Windows XP Home Edition 2002 AMD Athlon 1500 1.33 766 Micron DDR I normally play Dark Age of Camelot. About two weeks ago I started to have terrible linkdead problems. This is what I have done so far. Called the cable company, they switched the splitter out and boosted my signal to the network connection. Installed Nortan Super Disk 2003 Antivirus and found nothing, but it is disabled for several seconds while windows loads. Installed Ad-ware and removed 268 incidents (I know that is bad). Tried to use F-prot. It hangs. Tried to use www.trojanscan.com. It hangs. Installed Zonealarm. Installed HijackThis and have a report for you guys if anyone can help me. I am going to try to run a diagnostic on my router. I have a feeling my system is infected with something I cant find.

Hi Erik, 268 I hope those were all cookies, but from what you're telling, I expect to see some bad stuff in your HjT log. Before you post the log, do at least one Anti-Virus scan, and Spybot and TDS3. Anti-Virus: ▫ [on-line] BitDefender Anti-Virus ▫ [on-line] RAV Anti-Virus (AV Security) ▫ [on-line] ActiveScan Anti-Virus (Panda) ▫ [on-line] HouseCall Anti-Virus (Trend Micro) ▫ nod32 Anti-Virus (eset) ▫ F-Prot Anti-Virus (F-Secure) ▫ AVG Anti-Virus (Grisoft) Anti-Spyware: ▫ Spybot Search & Destroy (Safer Networking) ▫ Ad-aware (Lavasoft) ▫ [on-line] TrojanScan (GFi) ▫ TDS-3 (DiamondCS) ▫ Pest Patrol ▫ CWShredder (Merijn.org) Keep in mind that some of them may need to be updated over the web first when started, and before zapping the baddies! After zapping, create a new HjT log & post it. HijackThis Log Requested...............................................HjT® ___________________________________________ ☺ [Belgium, GMT+1]_________________________svg

Try the http://housecall.trendmicro.com/ My friend ran into the agobot virus that was not being detected by Norton Antivirus and it was stopping the Norton 2003 from functioning!

Sorry it took so long. I am also sorry for the mess as well :) I have never been very good at completely removing programs. The majority of the Ad-ware was cookie related. I spoke with Netgear, I have a RP114. They told me there are no diagnostic applications for their routers. I installed the newest firmware as well. I am also changing out the coaxial cable and the cat5. Can routers intermitiately work? I figured they would just die. Something else I remember in the past few days was my cpu usage on the game.dll of the game I play went to 99% when I started to have problems. Not sure if that helps. Additionally, I have 2 other computers on my network, yet they may or may not act up at the same time as my main computer (ie this one). One particular program I run on a seperate computer is Teamspeak. When I am having problems, I am able to hear the other people clearly, but they tell me I am garbled when I speak. This seems to me that my upload stream is being maxxed <- think this is a key to my problem. Maybe someone downloading from me? Lastly, I have friends who play on the same node as I do, and they are not having problems so it is "likely" not the cable company's issue. Nevertheless, here is what you asked for... ********** BitDefender Log (I do not know how to remove these) Memory unable to check (When I used F-Prot it said the memory was fine) C:\Documents and Settings\Erik Tucker\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst=>[Subject: Let's be friends][From: halo]=>(body)=>(Compressed Rtf) suspect: Exploit.Iframe.Vulnerability C:\Documents and Settings\Erik Tucker\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst=>[Subject: Congratulations][From: bchase]=>(body)=>(Compressed Rtf) suspect: Exploit.Iframe.Vulnerability C:\Documents and Settings\Erik Tucker\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst=>[Subject: Log File][From: a-sbono]=>(body)=>(Compressed Rtf) suspect: Exploit.Iframe.Vulnerability C:\Documents and Settings\Erik Tucker\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst=>[Subject: Full coverage][From: miprobst]=>(body)=>(Compressed Rtf) suspect: Exploit.Iframe.Vulnerability C:\System Volume Information\_restore{CCFC96B1-CA22-450D-891E-88FD4A3A560F}\RP652\A0120035.exe infected: Trojan.PWS.WinterNights.A C:\System Volume Information\_restore{CCFC96B1-CA22-450D-891E-88FD4A3A560F}\RP652\A0120035.exe unable to disinfect D:\system.sav\RESVFMBR.exe suspect: Dos.MBRInfector D:\system.sav\RESVFMBR.exe copied ********** Spybot Search & Destroy (I was able to remove all of these) Alexa Related: What's related link (Replace file, nothing done) C:\WINDOWS\Web\related.htm Avenue A, Inc.: Tracking cookie or cookie of tracking site (File, nothing done) C:\Documents and Settings\Erik Tucker\Cookies\erik