Mums PC

[clennonuk]

This is a log of my mums pc can someone check please this pc is really playing up at the moment
Cheers
CLennonUK
Logfile of HijackThis v1.99.1
Scan saved at 05:22:31, on 15/09/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\pdate.exe
C:\WINDOWS\System32\Syss.exe
C:\dsonic.exe
C:\WINDOWS\exe82.exe
C:\WINDOWS\system32\winsvc\winsvc.exe
C:\WINDOWS\slmvlxlx.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\hola\runm.exe
C:\WINDOWS\System32\t?skmgr.exe
C:\Program Files\WinFixer 2005\wfx5.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Supreme Office Suite3.0\program\soffice.exe
C:\WINDOWS\etb\pokapoka67.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\james lennon\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ycomp/ ... .yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/ ... .yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {C084CB04-0EE7-5A6E-B179-2D172A362FE6} - C:\WINDOWS\System32\dpnszsw.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [MICROSOFT Windows update] pdate.exe
O4 - HKLM\..\Run: [Windows TM] Syss.exe
O4 - HKLM\..\Run: [REGRUN] C:\dsonic.exe
O4 - HKLM\..\Run: [SWOD] C:\WINDOWS\exe82.exe
O4 - HKLM\..\Run: [Microsoft Windows DLL host winsvc] "C:\WINDOWS\system32\winsvc\winsvc.exe"
O4 - HKLM\..\Run: [elos] C:\WINDOWS\exe82.exe
O4 - HKLM\..\Run: [7CgEN] C:\WINDOWS\slmvlxlx.exe
O4 - HKLM\..\Run: [System service66] C:\WINDOWS\etb\pokapoka66.exe
O4 - HKLM\..\Run: [ICcontrol] C:\WINDOWS\iccontrol.exe
O4 - HKLM\..\Run: [System service67] C:\WINDOWS\etb\pokapoka67.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\RunServices: [MICROSOFT Windows update] pdate.exe
O4 - HKLM\..\RunServices: [Windows TM] Syss.exe
O4 - HKLM\..\RunServices: [Microsoft Windows DLL host winsvc] "C:\WINDOWS\system32\winsvc\winsvc.exe"
O4 - HKLM\..\RunOnce: [Pest Cleaning] "C:\Program Files\Yahoo!\YPSR\ppclean.exe" "clean" "wintools" "2"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MICROSOFT Windows update] pdate.exe
O4 - HKCU\..\Run: [Microsoft Windows DLL host winsvc] "C:\WINDOWS\system32\winsvc\winsvc.exe"
O4 - HKCU\..\Run: [Taru] C:\Program Files\hola\runm.exe
O4 - HKCU\..\Run: [Yecacfm] C:\WINDOWS\System32\t?skmgr.exe
O4 - HKCU\..\Run: [WinFixer 2005] "C:\Program Files\WinFixer 2005\wfx5.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\RunServices: [Microsoft Windows DLL host winsvc] "C:\WINDOWS\system32\winsvc\winsvc.exe"
O4 - Startup: Supreme Office Suite 3.0.lnk = C:\Program Files\Supreme Office Suite3.0\program\quickstart.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: v3cab - http://searchmiracle.com/cab/v3cab.cab
O16 - DPF: {0D62A517-E7C6-4E1F-A577-07D4AC549A48} (Progetto1.int_ver32) - http://advnt01.com/dialer/int_ver32b.CAB
O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://c:\nosuch.mht!http://www.bardownload.com/ie/addon.chm::/file.exe
O16 - DPF: {20048BB3-DB68-11CF-9CAF-00AA006CB425} (007installer Control) - http://www.bardownload.com/prompt/cabs/msnnames.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.c ... 040510.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 6638495537
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004 ... scan53.cab
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} - http://static.zangocash.com/cab/Zango/ie/bridge-c32.cab
O16 - DPF: {9EAC0186-5F5A-4362-B120-15C312CE012D} - http://www.awmdabest.com/cabl/5558/tb.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTickets ... refid=2117

[PCguy]

Looks like she has been hit hard. Before I go through the logfile, can you run Adaware, Spybot and Trend Micro's online virus scanner for me?

You are out of date on the XP service packs, IE service packs and you have no Antivirus running. But we shall try to deal with those after we get this sorted.

[clennonuk]

Thanks for reply pc guy but my mum has now got rid of this pc and got a new one cheers mate