Something is wrong.

[Spamdini]

So i have this problem i think its caused by 2 IEXPLORER.EXE running in background, but it gives me stutter fps in games that i play and its really annoying jumping down to like 2 fps for a split second ever 3 seconds. I tried ending them in task manager and they come back as soon as i close them and i also tried rebooting and i cleaned by pc of spyware as best i could. i dont IE i use mozilla but i have a dumb family so :/ if someone could help me out it would be cool.


-----------------------------------------------------------------------------------------------------------------------

this is my hijackthis log:

Logfile of HijackThis v1.98.2
Scan saved at 9:13:18 PM, on 9/29/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\WINNT\System32\RUNDLL32.EXE
C:\WINNT\System32\devldr32.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINNT\System32\nvsvc32.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Administrator\Desktop\Tristan\hijackthis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.etcxsfdtarmhdu.us/i...khZwHk4aeWRRsQ/5df.htm
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {36CD39E9-B304-1055-72FF-CBD25FC319C0} - C:\PROGRA~1\32WIND~1\NURBCDROM.exe
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Peak Hope] C:\PROGRA~1\Real 64 Roam\support tick.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NvMcTray.dll,NvTaskbarInit
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/...neSweeper.cab27571.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840.../housecall/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/...atsClient.cab27571.cab

-----------------------------------------------------------------------------------------------------------------------

thanks in advance.

 

[warcrow]

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.etcxsfdtarmhdu.us/i...khZwHk4aeWRRsQ/5df.htm

that looks suspicious, but did you run adware and spybot in safemode? What about drivers (chipset/soundcard/videocard)? These things are important so provide as much info as possible.

 

[warcrow]

Yea, http://www.etcxsfdtarmhdu.us looks like bad news. A whois on the domain comes up null, so they're probably spoofing domains.

 

[Spamdini]

k well i have all my drivers updated i didnt run spybot in safe mode but i did in normal mode, chipset i dunno old pc, gf4 mx 440, soundblaster live.

 

[Spamdini]

alright well i did it in safe mode and i got rid of the R0 but i rebooted and they are still there. maybe something else?, should i do a virus scan in safe mode too?

 

[Spamdini]

bump

 

[BFG10K]

i dont IE i use mozilla but i have a dumb family so :/

The first thing you should have done is put them all on restricted accounts.

 

[Spamdini]

is it safe or even possible to just uninstall IE? or atleast uninstall it then reinstall it?

 

[1sikbITCH]

If you google for this line:
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant
you will see that it is indeed spyware, regardless of whatever url comes after it.

You will also find ways to remove it, along with whatever file it relates to. I would suspect it's not the only problem. You can post your HijackThis log on one of the security forums you'll find when you google, and they will help you fix it.

 

[Chunkee]

be sure to turn off system restore so it does not reload

jC