[IOStream]

I have a problem with bootup that has to do with explorer.exe (I'm pretty sure)

The computer boots up --> Welcome screen --> Desktop background --> Folder "My Documents" is open
*** OR ***
The computer boots up --> Welcome screen --> Desktop background --> Icons and Start bar flicker --> Blue Screen --> Do NOT pass "Go" (Bill gates will go ahead and collect that $200 for you :wink: ) GO DIRRECTLY TO...

When I go into "Safe Mode" The message "This is the uber cool safe mode." shows up, but after that nothing. Taking a look at task manager it seems that explorer.exe has shut itself off, or perhaps "crashed" without notice (no error pops up or anything). Safe Mode with command prompt enables me to copy the explorer.exe file from my jump-drive (taken from another Windows XP SP1 Machine) to my C:\WINDOWS dirrectory. After that I can boot up somewhat normally, HOWEVER, after I restart once again, back to the same problem (But safe mode always boots up the same, no matter what). Explorer.exe has been overwritten maybe?

Well, thats my pro-blem-o.
Thanks for the help, or at least taking the 23 and a half seconds to read this.

--+IOStream+--

PC Specs
-------------
DELL
Windows XP Home SP1 (Not mine.. I'm "fixing" it)
I think 256 RAM
Bout all I know bout it.

[ladygreenwitch]

:-D Hey IOStream,

Welcome to PCHF. Don't throw it out the window just yet, we have an awsome team of folks here, and I am positive that we are going to be able to help you fix this PC.

Sounds like some RLMs (rotton little monsters) have decided to infect this PC. Can you please download CCLeaner and HijackThis! from my signature. Get the machine to boot up, install the two programs. It is important that HJT be installed in its own folder. Run CCleaner with all options selected, including Advanced, answer Yes to all warnings. Click on Analyze, when it is finished, click on Run Cleaner.

Before running HJT, make sure that all files and folders are showing if possible, Windows Exploere, Tools, Folder Options, View, Show all Hidden Files and Folders. Run HJT with the top option, save the log. Attach it back here at the bottom of your post.

Look forward to your reply,

TTFN

T

[joe5]

Also give this a go:

go to start / run and in the run window type in:
sfc /scannow >enter
Have you XP CD in youre drive, and it'll run itself, replacing any missign or damaged protected XP files.

and:

Thanks for the help, or at least taking the 23 and a half seconds to read this.

It only toke me 21 :-P

[IOStream]

I'll have to hit some of this stuff up after work. Thanks for the help.

I know that this stuff is happenin because of spyware/adware/Virus/Trojans... thats the reason this computer is in my home. I've ran ad-aware on it, PC Doctor, Panda online anti-virus scan, and I have edwido Security Suite on it as well. Most of the things I've tried to do manually, because these programs dont get rid of the bad things, or they just keep comming back. One of the things that I've had problems with on this is Look2Me, but I think its gone now.. have to check into that further later.

[ladygreenwitch]

:-D Hey IOstream,

Lots of the time, when you try to get rid of the RLMs, (rotton little monsters) you don't do things in the right order or in the right combination, so you just keep reinfecting yourself. Luckily, that's what we're here for :wink: .

We'll look forward to your reply, so we can get you all cleaned up.

TTFN

T

[IOStream]

Ok, I'm home, and back on the fixing of this horrid computer.

I ran HJT again, and it looks like the stuff I removed before has come back. :banghead:

Here is my log. I also went through and colored all the stuff red that I thought should be removed. Please check my markings, and tell me if I'm way off, or if I missed something.

I downloaded a little program called "ISearchFix". Just so you know I'm equipped with that. Dont quite know yet if its useful, but might be to get rid of one of the infections.

-------------------------------------------------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 5:30:31 PM, on 9/27/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\System32\svchost.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\System32\wuauclt.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cedar-rapids.mchsionline.net/community
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/yco.../www.yahoo.com
R3 - URLSearchHook: (no name) - {F7655B31-8D90-7C1D-E467-1632B8BD5914} - C:\WINDOWS\Lfkjglfv.dll
F2 - REG:system.ini: Shell=Explorer.exe,C:\WINDOWS\Nail.exe
O2 - BHO: PicShow Class - {4487598C-2EC7-43A2-870E-6D8D720FDD9F} - C:\WINDOWS\System32\pkshjjgr.dll (file missing)
O2 - BHO: (no name) - {45A8878C-3C80-0EA2-998E-1B0C6F342ABF} - C:\WINDOWS\Lfkjglfv.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: CIEPl Object - {7A2A1842-1BEB-4F2D-9B06-D59C46D74A2E} - C:\WINDOWS\system32\awtss.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: Search - {70B5CDCA-0FED-595D-7DA3-E7CBF76A8F74} - C:\WINDOWS\Lfkjglfv.dll
O4 - HKLM\..\Run: [MCAgentExe] C:\Program Files\McAfee.com\Agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
O4 - HKLM\..\Run: [DSL Connection Tool] C:\Program Files\MSN\MSNIA\dslmon.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearc...p=ZNxdm00644US
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra 'Tools' menuitem: Java - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/actives...ree/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = JTFISHER
O17 - HKLM\Software\..\Telephony: DomainName = JTFISHER
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = JTFISHER
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = JTFISHER
O20 - AppInit_DLLs: C:\WINDOWS\System32\mgnkqvhj.dll
O20 - Winlogon Notify: awtss - C:\WINDOWS\SYSTEM32\awtss.dll
O20 - Winlogon Notify: MCD - C:\WINDOWS\system32\DPAUTH.DLL
O23 - Service: Command Service (cmdService) - CMD Technology, Inc. - (no file)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Mcafee.com Corporation - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe

-------------------------------------------------------------------------------

[ladygreenwitch]

:-D Hey,

Pretty good on your HJT read, let me take a real close look at it tho, from a cursory glance you are going to need some additional downloads.

I'll be right back.

TTFN

T