the activity light on the hard drive seems to just keep blinking randomlyeven when im not doing anything. I turned off windows indexing and I can seem to figure out whats doing it. help please.
Hard drive light constantly blinkin
- Thread starter keenan312
- Start date
There are points when it seems to be blinking somewhat steady, but most of the time it seems more random. Most blinks are dim, then some arent. There are periods where it just stops for a minute or two, then just starts again. This computers pretty new, and I thought I should buy some virus stuff this time, does the Norton Antivirus do any checks or something?
This can happen for a variety of legit reasons, and several malicious reasons.
- If you're using over 60% of your physical memory, then Windows always does some data transfers to the swap file. That's normal. Open Task Manager and check your "Peak Commit Charge" value after your computers been in use for several hours. That number should never exceed your Total Physical Memory. If it does, you've using the swap file excessively. You either need more RAM, or you need to reduce RAM usage. Some modern bloatware anti-virus apps like Norton Internet Security use a whopping 120Mb or more. If you only have 256Mb installed, you just don't have enough. Add more RAM or lose the bloatware (I recommend AVG anti-virus to my clients because it's free, works fine, and uses little memory and system resources. Norton and McAfee have become major bloatware. The free AntiVir is also a good one.
- You might have some background application that's doing a lot of disk accessing. Go through your startups in MSCONFIG and disable anything you don't need like resigstration reminders, etc. If in doubt, look up the startup process name or file name in google to find out what it is. Be sure to save a restore point first in case you disable something critical.
If in doubt, download HiJackThis , run it, and post your results here. Me or someone else who's familiar with startup can tell you if there's anything you can disable.
- Indexing is another the other possible culprit. You mentioned you disabled it but most people don't disable it properly. Just disabling the service alone is not enough.
NOTE: Indexing service needs to be enabled while you do this.
In Windows XP right-click on My Computer and click Manage.
In Windows XP Computer Management window expand the following:
- Services and Applications
- Indexing Service
- System
- Directories
and make sure all directories listed show No for the Include in Catalog. If not, double-click on the directory or directories and select No to Include in Index.
Double-click on My Computer, right-click on the C: drive and click Properties, unselect Allow Indexing Service to index this disk for fast file searching. Click Apply.
In the Confirm Attribute Changes window select Apply changes to C:\, subfolders and files and click OK to continue.
When complete, close the C: Properties window.
There is no need to disable the Indexing Service - Windows will disable it automatically, but it doesn't hurt to disable it.
- You may have a spyware app or virus. Just because your system is stable and running fast doesn't mean you're not infected. Also just running a spyware scanner isn't enough - you might have a malicious BHO object or a compromised HOSTS file.
I recommend you refer to my detailed spyware removal instructions here: http://soldcentralfl.com/flyingpenguin/spyware/spyware_help.html
Afterwards you should run a FULL virus scan in SAFE MODE. Make sure your virus definitions are up to date.
Hope this helps...
- If you're using over 60% of your physical memory, then Windows always does some data transfers to the swap file. That's normal. Open Task Manager and check your "Peak Commit Charge" value after your computers been in use for several hours. That number should never exceed your Total Physical Memory. If it does, you've using the swap file excessively. You either need more RAM, or you need to reduce RAM usage. Some modern bloatware anti-virus apps like Norton Internet Security use a whopping 120Mb or more. If you only have 256Mb installed, you just don't have enough. Add more RAM or lose the bloatware (I recommend AVG anti-virus to my clients because it's free, works fine, and uses little memory and system resources. Norton and McAfee have become major bloatware. The free AntiVir is also a good one.
- You might have some background application that's doing a lot of disk accessing. Go through your startups in MSCONFIG and disable anything you don't need like resigstration reminders, etc. If in doubt, look up the startup process name or file name in google to find out what it is. Be sure to save a restore point first in case you disable something critical.
If in doubt, download HiJackThis , run it, and post your results here. Me or someone else who's familiar with startup can tell you if there's anything you can disable.
- Indexing is another the other possible culprit. You mentioned you disabled it but most people don't disable it properly. Just disabling the service alone is not enough.
NOTE: Indexing service needs to be enabled while you do this.
