sporatic but it redirects searches only to yellowpages.com ect, nothing when I put the direct address in the bar and no issues when I use firefox, safari ect.I downloaded and ran hijack this and wanted to see if anyone could translate the log for me and point me in the right direction. I also renamed hijack this to scanner.exe before I ran it, I heard that some spyware can avoid the program if you dont do that /shrugLogfile of Trend Micro HijackThis v2.0.2Scan saved at 6:02:17 PM, on 2/11/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16762)Boot mode: NormalRunning processes:H:\WINDOWS\System32\smss.exeH:\WINDOWS\system32\winlogon.exeH:\WINDOWS\system32\services.exeH:\WINDOWS\system32\lsass.exeH:\WINDOWS\system32\svchost.exeH:\WINDOWS\System32\svchost.exeH:\Program Files\Lavasoft\Ad-Aware\aawservice.exeH:\WINDOWS\system32\spoolsv.exeH:\WINDOWS\Explorer.EXEH:\PROGRA~1\Grisoft\AVG7\avgamsvr.exeH:\PROGRA~1\Grisoft\AVG7\avgupsvc.exeH:\PROGRA~1\Grisoft\AVG7\avgemc.exeH:\WINDOWS\eHome\ehRecvr.exeH:\WINDOWS\eHome\ehSched.exeH:\Program Files�... Read more

Answer:IE hijacked, 4 spyware program later, need help with hijackthis log

Hi,* Please visit this webpage for instructions for downloading and running ComboFix:http://www.bleepingcomputer.com/combofix/how-to-use-combofixPost the log from ComboFix in your next reply.Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix..This because Security Software may see some components ComboFix uses (prep.com for example) as suspicious and blocks the tool, or even deletes it. Please visit HERE if you don't know how.

8 more replies
Relevance 59.04%

ok well i finally got the hijackthis file to get on my computer without the little windows icon. and now it gives me this..."A Required .DLL file, MSVBVM60.DLL, was not found." What does it all mean!!!! plz help
 

Answer:Error starting program: Hijackthis

7 more replies
Relevance 59.04%

Logfile of HijackThis v1.99.1
Scan saved at 9:07:57 AM, on 5/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Personal Firewall\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\tjedhnaa.exe
C:\Program Files\Atomic Clock Sync\Atomic.exe
C:\Program Files\Messenger... Read more

Answer:HijackThis Log; wierd program at shutdown

Welcome to TSF.

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that 'Display the contents of system folders' is checked. If you have Windows XP, the search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that 'Search system folders', 'Search hidden files and folders', and 'Search subfolders' are checked.

For the options that you checked/enabled earlier, you may uncheck them after your log is clean. If we ask you to fix a program that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep).

Download ETRemover and unzip it. Don't run it yet.

Reboot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work. Make sure to close any open browsers. Run a scan in HijackThis. Check each of the following a... Read more

1 more replies
Relevance 58.63%

I had trouble with opening many of my programs and the icons on my desktop had a key (microsoft access) next to them. I was told I might have a bad area on my hard drive (C).I reformatted my C drive, reloaded my software and all is well except: When I try to open Program Files I get the message in the subject line. My experience level is beginner. It took all I had and some good advice to reformat drive and reload.Any advice you give me please make it simple. I have an HP Pavillion DV5000 laptop, 4 and 1/2 years old and run Microsoft Windows XP home edition. Not sure of service pak info but if you need this to diagnose let me know how to find it and I will supply. Everything is working well on my computer except this but i would like to keep my programs in the program file rather than spread out in the C drive.Thank you for your help!!Glennps If I need to sign in as systems administrator I do not know how to do that.

Answer:Cannot access Program File. Access is denied.

Happy Holidays n Welcome to our forum.Posting is not very clear, but it sounds like a permission issue.It would help a lot to post the exact warning or error. This will let us help u more.  Did u validate Windows? Is the Win CD a genuine Windows CD?Lets try to start u in Safe Mode to see if we can get u into a new Admin account.1- reboot PC as soon as it starts, start pressing F8 Key. This will not load Windows and give u some option. Choose Safe Mode with Network. Windows will start to load just follow the directions. Once Window starts it will load only enough to get started. There's not much u r going to damage at this stage. All we want to do is here is create 2 new accounts. One new Administrator account and one Regular account (with Administrator privileges).  U can name the new accounts anything u want. Just remember which one is the new Admin account and the regular account. To create the new account:Go to >Start>Control Panel>User Accounts> Select new accounts. Name each account, u will want to create a Computer Admin and a Limited user account.When done just reboot and Windows will load with the 2 new accounts u just created. 2- Log on with the new Admin account and see if u get the same message. If u do, post the exact message on the next thread.3- the regular account should also be tested. Once again see if u get the same message. If different post the message. Write back let us know.

2 more replies
Relevance 58.63%

Hey, everyone. For the past two days I've had a problem that I'm not sure how to approach. Apparently my PC is sending out e-mails on its own, which is odd considering that I don't have an e-mail client like Outlook open. I wouldn't even have noticed had McAfee not given me a warning.

The McAfee warning pop up message looks like this:

"! E-mail Message Problem

One or more e-mail messages cannot be sent.

Details

View the log

After you verify the format of your recipient addresses, McAfee recommends that you resend those messages from your e-mail program."

Upon viewing the McAfee log, I don't recognize the recipient and the Subject of the e-mail is "October 73% OFF".

Needless to say, this is a bit alarming. I have no idea what information is being sent, no clue what client it's using, or how to shut it off other than cutting my internet connection. I ran a Spybot scan the other night as well as a McAfee scan and neither found anything suspicious other than a couple of cookies which were deleted.

