# Solved: How do I tell if I've been hijacked???



## jimmyt71 (Feb 3, 2007)

How do I tell if my browres has been hijacked?My wife noticed that on our history there was a series of numbers instead of a web address.She deleted the numbers so I didnt see what they were.Any info would be great.


----------



## jimmyt71 (Feb 3, 2007)

Here is the HJT log.Ihave scanned with Ad-Aware,AVG antispyware,and spybot S&D and they Logfile of HijackThis v1.99.1
Scan saved at 4:13:01 PM, on 3/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Azureus\Azureus.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ie/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~5\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\NPPDF32.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://aolsvc.aol.com/onlinegames/chuzzledeluxe/popcaploader_v10.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

all found nothing.Can you take alook and let me know if everything is ok?


----------



## Cheeseball81 (Mar 3, 2004)

Log looks okay but what items were disabled with msconfig?


----------



## jimmyt71 (Feb 3, 2007)

There were 2 instances of Free Ram XP Pro,so I diabled 1.Tried to launch System Restore but it wouldn't.How can I solve that?


----------



## Cheeseball81 (Mar 3, 2004)

Does it give you an error


----------



## rainforest123 (Dec 29, 2004)

If you receive no errors when trying to run system restore, look in the event viewer for error messages.
start > run 
type: eventvwr.exe 
click "ok"
maximize the screen
on the left you will see "applications", "security", "programs" and "IE". 
Left click on "applications". On the right, look for errors. 
Do the same for "programs". 
If you see an error, right click on it. Left click properties.
Note the source & event ID. 
You can copy the information in the "description" area. Use your mouse to high light it. Then with your keyboard, use the "ctrl" and "c" keyboard shortcut. 
then paste it into notepad or into a reply area of this thread. 

RF123


----------



## jimmyt71 (Feb 3, 2007)

Will try the lasI tried to run system restore,won't alolow it.What do I do next?Might have to reply in the morning.Just a small bit pissed now! Sorry


----------



## rainforest123 (Dec 29, 2004)

Please clarify "won't [sic]alolow it". Does your computer hang up? Does your computer display an error message? Does nothing happen?

When was the last time you performed a system restore?

Some viruses [ Klez, a few years ago, for example ] [ & probably other malware ] are known to prevent system restore from functioning.

Cheeseball 81 or 1 of the other certified malware removal members are your best bet if malware is your problem.

Have you tried to boot to safe mode, then run system restore? 
To boot to safe mode, tap the "F8" key once a second during the startup process. If the Win XP screen appears, wait until the desktop appears, then try again.

RF123


----------



## jimmyt71 (Feb 3, 2007)

1st Error in Applications-Source MsiInstaller.Event 10005Product: Nero 7 -- Error 2228.Database: . Unknown table 'ComponentCT' in SQL query: SELECT Component.Component, Component.ComponentId, Component.Directory_, Component.Attributes, Component.Condition, Component.KeyPath, ComponentCT.Misc, ComponentCT.OrigName, File.File, File.FileName, File.FileSize, File.Version, File.Language, File.Attributes, File.Sequence, FileCT.MD5 FROM Component, ComponentCT, File, FileCT WHERE( (Component.Component = File.Component_) AND (Component.Component = ComponentCT.Component) AND (File.File = FileCT.File)) ORDER BY Component.Component.
2nd Error Sorce MPSampleSubmission Event 5000The description for Event ID ( 5000 ) in Source ( MPSampleSubmission ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: mptelemetry, 80070424, updateservicemanager-_get_services, fallbackcheck, 1.1.1593.0, mpsigdwn.dll, 1.1.1593.0, windows defender, NIL, NIL, NIL.
3rd Error Source MPSampleSubmission Event 5001The description for Event ID ( 5000 ) in Source ( MPSampleSubmission ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: mptelemetry, 80070424, updateservicemanager-_get_services, fallbackcheck, 1.1.1593.0, mpsigdwn.dll, 1.1.1593.0, windows defender, NIL, NIL, NIL.
4th Error-Source MsiInstaller Event 11719Product: QuickTime -- Error 1719. The Windows Installer Service could not be accessed. This can occur if you are running Windows in safe mode, or if the Windows Installer is not correctly installed. Contact your support personnel for assistance.


----------



## rainforest123 (Dec 29, 2004)

Good job of gathering the data from event viewer. 

Which of the errors occurred when you tried to run system restore? If you are uncertain, note the time, try to run system restore, then check the event viewer. 

RF123


----------



## jimmyt71 (Feb 3, 2007)

Source ServiceControlManager EveThe System Restore Service service terminated with the following error: 
The system cannot find the file specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.nt 7023


----------



## rainforest123 (Dec 29, 2004)

J1: 
What is the event ID number? 

Did you go to the link? If so, please copy the address / URL and paste in a response. 
When I clicked on link you displayed, I received 404 page cannot be displayed. 

RF123


----------



## rainforest123 (Dec 29, 2004)

A. Try running System Restore in Safe Mode.

1. Restart your computer, and then press F8 during the initial startup to start your computer in Safe Mode or Safe Mode with a command prompt.
2. Log on to your computer with an administrator account or with an account that has administrator credentials.
3. In Safe Mode type or paste the following command in the Start - Run box then press Enter. In Safe Mode Command Prompt type the following command then press ENTER.

%systemroot%\system32\restore\rstrui.exe

4. Follow the instructions that appear on the screen to restore your computer to an earlier state, or undo the last restore if available.

B. 
What happens if you try in Safe Mode, logged in as Administrator, and use the command line:

Start, Run, %systemroot%\system32\restore\rstrui.exe

Follow the instructions to restore your computer to an earlier state, or undo the last restore if available.

Note: When restoring a system from the command prompt, a automatic "UNDO" restore point will NOT be created and will not allow a restoration to the current state.

C. How to re-install System Restore in XP. I don't know what happens if you try this in Vista. 
http://bertk.mvps.org/html/tips.html#ReinstallSR

RF123


----------



## jimmyt71 (Feb 3, 2007)

The link should have read http://go.mircosoft.com/fwlink/events.asp
The event id was 7023
I visited the link and this is what it said

Details 
Product: Windows Operating System 
Event ID: 7023 
Source: Service Control Manager 
Version: 5.0 
Component: System Event Log 
Symbolic Name: EVENT_SERVICE_EXIT_FAILED 
Message: The %1 service terminated with the following error: 
%2

Explanation 
The specified service stopped unexpectedly with the error indicated in the message. The service closed safely.

User Action 
To troubleshoot the error:

Review the error information displayed in the message.
To display the WIN32_EXIT_CODE error that SCM encountered, at the command prompt, type
sc query service name
The information displayed can help you troubleshoot possible causes for the error.

