Computer Help Forums
Home Register Members Search Articles Gallery Arcade Links
Member Login:

Computer Help Forum > Operating Systems > System Security & Infection Support > (New)Can Not Delete!!!!

Notices


Reply
Page 1 of 2 1 2
Thread Tools Display Modes

(New)Can Not Delete!!!!

 
 
THQ Newbie
Join Date: Dec 2004
Location: Australia
Age: 24
Posts: 11

Shadari will become a geek soon enough
 
      Dec 31st, 04, 12:39 AM


Hey guys.... New here, not so new with compys.

I have the same problem. It's not on my computer, so fixxing it means not knowing exactly what caused it.

I managed to tie the two iexplore.exe entries in Task manager to the icons on the desktop, and also to at least one of the popups I get in IE.

I hadn't been able to trace the exe file....

AVG antivirus couldn't find it.

It seems you couldn't get much of an answer before, but I urge you to try again.

Tia,

-Phil
 
Reply With Quote
 
Assistant Sensei
Join Date: Aug 2004
Location: VA & NC
Age: 24
Posts: 1,162
D Schrute's Avatar

D Schrute is a splendid one to beholdD Schrute is a splendid one to beholdD Schrute is a splendid one to beholdD Schrute is a splendid one to beholdD Schrute is a splendid one to beholdD Schrute is a splendid one to behold
 
      Dec 31st, 04, 12:43 AM
@Shadari: Have you run HiJackThis? Found under Quick Links > Handy Tools
 

 
"I can travel anywhere, except Cuba, and I will travel to New Zealand and walk the Lord of the Rings trail to Mordor and I will hike Mount Doom." ~Dwight K. Schrute
Reply With Quote
 
THQ Newbie
Join Date: Dec 2004
Location: Australia
Age: 24
Posts: 11

Shadari will become a geek soon enough
 
      Dec 31st, 04, 1:00 AM
New proggies all the time...

HJT log as follows:
Logfile of HijackThis v1.99.0
Scan saved at 10:56:54 AM, on 31/12/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kentronix\Wheel Mouse\2.0\lwbwheel.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Ulead PhotoImpact 6\Abmtsr.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
C:\Program Files\MSWorks\Calendar\WKCALREM.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\crypserv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WinMX\WinMX.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
C:\Documents and Settings\user\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.com.au/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.bigpond.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ninemsn.com.au/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Telstra Big Pond Home Internet Explorer
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: (no name) - {0F4A45E1-7D9D-0A13-D934-257CD924C58A} - C:\PROGRA~1\CLOSEI~1\ToolDumb.exe (file missing)
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.2001.0001\en-au\msntb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Kentronix\Wheel Mouse\2.0\lwbwheel.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.0002.1001\en-au\msnappau.exe"
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\MSWorks\Calendar\WKCALREM.EXE
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Album Fast Start.lnk = C:\Program Files\Ulead PhotoImpact 6\Abmtsr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.bigpond.com/
O17 - HKLM\System\CCS\Services\Tcpip\..\{1D96D078-DAAF-4D3B-B5EB-0D05D97B3A06}: NameServer = 61.9.192.14
O17 - HKLM\System\CCS\Services\Tcpip\..\{BB664A87-8863-4077-9044-84C67B064318}: NameServer = 61.9.192.14,61.9.192.15
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = nsw.bigpond.net.au
O17 - HKLM\System\CS1\Services\VxD\MSTCP: SearchList = vic.bigpond.net.au
O17 - HKLM\System\CS1\Services\Tcpip\..\{1D96D078-DAAF-4D3B-B5EB-0D05D97B3A06}: NameServer = 61.9.192.14
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = nsw.bigpond.net.au
O17 - HKLM\System\CS2\Services\VxD\MSTCP: SearchList = vic.bigpond.net.au
O17 - HKLM\System\CS2\Services\Tcpip\..\{1D96D078-DAAF-4D3B-B5EB-0D05D97B3A06}: NameServer = 61.9.192.14
O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = vic.bigpond.net.au
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = nsw.bigpond.net.au
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Crypkey License - Unknown - crypserv.exe (file missing)
O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Running WinXP HomeSP2 with AVG Free antivirus
 
Reply With Quote
 
Assistant Sensei
Join Date: Aug 2004
Location: VA & NC
Age: 24
Posts: 1,162
D Schrute's Avatar

D Schrute is a splendid one to beholdD Schrute is a splendid one to beholdD Schrute is a splendid one to beholdD Schrute is a splendid one to beholdD Schrute is a splendid one to beholdD Schrute is a splendid one to behold
 
      Dec 31st, 04, 1:15 AM
Not sure if this is the problem, but take note of this virus since you have WinMX
 

 
"I can travel anywhere, except Cuba, and I will travel to New Zealand and walk the Lord of the Rings trail to Mordor and I will hike Mount Doom." ~Dwight K. Schrute
Last edited by D Schrute; Dec 31st, 04 at 1:21 AM..
Reply With Quote
 
THQ Newbie
Join Date: Dec 2004
Location: Australia
Age: 24
Posts: 11

Shadari will become a geek soon enough
 
      Dec 31st, 04, 1:17 AM
The page you were looking for was not found. The link may be outdated, or you may have typed the address (URL) incorrectly. You may find what you are looking for in one of the links below
 
Reply With Quote
 
THQ Newbie
Join Date: Dec 2004
Location: Australia
Age: 24
Posts: 11

Shadari will become a geek soon enough
 
      Dec 31st, 04, 1:18 AM
Found it... something buggered up the link....