I ran a Hijack This scan tonight and these were my results:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:17:35 PM, on 10/16/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.e... Read more

More replies
Relevance 58.63%

Downloaded file off Kazaa with no antivirus, DOH! Installed & ran a complete Panda Titanium scan(couldn't update, so virus def. were 6 months old) W32/Kindal & Jeefo came up and were neutralized. Still had problems with starting & uninstalling some programs(Panda, ect.) Ran AVG free(updated) Worm/Sddrop was Neutralized. Ran Spybot, turned off system restore, fixed registry, but when I still try to open some programs..all I get is "Only part of a ReadProcessMemory or WriteProcessMemory request was completed" or "The parameter is incorect" Can someone PLEASE help me out, Thanks

Logfile of HijackThis v1.97.7
Scan saved at 4:28:42 PM, on 4/7/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\GEARSec.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\Pavsrv51.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\AVENGINE.EXE
C:\WINDOWS\SYSTEM32\ZONELABS\vsmo... Read more

Answer:Hijackthis report, program parameters are incorect

ddincali,

go here and download, update and configure Ad-aware:

http://www.lavasoftusa.com/support/download/#free

Make sure you configure Ad-aware according to Winchester73's guide:

http://forums.techguy.org/t164245.html

pay particular attention to step #4.
 

2 more replies
Relevance 58.63%

Hey guys... unfortunatly this comps messin up... again. Included is the logfile... but i guess a quick background will help eh? Began with one of those retarded MSN viruses, where it sends you a link from a friend... and you stupidly click the link thinking your friend is showing you something. Low and behold.. your computer is going nuts and your spybot is going overtime. Anyway, spybot stopped the virus.. but there are registry files that keep poping up when i reboot. On startup I begin everytime with 4 error messages. First being that it can't find 'C:\Program'.. then that desktop can't find 'C:\Program' in registry. Yeah... C:\Program... not C:\Program files. The next 2, pretty much the same only 'Files\WAFFLEz\mlg1.exe' and the same for registry. I've disabled (but not eliminated) the WAFFLEz error simply using msconfig... but don't want to mess around with HijackThis until I have some intruction (I'm pretty much useless when it comes to this) So enough type.. here's the log:

Logfile of HijackThis v1.99.1
Scan saved at 10:22:56 AM, on 05/05/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\ACS.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\TO... Read more

Answer:HijackThis inside - WAFFLEz... c:\Program.... waaaaa?

bump for some help

9 more replies
Relevance 58.63%

Hello,

I have followed the KRC Anti-Spyware Tutorial and now post this result. My computer has some problems including bootup, internet connection closed automatically right after I start Outlook Express and hit Send and Receive Button. Now everything looks fine. Please take yout time to see if there are still any problems needed to be addressed. Thanks

Here is the result:

====================================================================
Log was analyzed using KRC HijackThis Analyzer - Updated on 8/4/05
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Speed Disk se... Read more

Answer:Result generated from the HijackThis Analyzer program

Welcome to TSF

You log appears fine. Just some orphaned entries to fix.

Run a scan with HiJackThis & select/tick the following :

O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)

Make sure your browser is closed & click "Fix checked"

Reboot your computer & post a fresh HijackThis log.
Let me know if you have any other problems

1 more replies
Relevance 58.63%

Hello!I was wondering if anyone can help me with this I've done as much as I can but I have a virus that gives me constant pop ups to spyware programs. It also blocks me from going on certain websites including hotmail, or any server that can update spyware or anti virus programs.I have tried spybot which has returned wih a few trackers and also 2 virtomonde trojan viruses which simply wont go away. It says its fixed them but they just keep returning. I have tried spybot in safe mode and also restarted with no internet connection but still no joy.I have done virus searches with Avira, Avast, Norton and McAfee but they find nothing. I can also no longer uninstall Avast now for some reason.I have installed Sygate Personal Firewall which seems to recognise something is happening, but it makes it very difficult to access anything on the internet at all.So in conclusion, the main problems are;*Cannot connect to any update servers (for Anti Virus and Anti Spyware programs)*Cannot remove virus*Cannot go on certain websites (Including windows update)*Pop Ups from companies offering Anti Virus programs appear alot.Anyway heres the log, if anyone can help I will really appreciate it.Many Thanks.Logfile of Trend Micro HijackThis v2.0.2Scan saved at 15:24:15, on 15/08/2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.17184)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.... Read more

Answer:Spyware Program Adware Virtumonde Hijackthis Log

Hello and welcome to Bleeping Computer.My name is km2357 and I will be helping you to remove any infection(s) that you may have.I will be giving you a series of instructions that need to be followed in the order in which I give them to you.If for any reason you do not understand an instruction or are just unsure then please do not guess, simply post back with your questions/concerns and we will go through it again.Please do not start another thread or topic, I will assist you at this thread until we solve your problems.Lastly the fix may take several attempts and my replies may take some time but I will stick with it if you do the same.Sorry for the delay in replying, the forum is very busy. If you still need help, please post a fresh HiJackThis Log and an Uninstall List (instructions forthcoming)Step # 1: Make an uninstall list using HijackThisTo access the Uninstall Manager you would do the following: 1. Start HijackThis 2. Click on the Config button 3. Click on the Misc Tools button 4. Click on the Open Uninstall Manager button. 5. Click on the Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here on your next reply.

3 more replies
Relevance 58.63%

Hey everyone, i have a trouble, my laptop yesterday shows a blue screen "STOP: c0000135 The program can`t start because %hs is missing from your computer. Try reinstalling th program to fix this problem."
Please I need your help.

*I can't start in safe mode
*I can't repair since DVD Windows 7
*I can't Restore System

I installed in a USB flash driver FARBAR recovery scan tool in the command propt

It was the log:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-01-2013 02
Ran by SYSTEM at 24-01-2013 11:13:13
Running from F:\
Service Pack 1 (X86) OS Language: Spanish Modern Sort
Attention: Could not load system hive.
Attention: System hive is missing.