Version: 5.2 
Symbolic Name: EVENT_SERVICE_EXIT_FAILED 
Message: The %1 service terminated with the following error: 
%2

Explanation 
The specified service stopped unexpectedly with the error indicated in the message. The service closed safely.

User Action 
To troubleshoot the error:

Review the error information displayed in the message.
To display the WIN32_EXIT_CODE error that SCM encountered, at the command prompt, type
sc query service name
The information displayed can help you troubleshoot possible causes for the error.

--------------------------------------------------------------------------------

Related Knowledge Base articles
You can find additional information on this topic in the following Microsoft Knowledge Base articles: 
• Adding or removing a program may generate Event ID 7023 
When you add or remove a program by using Add/Remove Programs in Control Panel, the following event may appear in the system log: Event Type: Error Event Source: Service Control Manager Event ID: 7023 Description: The Application Management... 
• You cannot create a network connection after you restore Windows XP 
Fixes a problem with a restored installation of Windows XP SP1 that cannot create a network connection. 
• You cannot start the Windows Firewall service in Windows XP Service Pack 2 
Describes that you cannot start Windows Firewall after you install Windows XP Service Pack 2. This article provides steps for troubleshooting startup problems with the Windows Firewall service. 
• When you disable the Windows Firewall service on your Windows XP Service Pack 2-based computer, the Computer Browser service stops after five minutes and Event ID 7023 is logged in the Event Viewer 
Describes a fix for an issue in Windows XP Service Pack 2 (SP2) where the Computer Browser service stops after five minutes and Event ID 7023 is logged in the Event Viewer System log when you disable the Windows Firewall service.


----------



## jimmyt71 (Feb 3, 2007)

Just tried running system restore in safe mode.Same problem again.Got an error message.
Source srsservice Event 104

The System Restore initialization process failed.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
I was told that I could be protected by system restore and to restart my computer and launch system restore again.Did that and got the same message again.Will have a look at that link now.


----------



## Cheeseball81 (Mar 3, 2004)

This can occur if the C: drive is replaced with a new drive and move to the secondary position ( D: ) and the System Volume Information folder is left in place.

It is possible, however, to reinstall System Restore and get it running again if the mechanisms for performing System Restore become damaged or unregistered. The one drawback to doing this is that all existing System Restore points will be deleted. But if you need to get System Restore working, this may be a relatively small price to pay. 

Enable hidden and system files in Explorer if you haven't done so already. To do this, open Control Panel | Folder Options | View, and in Advanced Settings under Hidden Files and Folders, select "Show hidden files and folders," Below that, uncheck "Hide protected operating system files." (You will probably want to restore this option later.) 
From Start | Run, type %SystemRoot%\inf and press Enter. 
Find the file named sr.inf. Right click on it and select Install. 
You may be prompted for your Windows installation media, or a directory on your hard drive that has the \i386 folder. If you installed Service Pack 2 (as opposed to installing a version of Windows XP with SP2 preinstalled), use the folder %SystemRoot%\ServicePackFiles\i386 .


----------



## jimmyt71 (Feb 3, 2007)

Searghed fo file sr.inf.I couldn't see it.This is what I have in sr--sr,sr.PNF,srchasst,srchasst.PNF,srusbusd,srusbusd.PNF
Is it one of these?


----------



## rainforest123 (Dec 29, 2004)

In addition to following CB81's excellent instructions, you need to set XP's search to search for hidden files & folders.

Please follow the instructions Microsoft has provided. 
Then search again.
http://support.microsoft.com/kb/302347

RF123


----------



## jimmyt71 (Feb 3, 2007)

Cheeseball81
I had a new DVD rewriter installed in December.Could that have caused it to become damaged?I used search to try to find that file.I looked in set up information files and all it found was---net3sr and sr.


----------



## rainforest123 (Dec 29, 2004)

A file name is actually [ usually ] 2 parts, in the form "filename.ext"
filename 
the "dot"
and the extension
sr could be sr.inf 
sr could be sr.xyz

Do you have your computer set to show the file extensions? 
Open "my computer".
Across the top, left click "folder options".
Left click the "view" tab.
In the center, in a big white area labeled "advanced settings", 
look for "Hide extensions for known file types" [ or something similar ]. 
If the box is checked, uncheck it.

Also, be sure "hide protected operating system files [ recommended ] " is unchecked.

Also, be sure "show hidden files & folders" is unchecked. 
Left click "apply". 
Left click "ok".

Then, use Windows XP's search again.

Sincerely, 
RF123


----------



## jimmyt71 (Feb 3, 2007)

Sorry about this.I found the file and tried to install and this was the message I got-
The file 'srs.sys'on Windows XP Home Edition Service Pack 2 CD is needed.(what does this mean)
Type the path where the file is located,and then press OK.
Copy files from
C:\WINDOWS\inf\i386

I typed in %SystemRoot%\ServicePackFiles\i386
All that happened was I got a noise and nothing else.I am still only learning so please forgive me!!


----------



## rainforest123 (Dec 29, 2004)

1. %SystemRoot% explanation 
%SystemRoot% is not a specific location.

%SystemRoot" refers to the folder into which Windows was installed.

Generally / By default, on a Windows XP computer MOST of the time, Windows is installed to a folder on your C: drive. The folder is called "Windows".

Thus, in this case, %SystemRoot% would be C:\Windows

2. Which edition [ SP = service pack ] of Windows XP Home [ basic, i.e. SP 0; SP1 or SP2 ] was on your computer when the computer was built? Now, you have Windows XP SP2.

3. Do you have an authentic Windows XP CD for your computer? I am not asking because of the occasional use of borrowed copies of Windows XP. If yes, which version of Windows is on the disk? Please include the service pack number.

4. SP2 CD 
If your computer came with SP0 or SP1 & it has been upgraded to SP2, you will probably need SP2. SP2 can be ordered, in CD form from Microsoft, or downloaded. It is a VERY LARGE file, > 250 MB.

You can download XP SP2 from 
http://www.microsoft.com/downloads/...BE-3B8E-4F30-8245-9E368D3CDB5A&displaylang=en

To order the CD, please visit: 
http://www.microsoft.com/windowsxp/downloads/updates/sp2/cdorder/en_us/default.mspx

5. sr.inf 
If you look on your computer, in C:\Windows", you will probably see a folder called "INF". There, you will probably find sr.inf .
Your computer needs to be set to show hidden, system & protected files. See # 20, above.

6. With your computer set to search in "hidden files & folders", use Windows XP's search tool for "i386" [ without the quotes ] . See #18, above.

