Question

eamoss

My friends computer is a bit messed up.

1st of all I was went over there to try and see why youtube.com wasnt working, it wud load the home page but once I went to search something it stoped loading after it had loaded the header.

Then I downloaded firefox but I cudnt even get the homepage to load.

Then I tryed task manager but I cud only see 'applications' like I cudnt see the tap for processes or even file ect.

Then I tried to restore the computer but once I got and window open the program wouldnt load like the egg timer wud come up but then it wud go away and still the computer wudnt load!

Wud it be a case of RAM or something?

How do I fix it?

Formatting the best option?

Anti

yes. format it

eamoss

Thing is I formatted the hard drive a few months ago!!

Ruu_Old

A few system details would be good.

eamoss

Im not too sure myself all I know its a Dell Dimension 2XXX about 256RAM(I think) will I download hijack and get the details put them up here?

Ruu_Old

Yeah go ahead and do so. Windows XP I assume?

eamoss

Flippin hell some ppl r just dumb when it comes to computers!! It took me 30mins for him 2 send a file over on msn!

Anyway

Logfile of HijackThis v1.99.1
Scan saved at 15:43:18, on 15/08/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Documents and Settings\dell\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?x=wKX1ILEOi+Vh7AfA98Gm4Me69ZMbubcD6jnrmkc3gR33x8j42fFLu52nVQT663oNDwJzpawPJ4ega7SVnsKyclK7Ifh6dhs48L6sxNDLEEVdACKOJMo1MQ2OJWEnMMnFqkgA0cw+sZ7HZNMXaicYp8plcqHBfVCiWHzpm0h3qTWVILkWpMNv33XgUnIseGVj
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Starware - {CA356D79-679B-4b4c-8E49-5AF97014F4C1} - C:\Program Files\Starware\bin\Starware.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\***xm.ocx
O3 - Toolbar: Starware - {D49E9D35-254C-4c6a-9D17-95018D228FF5} - C:\Program Files\Starware\bin\Starware.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunServices: [Microsoft Windows Autowckx] autowckx.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: E&xport to Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/29efd93cebb19d35fa23/netzip/RdxIE601.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1135815153055
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Ruu_Old

I think the one below is a problem, according to google its a backdoor, worm like virus.

O4 - HKLM\..\RunServices: [Microsoft Windows Autowckx] autowckx.exe

Go into safe mode and scan for viruses. Open msconfig.exe from the Run box, and untick the above file from the Startup tab.

irlrobins

Run your log thru this.

One bad hit on it alright.

kippy

When you formated the machine a few months ago did you install all the latest updates an configure the machine to update automaticilly, did you install and AV and also configure to update automaticilly?
Will be well worth it next time as you may have a few problems getting rid of that Virus.
Kippy