==================== Registry (Whitelisted) ===================

Attention: Software hive is missing.

ATTENTION: Unable to load Software hive.
==================== Services (Whitelisted) ===================
==================== Drivers (Whitelisted) ====================
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
==================== One Month Modified Files and Folders ========
==================== Known DLLs (Whitelisted) =================
==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe IS MISSING <==== ATTENTION!.
C:\Windows\System32\winlogon.exe IS MISSING <==== ATTENTION!.
C:\Windows\S... Read more

Answer:STOP: c0000135 The program can`t start because %hs is missing from your computer. Try reinstalling th program to fix this problem

Hello and welcome to Bleeping Computer! I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything. We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here. To help Bleeping Computer better assist you please perform the following steps:*************************************************** In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/482878 <<< CLICK THIS LINK If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.*************************************************** If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lo... Read more

2 more replies
Relevance 58.63%

Good morning, On the very infrequent occasion when MBAM Pro happens to display an OUTGOING block message, I will try and ascertain which program on my computer is making the call using the TcpView program. Unfortunately, it seems I can never get TcpView going fast enough to catch the program responsible. (Being I use an XP Pro machine, the block message only displays the IP address).Question: Is there some other method I can use to see which application on my machine is making these infrequent outgoing calls? (HpHosts shows the IP address to be malicious and located in Germany).Thanks for any info.

Answer:MBAM outgoing block; Any program besides TcpView to find originating program on computer?

Yes, use procmon. Start procmon before you get the warning, and filter on "Operation is TCP Connect".

7 more replies
Relevance 58.63%

Until recently, whenever I opened a program by clicking on the program icon pinned to the taskbar, that icon was replaced by the active program button. This is the behavior I want in order to keep the taskbar uncluttered. However, I recently mistakenly unpinned an icon for Mozilla Thunderbird and after re-pinning the program start icon, now the active program button appears in addition to the startup icon rather than replacing it. I have pinned and unpinned the program several times, and even after a restart of the machine, the same result persists. The problem seems to be limited to Thunderbird, at least in my limited research.

If I pin other new programs to the taskbar, the expected replacement behavior occurs, even after un-pinning and re-pinning, e.g for Microsoft Word.

If I un-pin and re-pin programs that have been pinned to the taskbar from before the time this issue occurred with Thunderbird, the expected replacement behavior occurs, e.g Mozilla Firefox

Answer:Program icon pinned to taskbar not replaced by active program button

I had a similar problem. Try to re-install the program (Thunderbird)

2 more replies
Relevance 58.63%

I have been using Add/Remove icon in Control Panel to remove programs. Although the Win2k Pro is running fine ,the icon of Add/Remove Program is not opening the next window to remove the programs.
Can anyone help me?
MZR Siddiquee
 

Answer:Clicking Add/Remove Program icon in Control Panel does not start the Program

13 more replies
Relevance 58.22%

Hi guys

I have a 40GB SSD (32gb usable) I want to use the SSD for the OS for fast reboots - and some programs (custom install locations when needed)

However, I want all my mass data to be on my 500GB SATA, how can I achieve this without breaking updates or windows?

Thanks
 

Answer:Windows 7 SSD and SATA. Moving Users Program Files and Program data to bigger drive

Here's a sample on how to move "My Documents"

Works the same for any folder.

http://hubpages.com/hub/Windows-7_-_Moving_My_Documents
 

1 more replies
Relevance 58.22%

When I attempt to open anything with Adobe,it loads the page but then a box comes up with the following message:
Microsoft Visual C++ Debug Library Runtime Error! Program: C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat.exe The application has requested the Runtime to terminate it in an unusual way. Please contact the application's support team for more information. "
Uninstalling and reinstalling Adobe was no help.Be aware,I'm pretty 'puter illiterate.
 

Answer:Solved: Microsoft Visual C++ Debug Library Runtime Error! Program: C:\Program Files\A

Until more experienced help comes along, leave Adobe uninstalled and try the Free Foxit Reader, it reads PDF files and loads a bit quicker and is lighter on resources and takes a hell of lot less disk space.
Ray
 

2 more replies
Relevance 58.22%

My computer has been stuck in restart loop for 2 hours now and it can't seem to stop! I tried using system repair but that does not seem to be of any help at all!
I'am so worried! It also keep showing a blue screen saying STOP: C0000135 The program can't start because %hs is missing. Try resintalling the program .

I've tried to find solutions and many are saying this is related to AVG the anti-virus but i don't even have that anti-virus
I would appreciate a tons if anyone could help me! Thank SO much!

Answer:STOP: C0000135 The program can't start because %hs is missing. Try resintalling the program

Hi,This is generally caused by malware, I will have a mod move this thread to the Virus Removal Forum,in the meantime, please run the following:For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.Plug the flashdrive into the infected PC.Enter System Recovery Options. To enter System Recovery Options from the Advanced Boot Options:Restart the computer.As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.Use the arrow keys to select the Repair your computer menu item.Choose your language settings, and then click Next.Select the operating system you want to repair, and then click Next.Select your user account and click Next.To enter System Recovery Options by using Windows installation disc:Insert the installation disc.Restart your computer.If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.Click Repair your computer.Choose your language settings, and then click Next.Select the operating system you want to repair, and then click Next.Select your user account an click Next.On the System Recovery Options menu you will get the following options:Startup RepairSystem RestoreWindows Complete PC RestoreWindows Memory Diagnostic ToolCommand Prompt[*]Select Command Prompt[*]In the command window type in notepad and press... Read more

12 more replies
Relevance 58.22%

Good Afternoon,

I have another student computer displaying the above stop code. The computer had been booting fine until the last restart I did now it will not boot to the desktop just to the blue screen with the above stop code. It had been infected by a virus that displayed multiple fake systems messages but I thought I had got rid of everything by using MalwareBytes and Microsoft Security Essentials. This student had been running without virus protection for who knows how long.