Sincerely, 
RF123


----------



## jimmyt71 (Feb 3, 2007)

When I got this computer Windows 98 ME was installed.I installed Xp later.I downloaded SP 2 from microsoft.I checked for updates on my control panel just now an I didn' have SP1 at all!I cannot find the booklet for the program to find out SP1 was preinstalled.I have a genuine copy of XP home,version 2002.0161 part no x08-33941.Product key (removed).Is this wjat you are looking for?


----------



## Cheeseball81 (Mar 3, 2004)

Yikes. I had to remove the product key from your post. That's not something you wanna show to the world.


----------



## jimmyt71 (Feb 3, 2007)

Thanks mate,wasn't sure what RF123 was looking for.


----------



## jimmyt71 (Feb 3, 2007)

Oh I'm so sorry,HAPPY BIRTHDAY!!!


----------



## Cheeseball81 (Mar 3, 2004)

LOL it's okay. Thank you!


----------



## jimmyt71 (Feb 3, 2007)

I went to the microsoft website and tried to get an update for SP2.Instead of getting the usual file download dialogue box I went straight to the thank you for downloading page.Whats that all about??


----------



## jimmyt71 (Feb 3, 2007)

Just ran msconfig.In services I noticed that System Restore Service is stopped.Also in start up StateMgr doesn't appear.I was looking at a similar thread an someone said it should appear as it is this that runs system restore.The person that posted the thread was running ME.Is it the same with XP?


----------



## rainforest123 (Dec 29, 2004)

CB: 
Thanks.

J71, I definitely did not want you to post your product key / ID. I apologize for any confusion resulting from my posts.

Did you set your computer to display system, hidden & protected files, as noted in # 20?

Have you set XP's search to look in hidden folders, per # 18, above? The processes are distinctly different. Don't ask me why.

After you have verified the above,

Follow Cheeseball81's instructions in #16, above.

"From Start | Run, type %SystemRoot%\inf and press Enter.
Find the file named sr.inf. Right click on it and select Install. "

Windows XP is probably installed in a folder called "windows" on your "C" drive. If both of those are true, you would type: c:\windows\inf

You would NOT type: %system root%\inf

You would type: c:\windows\inf

If that fails, report any messages / error messages.

You could also search your computer for sr.*

If you don't find sr.inf, search your Windows XP SP2 CD for sr.*

The "*" is a wildcard; a symbol that can represent any digit, letter, and some characters. 
start > search > "all files & folders" .
Maximize the search window if necessary. It is maximized if the middle box in the upper right hand corner displays 1 rectangle overlying a 2nd rectangle.

In the box "all or part of . . ", type: sr.*

In the "look in", you need to see your "C" drive, which may be labeled local disk C: .

Left click "search".

When searching a CD, in the "look in" area, you would need to have your CD drive selected. Left click on the down pointing arrow to the right margin. Look up or down. Once you find the CD drive, left click on it.

Regarding "state manager", that was used by Windows Millennium. "state manager" is not on my Win XP computers. I don't recall having seen it on any other Win XP computers.

FYI regarding upgrades to Windows XP SP2.
You could have upgraded from Win 98 or Win ME [ they are different operating systems ] to Windows XP base [ SP 0 ] or SP 1. It sounds like you then upgraded to Win XP SP2.

It is possible to have upgraded to SP2 by CD, or download, as noted above. It is also possible to upgrade to SP2 using Microsoft's automatic update utility.

Sincerely, 
RF123


----------



## jimmyt71 (Feb 3, 2007)

I found the file and tried to install it.See #21 above to see what happened.I dont have SP2 CD.I downloaded it from Microsoft.I looked at the Administrive Tools and looked in services.I clicked on System Restore Services.The startup type is set at automatic.The path to executable is C:\WINDOWS\System32\svchost.exe -k netsvcs.I tried to start system restore and got this message,
Services
could not start System Restore Service service on Local Computer.
Error 2:The system cannit find the file specified.
Do you have any idea what this means??I'm at my wits end


----------



## rainforest123 (Dec 29, 2004)

J71: 
In #21, you wrote: 
The file 'srs.sys'on Windows XP Home Edition Service Pack 2 CD is needed.(what does this mean)
Type the path where the file is located,and then press OK.
Copy files from
C:\WINDOWS\inf\i386

1. Are you sure the message is srs.sys & not sr.sys? 
Search your computer for srs.sys, if that is the correct file name noted in the error message.

2. NOTE: below, the author writes "%Windir%\INF"
jimmyt71, in which folder is Windows XP installed? Is it installed on your C: drive, in a folder called "windows"? 
If so, replace %Windir% with C:\windows\inf

Source http://windowsxp.mvps.org/repairsr.htm 
How to reinstall System Restore in Windows XP?

Reinstalling System Restore

1. Click Start, Run and type %Windir%\INF

2. Locate the SR.INF file. If you have configured Windows Explorer to hide known file extensions, the file may show up as SR. To see the file extensions for all file types, then try this:

* On the Tools menu in My Computer, click Folder Options.
* Click the View tab.
* Clear the Hide extensions for known file types check box.

3. Right-click the SR.INF file, and then click Install

4. Windows will now attempt to reinstall System Restore, and may prompt you for the Windows installation source path. Point to %Windir%\ServicePackFiles folder, or insert your slipstreamed Windows XP (matching the Service Pack level of your system.)

5. System Restore core files will be reinstalled. Restart Windows when prompted.

Hang in there.

RF123


----------



## jimmyt71 (Feb 3, 2007)

Thanks RF123.Will try all and get back to you


----------



## jimmyt71 (Feb 3, 2007)

Tried to install agian.Got the same message saying files needed and sr.sys on Windows XP Home Edition SP2 CD is needed.Should I have pointed to 
%Windir%\ServicePackFiles\inf\i386?


----------



## jimmyt71 (Feb 3, 2007)

I used search to find sr.sys.There are three.The first is inC:\WINDOWS\ServicePackFiles\i386.The secondis in C:\WINDOWS\System32\DRIVERS.The last is in C:\WINDOWS\$NtServicePackUninstall$.Would this be my problem?


----------



## rainforest123 (Dec 29, 2004)

%windir% is NOT a REAL location

CAPS for emphasis, not shouting.  

On which drive is Windows XP installed? Probably your C: drive.

In which folder is Windows XP installed? Probably Windows

If Windows XP is installed on your C: drive in a folder called Windows, 
%WinDir% , you would type
C:\Windows\INF 

1. Are you sure the message is srs.sys & not sr.sys?
Search your computer for srs.sys, if that is the correct file name noted in the error message.