And no, it's the actual WinMX, not a virus generated through the evils of Kazaa

-Phil
 
Reply With Quote
 
THQ Newbie
Join Date: Dec 2004
Location: Australia
Age: 24
Posts: 11

Shadari will become a geek soon enough
 
      Dec 31st, 04, 1:38 AM
Looking a bit deeper into the system... looks like the MSN toolbar could be partly responsible. I can't remove it in Add/remove programs, because theres two "iexplore.exe" files open, which it misconstrues into being two instances of IE, and therefore itself.

The icons on the desktop are unmovable, unchangable, unrightclickable....

Tis a challenge to be sure.
 
Reply With Quote
 
Assistant Sensei
Join Date: Aug 2004
Location: VA & NC
Age: 24
Posts: 1,162
D Schrute's Avatar

D Schrute is a splendid one to beholdD Schrute is a splendid one to beholdD Schrute is a splendid one to beholdD Schrute is a splendid one to beholdD Schrute is a splendid one to beholdD Schrute is a splendid one to behold
 
      Dec 31st, 04, 1:43 AM
Have you tried using Kill.exe to end the programs to allow you to be able to remove the toolbar?
 

 
"I can travel anywhere, except Cuba, and I will travel to New Zealand and walk the Lord of the Rings trail to Mordor and I will hike Mount Doom." ~Dwight K. Schrute
Reply With Quote
 
THQ Newbie
Join Date: Dec 2004
Location: Australia
Age: 24
Posts: 11

Shadari will become a geek soon enough
 
      Dec 31st, 04, 1:58 AM
Does the same thing as ending them in Task Manager.

It says it's killed, but they just comeback

using it as:

>tlist
[List of processes and PIDs]

>kill [PID]
"Process #[pid] killed

>tlist

[Same processes and iexplore.exe has a new PID]
 
Reply With Quote
 
THQ Newbie
Join Date: Dec 2004
Location: Australia
Age: 24
Posts: 11

Shadari will become a geek soon enough
 
      Dec 31st, 04, 2:27 AM
I'm now in safe mode, and the iexplore's aren't there to remove, and HJT doesn't seem to have anything useful to fix...

Ideas....?

Logfile of HijackThis v1.99.0
Scan saved at 12:27:10 PM, on 31/12/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\user\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.leiptlahsfggo.com/a3Gi1J0...80vJ2xhF3.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.com.au/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.bigpond.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ninemsn.com.au/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Telstra Big Pond Home Internet Explorer
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Kentronix\Wheel Mouse\2.0\lwbwheel.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.0002.1001\en-au\msnappau.exe"
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\MSWorks\Calendar\WKCALREM.EXE
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Album Fast Start.lnk = C:\Program Files\Ulead PhotoImpact 6\Abmtsr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.bigpond.com/
O17 - HKLM\System\CCS\Services\Tcpip\..\{1D96D078-DAAF-4D3B-B5EB-0D05D97B3A06}: NameServer = 61.9.192.14
O17 - HKLM\System\CCS\Services\Tcpip\..\{BB664A87-8863-4077-9044-84C67B064318}: NameServer = 61.9.192.14,61.9.192.15
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = nsw.bigpond.net.au
O17 - HKLM\System\CS1\Services\VxD\MSTCP: SearchList = vic.bigpond.net.au
O17 - HKLM\System\CS1\Services\Tcpip\..\{1D96D078-DAAF-4D3B-B5EB-0D05D97B3A06}: NameServer = 61.9.192.14
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = nsw.bigpond.net.au
O17 - HKLM\System\CS2\Services\VxD\MSTCP: SearchList = vic.bigpond.net.au
O17 - HKLM\System\CS2\Services\Tcpip\..\{1D96D078-DAAF-4D3B-B5EB-0D05D97B3A06}: NameServer = 61.9.192.14
O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = vic.bigpond.net.au
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = nsw.bigpond.net.au
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Crypkey License - Unknown - crypserv.exe (file missing)
O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

-Phil
 
Reply With Quote
Reply
Page 1 of 2 1 2

« recurring viruses plz help!!! | Another HJT thread »
Thread Tools
Display Modes
Linear Mode Linear Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
can't delete camoflaugedm Software Support 10 Feb 25th, 06 8:24 PM
cant delete this file... Supra Microsoft Windows 7 Jan 26th, 06 8:37 AM
Can't Delete a file Xphstos Microsoft Windows 4 Dec 15th, 05 6:58 PM
Can Not Delete!!!! frankrizzo System Security & Infection Support 53 Feb 27th, 05 2:08 AM
How do I delete everything off my C drive contentment Microsoft Windows 4 Oct 19th, 03 5:38 PM


Powered by vBulletin® Version. Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
SEO by vBSEO 3.3.2 ©2009, Crawlability, Inc.
Contact Us - Computer Help Forum - Sitemap - Privacy Statement - Top

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35