FRST log is attached

Answer:STOP: C0000135 The program can't start because %hs is missing. Try resintalling the program

Greetings quiksilvermp3 and to BleepingComputer's Virus/Trojan/Spyware/Malware Removal forum.My name is Oh My! and I am here to help you!===================================================Ground Rules:First, I would also like to inform you that most of us here at Bleeping Computer offer our expert assistance out of the goodness of our hearts. Please try to match our commitment to you with your patience toward us. If this was easy we would never have met. Please do not run any tools or take any steps other than those I will provide for you while we work on your computer together. I need to be certain about the state of your computer in order to provide appropriate and effective steps for you to take. Most often "well intentioned" (and usually panic driven!) independent efforts can make things much worse for both of us. If at any point you would prefer to take your own steps please let me know, I will not be offended. I would be happy to focus on the many others who are waiting in line for assistance. Please perform all steps in the order they are listed in each set of instructions. Some steps may be a bit complicated. If things are not clear, be sure to stop and let me know. We need to work on this together with confidence.Please copy and paste all logs into your post unless directed otherwise. Please do not re-run any programs I suggest. If you encounter problems simply stop and tell me about it.
When you post your reply, do not use th... Read more

16 more replies
Relevance 58.22%

Good Afternoon,

I have student's computer with the STOP code C0000135. FTST log to follow. Thanks in advance for the help.

Scan result of Farbar Recovery Scan Tool Version: 15-03-2012
Ran by SYSTEM at 02-04-2012 14:17:42
Running from G:\
Windows 7 Home Premium (X64) OS Language: English(US)
The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [11725928 2010-12-22] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE4 [2186856 2010-12-10] (Realtek Semiconductor)
HKLM\...\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe [167960 2011-02-11] (Intel Corporation)
HKLM\...\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe [391704 2011-02-11] (Intel Corporation)
HKLM\...\Run: [Persistence] C:\Windows\system32\igfxpers.exe [418328 2011-02-11] (Intel Corporation)
HKLM\...\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" [4526 2010-10-08] ()
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2280232 2010-07-29] (Synaptics Incorporated)
HKLM\...\Run: [Acer ePower Management] C:\Program Files\Acer... Read more

Answer:STOP: C0000135 The program can't start because %hs is missing. Try resintalling the program

HiPlease do the following:Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below. (To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste). Save it on the flashdrive as fixlist.txt start
script removed
endNOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating systemNow please enter System Recovery Options then select Command PromptRun FRST64 and press the Fix button just once and wait.The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.Now restart, let it boot normally and tell me how it went.NEXTRefer to the ComboFix User's Guide Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Place ComboFix.exe on your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
You can get help on disabling your protection programs here
Double click on ComboFix.exe & follow the prompts.Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's r... Read more

12 more replies
Relevance 58.22%

Hello,

My computer is setup to use a 120gb SSD for my OS (Windows 7 ultimate 64bit) and a 2Tb hard drive for my program files, user folders etc. I use junction points to link the program files and user files from C:\ to D:\. This normally works like a charm however I recently updated iTunes and it deleted my C:\Program Files (x86) junction point and created a Program Files (x86) folder on the C:\ drive, this completely roots my system as all my Program Files (x86) are stored on my D:\ drive and now my computer can't find them since the junction point has been deleted. How can it do this and most importantly any reason as to why it's doing this? It's an easy fix on my end as all I have to do is put back in my windows installation disk boot from it and remake the junction point but it's a real pain to do it when it shouldn't happen in the first place.

Also after remaking the Junction point I decided to uninstall iTunes and it once again deleted my junction point while uninstalling.

(Note: My Program Files, and User, junction points have worked as normal and have not been deleted just my Program Files (x86) junction point. I am creating my junction points using the command mklink "C:\Program Files (x86)" "D:\Program Files (x86)" /J)

Does anyone have any ideas to why this is happening? Any help is much appreciated.

Thanks

Nairda.

More replies
Relevance 58.22%

Hi everyone.

Today I used an AV to fix some annyoing ad (malware i guess) and after reeboting i found this nice message:

"STOP: C0000135 The program can't start because %hs is missing. Try resintalling the program"

I met this forum on the net looking for a solution. So I decided ask help (:

I read in this thread the steps i must do, but I need someone to help me out with a "script".

http://www.bleepingcomputer.com/forums/topic451138.html
and
http://www.bleepingcomputer.com/forums/topic451183.html

Thanks in advance!

EDIT: Hi, here's the log of Frst.

Scan result of Farbar Recovery Scan Tool Version: 27-04-2012
Ran by SYSTEM at 27-04-2012 20:12:24
Running from F:\
Windows 7 Ultimate (X64) OS Language: English(US)
The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [K10] c:\K10\K10STAT.exe -lp:1 -ClkCtrl:2 -StayOnTray -nw [162304 2010-05-04] ()
HKU\Asteroide\...\Run: [Google Update] "C:\Users\Asteroide\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2010-12-13] (Google Inc.)
HKU\Asteroide\...\Run: [AtiTrayTools] "C:\Program Files (x86)\Ray Adams\ATI Tray Tools\atitray.exe" [890880 2011-08-15] (Ray Adams)
HKU\Asteroide\...\Run: [ASRockOCTuner] [x]
Tcpip\Parameters: [DhcpNameServer] 62.81.29.254 62.42.230.24
SubSyst... Read more

Answer:STOP: C0000135 The program can't start because %hs is missing. Try resintalling the program

Hi Asteroide,Welcome to the forum.Please no need to attach the logs unless it is requested. Also please just copy and paste the log instead of putting them in the codebox.I see the computer is infected. We can fix that. But before doing that please tell me if you altered the log:Tcpip\Parameters: [DhcpNameServer] 6x.81.29.254 6x.42.230.24

16 more replies
Relevance 58.22%

I have an Advent (PC World brand) Laptop that comes with its own custom On-Screen Display software.