2. NOTE: below, the author writes "%Windir%\INF"
jimmyt71, in which folder is Windows XP installed? Is it installed on your C: drive, in a folder called "windows"?
If so, replace %Windir% with C:\windows\inf 

RF123


----------



## rainforest123 (Dec 29, 2004)

J71: 
1. Regarding #34, above 
"Should I have pointed to %Windir%\ServicePackFiles\inf\i386?"

Try pointing to C:\WINDOWS\ServicePackFiles\i386

If that fails, try pointing to C:\WINDOWS\System32\DRIVERS 

You noted these locations in #35 above. 

RF123


----------



## jimmyt71 (Feb 3, 2007)

Same as before in#34.You must be starting to pull your hair out aswell.I'm going to get a stiff drink and check back with you.


----------



## jimmyt71 (Feb 3, 2007)

I was looking in "my computer" and I found a file with 3 restore points in it.They were from Dec 06.Could I use one of these?Would I loose Everything after that date?


----------



## rainforest123 (Dec 29, 2004)

"Persistence & patience are required when working with computers." You can quote me.

Yes, J71, it is frustrating. Hang in there.

In #38, you wrote "Same as before in#34."

Please be as complete as possible in the steps you performed.

In #31, above, you wrote: 
"I dont have SP2 CD.I downloaded it from Microsoft."
Do you still have the download? If not download it again.

You may need to create a slip streamed Win XP CD. 
You will need: A CD burner; a blank CD-R CD.

http://forums.techguy.org/windows-nt-2000-xp/466993-slipstreaming-sp2.html 
See JW's comment about AutoStreamer
I have used AutoStreamer. 
It REALLY was easy for me to use.

On your hard drive, create a folder called autostreamer
open "my computer"
open your "C:" drive
Left click file
left click new
left click folder
name / rename the folder autostreamer 
Go to http://www.neowin.net/forum/index.php?showtopic=223562 ,
Scroll down to #7
Left click on "auto streamer installer"
Save the file to your hard drive, to C:\autostreamer

RF123


----------



## jimmyt71 (Feb 3, 2007)

I tried to install it again but I got the same message as before,about needing the cd.I got autostreamer and there is nothing in the service pack file portion.Does that mean I haven't got it downloaded?I will try to download it again while I am waiting for you to reply


----------



## rainforest123 (Dec 29, 2004)

J71:

"I was looking in "my computer" and I found a file with 3 restore points in it.They were from Dec 06.Could I use one of these?Would I loose Everything after that date?"

If system restore is not working, those restore points are probably not useful.

Yes, you would lose everything after that date. Theoretically, changes that occur after restoring your computer are reversible, if and only if [ IFF ] you reverse the system restore point.

RF123


----------



## rainforest123 (Dec 29, 2004)

J71: 
Go to http://bertk.mvps.org/html/tips.html#ReinstallSR

Look for " How do I re-install system restore?", which is about 1/2 way down

Excerpt: 
Or simply type or paste the following command into the Start - Run box and press enter.

rundll32.exe advpack.dll,LaunchINFSection C:\Windows\Inf\sr.inf

Do the following, please. Report the results. Report any error messages. 
left click start
left click run
delete the contents of the long skinny box
Into to long, skinny box, paste: 
rundll32.exe advpack.dll,LaunchINFSection C:\Windows\Inf\sr.inf

Left click "ok"

RF123


----------



## jimmyt71 (Feb 3, 2007)

I tried the last post and the same message came up again.I will search for the files specified on the link you provided.I tried to download SP2 again but there seems to be a problem with the site everytime I try to download something.I looked in Add/Remove an when the list came up it said I have SP2.


----------



## rainforest123 (Dec 29, 2004)

J71: 
At which point did the message appear?

Regarding SP2. You noted, in an earlier post to this thread, that you had downloaded it. 
Presumably, the download is still on your computer.

Search your computer for WindowsXP-KB835935-SP2-ENU.exe .

http://www.microsoft.com/windowsxp/sp2/default.mspx 
On the right, click on "download and deploy .. to multiple ..".
You should now be at 
http://www.microsoft.com/downloads/...BE-3B8E-4F30-8245-9E368D3CDB5A&displaylang=en

Left click on the "download" button.

The file name is WindowsXP-KB835935-SP2-ENU.exe . 
[ You could change the name to Ireland.exe . The computer doesn't care. ]

Sincerely, 
RF123


----------



## rainforest123 (Dec 29, 2004)

J71: 
You have written that the fixing this problem is frustrating. Hang in there.

Because you & the forum are not in the same physical location, communication is very important.

What is the EXACT error message that appears when you try to re-install system restore?

I looked at at web page dedicated to Win XP system restore error messages. 
http://bertk.mvps.org/html/error.html

The error message you noted [ I even changed "cannit" to "cannot" ] is not listed. It is possible that the list of error messages at http://bertk.mvps.org/html/error.html is incomplete.

RF123


----------



## rainforest123 (Dec 29, 2004)

J71:

What is the EXACT error message that appears when you ran autostreamer?

At which point did the error message appear? 
You can use the screen shots at http://www.neowin.net/forum/index.php?showtopic=223562 , post #1 by Flishfun 
Just tell us which screen shot best describes the area at which you encounter difficulties.

Plan B: 
Go to this site, which provides step by step instructions for using AutoStreamer.

http://www.simplyguides.net/guides/using_autostreamer/using_autostreamer.shtml

Near the bottom, you will find a link to "I want to use my Windows CD". 
Left click on it. 
You will be taken to http://www.simplyguides.net/guides/using_autostreamer/using_autostreamer2.shtml

RF123


----------



## jimmyt71 (Feb 3, 2007)

I am doing what you said in #45.Thank you for being so patient.Us newbies must try your patience


----------



## jimmyt71 (Feb 3, 2007)

I was looking at the screenshots.In using CD should I type in the info displayed about the service pack or should it be automatically displayed?


----------



## jimmyt71 (Feb 3, 2007)

Its me again,I searched for WindowsXP-KB835935-SP2-ENU.exe . 

Search couldn't find it.Does that mean that it is not installed?


----------



## rainforest123 (Dec 29, 2004)

J71: 
I need to write, step by step, that which you did. Telling me that you followed the steps really is of little use.

If you really are in Ireland, it must be very late. Perhaps you want to sleep for a few to several hours.

I suggest that you read / re-read http://www.simplyguides.net/guides/using_autostreamer/using_autostreamer2.shtml

"Windows CD drive: 
AutoStreamer should detect the drive where you have placed your Windows XP CD and if successful a drive letter should be displayed."

Service pack file: 
If you click the magnifying glass you will have to locate the Service Pack file. AutoStreamer will then analyze the file and display the build number.

