Two applications

[ChickaD]

I need to know if there is anything about CCleaner that can change how iTunes works or makes some email nonviewable. I downloaded and used CCleaner May 28. About the same time I began having trouble with iTunes. It would load and access the music store, but when I clicked to Search or Browse Music, the progress bar would continue to work but the link did not appear. When I closed iTunes, I could not reopen it without rebooting. After rebooting, I tried again, but got the same results. I opened Task Manager to see what it showed. While trying to start iTunes, nothing looked abnormal. But when I clicked to close the program, the CPU usage info at the bottom went to 100% even though iTunes disappeared, and in the Processes list iTunes showed a 97 I think it was. In Applications, iTunes did not even show to be running. Again, I had to reboot to get it back where I could try to use it again. I decided to uninstall, delete the old install folder, download the newer version. After doing all that, it still messed up the same way.

 

I am having an email problem also. Jasc Paint and Windows Picture viewer both work when I look at items in folders. But in mail that has come in after May 28, neither one can view jpgs or gifs and certain email forms come in blank in Thunderbird. I tried sending the email to myself again and downloading into IncrediMail and Outlook, but the jpg, gif and certain email from outside sources will not view in those clients either. I did manage to send some of my jpgs and gifs to myself and get those to view in IncrediMail, but they never did view in Thunderbird. I know that this sounds confusing, but I hope a pattern will show itself, if there has been an alter to something that should not have been altered. I use MailWasherPro and I have saved some of the email headers in text form, if it would help you to see what kind of email is coming in blank.

 

Last night I tried System Restore. Now I get a prompt saying iTunes is missing some files and to reinstall. But I am not going to try that until I can find out more. iTunes is still listed in Add/Remove, but it will not uninstall. So I don't really want to go to installing over it. Belarc does not recognize it being on the system, but Aida 32 lists it in the software list.

 

Please let me know if this sounds like anything that can be connected. I ran an online virus scan last night at Trend and Panda. One found one file of malware....My websearch or something like that. The other found jokepad, which I deleted. I don't think either of those can do something like the trouble I am having. Is there a chance my OS did not install properly and affected how CCleaner worked in it? Thanks again for any help or insight you can give.

[Tarun]

First, download this Anti Malware Package, it contains everything you need to effectively clean your computer.

 

Next, refer to this PC Maintenance website, as it will tell you the settings you need and everything to effectively clean your computer. Then you can post your HijackThis log here.

[ChickaD]

Tarun,

 

When I attempted to unzip the antimalware file, it says it is invalid or corrupt. Should I try redownloading it? I have Adaware, Spybot S & D and Microsoft Antispyware downloaded already. Please let me know if I should use what I already have or try again to get the file you have in the post. Thanks for your help!

[rridgely]

Go to the freeware section and get any antimalware program you dont have, this has all of the programs that are in Taruns antimalware package.

[ChickaD]

Thanks rridgely! I will do that. I just ran the updated versions of Spybot S&D and Adaware that I have. Spybot was clean. Adaware found 13 tracking cookies. But I will go to Freeware and download the file again. Thanks for telling me about it!

[rridgely]

Are you using an antivirus? If not get the free 12 month one on the freeware section as well. Its a very good program if you have a virus it will fix it.

[ChickaD]

rridgely,

 

I use AVG. Also, I did an online scan at both Trend and Panda and reported what was found in my first post, last paragraph.

 

I am not finding the Freeware section you referred to. Is it at this site? I would like to get the Anti Malware zip recommended. Thanks for helping!

[TwistedMetal]

http://forum.CCleaner.com/index.php?showtopic=1224

[Tarun]

Tarun,

 

When I attempted to unzip the antimalware file, it says it is invalid or corrupt.  Should I try redownloading it?  I have Adaware, Spybot S & D and Microsoft Antispyware downloaded already.  Please let me know if I should use what I already have or try again to get the file you have in the post.  Thanks for your help!

 

<{POST_SNAPBACK}>

 

 

I just checked the zip and it come back with zero errors. May have been a download fluke for you. Retry if you like.

