I got a bug somewhere.......

[pepsik]

xp1700 running xp home and lately applications keep freezing, I ran hijackthis, can someone look at the log and help me out.

Logfile of HijackThis v1.97.7
Scan saved at 11:31:45 PM, on 2/6/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr/*http://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/ymsgr/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr*http://my.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/ymsgr/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr*http://my.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr/*http://www.yahoo.com
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0. dll
O2 - BHO: (no name) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0. dll
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\tppaldr.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program (file:///C:Program) Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program (file:///C:Program) Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://jcs.chat.dcn.yahoo.com/v45/yacscom.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38027.706412037
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8227D5C2-6E08-41F9-8C3E-6600DB1AACEC}: NameServer = 128.97.128.1 164.67.128.11

[Elaine]

Off the top of my head, I don't see anything suspicious. Other than you do seem to like yahoo. :laugh:

[Neo]

I can't find anything of the top of my head, except Im unfamiliar what this is "tfswctrl.exe"

And im asuming you already ran spybot, adaware, and spysweeper?

[Bad Boy]

tfswctrl.exeDrive letter access to HP's and Veritas' version of DirectCD. Does the same thing as DirectCD. From HP - "This is a needed file as it controles the readability of the Combo drives. Without this file loading the end user will be able to burn CD's but wont be able to read them. The drive itself will be able to read store bought master Cd's without the file but not burnt ones"

[pepsik]

Damn, I'm really stumped on this. Here are my symptoms. Basically any program that used for dvd/cd production and editing freezes when accesing files these include recordnow max, spruceup and tmpgenc plus. The only change made to my setup was that I upgraded TMgenc to retail version. Since the problem started I've uninstalled and reinstalled all the programs, i've ran avg and adaware and nothing comes up in the scans.

[Neo]

ASPI? Reinstall it/Install it.

[pepsik]

Avg finally found it, it's tweekids.ex$ or the lovesan2 worm and explorer.ex$ the 8am virus, now I have to clean the registry as it quarintined(?) the virus but it didn't remove it.

[pepsik]

worm/agobot.8am <--- I can't seem to remove this and is still causing me all the problems, different anti virus software call it different things, so I'm a little confused about the removal. Can anyone help me out with the removal, it's also known as gaobot but I can't find anything on the 8am variant. Please help.

[Elaine]

I think the method of getting rid of them should be very similiar.
First you will need to turn off system restore. Then restart in safe mode. Edit the Hosts file so that all that is in there is 127.0.0.1 localhost. Go to run "regedit", then to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run. Export it to back it up, then go in edit out anything that looks suspicious. Reboot and do another virus scan.

[pepsik]

thanx will give it a go.

[Neo]

Hmm.. You didn't patch your system?

[pepsik]

Hmm.. You didn't patch your system?
I did, that's what's got me confused on how the whole thing came around and why AVG didn't clean it for awhile if the system was infected before. But oh well, hopefully this will get resolved when I get home and can get to cleaning it up.