In Windows XP right-click on My Computer and click Manage.
In Windows XP Computer Management window expand the following:
- Services and Applications
- Indexing Service
- System
- Directories
and make sure all directories listed show No for the Include in Catalog. If not, double-click on the directory or directories and select No to Include in Index.
Double-click on My Computer, right-click on the C: drive and click Properties, unselect Allow Indexing Service to index this disk for fast file searching. Click Apply.
In the Confirm Attribute Changes window select Apply changes to C:\, subfolders and files and click OK to continue.
When complete, close the C: Properties window.
There is no need to disable the Indexing Service - Windows will disable it automatically, but it doesn't hurt to disable it.
- You may have a spyware app or virus. Just because your system is stable and running fast doesn't mean you're not infected. Also just running a spyware scanner isn't enough - you might have a malicious BHO object or a compromised HOSTS file.
I recommend you refer to my detailed spyware removal instructions here: http://soldcentralfl.com/flyingpenguin/spyware/spyware_help.html
Afterwards you should run a FULL virus scan in SAFE MODE. Make sure your virus definitions are up to date.
Hope this helps...
Ok, I have 1GB of memory, the peak commit charge is 761,640. I just turned off all the startups and it didnt seen to help. But I'm trying the computer management thing, and I can get services, then indexing service, but then theres nothing there. No "system" to click on. Could this be whats causing the problem?
You're in the wrong place. Read the instructions again. You shouldn't be in Services. Expand "Services and Applications" and under that tree is "Indexing Service".
Sorry, I should have been more clear. I did go to services and applications, under that was services, wmi comtrol, and indexing service. I click on indexing service, and on the right it says there are no items to show in this view. No "system".
Earlier you mentioned you disabled the Indexing Service, then FlyingPenguin mentioned you most probably disabled the Indexing Service incorrectly and you need to follow his steps.
It seems you attempted to follow the steps but forgot to undo the actions you took to disable the Indexing Service the first time. The first line of FlyingPenguins bold instructions states "NOTE: Indexing service needs to be enabled while you do this."
I think you will need to undo the steps you took previously to undo the Indexing Service so you can properly follow FlyingPenguin's provided instructions.
It seems you attempted to follow the steps but forgot to undo the actions you took to disable the Indexing Service the first time. The first line of FlyingPenguins bold instructions states "NOTE: Indexing service needs to be enabled while you do this."
I think you will need to undo the steps you took previously to undo the Indexing Service so you can properly follow FlyingPenguin's provided instructions.
Just enable indexing service if it's currently disabled (do that from Services). Follow the instructions and then disable it.
To be honest, I don't think your problem is the indexing service. I would suspect it's a background application. Maybe even spyware.
Run HiJackThis and paste a copy of the log in a post here and let us look at it.
Also, in the Task Manager Performance tab, what's your Total Commit memory? With just a browser open and nothing else it shouldn't be more than 250Mb or so.
To be honest, I don't think your problem is the indexing service. I would suspect it's a background application. Maybe even spyware.
Run HiJackThis and paste a copy of the log in a post here and let us look at it.
Also, in the Task Manager Performance tab, what's your Total Commit memory? With just a browser open and nothing else it shouldn't be more than 250Mb or so.
