Archived from groups: microsoft.public.windowsxp.perform_maintain (
More info?)
Smacky:
I hope you read the post about my Kodak camera problems.
Here is the log from Hijackthis. I had some trouble downloading it .
saf
Logfile of HijackThis v1.97.7
Scan saved at 7:36:48 PM, on 10/27/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\comcast\security manager\app\CurtainsSysSvcNt.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
c:\program files\comcast\security manager\app\PRISM.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe
C:\WINDOWS\System32\xwxnwhcw.exe
C:\Documents and Settings\default\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://www.websearch.com/ie.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.comcast.net/comcast.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
http://if.searchcentrix.com/sidecat.jsp?p=98567&appid=21&id=1447361221220820
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft
Internet Explorer provided by Comcast High-Speed Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings,ProxyServer = funnel.ds.adp.com:8585
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings,ProxyOverride =
*.r5.attbi.com;139.126.*.*;172.17.*;204.*;206.*;;localhost;*.adpcorp.*;<local>
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant =
http://www.websearch.com/ie.aspx?tb_id=50017
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no
file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,c:\program
files\comcast\security manager\app\SecurityManager.exe
O2 - BHO: (no name) - {000006B1-19B5-414A-849F-2A3C64AE6939} -
C:\WINDOWS\bi.dll
O2 - BHO: (no name) - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} -
C:\WINDOWS\systb.dll
O2 - BHO: Recommended Hotfix - {0421701D-CF13-4E70-ADF0-45A953E7CB8B} -
C:\Program Files\Recommended Hotfix - 421701D\v15\RH.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program
Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-DFF7-EC6BF4D5FA7D} -
C:\WINDOWS\gsim.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program
Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {E434D3C7-A673-4100-8140-79C020945017} - C:\Program
Files\Comcast\Security Manager\app\AuthBHO.dll
O2 - BHO: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -
C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O3 - Toolbar: Security Manager Popup Blocker -
{53829F91-1B06-4DB9-B13E-812A986169F9} - C:\Program Files\Comcast\Security
Manager\app\AuthBHO.dll
O4 - HKLM\..\Run: [MSConfig]
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [lscwja] C:\WINDOWS\System32\xwxnwhcw.exe
O4 - HKLM\..\Run: [Security Manager] C:\Program Files\Comcast\Security
Manager\app\SecurityManager.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM32\qttask.exe"
-atboottime
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Define - C:\Program Files\Common
Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program
Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Encarta Encyclopedia (HKLM)
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia (HKLM)
O9 - Extra button: Define (HKLM)
O9 - Extra 'Tools' menuitem: Define (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O9 - Extra button: Dell Home (HKCU)
O15 - Trusted Zone: www.comcast.net
O16 - DPF: {0A891521-685E-4B6D-A9FD-759BB2CD6A66} (SecureImage Control) -
http://www.psbwebsurveys.com/secure/SecureImage.cab
O16 - DPF: {12589FA1-C456-11CE-BF01-10AA1055595A} -
http://www.wsel.net/imcupdatefiles/whistlesilent610.cab
O16 - DPF: {1678F7E1-C422-11D0-AD7D-00400515CAAA} -
http://files.cometsystems.com/cometcursor/cobrand/comet.cab?0.9441992111998151075964595640
O16 - DPF: {30000273-8230-4DD4-BE4F-6889D1E74167} -
http://download2.abetterinternet.com/download/cabs/FON39120/flash.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -
http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe
O16 - DPF: {459729AC-727D-4D97-B18A-72EE224EFEC0} -
http://defender.veloz.com/pub/download/scandl_advt.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} -
http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37617.6032638889
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Please let me hear from you soon.
Thanks.
"smacky" wrote:
>
> Saf Wrote:
> > That does seem to improve startup and shutdown.
> > What is the next step?
> > Thanks.
> > Saf
> >
>
>
> Saf,
>
> I would like to see what exactly is causing your problem and remove the
> relevant items from the registry as the next step, then I would get you
> to see if the problem still occurs and if so, use msconfig to determine
> the cause.
>
> I would suggest downloading "Hijackthis" which is a small but powerful
> little program which can help us to see what is causing you problems.
>
> Download Hijackthis and paste the log back in here:
>
> Instructions:
> Click "Scan"
> Click "Save Log"
> Copy the contents from the Notepad document here so we can see the
> causes of the hijackers and spyware.
>
> Download Hijackthis Here:
>
http://www.spychecker.com/download/download_hijackthis.html
>
>
> Thanks
> Smacky
>
>
> --
> smacky
>