Disk checker

[Borogorn]

thanks for that ,

Right, found all of the things in HJT, deleted them all...

Now delete these Folders or Files that are Highlighted: (You may need enable "Show all Files" and disable "Hide System Files" in Windows Explorer / Tools / Folder Options / View Tab) (You may have to boot to "Safe Mode" and rename them, in order to delete some Files/Folders)

C:\WINDOWS\SYSTEM\blank.htm
C:\Documents and Settings\Lesley Clare\Local Settings\Application Data\microsoft\internet explorer\V0.15.dat
C:\PROGRAM FILES\ELSEOP This is abbreviated
C:\PROGRAM FILES\EGGSLO This is abbreviated

Could not find the top one at all... (I have enabled viewing hidden files etc)
Found the second, but access was denied (make sure the disk is not full and not write protected etc)
The bottom one's full name is 'Eggslocks', and in the folder it has the 'htmping' file, but again my access was denied and so could not delete it... any other ways of going about it?
O, and the the third's full name is 'Else Option Road' but again, I cannot delete that folder due to access being denied...

Any ideas?

Boro

[teststrips]

does it allow you to delete them in safe mode?

[Cactus]

Re-boot into SAFE MODE
Now try deleting them files and folders from there.

If a file is not there then that's ok...
You could goto START>FIND>FILES/FOLDERS
Type:
blank.htm
Just delete it if it's found.

Cactus

[Borogorn]

As always, You guys worked... went into safe mode and yes, I deleted the 'Else OPption Road' and the 'Eggslocks' folders. However, my original problem persists... The check disk feature that runs on startup after an unexpected windows closure, still automatically cancels the check immediately...?

Also Im getting, as the PC starts shutting down, an error message stating that the file

drveac-1.dll cannot start as the windows platform is shutting down

Thats a bit confusing on my ol' melon too

Anyway, here's a hopefully cleaner HJT log...

Regards, Boro
(gonna have to call it a night now too, Im in UK and its getting a tad late, work tomorrow too )

Logfile of HijackThis v1.98.2
Scan saved at 11:45:25 PM, on 9/2/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\brss01a.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\Program Files\TightVNC\WinVNC.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\Program Files\Altnet\Points Manager\Points Manager.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\WinZip\Wzqkpick.exe
C:\PROGRA~1\Altnet\DOWNLO~1\asm.exe
C:\Program Files\mozilla.org\Mozilla\mozilla.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Lesley Clare\My Documents\Installers\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.vincfxeuxaskmbaaahnahun.com/ ... s8VbuF.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Freeserve
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\TightVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [AltnetPointsManager] C:\Program Files\Altnet\Points Manager\Points Manager.exe -s
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [campsafe] C:\PROGRA~1\ELSEOP~1\drv each face.exe
O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004 ... scan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b28578.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{70B77052-7E56-4173-B0A6-5198A38203EF}: NameServer = 195.92.195.94 195.92.195.95

[/quote]

[Borogorn]

Just looked at the logfile a bit more closely and have already deleted:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.vincfxeuxaskmbaaahnahun.com/ ... s8VbuF.htm

and

O4 - HKLM\..\Run: [campsafe] C:\PROGRA~1\ELSEOP~1\drv each face.exe

dont know how the other ELSEOP was still there though.... I just deleted the whole folder in safe mode :/

Boro

[Cactus]

Make sure you DELETE all your TEMP files/Folders before
rebooting again...

Cactus

[Cactus]

**(Always create a Folder for HiJackThis anywhere but your Temp/Temporary Internet Folders. This is where it will save the backup files needed if there's a problem.)**

Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following: (They may or may not be there)

Points Manager.exe
asm.exe
wuauclt.exe --->THIS IS FOR WIN ME UPDATES <---
REGSHAVE.EXE
face.exe **YOU SAID YOU DELETED--SO IF ITS NOT THERE DON"T WORRY**

Turn off System Restore. (Turn it back on after this is repaired and you've rebooted.) Close all other open Windows and have HiJackThis Fix:


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.vincfxeuxaskmbaaahnahun.com/ ... s8VbuF.htm
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN --->NOT NEEDED AT STARTUP<---
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART --->NOT NEEDED AT STARTUP<---

O4 - HKLM\..\Run: [AltnetPointsManager] C:\Program Files\Altnet\Points Manager\Points Manager.exe -s
O4 - HKLM\..\Run: [campsafe] C:\PROGRA~1\ELSEOP~1\drv each face.exe
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -

The next are optional, but recommended for removal,Resource hogs and not needed on startup, but does not disable the program:

O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe --->HAVE HJT REMOVE THIS ENTRY AS WELL<---


Go to Control Panel / Add/Remove Programs and remove the
following if they are there:

campsafe
AltnetPointsManager

Now delete these Folders or Files that are Highlighted: (You may need enable "Show all Files" and disable "Hide System Files" in Windows Explorer / Tools / Folder Options / View Tab) (You may have to boot to "Safe Mode" in order to delete some Files/Folders)

C:\Program Files\Altnet\Points Manager\Points Manager.exe -s


Now, empty all your TEMP Folders (WinXp has up to 4 of them) / Temporary Internet Files Folder and then empty your "Recycle Bin".

RESTART your computer
Post back with a Fresh hijackthis log and let me know how your doing.


Cactus...