tucker@atdmt[2].txt Commission Junction: Tracking cookie or cookie of tracking site (File, nothing done) C:\Documents and Settings\Erik Tucker\Cookies\erik tucker@qksrv[1].txt CommonName: Temporary directory (Directory, nothing done) C:\WINDOWS\Temp\Adware DoubleClick: Tracking cookie or cookie of tracking site (File, nothing done) C:\Documents and Settings\Erik Tucker\Cookies\erik tucker@doubleclick[1].txt DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004=W=3 DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004=W=3 DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\S-1-5-21-2935130677-2902548653-3136207814-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004=W=3 DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004=W=3 DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004=W=3 NewsUpdate: Ad settings (Registry key, nothing done) HKEY_LOCAL_MACHINE\Software\Creative Tech\Software Installed\News NewsUpdate: Class (Registry key, nothing done) HKEY_CLASSES_ROOT\CTMARQ.CTMarqCtrl.1 NewsUpdate: Class ID ( (CTMarq Property Page)) (Registry key, nothing done) HKEY_CLASSES_ROOT\CLSID\{C1B43B82-8B3C-11D4-B615-00A0C98E9F5B} NewsUpdate: Class ID (Registry key, nothing done) HKEY_CLASSES_ROOT\CLSID\{C1B43B81-8B3C-11D4-B615-00A0C98E9F5B} NewsUpdate: Interface ( (_DCTMarqEvents)) (Registry key, nothing done) HKEY_CLASSES_ROOT\Interface\{C1B43B80-8B3C-11D4-B615-00A0C98E9F5B} NewsUpdate: Interface ( (_DCTMarq)) (Registry key, nothing done) HKEY_CLASSES_ROOT\Interface\{C1B43B7F-8B3C-11D4-B615-00A0C98E9F5B} NewsUpdate: Program directory (Directory, nothing done) C:\Program Files\Creative\News NewsUpdate: Typelib (Registry key, nothing done) HKEY_CLASSES_ROOT\Typelib\{C1B43B7E-8B3C-11D4-B615-00A0C98E9F5B} --- Spybot-S&D version: 1.2 --- 2004-02-26 Includes\Cookies.sbi 2004-02-29 Includes\Dialer.sbi 2004-02-29 Includes\Hijackers.sbi 2004-02-26 Includes\Keyloggers.sbi 2004-02-29 Includes\Malware.sbi 2003-03-16 Includes\plugin-ignore.ini 2004-03-09 Includes\Revision.sbi 2004-02-26 Includes\Security.sbi 2004-02-29 Includes\Spybots.sbi 2003-03-16 Includes\Temporary.sbi 2004-02-26 Includes\Tracks.uti 2004-02-29 Includes\Trojans.sbi ********** TDS-3 (I removed audioscrobbler) Scan Control Dumped @ 22:25:22 19-03-04 (DELETED) Suspicious Filename: Dual extensions File: c:\documents and settings\erik tucker\desktop\audioscrobbler.wmp.1.0.2.exe ********** HijackThis StartupList report, 3/19/2004, 10:35:07 PM StartupList version: 1.52 Started from : C:\Documents and Settings\Erik Tucker\My Documents\download\irranshalee\hijackthis\hijackthis\HijackThis.exe Detected: Windows XP SP1 (WinNT 5.01.2600) Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106) * Using default options * Including empty and uninteresting sections * Showing rarely important sections ================================================== Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\System32\devldr32.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe C:\Program Files\Compaq\Compaq Advisor\bin\compaq-rba.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\WINDOWS\system32\pctspk.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\system32\NOTEPAD.exe C:\Program Files\Messenger\msmsgs.exe C:\Documents and Settings\Erik Tucker\My Documents\download\irranshalee\hijackthis\hijackthis\HijackThis.exe --------------------- Listing of startup folders: Shell folders Startup: [C:\Documents and Settings\Erik Tucker\Start Menu\Programs\Startup] *No files* Shell folders AltStartup: *Folder not found* User shell folders Startup: *Folder not found* User shell folders AltStartup: *Folder not found* Shell folders Common Startup: [C:\Documents and Settings\All Users\Start Menu\Programs\Startup] *No files* Shell folders Common AltStartup: *Folder not found* User shell folders Common Startup: *Folder not found* User shell folders Alternate Common Startup: *Folder not found* --------------------- Checking Windows NT UserInit: [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] UserInit = C:\WINDOWS\system32\userinit.exe, [HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon] *Registry key not found* [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] *Registry value not found* [HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon] *Registry key not found* --------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\Run WCOLOREAL = "C:\Program Files\COMPAQ\Coloreal\coloreal.exe" srmclean = C:\Cpqs\Scom\srmclean.exe UpdReg = C:\WINDOWS\Updreg.exe AHQInit = C:\Program Files\Creative\SBLive\Program\AHQInit.exe ATIPTA = C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe ccApp = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" ccRegVfy = "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" Zone Labs Client = C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe --------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce (Default) = C:\Program Files\Compaq\Compaq Advisor\bin\compaq-rba.exe -z --------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx *No values found* --------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices *Registry key not found* --------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce *Registry key not found* --------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run *No values found* --------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce *No values found* --------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx *Registry key not found* --------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices *Registry key not found* --------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce *Registry key not found* --------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run *Registry key not found* --------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run *Registry key not found* --------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\Run [OptionalComponents] *No values found* --------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce *No subkeys found* --------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx *No subkeys found* --------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices *Registry key not found* --------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce *Registry key not found* --------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows\CurrentVersion\Run *No subkeys found* --------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce *No subkeys found* --------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx *Registry key not found* --------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices *Registry key not found* --------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce *Registry key not found* --------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run *Registry key not found* --------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run *Registry key not found* --------------------- File association entry for .EXE: HKEY_CLASSES_ROOT\exefile\shell\open\command (Default) = "%1" %* --------------------- File association entry for .COM: HKEY_CLASSES_ROOT\comfile\shell\open\command (Default) = "%1" %* --------------------- File association entry for .BAT: HKEY_CLASSES_ROOT\batfile\shell\open\command (Default) = "%1" %* --------------------- File association entry for .PIF: HKEY_CLASSES_ROOT\piffile\shell\open\command (Default) = "%1" %* --------------------- File association entry for .SCR: HKEY_CLASSES_ROOT\scrfile\shell\open\command (Default) = "%1" /S --------------------- File association entry for .HTA: HKEY_CLASSES_ROOT\htafile\shell\open\command (Default) = C:\WINDOWS\System32\mshta.exe "%1" %* --------------------- Enumerating Active Setup stub paths: HKLM\Software\Microsoft\Active Setup\Installed Components (* = disabled by HKCU twin) [>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] StubPath = C:\WINDOWS\INF\unregmp2.exe /ShowWMP [>{26923b43-4d38-484f-9b9e-de460746276c}] * StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE [>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] * StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE [>{9A5A76F5-042A-4336-B7C6-E3B729E324A2}] * StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP [{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] * StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll [{306D6C21-C1B6-4629-986C-E59E1875B8AF}] * StubPath = "C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Messenger\msgsc.dll",HideIconsUser [{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] * StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install [{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] * StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT [{5945c046-1e7d-11d1-bc44-00c04fd912be}] * StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser [{6BF52A52-394A-11d3-B153-00C04F79FAA6}] * StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub [{7790769C-0471-11d2-AF11-00C04FA35D02}] * StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install [{89820200-ECBD-11cf-8B85-00AA005B4340}] * StubPath = regsvr32.exe /s /n /i:U shell32.dll [{89820200-ECBD-11cf-8B85-00AA005B4383}] * StubPath = %SystemRoot%\system32\ie4uinit.exe --------------------- Enumerating ICQ Agent Autostart apps: HKCU\Software\Mirabilis\ICQ\Agent\Apps *Registry key not found* --------------------- Load/Run keys from C:\WINDOWS\WIN.INI: load=*INI section not found* run=*INI section not found* Load/Run keys from Registry: HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found* HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found* HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found* HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found* HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found* HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found* HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found* HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found* HKCU\..