I was a beginner, not long ago. I wasn't born with a computer in my lap.

I am glad to help you, but I can't do it for you.

Do you know the location of SP2? If not

After downloading the 266 MB Win XP SP2 file, open it. 
You will see a small screen that tells you that the program is extracting files.

You will see a location such as c:\88ff .. .. "SUCH AS" for emphasis. 
The location could easily be c:\abcdefg12345 . . ..

After the extraction process has completed, you will see [ go to attached screen shot ].
Left click "cancel". 
Left click "yes", confirming that you want to cancel. 
Left click "ok" OR "yes" when Windows informs you that SP2 upgrade was stopped / cancelled.

Now, open "my computer"
Open "C:" drive
Open the folder to which SP2 files were extracted, as noted above in this post.

************
You will see a location such as c:\88ff .. .. "SUCH AS" for emphasis. 
The location could easily be c:\abcdefg12345 . .

************ 
That is the location of your SP2 files. 
Open that folder. 
You should see i386.
open i386

Good luck.

Sincerely, 
RF123


----------



## jimmyt71 (Feb 3, 2007)

When I run Autostreamer this is what I get on the main page,
Operating System:Windows XP Family 
Build:5.1.2600.1106(SP1)
Size:518MB
There is an red X next to the service pack file
Build:Unknown


----------



## jimmyt71 (Feb 3, 2007)

I am in Ireland,where in the world are you???.Its getting late ok but,I'm willing to stick with it if you are


----------



## rainforest123 (Dec 29, 2004)

J71:
Search couldn't find it.Does that mean that it is not installed?
No. You have verified, in add / remove programs the presence of Win XP SP2. 

It means that:
1. you or someone / some program deleted the file;
2. the file has a different name;
3. the file was not downloaded. It is possible to upgrade to SP2 using Microsoft's automatic update feature. 

Something else, perhaps. 

I suggest that you print out each of these postings. It is difficult to find information which was stated 1 or more pages ago, J71. 

If you don't know how to print a web page, disregard my suggestion. 

RF123


----------



## rainforest123 (Dec 29, 2004)

J71: 
I need YOU to write, step by step, that which you did. Telling me that you followed the steps really is of little use.

Regarding #52, you wrote:
"When I run Autostreamer this is what I get on the main page,
Operating System:Windows XP Family
Build:5.1.2600.1106(SP1)
Size:518MB
There is an red X next to the service pack file
Build:Unknown"

I think you need to send screen shots.

A screen shot is a term used to describe the capture of that which is on your computer screen. Often, there is a need to provide a remote computer technician with information about your computer.

Events may be such that on occasion, you want / need [ or are requested ] to send a screen shot.

Creating a screen shot requires:
1. a keyboard with a key labeled "Print Screen". This may be abbreviated "PrtScn", "PrntScn", or some other variation.
2. a destination program. Microsoft WordPad, and Paint, which are built into Windows 95 and beyond, as well as Microsoft Word, not a part of Windows will suffice. My favorite is Paint, because it provides the greatest versatility. Paint saves images, by default, as bitmap files [ .bmp ], which are very large files, but Paint can also save files as
jpg / jpeg files which are much smaller. Paint also provides editing features.
2.a. To open Paint
left click "start"
left click "accessories"
left click "Paint".
3. Press the "PrtScn" [ or similar button ] on your keyboard. Mine is about 2" to the right of the F12 key.
4. Open the destination program [ see # 2 above ].
5. Maximize the screen of the destination program.
6. Left "edit" across the top.
7. Left click "paste".
8. Save the file.
a. left click "file"
b. left click "save as"
c. near the bottom, save as type, left click the down pointing arrow.
d. left click on "jpg" or "jpeg"
e. in the area of the file name, enter something descriptive
f. near the top, note the location to the right of "save in".
g. left click the "save" button, lower right.

3.
To send a screen shot, click on "go advanced".

Near the bottom, left click the "manage attachments" button.
A new screen will open.
Left click the "browse" button.
Go / Browse to the location of the file.
Left click on the file.
Left click the "upload" button.
When finished, left click "close window" upper right.

Left click the "submit reply" button.

I have also attached the instructions for creating a screen shot. 
Open the file. 
Please print them.

Sincerely,
RF123


----------



## rainforest123 (Dec 29, 2004)

J71:

Here is a step by step tutorial for creating screen shots, complete with pictures, some of which, dare I say it, are screen shots.

http://www.rrsecurity-abuse.com/screenshots.html

Hang in there.



Sincerely,
RF123


----------



## jimmyt71 (Feb 3, 2007)

Search keeps coming up with no results for SP2.I know I should be ashamed of myself but I dont have a printer.I'm waiting for it to be delivered,so I have to keep going back to the other posts.You never told me,where in the world are you?


----------



## rainforest123 (Dec 29, 2004)

Orbiting Pluto. 

What search term are you using, "SP2". It is unlikely that you will find it. 

As I noted above, there are 3 reasons I know that will result in your computer upgrading to SP2 without finding Windows...............SP2.......exe on your computer. 
#54 above

Please see #51, above, for instructions about placing the SP2 installation files onto your computer. 

Then, please run AutoStreamer again. Send a screen shot if you have questions. 

Screen shots will hopefully increase the efficiency of this process. 

RF123


----------



## jimmyt71 (Feb 3, 2007)

I am trying to get a screenshot.My keyboard is messed [email protected] is in shift 2 and visaversa.So I am trying to find Print Screen


----------



## rainforest123 (Dec 29, 2004)

J71: 
I am unclear as to meaning of "My keyboard is messed [email protected] is in shift 2 and visaversa.So I am trying to find Print Screen". 

Look for the function " F " keys. To the right of the F12 key, on my keyboard, about 2" is the "PrtScn" key. 

Have you read the tutorial I noted in #56? If not, please read it. 

Turning off, waiting 5 min, then turning on your computer MIGHT be useful. 

You may need another keyboard. 

Sincerely,
RF123


----------



## jimmyt71 (Feb 3, 2007)

I read the tutorial but as I said my key


















































I am sorry for all of this.I read the tutorial.I pres the print screen button and nothing happens.What I meant by messed up is,I thought that @ should be over ',Near the enter button.On my keyboard its over 2.# should be right next to enter.On this its over 3.Howe messed up is that?


----------



## jimmyt71 (Feb 3, 2007)

I told you this keyboard was messed up,I dont know what happened there.


----------



## rainforest123 (Dec 29, 2004)

On the physical keyboard, where is the "PrtScn button?

During Windows setup, one is usually given the option of choosing a keyboard.

start > control panel

OR

start > settings > control panel 
In the upper left, about 2" from the top, be sure it states "switch to category view". If it states "switch to classic view", left click on that phrase.

