What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

hijacklog June3rd/05

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi All:
Recently been having a problem with Windows shutting down and restarting.
Usually occurs about one a day…sometimes twice. Does not seem to make
a difference in what I am doing, although I would have to say more often the crash occurs while playing games online(pogo) or at other times playing a soft ware game(s) I installed some time ago.
I believe I have cleaned up all the trash in the computer, ran Spybot S&D, Grisoft AVG and Lavasoft Ad-Aware but the crashing continues . I do have a suspicion that there may be a bad driver but that's just a quess.

Had a thought about hijacking so…….I am posting the latest hijackthis log file from my computer just in case there is something listed in log that should not be there.


Logfile of HijackThis v1.99.0
Scan saved at 5:08:30 PM, on 6/3/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\GuruNet\GuruNet.exe
C:\PROGRA~1\COMMON~1\GURUNE~1\agtserv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Fast.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Hijackthis\hijackthis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ca4.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: GuruNet - {E8893D9E-169E-4a05-B0B6-FC5809D1AA77} - C:\PROGRA~1\GuruNet\Toolbar\GuruNetToolbarU.dll
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Event Reminder.lnk = ?
O4 - Global Startup: GuruNet.lnk = C:\Program Files\GuruNet\GuruNet.exe
O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: GuruNet… - file:C:\Program Files\GuruNet\Html\atiemenu.htm
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy (file missing)
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy (file missing)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sandra Data Service - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR1\RpcDataSrv.exe
O23 - Service: Sandra Service - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR1\RpcSandraSrv.exe

Appreciate all and any help and suggestions

Alf
Post #2
Hello alf, Welcome to TomCoyote forum and sorry to keep you waiting. The only thing I see wrong in this log is an outdated HijackThis.exe. We are running version 1.99.1. You can update from within the software like this: Open HJT > Open the Misc Tools section > Scroll to Check for update online > Follow instructions. Since the new log will show another area you may post another log if you wish. I suggest you post here:
http://forums.tomcoyote.org/index.php?showforum=83 to see if they can help. This does not sound like a malware problem. Sounds like it could be overheating?

Thanks…pskelley
TomCoyote forum
Slyware Warrior
Post #3
pskelley: Appreciate the information and helpful advice. I actually thought I had the latest version of hijackThis- thanks for the help there. Not sure about the suggestion of overheating….could be I quess have not checked the reading in the bios for some time. I will follow your suggestions by updating the HJT and reposting. Thank You for your help and suggestions Alf
Post #4
Hello Alf, I might be able to tell you more once I have viewed the new log. An additional area "Winlogon" 020 is displayed and I can see if there are problems in that area.

Not sure about the suggestion of overheating….could be I quess have not checked
the reading in the bios for some time.

I used to do a load of general troubleshooting but it's been a couple of years. I spend so much time removing malware it's hard to keep up but I can tell you that once viruses like blaster, etc. are ruled out, and you usually know when they are onboard because of the shutdown messages, the next thing to look for are overheating (fans dirty) etc. I would also check all of your plugs, one that is not totally seated could cause a problem, check your power supply cords and your power supply. There are so many things it could be. Here are some ideas from Google:
http://www.google.com/search?sourceid=navc…troubleshooting Posting at the General Computer forum may also help. Make sure you supply as much information as possible, especially any error messages you are receiving, any new hardware or software you have recently installed. If you recently installed SP2. The more information the better.

Thanks…pskelley
Post #5
Hi: pskelley Thanks for the response to my post O/S Windows XP Home Edition HP Pavilion 521n As suggested I have updated HJT and looked into the basic operations of this computer. Generally things seem alright. Connections seem okay, fans running at normal speed (Main fan 1998)(CPU 4147 - temp 98.5f) . Reran AVG, Spybot S&D, Ad-Aware and even ran Panda virus - did not find much. I have not added any new hardware, the only fairly recent (2 months ago) software installed was "Service Pack 2" and the reason for the install was (1) security etc - and - (2) I was hoping the problem with crashing would be fixed. Well my security may be better but the crashing has continued. Will take your suggestion and put some info together and post in the General Forum. On the subject of posting would I be in error if I posted a new updated HJT Log in the old thread or do I start a new thread? Again Thank You for the help and assistance Regards Alf PS: I should mention: Browsed the suggested Elder Geek site, lots of info there. Think a guy would have to be careful tho.
Post #6
Hi Alf, Post your HJT log with the version 1.99.1 in this same thread. Start a new thread when you post at the other link. You can link them to this thread if you wish so they will know what you have had done. I have the ElderGeek in my favorites, and as far as I know it is a very reputable site. Thanks…Phil
Post #7
Hi pskelley, Thanks again for the prompt repy to my post. As per your instructions I will post a new HJT Log to this thread. following that I will collect info and post to the the other site previously suggested. With reference to the Elder Geek site I to have the site in my Favorites and have had for some time. I to beleive it a very reputable site. My sincere apologies to all If my comment was taken to be desparaging in any way to the Elder Geek site. That certainly was not my intention . To clarify…the intention of my remark was that "I" have to be careful but not because of the information provided at the Elder's site but because of my limited knowledge of many of the sublects. No doubt the comment was poorly phrased - caution required Again thank you for the help and assistance Regards Alf
Post #8
no malware/overheating? Suggested the general computing forum.


If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI