Need Help with Hijack

[lilspanisheddie]

My computer keeps doing a memory dump and shutting down. Norton, Ad Aware & Spybot are not finding any problems. Do any of you see anything suspicious?

Logfile of HijackThis v1.97.7
Scan saved at 3:05:42 PM, on 5/25/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\System32\SK9910DM.EXE
C:\WINNT\GWMDMMSG.exe
C:\WINNT\System32\igfxtray.exe
C:\WINNT\System32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb05. exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\PANICW~1\POP-UP~2\PSFree.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\WINNT\System32\svchost.exe
C:\unzipped\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] SK9910DM.EXE
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [Keyboard Preload Check] C:\OEMDRVRS\KEYB\Preload.exe /DEVID: /CLASS:Keyboard /RunValue:"Keyboard Preload Check"
O4 - HKLM\..\Run: [GWMDMpi] C:\WINNT\GWMDMpi.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb05. exe
O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~2\PSFree.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: Real.com (HKLM)
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://www.dormaweb.com
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://support.gateway.com/support/profiler/PCPitStop.CAB
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {1ED4D5E6-A0BE-11D2-91BD-00A0C924269C} (NetVueX Control) - http://planexpress.net/peiweb/netvuex.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37643.3800578704
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab

[cx0]

well, only thing i can see:

C:\PROGRA~1\PANICW~1\POP-UP~2\PSFree.exe

do you know what that is?

[classicsoftware]

<I think the log looks clean. We'll wait for Steve or Budfred to happen by to confirm my suspicions. I dont see anything that looks bad.

[Steve]

I don't see anything suspicious in your log.

C:\PROGRA~1\PANICW~1\POP-UP~2\PSFree.exe is a free pop-up stopper and seems rather benign.

If you didn't put this site in your trusted zone, have HJT fix it:

O15 - Trusted Zone: http://www.dormaweb.com

I'm not sure what's causing the memory dump and shutdown, but others will be along...

:)

[Fruss Tray Ted]

<I think the log looks clean. We'll wait for Steve or Budfred to happen by to confirm my suspicions. I dont see anything that looks bad. [/B]

It's the <, or the space prior to [/B], not sure... Do you need a proofreader ;) ?

[Fruss Tray Ted]

Originally posted by classicsoftware
<I think the log looks clean. We'll wait for Steve or Budfred to happen by to confirm my suspicions. I dont see anything that looks bad.

[Fruss Tray Ted]

Read your message but can't copy/paste it :confused:

Aarrgghh!

[classicsoftware]

I can tell you guys, I have no idea how that happened and I didn't have anything to drink before I posted. I huess i"ll just blame it on the heat

[Budfred]

I don't see anything bad, but a couple of the O16 items are suspicious. You can safely fix them all if you would like and they will get restored when you visit the sites again....

Also, one of the common free popup blocker recently went rogue, but I don't remember if it was Panicware....

[lilspanisheddie]

Another thing I have noticed is that Norton won't make it through an entire scan without the computer shutting down. I even tried this in safe Mode. I am Running XP on this machine. Any other ideas on what is happening? Or any free virus software I can download to see if it can make it through a scan?

[cx0]

Originally posted by lilspanisheddie
Another thing I have noticed is that Norton won't make it through an entire scan without the computer shutting down. I even tried this in safe Mode. I am Running XP on this machine. Any other ideas on what is happening? Or any free virus software I can download to see if it can make it through a scan?

try this:
http://housecall.trendmicro.com/

it's a free online virus scan that runs in your internet explorer via activex. i think whatever is shutting you down will not see this virus scan.

[Quantax]

Since this is WinXP, the next time this happens, go from Start to Run and type in Eventvwr. Click OK and when the new window appears, click "applications" to see what the log says.