\Windows NT\CurrentVersion\Windows: load= HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found* HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found* HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found* HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs= --------------------- Shell & screensaver key from C:\WINDOWS\SYSTEM.INI: Shell=*INI section not found* SCRNSAVE.EXE=*INI section not found* drivers=*INI section not found* Shell & screensaver key from Registry: Shell=Explorer.exe SCRNSAVE.EXE=*Registry value not found* drivers=*Registry value not found* Policies Shell key: HKCU\..\Policies: Shell=*Registry key not found* HKLM\..\Policies: Shell=*Registry value not found* --------------------- Checking for EXPLORER.exe instances: C:\WINDOWS\Explorer.exe: PRESENT! C:\Explorer.exe: not present C:\WINDOWS\Explorer\Explorer.exe: not present C:\WINDOWS\System\Explorer.exe: not present C:\WINDOWS\System32\Explorer.exe: not present C:\WINDOWS\Command\Explorer.exe: not present C:\WINDOWS\Fonts\Explorer.exe: not present --------------------- Checking for superhidden extensions: .lnk: HIDDEN! (arrow overlay: yes) .pif: HIDDEN! (arrow overlay: yes) .exe: not hidden .com: not hidden .bat: not hidden .hta: not hidden .scr: not hidden .shs: HIDDEN! .shb: HIDDEN! .vbs: not hidden .vbe: not hidden .wsh: not hidden .scf: HIDDEN! (arrow overlay: NO!) .url: HIDDEN! (arrow overlay: yes) .js: not hidden .jse: not hidden --------------------- Verifying REGEDIT.exe integrity: - Regedit.exe found in C:\WINDOWS - .reg open command is normal (regedit.exe %1) - Company name OK: 'Microsoft Corporation' - Original filename OK: 'REGEDIT.EXE' - File description: 'Registry Editor' Registry check passed --------------------- Enumerating Browser Helper Objects: (no name) - C:\Program Files\Mediacom\BBClient\Programs\SaBHO.dll - {058FC709-D5CD-4A95-92DB-59E6488ECDA4} (no name) - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} NAV Helper - C:\Program Files\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872} --------------------- Enumerating Task Scheduler jobs: Registration reminder 1.job Registration reminder 2.job Registration reminder 3.job Symantec NetDetect.job --------------------- Enumerating Download Program Files: [Microsoft XML Parser for Java] CODEBASE = file://C:\WINDOWS\Java\classes\xmldso.cab OSD = C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd [Shockwave ActiveX Control] InProcServer32 = C:\WINDOWS\system32\Macromed\Director\SwDir.dll CODEBASE = http://active.macromedia.com/director/cabs/sw.cab [Scanner Class] InProcServer32 = C:\temp\TDECntrl\TDECntrl.dll CODEBASE = http://www.trojanscan.com/trojanscan/TDECntrl.CAB [AvxScanOnline Control] InProcServer32 = C:\WINDOWS\DOWNLO~1\BITDEF~1.OCX CODEBASE = http://www.bitdefender.com/scan/Msie/bitdefender.cab [Shockwave Flash Object] InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocx CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab --------------------- Enumerating Winsock LSP files: NameSpace #1: C:\WINDOWS\System32\mswsock.dll NameSpace #2: C:\WINDOWS\System32\winrnr.dll NameSpace #3: C:\WINDOWS\System32\mswsock.dll Protocol #1: C:\WINDOWS\system32\mswsock.dll Protocol #2: C:\WINDOWS\system32\mswsock.dll Protocol #3: C:\WINDOWS\system32\mswsock.dll Protocol #4: C:\WINDOWS\system32\rsvpsp.dll Protocol #5: C:\WINDOWS\system32\rsvpsp.dll Protocol #6: C:\WINDOWS\system32\mswsock.dll Protocol #7: C:\WINDOWS\system32\mswsock.dll Protocol #8: C:\WINDOWS\system32\mswsock.dll Protocol #9: C:\WINDOWS\system32\mswsock.dll Protocol #10: C:\WINDOWS\system32\mswsock.dll Protocol #11: C:\WINDOWS\system32\mswsock.dll Protocol #12: C:\WINDOWS\system32\mswsock.dll Protocol #13: C:\WINDOWS\system32\mswsock.dll --------------------- Enumerating Windows NT/2000/XP services Microsoft ACPI Driver: System32\DRIVERS\ACPI.sys (system) Microsoft Kernel Acoustic Echo Canceller: system32\drivers\aec.sys (manual start) AFD Networking Support Environment: \SystemRoot\System32\drivers\afd.sys (autostart) Alerter: %SystemRoot%\System32\svchost.exe -k LocalService (manual start) Application Layer Gateway Service: %SystemRoot%\System32\alg.exe (manual start) AMD AGP Bus Filter Driver: System32\DRIVERS\amdagp.sys (system) AMDPCI: \??