Strange messages started apearing - please help

pchelpman

The log is clean now.

Yep ... call Packard Bell and ask them directly. Hdreg (or anything else to do with the product registration) shouldn't keep popping up.

In actual fact "wscntfy.exe" is the Windows Security Center, introduced in Service Pack 2. It displays a tray icon indicating the status of updates, virus protection, and firewall. As it's coming up clean (as I suspected) you can leave it alone. It's OK.

If that wccntfly.exe isn't there that's good. As is should be.

Chugging could be another question for Packard Bell, I think. If they say they need to fix it you should have a full "on site" warranty. They should come out and fix it on site for at least the first year, I feel. Check that.

Well, that's your user account clean.

Want to start on the others now?

MickKnipfler

Here you go then:

Logfile of HijackThis v1.99.1
Scan saved at 22:58:52, on 07/02/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe
C:\Program Files\NETGEAR\WG511v2\wlancfg5.exe
C:\Program Files\BUFFALO\HDManage\HDManage.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tesco.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tesco.net/
O2 - BHO: AcroIEHlprObj Class - !!06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - !!42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - !!8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: BUFFALO Power Save Utility for HD.lnk = C:\Program Files\BUFFALO\HDManage\HDManage.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NETGEAR WG311v3 Wireless Assistant.lnk = ?
O4 - Global Startup: NETGEAR WG511v2 Wireless Assistant.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O14 - IERESET.INF: START_PAGE_URL=http://www.tesco.net
O15 - Trusted Zone: http://register-tesco.qa.business.ntl.com
O15 - Trusted Zone: http://memberservices.tesco.net
O16 - DPF: NTLSignup - https://tesco.autoregister.net/tesco/NTLSignup.cab
O16 - DPF: !!6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1130634624934
O16 - DPF: !!6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1139231058642
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

angus1

Wehay!!!!! I'm so happy ... :A Thanks so much - when I think of the last few days and just about in tears over it, can't believe that it's sorted! (Well at least one user account)

Yep ready to go with the other one (there is only one more). Please let me know what I should do first with it.

hidchere

coke and pepsi are the same thing! people wake up! :eek:

MickKnipfler

hidchere wrote:

coke and pepsi are the same thing! people wake up! :eek:

You're obviously not in marketing!

Actually, if you go to an establishment and ask for a Coke, I'm pretty sure that it's illegal just to give you Pepsi without offering it as an alternative.

angus1

Am I missing something here? What's it got to do with my computer problems?

pchelpman

angus1 wrote:

Am I missing something here? What's it got to do with my computer problems?

Nothing that I can see.

Start a new topic in this forum with an HJT log on another user's acount AND let us know what's not working right with that user. We'll go from there.

MickKnipfler > that log is clean. If you are having problems with your computer start a NEW topic in this forum. Please don't jump on the back of another member's problems. It only confuses things for everyone.

When posting plse ensure you go though this first ....

http://forums.moneysavingexpert.com/showthread.html?t=133269

...and post with details of what's malfunctioning.

angus1

Hi pchelpman - am confused. When I asked if I was missing something ...
I was responding to McKnipfler and Hidchere who were talking about something in this thread that was nothing do with it.


Sorry, what should I do next about the other user on my account? Do you mean I should start another thread for that? What should I do first - open it and run all the spyware programmes and then post an HJT log? Will you have a look at this one for me too?

Thanks

pchelpman

Angus1 - Looks like we're all confused.

Ignore anything here that doesn't relate to your thread. In any event your issues are cleared now, I think.

As to your other user accounts, yes, you should be starting a new topic on each new user separately.

Before doing that, however, log on as each user and work though the usual cleaning up routines in the first 4 posts to this thread .....

http://forums.moneysavingexpert.com/showthread.html?t=133269

Only if that doesn't work should you move on to post a HJT log from that user's account with details of why you're doing it and what's wrong.

Best of luck.

angus1

Ok pchelpman - will do that - if I do have to post a log for that account would be really grateful if you could look out for it as you've been that good over this one.

I've just been and printed out Browntoa's 4 posts as you said. It says in there about disabling system restore but I could see in that post there's a big debate as to whether to do that or not - what do you suggest I do as am v confused as to whether I'm supposed to or not?

Can I just check though, now that my computer is clean, do I need to keep all the sypware programmes etc I've downloaded - should I keep them and take turns with them to make sure everything's spotted? Should I run a check every day or every week? Maybe there's a thread on here about keeping the PC clean?

Also, should I keep the children off things like miniclip or is it okay as long as I do virus and spyware checks very regularly? (Think will ban them off miniclip).


Also, should I put system files etc back to being hidden or does it not matter?

Thanks again