Hiya All,

I'm at my wits end with this problem.

This PC just hangs at any given point in time and can has to be switched off at the mains in order to rectify it. I have scan for viruses using EZ Anti virus, as well as spyware using AdAware. Found no viruses, and AdAware found some problems and cleaned them up.

I have once before had this problem and it turned out to be faulty memory, so last night I left the PC running a memory test loop but nothing wrong was found.

As a last resort I am posting my HiJackThis log on this forum in an attempt to hopefully have someone find some problems.

PC is running Windows 2003 Server Enterprise Edition.

Thanks for any help.

Logfile of HijackThis v1.99.1
Scan saved at 3:11:14 PM, on 19/10/2006
Platform: Windows 2003 SP1 (WinNT 5.02.3790)
MSIE: Internet Explorer v6.00 SP1 (6.00.3790.1830)
Windows folder: C:\WINDOWS
System folder: C:\WINDOWS\SYSTEM32
Hosts file: C:\WINDOWS\System32\drivers\etc\hosts

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Juniper\NetScreen-Remote\IreIKE.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\keyhook.exe
C:\Program Files\Remote Desktop for Mobiles\rdmserver_cpanel.exe
C:\Program Files\tcpIQ\Line Speed Meter\LineSpeedMeter.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe
C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Juniper\NetScreen-Remote\SafeCfg.exe
C:\Program Files\Juniper\NetScreen-Remote\IPSecMon.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\aaNet Usage Meter\usage.exe
C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Program Files\BPFTP Server\bpftpserver.exe
C:\Program Files\UltraVNC\vncviewer.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft Office XP\Office10\msoffice.exe
E:\GMC\Bunnings\mysql\bin\mysqld-nt.exe
C:\Program Files\Common Files\pestpatrol\ppRemoteService.exe
C:\Program Files\Remote Desktop for Mobiles\rdmserv.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe
C:\Program Files\UltraVNC\WinVNC.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.Exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\karen\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://shdoclc.dll/softAdmin.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O1 - Hosts: 210.8.119.186 MCMS
O1 - Hosts: 202.164.203.65 ninelives
O1 - Hosts: 202.164.203.65 nineliveslaptop
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (filesize 63128 bytes, MD5 F17B2B264072B921FC66A0BE16626BAB)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll (filesize 434279 bytes, MD5 162186B53BBB5964F9E806F96934338E)
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" (filesize 968696 bytes, MD5 71514E2C74D554F5902DC184046ECA3B)
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\UltraVNC\WinVNC.exe" -servicehelper (filesize 712704 bytes, MD5 913FF5A608DE6A2AB320EB919092049A)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE (filesize 77824 bytes, MD5 6351B9D79370A6795921FA3C3950DED6)
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exeC:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [RDM Control Panel] "C:\Program Files\Remote Desktop for Mobiles\rdmserver_cpanel.exe" /min (filesize 592896 bytes, MD5 C03D2339D2CFE1D25C954C50ABD9F5F7)
O4 - HKLM\..\Run: [Line Speed Meter] C:\Program Files\tcpIQ\Line Speed Meter\LineSpeedMeter.exe -minimize (filesize 2990080 bytes, MD5 3CB3FADED4737422B5B17AF6440AA8FF)
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe" (filesize 185896 bytes, MD5 EEBEF3B6A9209AF0F1C5397E46A869C5)
O4 - HKLM\..\Run: [CaISSDT] "C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe" (filesize 159744 bytes, MD5 E4E22D25C74B4D1F571D27548CEED7C7)
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe" (filesize 230952 bytes, MD5 C5F044AE416BD8200C7C6DE5C601FCD7)
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe" (filesize 90112 bytes, MD5 7B28D0C461AEE3502D4338C4D13101E1)
O4 - HKCU\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe" (filesize 517632 bytes, MD5 107AF2DE3AF10D6D09C1B36FE9EF9156)
