2 errors on startup.. how do i remove?

[@driano]

I got these problems too so here is what i did
fisrst i went Start > Run > MsConfig
On the StartUp section u will see all programs that will run on start up , u cant uncheck what ever u thing its BS
Then ur comp will be fine
After taht get northon or Nod32 (Nod32 bettrer but suck in some ways 2)
i had like 10 worms when activated my windows and nod32 didnt do anything
i installed northon and erased everything
install both like i did. and a firewall

[peat moss]

@driano, Glad you got it sorted. Seems like every program I'v tryed lately, has a start up tool tho. Regseeker, Spybot , System Mechanic you name it! Probably easier to use too. Just remember to uncheck and don't delete them.

[Jg427]

Wolfmight, their is a newer version of hijackthis that might show more information. Download from one of these locations and post a fresh log.

http://tools.radiosplace.com/HijackThis.exe
http://www.downloads.subratam.org/hijackthis.zip
http://spywarewarrior.com/files/HijackThis.exe

You could try renaming the file msthost.exe.
If it's listed in taskmanager, shut down the process, rename and reboot to see if that helps.
My guess is that you will find it in C:\WINDOWS\system32\

[Wolfmight]

k, made another log useing the latest version:

Logfile of HijackThis v1.98.2
Scan saved at 5:39:26 PM, on 11/2/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
E:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
E:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\WINDOWS\system32\altsvc.exe
C:\WINDOWS\system32\service.exe
E:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
E:\PROGRA~1\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\rsvp.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\Program Files\LeechGet 2004\LeechGet.exe
D:\!My Downloads!\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = dynhost.inetcam.com;register.inetcam.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [DiskeeperSystray] "E:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [Zone Labs Client] E:\PROGRA~1\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [UIWatcher] E:\Program Files\Ashampoo\Ashampoo UnInstaller Suite Plus\UnInstaller Suite\UIWatcher.exe
O4 - Startup: Ashampoo Mail Virus Blocker Server.lnk = E:\Program Files\Ashampoo\Ashampoo UnInstaller Suite Plus\Mail Virus Blocker\Server.exe
O4 - Startup: Wallpaper Changer.lnk = E:\Program Files\WallpaperToy\Wallpapertoy.Exe
O8 - Extra context menu item: Download using LeechGet - file://E:\Program Files\LeechGet 2004\\AddUrl.html
O8 - Extra context menu item: Download using LeechGet Wizard - file://E:\Program Files\LeechGet 2004\\Wizard.html
O8 - Extra context menu item: Parse with LeechGet - file://E:\Program Files\LeechGet 2004\\Parser.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - E:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - E:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1094561985406

[Jg427]

Well, no lines showed up in this version of hijackthis at 020, 021 or 022.

I do see one line in your running processes that might be a problem.
C:\WINDOWS\system32\altsvc.exe

I could find very little information on altsvc.exe, which is usually a bad sign.
You could submit this file for virus scan online at http://www.kaspersky.com/scanforvirus

Right click altsvc.exe and check it's properties for information on it.

Did you try renaming msthost.exe?
If the scan on altsvc.exe is inconclusive, try renaming it too. It is running so you would need to end process on it in taskmanager first.

[Wolfmight]

Kasperky online scan said it is a virus. Norton and Nod32 both did not detect the mother f***er. Man, this is insain. glad I found it, I wanna pop some caps in the programmer's ass who got it on here. I beilieve it came from a rigged installer for "The All Seeing Eye". Norton said that installed had a virus, but it didnt detect the altsvc.exe. Anyways, it looks like it stands for Alternate Service. Cheap name in the first place eh?

[Wolfmight]

Dammit the 2 errors were actually 2 backdoor viruses!!
I hope zone alarm has been blocking them. I also have a hardware firewall in front on the network that blocks tons of incoming things. Kaspersky 5 personal found them both and deleted them.

I havnt noticed anything deleted or newly created.. hmm yet that is.

[Jg427]

Glad you found them.

Here are some free programs that will help protect your system. I've been using these and highly recommend them.


SpywareBlaster - Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted pests.

SpywareGuard - An anti-virus program scans files before you open them and prevents execution if a virus is detected - SpywareGuard does the same thing, but for spyware!

IE-SPYAD is a Registry file (IE-ADS.REG) that adds a long list of sites and domains associated with known advertisers, marketers, and crapware pushers to the Restricted sites zone of Internet Explorer.

Blocking Unwanted Parasites with a Hosts File
http://www.mvps.org/winhelp2002/hosts.htm


Visit these sites for more information on securing your computer.
How did I get infected?
Dealing with unwanted spyware.

[Afronaut]

Not one ViriiScanner is enough. But to install many is not good either.
All sorts of trouble brewing with many scanner running on the background.

I had the Norton before, gotsome trouble and installed BitDefender,
which found 3 viruses on the first scan that Norton missed.
Needless to say Im not using norton anymore.
But im not sure if BitDefender is teh best either,
I suppose no 1 scanner is.

Then there's a hassle to run online scans, and other clients for such stuff.
Just have to be carefull what to DL and install.
I had the AllSeeingEye installed about a year a go too, for AAO game,
but I didnt got infected.
It's not the app itself, many times they are just usefull apps bundled with crap.
One has to be also carefull from where to DL programs.

[trajillo]

44422211 type that into run and add your username afterwards no spaces and it will reset ur computer to factorary settings