\C:\DOCUME~1\ERIKTU~1\LOCALS~1\Temp\AMDPCI.sys (manual start) Application Management: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start) 1394 ARP Client Protocol: System32\DRIVERS\arp1394.sys (manual start) RAS Asynchronous Media Driver: System32\DRIVERS\asyncmac.sys (manual start) Standard IDE/ESDI Hard Disk Controller: System32\DRIVERS\atapi.sys (system) Ati HotKey Poller: %SystemRoot%\System32\Ati2evxx.exe (autostart) ATI Smart: C:\WINDOWS\system32\ati2sgag.exe (autostart) ati2mtag: System32\DRIVERS\ati2mtag.sys (manual start) atirage3: System32\DRIVERS\atimpae.sys (manual start) ATM ARP Client Protocol: System32\DRIVERS\atmarpc.sys (manual start) Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Audio Stub Driver: System32\DRIVERS\audstub.sys (manual start) Background Intelligent Transfer Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start) MAC Bridge: System32\DRIVERS\bridge.sys (manual start) MAC Bridge Miniport: System32\DRIVERS\bridge.sys (manual start) Computer Browser: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Symantec Event Manager: "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe" (autostart) Symantec Password Validation Service: "C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe" (manual start) CD-ROM Driver: System32\DRIVERS\cdrom.sys (system) Indexing Service: C:\WINDOWS\System32\cisvc.exe (manual start) ClipBook: %SystemRoot%\system32\clipsrv.exe (manual start) Compaq Advisor: C:\Program Files\Compaq\Compaq Advisor\bin\compaq-rba.exe (autostart) COM+ System Application: C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start) Creative Service for CDROM Access: C:\WINDOWS\System32\CTsvcCDA.exe (autostart) Cryptographic Services: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart) Creative SBLive! Gameport: System32\DRIVERS\ctljystk.sys (manual start) Compaq S200 Scanner: System32\DRIVERS\usbscan.sys (autostart) DHCP Client: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Disk Driver: System32\DRIVERS\disk.sys (system) Logical Disk Manager Administrative Service: %SystemRoot%\System32\dmadmin.exe /com (manual start) dmboot: System32\drivers\dmboot.sys (disabled) dmio: System32\drivers\dmio.sys (disabled) dmload: System32\drivers\dmload.sys (disabled) Logical Disk Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start) Microsoft Kernel DLS Syntheiszer: system32\drivers\DMusic.sys (manual start) DNS Client: %SystemRoot%\System32\svchost.exe -k NetworkService (autostart) Microsoft Kernel DRM Audio Descrambler: system32\drivers\drmkaud.sys (manual start) Creative SB Live! series(WDM): system32\drivers\emu10k1f.sys (manual start) Creative Interface Manager Driver (WDM): system32\drivers\ctlface.sys (manual start) Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Event Log: %SystemRoot%\system32\services.exe (autostart) COM+ Event System: C:\WINDOWS\System32\svchost.exe -k netsvcs (manual start) Fast User Switching Compatibility: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start) Floppy Disk Controller Driver: System32\DRIVERS\fdc.sys (manual start) Floppy Disk Driver: System32\DRIVERS\flpydisk.sys (manual start) Volume Manager Driver: System32\DRIVERS\ftdisk.sys (system) Game Port Enumerator: System32\DRIVERS\gameenum.sys (manual start) Gcr432: System32\Drivers\gcr432.sys (manual start) Generic Packet Classifier: System32\DRIVERS\msgpc.sys (manual start) Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) HID Input Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Microsoft HID Class Driver: System32\DRIVERS\hidusb.sys (manual start) HPFECP06: \SystemRoot\System32\drivers\HPFECP06.SYS (autostart) i8042 Keyboard and PS/2 Mouse Port Driver: System32\DRIVERS\i8042prt.sys (system) IMAPI CD-Burning COM Service: C:\WINDOWS\System32\imapi.exe (manual start) IP Traffic Filter Driver: System32\DRIVERS\ipfltdrv.sys (manual start) IP in IP Tunnel Driver: System32\DRIVERS\ipinip.sys (manual start) IP Network Address Translator: System32\DRIVERS\ipnat.sys (manual start) IPSEC driver: System32\DRIVERS\ipsec.sys (system) IR Enumerator Service: System32\DRIVERS\irenum.sys (manual start) PnP ISA/EISA Bus Driver: System32\DRIVERS\isapnp.sys (system) Keyboard Class Driver: System32\DRIVERS\kbdclass.sys (system) Keyboard HID Driver: System32\DRIVERS\kbdhid.sys (system) Microsoft Kernel Wave Audio Mixer: system32\drivers\kmixer.sys (manual start) Server: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Workstation: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) LicCtrl Service: C:\WINDOWS\runservice.exe (disabled) TCP/IP NetBIOS Helper: %SystemRoot%\System32\svchost.exe -k LocalService (autostart) Messenger: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) NetMeeting Remote Desktop Sharing: C:\WINDOWS\System32\mnmsrvc.exe (manual start) Mouse Class Driver: System32\DRIVERS\mouclass.sys (system) Mouse HID Driver: System32\DRIVERS\mouhid.sys (manual start) WebDav Client Redirector: System32\DRIVERS\mrxdav.sys (manual start) MRXSMB: System32\DRIVERS\mrxsmb.sys (system) Distributed Transaction Coordinator: C:\WINDOWS\System32\msdtc.exe (manual start) Windows Installer: C:\WINDOWS\System32\msiexec.exe /V (manual start) Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start) Microsoft Streaming Clock Proxy: system32\drivers\MSPCLOCK.sys (manual start) Microsoft Streaming Quality Manager Proxy: system32\drivers\MSPQM.sys (manual start) Norton AntiVirus Auto Protect Service: "C:\Program Files\Norton AntiVirus\navapsvc.exe" (autostart) NAVENG: \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20040318.025\NAVENG.Sys (manual start) NAVEX15: \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20040318.025\NavEx15.Sys (manual start) Remote Access NDIS TAPI Driver: System32\DRIVERS\ndistapi.sys (manual start) NDIS Usermode I/O Protocol: System32\DRIVERS\ndisuio.sys (manual start) Remote Access NDIS WAN Driver: System32\DRIVERS\ndiswan.sys (manual start) NetBIOS Interface: System32\DRIVERS\netbios.sys (system) NetBT: System32\DRIVERS\netbt.sys (system) Network DDE: %SystemRoot%\system32\netdde.exe (manual start) Network DDE DSDM: %SystemRoot%\system32\netdde.exe (manual start) Net Logon: %SystemRoot%\System32\lsass.exe (manual start) Network Connections: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start) 1394 Net Driver: System32\DRIVERS\nic1394.sys (manual start) Network Location Awareness (NLA): %SystemRoot%\System32\svchost.exe -k netsvcs (manual start) NT LM Security Support Provider: %SystemRoot%\System32\lsass.exe (manual start) Removable Storage: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start) IPX Traffic Filter Driver: System32\DRIVERS\nwlnkflt.sys (manual start) IPX Traffic Forwarder Driver: System32\DRIVERS\nwlnkfwd.sys (manual start) Texas Instruments OHCI Compliant IEEE 1394 Host Controller: System32\DRIVERS\ohci1394.sys (system) Parallel port driver: System32\DRIVERS\parport.sys (manual start) PCI Bus Driver: System32\DRIVERS\pci.sys (system) PCTEL Speaker Phone: %SystemRoot%\system32\pctspk.exe (autostart) PfModNT: \??\C:\WINDOWS\System32\PfModNT.sys (autostart) Plug and Play: %SystemRoot%\system32\services.exe (autostart) IPSEC Services: %SystemRoot%\System32\lsass.exe (autostart) WAN Miniport (PPTP): System32\DRIVERS\raspptp.sys (manual start) Processor Driver: System32\DRIVERS\processr.sys (system) Protected Storage: %SystemRoot%\system32\lsass.exe (autostart) QoS Packet Scheduler: System32\DRIVERS\psched.sys (manual start) Direct Parallel Link Driver: System32\DRIVERS\ptilink.sys (manual start) PCTEL Serial Device Driver for PCI: System32\DRIVERS\ptserlp.sys (manual start) Remote Access Auto Connection Driver: System32\DRIVERS\rasacd.sys (system) Remote Access Auto Connection Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) WAN Miniport (L2TP): System32\DRIVERS\rasl2tp.sys (manual start) Remote Access Connection Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start) Remote Access PPPOE Driver: System32\DRIVERS\raspppoe.sys (manual start) Direct Parallel: System32\DRIVERS\raspti.sys (manual start) Rdbss: System32\DRIVERS\rdbss.sys (system) RDPCDD: System32\DRIVERS\RDPCDD.sys (system) Remote Desktop Help Session Manager: C:\WINDOWS\system32\sessmgr.exe (manual start) Digital CD Audio Playback Filter Driver: System32\DRIVERS\redbook.sys (system) Routing and Remote Access: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled) Remote Procedure Call (RPC) Locator: %SystemRoot%\System32\locator.exe (manual start) Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart) QoS RSVP: %SystemRoot%\System32\rsvp.exe (manual start) Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver: System32\DRIVERS\RTL8139.SYS (manual start) Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart) SAVRT: \??\C:\WINDOWS\System32\Drivers\SAVRT.SYS (manual start) SAVRTPEL: \??