Open "keyboard".

Left click "locale" tab.

What do you have?

Plan B: 
New keyboard.

Plan C: 
Digital camera. Some cell phones have cameras built into them.

Plan D:

Plan D: 
IrFanView
Their term is capturing. 
http://www.irfanview.com/
They offer a free trial. I have not used this program.

E. http://www.hyperionics.com/ 
They offer a free trial. I have not used this program.

Sincerely, 
RF123

Sincerely, 
RF123


----------



## jimmyt71 (Feb 3, 2007)

I am trying to attach the screenshot but whenever I click Manage Attachments,all that happens is I set a beep and nothing happens.Whats wrong?


----------



## rainforest123 (Dec 29, 2004)

J71: 
1. Did you create a screen shot, per 1 of the methods above?

2. When you are at this thread, click on the "go advanced" button.

3. Click on the "manage attachments.

4. After clicking on the button, a window [ see screen shot ] should appear.

5. Browse to the location of the screen shot.

6. Left click the "upload" button.

7. When finished, in the upper right, left click "close window".

8. Left click "submit reply".

Sincerely, 
RF123


----------



## jimmyt71 (Feb 3, 2007)

Rf123
1 ;Yes,I captured the screenshot using Hyper Snap 6.
2; Yes,I clicked Go Advanced
3;Yes,I clicked Manage Attachments.All that happened was,I heard a beep and it didn't open.


----------



## rainforest123 (Dec 29, 2004)

I have no advice for the "manage attachments" problem.

Re-boot. ?

If you are using Internet Explorer, try FireFox. 
www.getfirefox.com

If you are using FF, use IE.

RF123


----------



## jimmyt71 (Feb 3, 2007)

I just logged in with firefox and can attach the screenshot


----------



## jimmyt71 (Feb 3, 2007)

I just logged in with firefox and can attach the screenshot
View attachment 100604


----------



## jimmyt71 (Feb 3, 2007)

I reinstalled SP2 but still can't launch system restore.Here's the screenshots of what happens when I try


----------



## rainforest123 (Dec 29, 2004)

J71: 
On Page 4 of this thread, in 1 of the posts, I wrote the following.
Ends with the row of ^^^s.
Please go to text following the row of ^^^^^^^^^^^s

I suggest that you read / re-read http://www.simplyguides.net/guides/u...treamer2.shtml

"Windows CD drive:
AutoStreamer should detect the drive where you have placed your Windows XP CD and if successful a drive letter should be displayed."

Service pack file:
If you click the magnifying glass you will have to locate the Service Pack file. AutoStreamer will then analyze the file and display the build number.

I was a beginner, not long ago. I wasn't born with a computer in my lap.

I am glad to help you, but I can't do it for you.

Do you know the location of SP2? If not

After downloading the 266 MB Win XP SP2 file, open it.
You will see a small screen that tells you that the program is extracting files.

You will see a location such as c:\88ff .. .. "SUCH AS" for emphasis.
The location could easily be c:\abcdefg12345 . . ..

After the extraction process has completed, you will see [ go to attached screen shot ].
Left click "cancel".
Left click "yes", confirming that you want to cancel.
Left click "ok" OR "yes" when Windows informs you that SP2 upgrade was stopped / cancelled.

Now, open "my computer"
Open "C:" drive
Open the folder to which SP2 files were extracted, as noted above in this post.

************
You will see a location such as c:\88ff .. .. "SUCH AS" for emphasis.
The location could easily be c:\abcdefg12345 . .

************
That is the location of your SP2 files.
Open that folder.
You should see i386.
open i386

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 
Before starting, you will need your Windows XP CD. 
You will need to know the location of the Win XP SP2 file that you downloaded. 
A blank CD-R disk. 
CD burning software installed on your computer.

1. Put the Win XP CD into your optical [ CD / DVD ] drive. 
If the Windows XP installation program appears, click "cancel". 
Confirm your desire to cancel, if the program asks you to confirm, by clicking "yes" or "something similar".

2. Open Auto Streamer 
Do you have more than 1 CD / DVD drive? 
It the top line of the Auto Streamer box doesn't display your Win XP CD, left click on the magnifying glass icon, if necessary & "browse" to the drive that in which you placed the Windows XP CD.

3. Left click "next".

If necessary, re-read the guide / tutorial 
http://www.simplyguides.net/guides/using_autostreamer/using_autostreamer.shtml

Best of success, J71

RF123


----------



## jimmyt71 (Feb 3, 2007)

RF123,Just noticed you were back on line.I was wondering ,when I looked at add/remove,there is no istallation date for sp2.Might it not have installed cleanly?If I remove it and download it again,would it help?Thanks again for your patience


----------



## jimmyt71 (Feb 3, 2007)

I reading a different thread.
whttp://forums.techguy.org/windows-nt-2000-xp/499568-guide-reinstall-windows.htmlas 
Would a reinstall of xp solve this?


----------



## Mosaic1 (Aug 17, 2001)

One thing I would suggest is that you need to uninstall Internet Explorer 7 before you try any kind of Service Pack reinstall or windows Repair. Then restart the system twice.

BUT would you like to try and work with me to get system restore back up and running? *Although at this point it is not a good idea not to use an older restore point,* you should get it up and running.

I have a simple registry file for you to download if you like.

Let me know.


----------



## Mosaic1 (Aug 17, 2001)

AS a start to diagnose the problem with 
System REstore and your inf installer, download and save the attachment I have added. It's a zip file. Extract its contents to your desktop.

Now you should have a file named getit.bat on the desktop.

Double click on getit.bat to run it. It will open a text file named rq.txt when done.

Please copy and paste the contents of rq.txt into your next reply here.


----------



## Mosaic1 (Aug 17, 2001)

> I reinstalled SP2 but still can't launch system restore


That was not a good idea. I wold like to see a new hijackthis log please. I need to see what version of Internet Explorer is now listed. Is Internet Explorer behaving itself? Everything working ok after the SP2 reinstall? Please don't go off on your own and make sweeping system changes. While you have IE7 installed, there could be some unpleasant consequences.


----------



## jimmyt71 (Feb 3, 2007)

Mosaic1,Firstly thank you for the advice on my posts.Here is the notepad.

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srservice\Parameters
ServiceDll	REG_EXPAND_SZ	C:\WINDOWS\System32\srsvc.dll

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup
DriverCachePath	REG_EXPAND_SZ	%SystemRoot%\Driver Cache
BootDir	REG_SZ	C:\
PrivateHash	REG_BINARY	D63203817BDC9CF089B1E8B4AD3DB1D4
Installation Sources	REG_MULTI_SZ	D:\\0\0
SourcePath	REG_SZ	D:\
ServicePackSourcePath	REG_SZ	c:\windows\ServicePackFiles
CDInstall	REG_DWORD	0x0
LogLevel	REG_DWORD	0x20000000
ServicePackCachePath	REG_SZ	c:\windows\ServicePackFiles\ServicePackCache

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\BaseWinOptions

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\ExceptionComponents

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Migration DLLs

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Oc Manager

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\OOBE

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\OptionalComponents


----------



## Mosaic1 (Aug 17, 2001)

You're welcome. Ok. Let's see if we can try something. The registry is pointing to the correct file. Let's see if the file is there.

Go to Start >Run and type cmd.exe
Press enter.

No copy this next comand I have typed in bold. then right click inside th4e ocmmand window and click Paste on the menu which will come up. then press enter again.

*dir /a /s srsvc.* >>looking.txt && start notepad looking.txt*

This will run a search for a particular file. When finsihed, it will open a text file named looking.txt

Please post the contents of looking.txt


----------



## jimmyt71 (Feb 3, 2007)

Here is the HJT log
Logfile of HijackThis v1.99.1
Scan saved at 23:04:53, on 10/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\CTFMON.EXE
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Azureus\Azureus.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ie/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~5\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\NPPDF32.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by7fd.bay7.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://aolsvc.aol.com/onlinegames/chuzzledeluxe/popcaploader_v10.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe


----------



## Mosaic1 (Aug 17, 2001)

You;re running a file sharing program. A lot of malware is spread throught file sharing. IT would be best not to run anything like that. Much safer for you.l

I posted more instructions while you were getting your hijackthis log for me.

Here's the link to that post:
http://forums.techguy.org/security/548028-how-do-i-tell-if-6.html#post4514837


----------



## jimmyt71 (Feb 3, 2007)

The link you posted is a link back to your last post.Where in the world are you?Maybe a snooze is needed.


----------



## Mosaic1 (Aug 17, 2001)

Exactly. And those instructions and the results have not been posted. I had assumed you mossed that one.

There were the instructions:
You're welcome. Ok. Let's see if we can try something. The registry is pointing to the correct file. Let's see if the file is there.

Go to Start >Run and type cmd.exe
Press enter.

No copy this next comand I have typed in bold. then right click inside th4e ocmmand window and click Paste on the menu which will come up. then press enter again.

*dir /a /s srsvc.* >>looking.txt && start notepad looking.txt*

This will run a search for a particular file. When finsihed, it will open a text file named looking.txt

Please post the contents of looking.txt


----------



## jimmyt71 (Feb 3, 2007)

I copied the command you bolded.It didnt work.I attached a screenshot to the message I got


----------



## Mosaic1 (Aug 17, 2001)

I bet you pasted the command into start >Run

You need to go to Start >Run thd type
cmd.exe
then press enter
Copy that command I gave you again. 

When the black command window opens, right click in the command window. A menu will appear. Click paste on this menu. Then press enter. The command should now work.


----------



## jimmyt71 (Feb 3, 2007)

Sorry about that.Misunderstanding.Will do that now.


----------



## jimmyt71 (Feb 3, 2007)

Done the last post.This is what happened.


----------



## Mosaic1 (Aug 17, 2001)

Normally when you go to start >Run theocmmand starts at C:

Yours didn't and that's why file not found.

Here's what I'd like you to do.

Go to Start >Run and type cmd.exe

Press enter

When the command comes up, copy and paste in this command:
*cd \ && dir /a /s srsvc.* >>looking.txt && start notepad looking.txt*

Post the contents of looking.txt


----------



## jimmyt71 (Feb 3, 2007)

Volume in drive C is 70_02_14M2
Volume Serial Number is 2F7C-16EF

Directory of C:\WINDOWS\SYSTEM32

04/08/2004 00:56 170,496 srsvc.dll
1 File(s) 170,496 bytes

Directory of C:\WINDOWS\$NtServicePackUninstall$

29/08/2002 12:00 158,720 srsvc.dll
1 File(s) 158,720 bytes

Directory of C:\WINDOWS\ServicePackFiles\i386

04/08/2004 00:56 170,496 srsvc.dll
1 File(s) 170,496 bytes
Volume in drive C is 70_02_14M2
Volume Serial Number is 2F7C-16EF

Directory of C:\WINDOWS\SYSTEM32

04/08/2004 00:56 170,496 srsvc.dll
1 File(s) 170,496 bytes

Directory of C:\WINDOWS\$NtServicePackUninstall$

29/08/2002 12:00 158,720 srsvc.dll
1 File(s) 158,720 bytes

Directory of C:\WINDOWS\ServicePackFiles\i386

04/08/2004 00:56 170,496 srsvc.dll
1 File(s) 170,496 bytes

Total Files Listed:
3 File(s) 499,712 bytes
0 Dir(s) 10,258,317,312 bytes free


----------



## Mosaic1 (Aug 17, 2001)

Go to Start >Run and type cmd.exe
Press enter.
Copy and paste in this command. Press enter:
*cd C:\windows\system32 && copy /y C:\WINDOWS\ServicePackFiles\i386\srsvc.dll
*

Once that command has finished running, run this command. (Always the same, copy and paste, then press enter)
*sc start srservice*

When the command has run, read the results in the command window. Success or failure? Let me know what it says. IF there;s an error or what please.

Remember, you don;t want to restore an old restore point. You just want to see if youcan get system restore fixed.

ALSO, you are running Nero Backitup. This is a utility to create a system back up too. Did you know that?

More on that utility here:
http://www.pcmag.com/slideshow_viewer/0,1205,l=&s=25545&a=197765&po=6,00.asp?p=y

I have to tell you I don't have Nero here and so you would have to look at their help to see how to use it. But it's running. You may want to check to see what kind or recent backups you have. Look, but make no changes.


----------



## Mosaic1 (Aug 17, 2001)

When you reinstalled Service pack 2, how did you do it please? Did you download the file again, save it and then run it?

Let's do a search for this:
copy and paste this command into a new command window just as you have been doing,
*cd \ && dir /a /s *SP2-ENU.exe >>installsearch.txt && start notepad installsearch.txt*

When finished, this search will open a file named installsearch.txt is anything is found.

Please post the contents of installsearch.txt or the error you get, if you get one.


----------



## jimmyt71 (Feb 3, 2007)

I will try #89 first and let you know how it goes.


----------



## Mosaic1 (Aug 17, 2001)

Ok.


----------



## jimmyt71 (Feb 3, 2007)

Re#89.


