PCTech Forums

Having problems with my PC minimizing the game I am playing to the desktop during play. I have run the ad-ware and spybot programs that you recommended but its still not working properly. Thanks


Logfile of HijackThis v1.99.1
Scan saved at 1:09:31 AM, on 9/12/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WIN2K\System32\smss.exe
C:\WIN2K\system32\winlogon.exe
C:\WIN2K\system32\services.exe
C:\WIN2K\system32\lsass.exe
C:\WIN2K\system32\Ati2evxx.exe
C:\WIN2K\system32\svchost.exe
C:\WIN2K\system32\spoolsv.exe
C:\WIN2K\System32\svchost.exe
C:\WIN2K\system32\hidserv.exe
C:\WIN2K\system32\regsvc.exe
C:\WIN2K\system32\MSTask.exe
C:\WIN2K\System32\WBEM\WinMgmt.exe
C:\WIN2K\system32\svchost.exe
C:\WIN2K\Explorer.EXE
C:\WIN2K\CTHELPER.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Teamspeak-2serv_RC2\server_windows.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Administrator\Desktop\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [ms03490551439] C:\WIN2K\ms03490551439.exe
O4 - HKLM\..\Run: [TheMonitor] C:\WIN2K\Duce6.exe
O4 - HKLM\..\Run: [csfnpxjA] C:\WIN2K\csfnpxjA.exe
O4 - HKLM\..\Run: [eheskm] C:\WIN2K\system32\epacko.exe reg_run
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Drua] "C:\PROGRA~1\ICROSO~1\csrss.exe" -vt yazb
O4 - HKCU\..\Run: [fkkw] C:\Program Files\Common Files\fkkw\fkkwm.exe
O4 - HKCU\..\Run: [aelul] C:\WIN2K\system32\epacko.exe reg_run
O4 - Startup: TeamSpeak 2 Server.lnk = C:\Program Files\Teamspeak-2serv_RC2\server_windows.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WIN2K\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WIN2K\system32\ati2sgag.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WIN2K\System32\dmadmin.exe

Please copy this to Notepad and print it. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.
You should not have any open windows when you are following the procedures below.

Reboot in to Safe mode:
Restart Windows after you see the BIOS screen and before Windows starts to load.
Start tapping the F8 key. The Windows Advanced Options Menu appears.
Use the Arrow key to ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.

Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following:
(They may or may not be there)
ms03490551439.exe
Duce6.exe
csfnpxjA.exe
epacko.exe
fkkwm.exe

Turn off system restore by right clicking on My Computer and go to Properties->System Restore and check the box for Turn off System Restore. Click Apply and then OK. (Turn it back on after this is repaired and you've rebooted.)
Close all other open Windows and have HiJackThis Fix:
O4 - HKLM\..\Run: [ms03490551439] C:\WIN2K\ms03490551439.exe
O4 - HKLM\..\Run: [TheMonitor] C:\WIN2K\Duce6.exe
O4 - HKLM\..\Run: [csfnpxjA] C:\WIN2K\csfnpxjA.exe
O4 - HKLM\..\Run: [eheskm] C:\WIN2K\system32\epacko.exe reg_run
O4 - HKCU\..\Run: [Drua] "C:\PROGRA~1\ICROSO~1\csrss.exe" -vt yazb
O4 - HKCU\..\Run: [fkkw] C:\Program Files\Common Files\fkkw\fkkwm.exe
O4 - HKCU\..\Run: [aelul] C:\WIN2K\system32\epacko.exe reg_run

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' is enabled. Also make sure that Display the contents of System Folders' is checked. Remember to reset these when done.
Delete the following Files/Folders if they exist:
C:\WIN2K\ms03490551439.exe
C:\WIN2K\Duce6.exe
C:\WIN2K\csfnpxjA.exe
C:\WIN2K\system32\epacko.exe
C:\PROGRAM FILES\ICROSO~1\csrss.exe
C:\Program Files\Common Files\fkkw\fkkwm.exe

If you cannot delete this file(s)then:
Start HijackThis and click the Open the misc tools section now click Delete a file on reboot
Select the file to be deleted on reboot:

Click open but click no to reboot now do the same for each of the files:

Now, empty all your TEMP Folders, Temporary Internet Files Folder and then empty your Recycle Bin, reboot and post a new HiJackThis log.

Having a problem while in safe mode trying to find system retsore. I am running windows 2000 and thought that system restore was an XP function. If not then how do I access it and if it is then how would I contiune with your instructions that I printed out?

Nevermind I found another post with a similar problem and you told him oops you should have deleted that and just to continue without that step do I did the same.

Here is my new log:

Logfile of HijackThis v1.99.1
Scan saved at 1:48:01 PM, on 9/12/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WIN2K\System32\smss.exe
C:\WIN2K\system32\winlogon.exe
C:\WIN2K\system32\services.exe
C:\WIN2K\system32\lsass.exe
C:\WIN2K\system32\Ati2evxx.exe
C:\WIN2K\system32\svchost.exe
C:\WIN2K\system32\spoolsv.exe
C:\WIN2K\System32\svchost.exe
C:\WIN2K\system32\hidserv.exe
C:\WIN2K\system32\regsvc.exe
C:\WIN2K\system32\MSTask.exe
C:\WIN2K\System32\WBEM\WinMgmt.exe
C:\WIN2K\system32\svchost.exe
C:\WIN2K\Explorer.EXE
C:\WIN2K\CTHELPER.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\Desktop\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: TeamSpeak 2 Server.lnk = C:\Program Files\Teamspeak-2serv_RC2\server_windows.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WIN2K\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WIN2K\system32\ati2sgag.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WIN2K\System32\dmadmin.exe

Your log is clean

Sorry about the bad directions, it's part of a canned reply and I forgot to remove that part.