\C:\WINDOWS\System32\Drivers\SAVRTPEL.SYS (autostart) ScriptBlocking Service: C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe (autostart) Smart Card Helper: %SystemRoot%\System32\SCardSvr.exe (manual start) Smart Card: %SystemRoot%\System32\SCardSvr.exe (autostart) Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Secdrv: System32\DRIVERS\secdrv.sys (manual start) Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart) Serenum Filter Driver: System32\DRIVERS\serenum.sys (manual start) Serial port driver: System32\DRIVERS\serial.sys (system) Creative SoundFont Manager Driver (WDM): system32\drivers\sfman.sys (manual start) Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS): %SystemRoot%\System32\svchost.exe -k netsvcs (manual start) Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Microsoft Kernel Audio Splitter: system32\drivers\splitter.sys (manual start) Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart) System Restore Filter Driver: System32\DRIVERS\sr.sys (system) System Restore Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Srv: System32\DRIVERS\srv.sys (manual start) SSDP Discovery Service: %SystemRoot%\System32\svchost.exe -k LocalService (manual start) Windows Image Acquisition (WIA): %SystemRoot%\System32\svchost.exe -k imgsvc (autostart) Software Bus Driver: System32\DRIVERS\swenum.sys (manual start) Microsoft Kernel GS Wavetable Synthesizer: system32\drivers\swmidi.sys (manual start) MS Software Shadow Copy Provider: C:\WINDOWS\System32\dllhost.exe /Processid:{3695CD3A-DDAD-4823-8FDD-F9256A77D66F} (manual start) SymEvent: \??\C:\Program Files\Symantec\SYMEVENT.SYS (manual start) SYMREDRV: \??\C:\WINDOWS\System32\Drivers\SYMREDRV.SYS (manual start) SYMTDI: \??\C:\WINDOWS\System32\Drivers\SYMTDI.SYS (autostart) Microsoft Kernel System Audio Device: system32\drivers\sysaudio.sys (manual start) Performance Logs and Alerts: %SystemRoot%\system32\smlogsvc.exe (manual start) Telephony: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start) TCP/IP Protocol Driver: System32\DRIVERS\tcpip.sys (system) Terminal Device Driver: System32\DRIVERS\termdd.sys (system) Terminal Services: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start) Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart) Microcode Update Driver: System32\DRIVERS\update.sys (manual start) Upload Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Universal Plug and Play Device Host: %SystemRoot%\System32\svchost.exe -k LocalService (manual start) Uninterruptible Power Supply: %SystemRoot%\System32\ups.exe (manual start) Microsoft USB Generic Parent Driver: System32\DRIVERS\usbccgp.sys (manual start) Microsoft USB Standard Hub Driver: System32\DRIVERS\usbhub.sys (manual start) USB Scanner Driver: System32\DRIVERS\usbscan.sys (manual start) Microsoft USB Universal Host Controller Miniport Driver: System32\DRIVERS\usbuhci.sys (manual start) VGA Display Controller.: \SystemRoot\System32\drivers\vga.sys (system) ViaIde: System32\DRIVERS\viaide.sys (system) XP Vmodem: System32\DRIVERS\vmodem.sys (system) XP Vpctcom: System32\DRIVERS\vpctcom.sys (system) vsdatant: \??\C:\WINDOWS\System32\vsdatant.sys (autostart) TrueVector Internet Monitor: C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service (autostart) Volume Shadow Copy: %SystemRoot%\System32\vssvc.exe (manual start) XP Vvoice: System32\DRIVERS\vvoice.sys (system) Windows Time: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) Remote Access IP ARP Driver: System32\DRIVERS\wanarp.sys (manual start) WAN Network Driver: System32\DRIVERS\wandrv.sys (manual start) Microsoft WINMM WDM Audio Compatibility Driver: system32\drivers\wdmaud.sys (manual start) WebClient: %SystemRoot%\System32\svchost.exe -k LocalService (autostart) Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart) WMDM PMSP Service: C:\WINDOWS\System32\MsPMSPSv.exe (autostart) Portable Media Serial Number Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start) WMI Performance Adapter: C:\WINDOWS\System32\wbem\wmiapsrv.exe (manual start) Automatic Updates: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart) Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart) --------------------- Enumerating Windows NT logon/logoff scripts: *No scripts set to run* Windows NT checkdisk command: BootExecute = autocheck autochk * Windows NT 'Wininit.ini': PendingFileRenameOperations: *Registry value not found* --------------------- Enumerating ShellServiceObjectDelayLoad items: PostBootReminder: C:\WINDOWS\system32\SHELL32.dll CDBurn: C:\WINDOWS\system32\SHELL32.dll WebCheck: C:\WINDOWS\System32\webcheck.dll SysTray: C:\WINDOWS\System32\stobject.dll --------------------- End of report, 31,572 bytes Report generated in 0.093 seconds Command line options: /verbose - to add additional info on each section /complete - to include empty sections and unsuspicious data /full - to include several rarely-important sections /force9x - to include Win9x-only startups even if running on WinNT /forcent - to include WinNT-only startups even if running on Win9x /forceall - to include all Win9x and WinNT startups, regardless of platform /history - to list version history only Thank you for your help guys. I really appreciate your time.