----------



## Mosaic1 (Aug 17, 2001)

That means the dll is loaded into memory.

Try this command please. Again, same deal.

*sc start srservice*

Let me know what the result of this command is.


----------



## jimmyt71 (Feb 3, 2007)

RE #90.When I reinstalled SP2 I did everything you quoted.I am going to try the last command you posted.


----------



## jimmyt71 (Feb 3, 2007)

Here is the screenshot for#94


----------



## Mosaic1 (Aug 17, 2001)

Ok. That service is running.

Can you go to start >Run and type *msconfig* and then press enter?

When the msconfig page opens, click the Launch System Restore button. Can you get in now? Or do you get an error message. Are you able to create a new restore point? Let me know what happens please.

And there was a command I posted in # 90 too. Can you do that one too please?

It must be getting to be fairly late over there and I think it's been a long day for you. It seems nothing is simple on your system. But we'll see what we can do. I am going to call it a day in another 15 minutes.


----------



## jimmyt71 (Feb 3, 2007)

No bother,Will do everything as quick as I can.


----------



## jimmyt71 (Feb 3, 2007)

Done msconfig.Launched system restore.Same error message about system restore not being able to protect me.Go to bed now.Will you check back in tomorrow?Where in the world are you?


----------



## jimmyt71 (Feb 3, 2007)

RE #90.Do iI run cmd.exe first an then enter the command you posted?


----------



## Mosaic1 (Aug 17, 2001)

Yes. Same thing as usual. Open cmd.exe and paste

I'm in the Eastern USA. It's only 8:10 pm here, but I have to go out for a while. 

Let me see about something and I'll be back tomorrow. In the meantime, check out what I told you about Nero BackitUp being installed on your system. It's another way to back up and restore your system.


----------



## jimmyt71 (Feb 3, 2007)

I' m in Ireland,its 1.15am so I might not last much longer.Will do what you said.Thanks for the help.Enjoy your night.


----------



## Mosaic1 (Aug 17, 2001)

Thanks. You're welcome.

Here's a good thorough registry file you can try to re-enable system restore in the event this is a restrictions or missing entry elsewhere.

Click the link:
http://www.kellys-korner-xp.com/regs_edits/sysrestoreenable.reg

Save the file (its name is sysrestoreenable.reg and then when you have it somewhere safe, duoble click on it to run) Say yes to the prompts. Just to be extra sure, restart the system and then see if system restore works for you.

I'll be back tomorrow. Have a good night.

Katie


----------



## jimmyt71 (Feb 3, 2007)

Mosaic1,YOU THE MAN.You sorted the problem out.Thanks for the help.Hope you had a good night last night.I will have a pint of the black stuff in your honor.


----------



## rainforest123 (Dec 29, 2004)

Congratulations J71 & M1.

What worked, the fix from Kelly's Korner or something else. 

I am curious. 

RF123


----------



## Mosaic1 (Aug 17, 2001)

It would have to be the Fix from Kelley's which fixed system restore.

jimmyt71,

You're welcome. Glad that fixed your system restore for you.

Now may I ask you to do the other anyway so you moght be able to crete that slipstreamed installcdisk? Ot might come in handy at some point.

I also need to know what kind if an install you originally used. Did you use a Microsoft install CD? Or did your computer come with what is known as a Restore Disk? 

Looking at your hijackthis log, I see two other issues. One, you need to update your Java.
The other is that you are not running a Firewall. Do you use a router? Either way, you need protection.


----------



## jimmyt71 (Feb 3, 2007)

Will make the slipstream disk as you said.When I installes XP on this system I used an original Microsoft disc and got updates ect.from the website.I will do the other two things you said and post a new HJT log for you.Thank you again.


----------



## jimmyt71 (Feb 3, 2007)

RF123,It was the fix from kellys that worked.Thank you also for your help and patience.In Mosaics1 last post,he said I have no firewall.I have checked windows firewall in control panel and its on.How do I get in to my routers firewall?


----------



## Mosaic1 (Aug 17, 2001)

A router is a separate piece of hardware. Either you have one or you don't.

Zone Alarm offers a free firewall if you need one.

http://www.zonelabs.com/store/content/company/products/znalm/freeDownload.jsp

Either a router or the Windows Firewall will protect you from inbound traffic only. Anything trying to get out will not be prevented. This is not a good thing and it is strongly recommended that you install a software firewall as well to prevent unauthorized outbound traffic.
-------------------------

Also it is very important that you update your java.

Ugrading Java: 
Download the latest version of Java Runtime Environment (JRE) 6 from this link:
http://java.sun.com/javase/downloads/index.jsp

Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement".
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
J2SE Runtime Environment 5.0 Update 1
J2SE Runtime Environment 5.0 Update 2
J2SE Runtime Environment 5.0 Update 4
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java version.
Reboot your computer once all Java components are removed.

Then from your desktop double-click on the download to install the newest version.


----------



## jimmyt71 (Feb 3, 2007)

Mosaic1,Did everything you said.Thank you again for your help.Here is the new HJT log,how does it look now??
Logfile of HijackThis v1.99.1
Scan saved at 22:12:41, on 12/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ie/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~5\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\NPPDF32.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by7fd.bay7.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://aolsvc.aol.com/onlinegames/chuzzledeluxe/popcaploader_v10.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe


----------



## Mosaic1 (Aug 17, 2001)

Hi,
You're very welcome. Looks good. How is everything running now? 

I am curious about your history. Can you go to the Internet Explorer Toolbar and click the History button to open history? How does it look? 

------------- 

This entry looks to be a leftover from an old Norton Anti Virus install. Run hijackthis and click in the box next to this entry. Then click the "Fix checked" button. 
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\

Hijackthis is just a start and shows us less than we need to see if there is a suspected infection. We often ask for more than this one type of log if there's a suspicion that something else is going on.


----------



## jimmyt71 (Feb 3, 2007)

Everything is goinf fine.I run SAS,AdAware,Spybot S&D and AVG Antispyware scans regulary and they find nothing.I was checking my history from last week and I noticed this weird entry;
yhst-92217182478112.stores.yahoo(yhst-92217182478112-yahoostores.net)
What is that all about???


----------



## Mosaic1 (Aug 17, 2001)

Have you gone to yahoo and done any shopping? The history item indicates you visited one of the Merchants on Yahoo.


----------



## jimmyt71 (Feb 3, 2007)

No never done any sort of shopping on line,dont trust myself enough.


----------



## Mosaic1 (Aug 17, 2001)

You may have done a search, clicked a result, and ended up on their shopping site. It doesn't mean you bought anything. Just that you were there. I did a quick google for that address and it seems to be related to computer parts.


----------