Ok, the total commit charge is 232,400K, and this is what the hijack thing said:
Logfile of HijackThis v1.99.1
Scan saved at 9:44:02 PM, on 8/22/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\mmc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Owner\My Documents\22222222\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mytelus.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Color Calibration.lnk.disabled
O4 - Global Startup: NaturalColorLoad.lnk.disabled
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: ftp.aopen.com
O15 - Trusted Zone: www2.ati.com
O15 - Trusted Zone: http://www.dfi.com.tw
O15 - Trusted Zone: openoffice.mirror.cygnal.ca
O15 - Trusted Zone: http://www.dfi.com
O15 - Trusted Zone: http://thesims2.ea.com
O15 - Trusted Zone: patches.ubi.com
O15 - Trusted Zone: http://patches.ubi.com
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://simcity.ea.com/update/EARTPX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda...86/client/wuweb_site.cab?1122673461937
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15014/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{96D62F02-231E-4223-8EFC-70499A9697E2}: NameServer = 199.185.220.36 199.185.220.52
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
Logfile of HijackThis v1.99.1
Scan saved at 9:44:02 PM, on 8/22/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\mmc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Owner\My Documents\22222222\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mytelus.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Color Calibration.lnk.disabled
O4 - Global Startup: NaturalColorLoad.lnk.disabled
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: ftp.aopen.com
O15 - Trusted Zone: www2.ati.com
O15 - Trusted Zone: http://www.dfi.com.tw
O15 - Trusted Zone: openoffice.mirror.cygnal.ca
O15 - Trusted Zone: http://www.dfi.com
O15 - Trusted Zone: http://thesims2.ea.com
O15 - Trusted Zone: patches.ubi.com
O15 - Trusted Zone: http://patches.ubi.com
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://simcity.ea.com/update/EARTPX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda...86/client/wuweb_site.cab?1122673461937
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15014/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{96D62F02-231E-4223-8EFC-70499A9697E2}: NameServer = 199.185.220.36 199.185.220.52
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
I find this site, for interpreting Hijack This files, in another thread. http://www.hijackthis.de/en.
Most everything was listed as Safe with the exception of a few Unknowns and a few Possibly Nasties.
Unknown
O4 - Global Startup: Color Calibration.lnk.disabled
O4 - Global Startup: NaturalColorLoad.lnk.disabled
Possibly Nasty
O15 - Trusted Zone: ftp.aopen.com - "If you didn't add 'ftp.aopen.com' to your trusted pages, it should be fixed."
O15 - Trusted Zone: www2.ati.com - "If you didn't add 'www2.ati.com' to your trusted pages, it should be fixed.
O15 - Trusted Zone: openoffice.mirror.cygnal.ca - "If you didn't add 'openoffice.mirror.cygnal.ca' to your trusted pages, it should be fixed."
O15 - Trusted Zone: patches.ubi.com - "If you didn't add 'patches.ubi.com' to your trusted pages, it should be fixed.
O17 - HKLM\System\CCS\Services\Tcpip\..\{96D62F02-231E-4223-8EFC-70499A9697E2}: NameServer = 199.185.220.36 199.185.220.52 - "Do you know the IP or Domain '199.185.220.36 199.185.220.52'? If not, fix this entry."
Most everything was listed as Safe with the exception of a few Unknowns and a few Possibly Nasties.
Unknown
O4 - Global Startup: Color Calibration.lnk.disabled
O4 - Global Startup: NaturalColorLoad.lnk.disabled
Possibly Nasty
O15 - Trusted Zone: ftp.aopen.com - "If you didn't add 'ftp.aopen.com' to your trusted pages, it should be fixed."
O15 - Trusted Zone: www2.ati.com - "If you didn't add 'www2.ati.com' to your trusted pages, it should be fixed.
O15 - Trusted Zone: openoffice.mirror.cygnal.ca - "If you didn't add 'openoffice.mirror.cygnal.ca' to your trusted pages, it should be fixed."
O15 - Trusted Zone: patches.ubi.com - "If you didn't add 'patches.ubi.com' to your trusted pages, it should be fixed.
O17 - HKLM\System\CCS\Services\Tcpip\..\{96D62F02-231E-4223-8EFC-70499A9697E2}: NameServer = 199.185.220.36 199.185.220.52 - "Do you know the IP or Domain '199.185.220.36 199.185.220.52'? If not, fix this entry."
First two O4s are related to color calibration - probably for a printer or scanner. They've been disabled anyway.
All the O15s are sites that have been added to your Trusted Zone in Internet Explorer. They don't need to be in there, but they're all legit sites (with the exception of openoffice.mirror.cygnal.ca maybe - you might want to nuke that one).
I missed O17 in my first look through it and that one is a bit suspicious. I'd fix that one, but make sure you create a Restore point first.
All the O15s are sites that have been added to your Trusted Zone in Internet Explorer. They don't need to be in there, but they're all legit sites (with the exception of openoffice.mirror.cygnal.ca maybe - you might want to nuke that one).
I missed O17 in my first look through it and that one is a bit suspicious. I'd fix that one, but make sure you create a Restore point first.