The software is made for 32 bit Windows with no 64 bit version available as far as I'm aware.

I have upgraded to 64 bit Windows recently and everything seems to work great except the OSD.

When installing. I'm given a choice of where I want to install the program in which I choose

C:\Program Files

after installation a mandatory restart is required and after the reboot OSD always ends up in
the other Program Files folder and I receive a error when trying to launch the OSD

I assume this error is because it gets confused being in the wrong directory (although I could be wrong and its simply just not compatible with 64bit Windows)

Anyone have a way to force it to install in the standard Program Files folder?

its the only way to tell if things like caps lock are enabled or not, so its pretty frustrating without it.

Answer:Program refusing to install in standard program files folder

In 64-bit Windows, the folder Program Files (x86) is for 32-bit applications. Try installing your OSD application there instead of the Program Files folder which is meant for 64-bit applications.

Kari

4 more replies
Relevance 58.22%

Hello everybody I followed CatByte instruction here http://www.bleepingcomputer.com/forums/topic451183.html and I got this log:Someone can help me plz?Thx in advance
Scan result of Farbar Recovery Scan Tool Version: 02-05-2012 01
Ran by Syst?me at 02-05-2012 21:25:14
Running from G:\
Windows 7 Ultimate N Service Pack 1 (X64) OS Language: French Standard
The current controlset is ControlSet001

ATTENTION: THE TOOL IS NOT RUN FROM RECOVERY ENVIRONMENT AND WILL NOT FUNTION PROPERLY.

========================== Registry (Whitelisted) =============

HKLM\...\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe [609144 2011-04-12] (Alps Electric Co., Ltd.)
HKLM\...\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" [4526 2010-11-29] ()
HKLM\...\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-05-27] (IDT, Inc.)
HKLM\...\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe [168216 2011-04-19] (Intel Corporation)
HKLM\...\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe [392472 2011-04-19] (Intel Corporation)
HKLM\...\Run: [Persistence] C:\Windows\system32\igfxpers.exe [416024 2011-04-19] (Intel Corporation)
HKLM\...\Run: [NVHotkey]... Read more

Answer:STOP: C0000135 The program can't start because %hs is missing. Try resintalling the program

Hello,Please follow the instructions in ==>This Guide<== starting at step 6. If you cannot complete a step, skip it and continue.Once the proper logs are created, then post them in a reply to this topic by using the Add Reply button.If you can produce at least some of the logs, then please create the post and explain what happens when you try to create the log(s) that you couldn't get. If you cannot produce any of the logs, then still post the reply and explain that you followed the Prep. Guide, were unable to create the logs, and describe what happens when you try to create the logs.Please note that I am not a member of the Malware Removal Team and will not be assisting you in removing the infection. I'm simply helping you to post the information they need in order to assist you.If HelpBot replies to your topic, PLEASE follow Step One so it will report your topic to the team members.

10 more replies
Relevance 58.22%

I have a machine with a reboot issue after some malware was removed. I'm not sure what the infection was. The PC won't boot into normal or safe mode, and has the blue screen error in the title. Any help would be greatly appreciated! Here is my FRST scan log:

Scan result of Farbar Recovery Scan Tool Version: 22-04-2012
Ran by SYSTEM at 23-04-2012 18:35:26
Running from E:\
Windows 7 Professional (X64) OS Language: English(US)
The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [LogMeIn GUI] "C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe" [57928 2011-01-11] (LogMeIn, Inc.)
HKLM\...\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming [1744152 2011-10-07] (Logitech, Inc.)
HKLM\...\Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [1436736 2011-06-15] (Microsoft Corporation)
HKLM-x32\...\Run: [VirtualCloneDrive] "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s [85160 2009-06-17] (Elaborate Bytes AG)
HKLM-x32\...\Run: [Standby] "c:\Program Files (x86)\Common Files\Corel\Standby\Standby.exe" -START [105632 2009-12-17] (Corel)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common File... Read more

Answer:Another STOP: C0000135 The program can't start because %hs is missing. Try resintalling the program

Hello and Welcome to Bleeping Computer!!My name is Gringo and I'll be glad to help you with your malware problems. I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of usPlease do not run any tools unless instructed to do so.
We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.Please do not attach logs or use code boxes, just copy and paste the text.
Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.Please read every post completely before doing anything.
Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.Please provide feedback about your experience as we go.
A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.NOTE:... Read more

10 more replies
Relevance 58.22%

When I run any DOS game like Allen Border's Cricket, etc. my system's performance degrades drastically when I run the same along with any media player like RealOne or Windows Media Player 9.
What exactly happens is that while I'm playing this DOS Game with its options of Music and Fx turned off for less memory consumption and at the same time I'm listening to any music with the option of Visualisation selected to 'None', again to free up memory, but still my system becomes slow, the music stops in between & resumes playing by itself, the game also becomes slow and then again starts working properly long with the music.

I fail to understand that inspite of having 512 MB DDRSD Ram & 1.9 Ghz processor still then why is the performance so poor even when I've disabled most of the options that consume more memory!

Please help sooooon!!!
 