[ChickaD]

Tarun,

 

I am downloading the individual programs I didn't already have. I don't know why the zip did not work--I fear it is because my system is so messed up. I will get back with the hijack log as soon as I can. Thanks!

[ChickaD]

http://reviews.cnet.com/5208-6130-0.html?f...ssageID=1183389

At the above link, there is a detailed instruction of how to restore a computer to working faster. In Step 7, it says to turn off System Restore prior to going into Safe Mode to run the various programs she has recommended, which is a similar process as the one at PC Maintenance. Should I do this?

[Tarun]

http://reviews.cnet.com/5208-6130-0.html?f...ssageID=1183389

At the above link, there is a detailed instruction of how to restore a computer to working faster.  In Step 7, it says to turn off System Restore prior to going into Safe Mode to run the various programs she has recommended, which is a similar process as the one at PC Maintenance.  Should I do this?

 

<{POST_SNAPBACK}>

 

 

It is recommended. The PC Maintence guide is a tad outdated and is being changed over to a php version for a better site.

[ChickaD]

Logfile of HijackThis v1.99.1

Scan saved at 8:47:00 PM, on 6/2/2005

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\WINDOWS\system32\CTsvcCDA.EXE

C:\Program Files\Executive Software\DiskeeperLite\DKService.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\system32\MsPMSPSv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe

C:\WINDOWS\system32\Rundll32.exe

C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

C:\Program Files\Dell\Media Experience\DMXLauncher.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe

C:\Program Files\WheresJames\WinSpike\WinSpike.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\Program Files\TDS Accelerator\tds_accel.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\AppHunter.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Downloads\hijackthis\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5400

R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\TDS Accelerator\PBHelper.dll

O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r

O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper

O4 - HKLM\..\Run: [updReg] C:\WINDOWS\UpdReg.EXE

O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"

O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe

O4 - HKLM\..\Run: [updateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r

O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe

O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe

O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iSUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [userFaultCheck] %systemroot%\system32\dumprep 0 -u

O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

O4 - HKLM\..\Run: [AppHunter] C:\Program Files\SystemTracker\SystemTracker.exe /init

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe

O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [WinSpike] C:\Program Files\WheresJames\WinSpike\WinSpike.exe

O4 - Global Startup: Digital Line Detect.lnk = ?

O4 - Global Startup: hpoddt01.exe.lnk = ?

O4 - Global Startup: TDS Accelerator.lnk = C:\Program Files\TDS Accelerator\tds_accel.exe

O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm

O8 - Extra context menu item: Show All Original Images - res://C:\Program Files\TDS Accelerator\tds_accel.exe/250

O8 - Extra context menu item: Show Original Image - res://C:\Program Files\TDS Accelerator\tds_accel.exe/227

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab

O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion...ctor/WebAAS.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{EE0A4350-B0F3-4119-A4D9-98DD79BB6698}: NameServer = 216.165.129.157 216.170.153.146

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE

O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe

O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

 

 

 

 

Results of recommended cleaning:

 

While in Safe Mode:

I use dialup and when I tried to sign on, the option to connect was grayed out. So I was unable to do the online virus scans as recommended. I had updated AVG just previous to beginning the system clean, so I did a deep scan with it.

 

CWShredder: removed CWSMsconfig

Spyware Blaster: activated

Ad Aware: 3 cookies

Spybot: 9 cookies

 

Normal mode and online:

Trend: no virus

McAfee: Active X loaded but scan would not begin

Symantec: Virus--Active X seemed to load, but scan never would begin

Firewall: At risk--Trojan, AV Product

Because of trouble with the two online scans above, I went back to Panda. It

found Adware--My Way

Second Ad Aware scan: No critical objects

Second Spybot S & D scan: No items

Browser Security Link: Passed

No Windows Updates needed

 

CCleaner: Removed 193 mb from Windows and Applications

Backed up and cleaned Issues Tab

 

Thanks for your time and help!

[rridgely]

These are bad:

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html

 

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab

[ChickaD]

This is the part of the file that did not make it above:

 

001/housecall.trendmicro.com/housec

 

I think that is okay isn't it?

[DjLizard]

Right.