I fixed the O15 openoffice one, and the O17 one, and then I restarted. Nothing seemed to change though. Do you guys have any other ideas? Thanks.
Do you have an application running on your computer such as Boinc or Seti? These applications run during the processor's idle cycles and access the disk periodically. Have you scanned for viruses and spyware? If you visit FlyingPenguin's website you will find a very good page devoted to explaining how to remove spyware. The basic procedure is to install Microsoft's new Anti-spyware then reboot the computer and scan your system for spyware from Safe Mode.
Can someone check this and see if there is anything suspicious. Thanks,
Logfile of HijackThis v1.99.1
Scan saved at 12:54:15 PM, on 8/25/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Documents and Settings\Justin\My Documents\HijackThis.exe
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Merriam-Webster Online BHO - {5ADA9CAC-04F9-4DD2-ABFD-74D673BE8624} - C:\WINDOWS\_MWOLTB.DLL
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: Merriam-Webster Online - {B7B76DD6-B6F0-4443-AF81-6A3ECF12A57D} - C:\WINDOWS\_MWOLTB.DLL
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [IntelAudioStudio] "C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" BOOT
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
O8 - Extra context menu item: MWOL &Dictionary - res://C:\WINDOWS\_MWOLTB.DLL/23/219
O8 - Extra context menu item: MWOL &Thesaurus - res://C:\WINDOWS\_MWOLTB.DLL/23/220
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {3CF32649-D1C0-4F42-AB44-ED284748920B} (Merriam-Webster Online Toolbar) - http://miriamwebster.com/toolbar/webinstall.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
Logfile of HijackThis v1.99.1
Scan saved at 12:54:15 PM, on 8/25/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Documents and Settings\Justin\My Documents\HijackThis.exe
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Merriam-Webster Online BHO - {5ADA9CAC-04F9-4DD2-ABFD-74D673BE8624} - C:\WINDOWS\_MWOLTB.DLL
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: Merriam-Webster Online - {B7B76DD6-B6F0-4443-AF81-6A3ECF12A57D} - C:\WINDOWS\_MWOLTB.DLL
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [IntelAudioStudio] "C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" BOOT
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
O8 - Extra context menu item: MWOL &Dictionary - res://C:\WINDOWS\_MWOLTB.DLL/23/219
O8 - Extra context menu item: MWOL &Thesaurus - res://C:\WINDOWS\_MWOLTB.DLL/23/220
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {3CF32649-D1C0-4F42-AB44-ED284748920B} (Merriam-Webster Online Toolbar) - http://miriamwebster.com/toolbar/webinstall.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
Dude,
Do not hijack the thread. Hijack This is a utility, not a request for thread hijacking. You should have seen this link above, http://www.hijackthis.de/en. Paste your output in there and you will find a couple unknowns, a couple possibly nasty, and a couple nasty that include the AOL Toolbar and the Merriam-Webster Online Toolbar.When I used the analyze tool for the Hijack this log file it said that I didn't have a firewall running. But I do have the XP firewall turned on! Why would this be?
Thanks
Justin
Thanks
Justin
I know, I am playing with you. I do not typically use words such as "Dude" but such inflections are difficult to communicate through text forums. Welcome to the forums.
For the most part, your system is clean. That is if you like having those toolbar add-ons. I dislike it when organizations feel free to misconfigure my computer for me so I always remove such things. I do enough system misconfiguration on my own without their help. It would also help to use Firefox to reduce BHO's (Browser Helper Objects) and spyware.
You may be able to remove some of those items through Add/Remove Software in the Control Panel.
Make sure you install Microsoft Anti-Spyware and you have an Anti-Virus program running. Then reboot and go into Safe Mode and scan for viruses and spyware.
EDIT: I do not know about the XP firewall not being recognized but I would not worry about it.
TRENDING THREADS
-
Discussion Zen 5 Speculation (EPYC Turin and Strix Point/Granite Ridge - Ryzen 9000)- Started by DisEnchantment
- Replies: 23K
-
Discussion Intel Meteor, Arrow, Lunar & Panther Lakes Discussion Threads
- Started by Tigerick
- Replies: 18K
-
-
-
Facebook
Twitter