Tech Support Guy banner
  • IMPORTANT: Only authorized members may reply to threads in this forum due to the complexity of the malware removal process. Authorized members include Malware Specialists and Trainees, Administrators, Moderators, and Trusted Advisors. Regular members are not permitted to reply, and any such posts will be deleted without notice or further explanation. Notice
Status
Not open for further replies.
1 - 7 of 7 Posts

· Retired Administrator
Joined
·
104,767 Posts
Discussion Starter · #1 ·
Please find below copy HijackThis scan :

Logfile of HijackThis v1.97.7
Scan saved at 11:35:28, on 12/04/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Apps\ActivBoard\nhksrv.exe
C:\Program Files\Norton Internet Security\ccPxySvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\htpatch.exe
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Apps\ActivBoard\MMKeybd.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Apps\ActivBoard\TrayMon.exe
C:\Apps\ActivBoard\OSD.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.freeserve.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title =
Microsoft Internet Explorer
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:
\apps\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program
Files\Microsoft Money\System\mnyside.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program
Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:
\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -
C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control
Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ACTIVBOARD] C:\Apps\ActivBoard\MMKeybd.exe
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec
Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe
SYSTEMBOOTHIDEPLAYER
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
Office\Office10\OSA.EXE
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Money Viewer (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet
Explorer\Plugins\NPDocBox.dll

Also, the message that I'm getting when I try to activate Norton is as
follows :

Access Denied. Only the Supervisor can view / change the options.

It won't let me enable auto protect.

It tells me that Auto protect is not loaded, and asks me if I want to load
it, but does not give me a choice to do so ? it just says Enable, and that
doesn't work!

Hope you can get some sense out of this!

Thanks again.
Jennifer
 

· Registered
Joined
·
46,465 Posts
There's nothing bad in the log. This is the only thing that should be fied:

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

It's not causing the problems though.

Have you tried uninstalling/reinstalling Norton? That should solve the Auto Protect problem.

I'm not familiar with NIS or how/where/if it has the cookie control. I do believe it does. Disabling the cookie control might enable you to access this site. I have seen similar problems related to Zone Alarm.
 

· Retired Administrator
Joined
·
104,767 Posts
Discussion Starter · #3 ·
Actually Mark, uninstalling/reinstalling Norton is not as easy as it sounds :( I just went thru a vicious uninstall, it's on par with McAfee :eek:

I'm actually doing a reinstall of XP on another machine now, and it had Norton, I reinstalled XP to the same directory, and even though no programs appear on the start menu, Norton was still there. I installed to the same directory and it's giving me problems. I think I'll have to run thru the manual uninstall before my job is done *sigh* Nothing is ever easy ;) Good thing it's just my trial and error machine :D
 

· Registered
Joined
·
46,465 Posts
Yes Candy I use Norton SystemWorks on all my machines. I've had times when the uninstall/reinstall went flawlessly, but I have had problems before too.

I like Norton Systemworks myself, because It comes with Ghost and the AV has never let me down. Also I always wait until at least latter part of the year and buy it for $10 ;). The amount of resources it uses has never been a problem for me because I'm not going to run a machine that doesn't have plenty of resources, unless of course it's a test machine.

I've never used NIS as I like Zone Alarm Pro.
 

· Retired Administrator
Joined
·
104,767 Posts
Discussion Starter · #6 ·
Mark, I just received an email from Jennifer again, and I misunderstood her connection problem, that is a problem from her work computer and I'm sure the IT department has something to do with that. This Norton problem is on her home machine and she wasn't sure she should attempt to get on the internet without Norton working correctly. She will try to update the thread tonight, while being careful not to download emails, etc. until we can work thru the Norton problem.
 
1 - 7 of 7 Posts
Status
Not open for further replies.
Top