Answer:Performance drastically degrades on running a DOS program alongwith any other program

6 more replies
Relevance 58.22%

Hello,

Yesterday evening, while administering my Minecraft server, a message saying my Adobe Calson Pro font (the first one in my Fonts folder) was corrupted appeared in the notification area. That was the first message of this type that I had ever seen. A second message appeared after a few seconds, saying another file was corrupted (I think it was a system file, but I don't remember). I ignored the messages and opened a file with Notedpad++ but it failed to launch. I decided to restart my computer but Windows 7 failed to boot with a BSOD : "STOP: C0000135 The program can't start because %hs is missing. Try resintalling the program". Before searching this issue on Google, I ran a CHKDSK which completed whitout erros. Then I foud these two topics which present a similar issue : http://www.bleepingcomputer.com/forums/topic444580.html and http://www.bleepingcomputer.com/forums/topic455797.html. I followed the procedure mentioned in the first topic and got the following log :

Scan result of Farbar Recovery Scan Tool Version: 09-06-2012 01
Ran by Système at 09-06-2012 18:22:33
Running from E:\
Windows 7 Home Premium (X64) OS Language: French Standard
The current controlset is ControlSet001

ATTENTION:=====> THE TOOL IS NOT RUN FROM RECOVERY ENVIRONMENT AND WILL NOT FUNTION PROPERLY.

========================== Registry (Whitelisted) =============

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAV... Read more

Answer:STOP: C0000135 The program can't start because %hs is missing. Try resintalling the program

Hi,Welcome to Bleeping Computer. My name is m0le and I will be helping you with your log.Please subscribe to this topic, if you haven't already. Click the Watch This Topic button at the top on the right.

Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible.

Please reply to this post so I know you are there.The forum is busy and we need to have replies as soon as possible. If I haven't had a reply after 3 days I will bump the topic and if you do not reply by the following day after that then I will close the topic.Once I receive a reply then I will return with your first instructions.Thanks

20 more replies
Relevance 58.22%

Mod Edit:MOVED to Virus,Trojan and Malware Removal Logs ~~boopmeHi,I am referring to the following post.http://www.bleepingcomputer.com/forums/topic444580.htmlI am having the same problem to log in to Windows. I installed MSE and restarted my PC. After that I saw that stupid blue screen with the message. Fortunately, I did partition of my computer where I have Linux Mint and I am now working on Linux. But I would like to wake up my Windows too. I followed the procedure that was mentioned in the above post and got the following log. I would really appreciate if anyone could help me out mentioning the further procedure.Scan result of Farbar Recovery Scan Tool Version: 03-06-2012Ran by SYSTEM at 03-06-2012 16:50:09Running from F:\Windows 7 Professional Service Pack 1 (X64) OS Language: English(US) The current controlset is ControlSet001========================== Registry (Whitelisted) =============HKLM\...\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe [167704 2011-06-28] (Intel Corporation)HKLM\...\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe [392472 2011-06-28] (Intel Corporation)HKLM\...\Run: [Persistence] C:\Windows\system32\igfxpers.exe [416024 2011-06-28] (Intel Corporation)HKLM\...\Run: [DBRMTray] C:\Dell\DBRM\Reminder\DbrmTrayIcon.exe [227328 2011-03-08] (Dell Computer Corporation)HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Sec... Read more

Answer:STOP: C0000135 The program can't start because %hs is missing. Try resintalling the program

Hi,Please delete the fixlist.txt from your desktop (the fix is designed for a specific machine so please do not use a fix designed for someone else)now run the following:Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below. (To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste). Save it on the flashdrive as fixlist.txt start
script removed
endNOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating systemNow please enter System Recovery Options then select Command PromptRun FRST64 and press the Fix button just once and wait.The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.Now restart, let it boot normally and tell me how it went.NEXTRefer to the ComboFix User's Guide Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Place ComboFix.exe on your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
You can get help on disabling your protection programs here
Double click on ComboFix.exe & follow the prompts.Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. ... Read more

23 more replies
Relevance 58.22%

Hi, I am running Windows 7 x64 on an ASUS g73 laptop and recently got hit with this error. The computer would startup only to hit this blue screen and restart. It would also not boot in any of the safe modes. I have read that it probably has to do with a malware infected .dll file but have no idea how I would go about fixing it.

Here is the log I got from frst, any help would be greatly appreciated. Thanks!

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 23-11-2012
Ran by SYSTEM at 27-11-2012 20:49:20
Running from F:\
Windows 7 Home Premium (X64) OS Language: English(US)
The current controlset is ControlSet001

==================== Registry (Whitelisted) ===================

HKLM\...\Run: [RunDLLEntry] C:\Windows\system32\RunDLL32.exe C:\Windows\system32\AmbRunE.dll,RunDLLEntry [17920 2009-02-26] (Creative Technology Ltd.)
HKLM\...\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323584 2009-08-31] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe" [1022904 2010-02-23] (Trend Micro Inc.)
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [x]
HKLM-x32\...\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [98304 2009-12-... Read more

Answer:STOP: C0000135 The program can't start because %hs is missing. Try resintalling the program.

Hi and welcome to the forum NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating systemAttached is:
 fixlist.txt   611bytes
  4 downloadsSave fixlist.txt to your flash drive.You should now have both fixlist.txt and FRST64.exe on your flash drive. Now re-enter System Recovery Options.Run FRST64 and press the Fix button just once and wait. The tool will make a log on the flashdrive (Fixlog.txt).Please attach this to your next message.Now attempt to boot normally.

4 more replies
Relevance 58.22%

in Win XP or earlier, we can change / delete file association in File type of "Folder Option". but found disappeared since Vista.Can anyone tell me where to find the same function?thankslolojack

Answer:how to delete file association with an unwanted program (i don't want it associate with any program?)