game.dll > Warcraft ? ▫ Warcraft appears to be a memory-gobbler. Upgrade to the latest directX if you haven't already. The only other thing I can advise you, is to go to BlackViper, and follow the guide for disabling unneeded XP Services. The site will also tell you how to set up different profiles so you can switch easily to the best Gaming setup. ▫ Black Viper The other thing I noticed, is that the Messenger service is running. If you don't need it (MSN Messenger?), ask me how to disable it properly. Also, this program will show you in real-time what connections your computer is making: ▫ TcpView (SysInternals) (no name) - C:\Program Files\Mediacom\BBClient\Programs\SaBHO.dll - {058FC709-D5CD-4A95-92DB-59E6488ECDA4} ▫ BigBrotherClient: I assume this is a legitimate program, used for monitoring your network. BitDefender Log / Exploit.Iframe.Vulnerability C:\Documents and Settings\Erik Tucker\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst=>[Subject: Let's be friends][From: halo]=>(body)=>(Compressed Rtf) suspect: Exploit.Iframe.Vulnerability C:\Documents and Settings\Erik Tucker\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst=>[Subject: Congratulations][From: bchase]=>(body)=>(Compressed Rtf) suspect: Exploit.Iframe.Vulnerability C:\Documents and Settings\Erik Tucker\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst=>[Subject: Log File][From: a-sbono]=>(body)=>(Compressed Rtf) suspect: Exploit.Iframe.Vulnerability C:\Documents and Settings\Erik Tucker\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst=>[Subject: Full coverage][From: miprobst]=>(body)=>(Compressed Rtf) suspect: Exploit.Iframe.Vulnerability ▫ You'll need to do the necessary WindowsUpdate to patch these exploits. Are you using IE4? Upgrade to the latest IE if you are. BitDefender Log / Trojan.PWS.WinterNights.A Either turn off SystemRestore (which will cause all RestorePoints to be removed) ▫ System Volume Information folder Or give yourself access to that folder via these steps (I'm not 100% sure this works in Home Edition - you probably have to be in SafeMode to do this): 1) ControlPanel>Folder Options>View> disable 'Use Simple File-Sharing' 2) Rightclick on the SysVolInfo folder in Windows Explorer for properties, and on the Security tab, add your UserAccount and give it full control (allow) via: -Press 'ADD' button -Press 'Advanced' -Press 'Find Now' -Select your UserAccount from the list & OK You can then run BitDefender again to clean it. Or this one: ▫ [trial] Digital Patrol Anti-Trojan (Don't forget to reverse those steps afterwards to remove [only!] your UserAccount again) BitDefender Log / Dos.MBRInfector D:\system.sav\RESVFMBR.exe suspect: Dos.MBRInfector D:\system.sav\RESVFMBR.exe copied ▫ This one's a bit tricky! My guess is: if you have a Compaq, then the D: partition is probably the FactoryRestore-Partition, and Bit-Defender [falsely] suspects one of the legitimate MasterBootRecord-tools. So, not a virus! Not too bad, after all! Regularly do an AV scan, and Spybot & Adaware (updated!), and keep up with the WindowsUpdates. That should keep it clean. ___________________________________________ ☺ [Belgium, GMT+1]_________________________svg

I am using IE6.0 with 5 update versions. The last ending with Q832894. The game.dll is for DAoC...ie Dark Age of Camelot. I have never had a problem with this program hogging too much memory, but will see if Black Viper can help me. I do not want MSM Messenger. I swear I removed it, but I guess I didnt. Please explain to me how to completely remove this program. This machine is a Compaq. Thanks for your help again!

Do the PreventRun registry-trick as described in the Microsoft link below. If your Outlook Express becomes slow to open after doing that, then follow the HideMessenger instructions in the other link: ▫ XP Home Messenger RegFix (Microsoft) ▫ XP 95720 OE opens slowly Compaq it is, so most likely NO MBRvirus! There seem to be patches around for both the security weaknesses and the lags for game.dll: ▫ DAoC Weak Encryption Vulnerability Or Google for: dark age of camelot game.dll You could also ask at the Gaming forum to find someone who found a solution for it already. ___________________________________________ ☺ [Belgium, GMT+1]_________________________svg