O4 - Startup: aaNet Usage Meter.lnk = C:\Program Files\aaNet Usage Meter\usage.exe (filesize 122880 bytes, MD5 4AE47097236CC8D1D4EA5459D1D57F8B)
O4 - Startup: BulletProof FTP Server.lnk = C:\Program Files\BPFTP Server\bpftpserver.exe (filesize 793088 bytes, MD5 513702EA9C362EF8AD9FB12AA0C7FFBF)
O4 - Startup: Run UltraVNC Viewer (Listen Mode).lnk = C:\Program Files\UltraVNC\vncviewer.exe (filesize 749568 bytes, MD5 95973838DF1345AB4A28F346443F1CF3)
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office XP\Office10\OSA.EXE (filesize 83360 bytes, MD5 5BC65464354A9FD3BEAA28E18839734A)
O4 - Global Startup: NetScreen-Remote.lnk = C:\Program Files\Juniper\NetScreen-Remote\SafeCfg.exe (filesize 65588 bytes, MD5 C402DD23D8E1F5DAD8755248AAD73671)
O4 - Global Startup: Shortcut to taskmgr.lnk = C:\WINDOWS\system32\taskmgr.exe (filesize 168448 bytes, MD5 5DA9698B46F46AD585A4DEEBC265700A)
O4 - Global Startup: VNC Tray Icon.lnk = C:\Program Files\UltraVNC\winvnc.exe (filesize 712704 bytes, MD5 913FF5A608DE6A2AB320EB919092049A)
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll (filesize 434279 bytes, MD5 162186B53BBB5964F9E806F96934338E)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll (filesize 434279 bytes, MD5 162186B53BBB5964F9E806F96934338E)
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (filesize 225280 bytes, MD5 B7FD99A3C7187D347C94487F2B8D8784)
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (filesize 225280 bytes, MD5 B7FD99A3C7187D347C94487F2B8D8784)
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (filesize 225280 bytes, MD5 B7FD99A3C7187D347C94487F2B8D8784)
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (filesize 225280 bytes, MD5 B7FD99A3C7187D347C94487F2B8D8784)
O16 - DPF: {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} (Dldrv2 Control) - http://download.gigabyte.com.tw/object/Dldrv.ocx
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1153190367578
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://msacpsts001.msa.com.au/msrdp.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (filesize 866304 bytes, MD5 AE87B0E59F65E49664E511A45DA4737A)
O20 - Winlogon Notify: ckpNotify - C:\WINDOWS\SYSTEM32\ckpNotify.dllC:\WINDOWS\SYSTEM32\ckpNotify.dll
O20 - Winlogon Notify: dimsntfy - C:\WINDOWS\SYSTEM32\dimsntfy.dllC:\WINDOWS\SYSTEM32\dimsntfy.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exeC:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exeC:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates International Inc. - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exeC:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: SafeNet Monitor Service (IPSECMON) - SafeNet - C:\Program Files\Juniper\NetScreen-Remote\IPSecMon.exeC:\Program Files\Juniper\NetScreen-Remote\IPSecMon.exe
O23 - Service: SafeNet IKE Service (IreIKE) - SafeNet - C:\Program Files\Juniper\NetScreen-Remote\IreIKE.exeC:\Program Files\Juniper\NetScreen-Remote\IreIKE.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exeC:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: MySql - Unknown owner - E:/GMC/Bunnings/mysql/bin/mysqld-nt.exeE:/GMC/Bunnings/mysql/bin/mysqld-nt.exe
O23 - Service: PestPatrol Remote - Computer Associates International, Inc. - C:\Program Files\Common Files\pestpatrol\ppRemoteService.exeC:\Program Files\Common Files\pestpatrol\ppRemoteService.exe
O23 - Service: Remote Desktop for Mobiles (RDMServer) - ZZZ Software - C:\Program Files\Remote Desktop for Mobiles\rdmserv.exeC:\Program Files\Remote Desktop for Mobiles\rdmserv.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exeC:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exeC:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exeC:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exeC:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exeC:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\UltraVNC\WinVNC.exe" -service (file missing)