I take ".dat" for example.Go to HKEY_CLASSES_ROOT in the registry.Search ".DAT" under this key.Click on this key and delete the (Default) value.Aski.
MVP Desktop Experience

26 more replies
Relevance 58.22%

Hello,

One of the computers in my office came up with this error when turned on this morning:

STOP: C0000135 The program can?t start because %hs is missing. Try resintalling the program

It took me a while to get to the error, because, as the computer's running Win 7 Pro, it was skipping the BSOD, and going straight to startup repair; when that didn't work, I then disabled the automatic restart option, and then found this error, which I've never seen before. I did do some googling, and found several references to this being either virus or corrupt registry entries, but I wanted to check in here first before I started doing anything to the computer.

Could somebody please steer me in the right direction?

Thanks in advance,

--Jon

Answer:STOP: C0000135 The program can’t start because %hs is missing. Try resintalling the program

I've seen a couple of references to the registry entry as described in this article, but I went in and looked, and do not see the bad entry for "consrv":

http://blog.computerservicepros.com/?p=73

I also searched the drive for any references of consrv.* and found nothing...

14 more replies
Relevance 58.22%

Have had Vista since it came out and nary a problem. Hard drive crashed
so installed a new one and put Vista, sp1 and many other programs back on. the last one to be installed was Quickload- a bullet reloading program.
It started to install and about 25% through it quit.
So I start the install again and now it starts to install and comes up with an error ( Unable to create program group ). then it unloads its self from the drive. Have checked the Registery and all folders for left over files,
but there are none.

Put Vista+SP1 on another hard drive and did the install and it went perfectly. The other drive had SP1 also

Why cant it do the program groups thing?

More replies
Relevance 58.22%

I have an infection of a fake anti-virus program that is constantly creating pop-ups. It has placed Trojans (which McAfee/Malwarebytes intermittently cleans). It has blocked access to internet (I am currently able to access internet in safe-mode after running Malwarebytes). There is a program in my installed program list entitled ?aaa? by company ?bbb?, I am not able to uninstall this program.

I would greatly appreciate assistance with this problem as it is rather worrying. I will endeavour to keep my internet access open so I can be here when you are available to help me.
Thank-you to bleepingcomputer for the guidance in posting,
hchicken
DDS log:
DDS (Ver_10-12-12.02) - NTFSx86 NETWORK
Run by Owner at 23:36:28.88 on Fri 18/02/2011
Internet Explorer: 8.0.6001.19019
Microsoft? Windows Vista? Home Premium 6.0.6002.2.1252.61.1033.18.3069.1599 [GMT 10.5:30]

AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\Syste... Read more

Answer:infected Fake anti-virus program, program entitled ‘aaa’

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.Please take note:If you have since resolved the original problem you were having, we would appreciate you letting us know. If you are unable to create a log because your computer cannot start up successfully please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
If you are unsure about any of these characteristics just post what you can and we will guide you.Please tell us if you have your original Windows CD/DVD available.If you are unable to perform the steps we have recommended please try one more time and if unsuccessful alert us of such and we will design an alternate means of obtaining the necessary information.If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review your topic an do their best to resolve your issues.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply'... Read more

3 more replies
Relevance 58.22%

Hi all. My problem started shortly after i downloaded some new nvidia game card drivers. after being istalled it asked to have pc rebooted. once i reboot at the screen right before administrator log in, the screen just stayed black and did nothing else. i ran the pc in safe mode to get rid off watever the pc caught with Mc Cafee and comcast spyware removal which did not hlep at all. i tried other things like checking memory for error and other things but nothing fixed the black screen problem at that point i was about to just reprogram the whole pc but of course i could not find and still cant find any of my pc disks. the only thing that worked temporarily was the system restore which only worked from the F8 boot. i set it for a day back it recovered everything everything worked fine til the next day after i start the pc and everything was loaded a message poped for permision "block or unblock" a program with a program name i did knew which was EA for some games i play. as soon as i did that my pc got messed up again, it boots fine i can go on the enternet but can not run any programs at all. i get this mesage evertime i try to."An unidentified program wants access to your computer" msdig.exe unidentified publisher Cacel or Allow which i press cacel everytime worried that it might just make my pc even worst. i also noticed that the name of the unidentified publisher changes everyime i boot the pc. even when i try to start my enternet explorer it asks for a... Read more

Answer:Cant run any program'unidentified program wants acess to ur computer'pops everytime

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:23:22 PM, on 3/16/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18385)
Boot mode: Normal
Running processes:
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\comcasttb\CIDGlobalLight.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10c.exe
C:\Users\Borikua Flava\Desktop\HijackThis exe.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&s=1&o=vp32&d=1208&m=et1161-07
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&s=1&o=vp32&d=1208&m=et1161-07
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet ... Read more

2 more replies
Relevance 58.22%

Hello,

I have a computer Windows 7 64bit with the error of "STOP: C0000135 The program can't start because %hs is missing. Try resintalling the program". I initially cleaned the computer from viruses, after installing MSE and uninstalling Norton and Mcafee trials. There were a number of infected items that were removed, finally it reboot with this issue. Here is the log of Farbar Recovery Scan Tool x64.
Scan result of Farbar Recovery Scan Tool Version: 22-04-2012
Ran by SYSTEM at 23-04-2012 15:02:12
Running from K:\
Windows 7 Home Premium (X64) OS Language: Spanish Modern Sort
The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [8158240 2009-10-07] (Realtek Semiconductor)
HKLM\...\Run: [RunDLLEntry_THXCfg] C:\Windows\system32\RunDLL32.exe C:\Windows\system32\THXCfg64.dll,RunDLLEntry THXCfg64 [17920 2009-10-15] (Creative Technology Ltd.)
HKLM\...\Run: [RunDLLEntry_EptMon] C:\Windows\system32\RunDLL32.exe C:\Windows\system32\EptMon64.dll,RunDLLEntry EptMon64 [21504 2009-10-15] (Creative Technology Ltd.)
HKLM\...\Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [1436736 2011-06-15] (Microsoft Corporation)
HKLM-x32\...\Run: [IAStorIcon] C:&... Read more

Answer:STOP: C0000135 The program can't start because %hs is missing. Try resintalling the program

HiPlease do the following:Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below. (To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste). Save it on the flashdrive as fixlist.txt start
script removed
endNOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating systemNow please enter System Recovery Options then select Command PromptRun FRST64 and press the Fix button just once and wait.The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.Now restart, let it boot normally and tell me how it went.

12 more replies
Relevance 58.22%

I read in a book the article below.

A managemnet station, called manager, is a host that runs the SNMP cleint program.

A managened station, called an agent, is a router (or a host) that runs the SNMP server program.

What does the bolded phrase mean ?
 

Answer:Manager, client program and agent, server program concepts

Hey zillah,
Found a link that may explain the relationship better.

http://72.14.207.104/search?q=cache...NMP+client+program"&hl=en&gl=us&ct=clnk&cd=24

Hope that helps.
 

2 more replies
Relevance 58.22%

Hello,

I work as a computer technician at a small private college on the Eastern shore of Maryland. I am mainly a Macintosh technician but I am trying to boost my skills with Windows more. With all that said, I had a student drop off a computer to our help desk running Windows 7 with the error of "STOP: C0000135 The program can't start because %hs is missing. Try resintalling the program". I initially removed the hard drive and connected to one of our other Windows machines and scanned it externally using MalwareBytes and MSE. There were a number of infected items that both programs removed. I then reinstalled the hard drive and got the stop error again. After some Googling and seeing recommendations about AVG I check the Program Files via Command Prompt in the Recovery Console and AVG is not present.

I have used my box of tricks and need more help. If someone could help that would be great.

Matt

Answer:STOP: C0000135 The program can't start because %hs is missing. Try resintalling the program

Hello, the malware infected the consrv.dll file and was removed.Please go here....Preparation Guide ,do steps 6-9.Create a DDS log and post it in this topic,thanks.If GMER won't run skip it and move on.Let me know if that went well.

9 more replies
Relevance 58.22%

hey guys, im new to the forum i seen a few people on here are having the same problem as me.
heres what happened:
I had the zero access virus and a whole load of other viruses, i ran my AV to get rid of them now my pc wont boot.
i had a look around on the internet and it had a few registry fix's to do, but the keys wernt in my registry to edit :\
i ran FRST and have attached the log

please help me lol this is urgent!

Thanks,
Mat

Answer:STOP: C0000135 The program can't start because %hs is missing. Try resintalling the program

Hello diintzke,

Welcome to the forum.

Please copy and paste the logs instead of attaching it unless otherwise requested.

You have a dual boot system and FRST has scanned the Windows XP. Are you technical enough to remove the HD with Windows XP and run the FRST again or we should use another method to scan the system and recover it?

34 more replies
Relevance 58.22%

Hi, i have a Laptop with Windows seven on it. I have a problem since 2 days, when i boot my laptop, i have a blue screen with : STOP: C0000135 The program can't start because %hs is missing. Try resintalling the program ! I can't repair it with Win 7 reparator CD
I tried some tricks like modify enter in the reg. but nothing change !

I saw you helped someone who as the same issue, so i require your help ! Sorry for my english, it is quite bad but i french :s

Thanks for your fast answers !

Answer:STOP: C0000135 The program can't start because %hs is missing. Try resintalling the program

Edit : i can't use the Farbar tools, when i run it with the cmd prompt, it said : The subsystem needed to support the image type is not present.

>.<

Please help me guys, you seem to be the only one who can solve my issue !

15 more replies
Relevance 58.22%

.Hello i have windows 7 and it's been a few days that I can't even enter safe mode on my laptop, every time i turn it on, i get the followin message error: STOP: C0000135 The program can't start because %hs is missing. Try resintalling the program. I have tried to solve this problem by looking at older threads but didn't work. I wish you could help me step by step! I can't get very technical so please make it look easy! Thank you in advance, Marco.

Answer:STOP: C0000135 The program can't start because %hs is missing. Try resintalling the program

Restart the PCPress F8 on bootupSelect REPAIR YOUR COMPUTERClick on REPAIROn the System Recovery Options menu you will get the following options:Startup RepairSystem RestoreWindows Complete PC RestoreWindows Memory Diagnostic ToolCommand PromptCan you get to this screen?If yesSelect System restoreIf you have restore point before you had this issue try a system restore and let me know if it works.

27 more replies
Relevance 58.22%

As per BOOPME directions this new thread has been started. From original thread here - http://www.bleepingcomputer.com/forums/ind...p;#entry1967273.The Computer is a Dell Lattitude 620 with windows XP SP-3The issues are that the computer will not allow many programs to run "access is denied errors" or simply the program is killed when the icon is clicked on. This started when fraudware was present. I had removed the fraudware by removing the drive and attaching it to another win XP machine and running Microsoft security essentials, MBAM, Spybot S&D and Trend micro housecall scanner. I have followed the directions for steps 6-9 from "Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help, Instructions for receiving help in cleaning your computer". I had created another user with Aministrators rights to run this. Of note to sign off after creating the new user I had a message box for the MCI Command Handling Window - "Could not Close" error message hung on close.Step 6 - Disable your CD Emulation Software - goodStep 7 - Download and Run DDS which will create a log of programs running on your computer. Done created log files Step 8 - Create a GMER Log - downloaded and when clicked to run GMER is killed immeadiately. it will not run.Just a little more information about above XP Pro, The directions were followed after creating a new user with admin privilages. still waiting to hear anything.EDIT: Posts merged ~BP

Answer:ACCES TO PROGRAM DENIED OR PROGRAM KILLED ON ATTEMPTING TO START

You may close this thread as I have gone to the extreme step of backing up data & then doing a reformat & install.

2 more replies