System files and a few other little questions

[Stevepac]

Actually yes it did fix it and Im working on the other problem. Youve been a huge help, thanks

[mauserme]

Ok, good.

Other than this thing with MCCWSAWINDOW I think we're about finished.  How is that going?


When you're ready let's create a clean system restore point and delete the old, possibly infected points:

1. Click Start>All Programs>Accessories > System tools > System Restore
2. In the dialog box that appears  Click in the radio button to Create a Restore Point
3. Click NEXT
4. Enter a name you will remember if you need to find this again (like Clean Point)
5. Click CREATE

You now have a clean restore point.   To get rid of the bad ones:

1. Click Start>All Programs>Accessories > System tools > Disk Clean Up
2. Click OK on the C: drive
3. Click the More Options tab
4. In the System Restore section click the Clean Up button



Next we'll remove the specialty tools that were downloaded and the malware backups they created.  Double click OTMoveIt once again and you should see a CleanUp! button.  Click that button.  You may get prompted by your firewall that OTMoveIt wants to contact the internet, allow this, a cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will delete all the tools you have downloaded plus itself.



Now, if you haven't found a firewall you like you can consider Comodo.  It has a nice balance between between being user friendly and tight security

http://filehippo.com/download_comodo/

Zone Alarm and PC Tools Firewall are also worth considering.



One final thought.  Spyware Blaster provides good, passive protection and is free.  Here is a link

http://www.javacoolsoftware.com/spywareblaster.html

Just make sure to update it from time to time.


And let me know, of course, if you're experiencing any more problems (especially with MCCWSAWINDOW).   

[Stevepac]

Yeah the MCCWSA problem is still there. The solution they had on that site isnt working because they wanted me to turn something off at start up, but it wasnt under the menu they had me go too. I'll get right on that other stuff as soon as my computer is done installing updates.

[Stevepac]

That "The instruction at "0x7e1f9af3" referenced memory at "0x7dc48950" The memory could not be found Problem is back again and Ive been trying to do as you say, but something is messed up. It keeps popping up saying your local area connection is disconnected, then the next second everything is fine, then a minute later again, it annoying because it signs off my messangers and stuff

[mauserme]

I think this error message and the MCCWSA message are related.  MCCWSA seems to be an updater for a helper program some ISPs provide and the memory error has to do with browser ad ons.  What internet provider do you have?

Just to make sure, please post a fresh HJT log so we know there are no new tool bars, etc cropping up.

[Stevepac]

I'll get on all this soon. I have DSL and Im having another problem. Like randomly it will pop up and say Local Area Connection disconnected, then a second later its fine. So Ive been on my lappy lately

[mauserme]

If you have the set up CD from your ISP try reinstalling the software.  I don't think MCCWSA is technicaly required but there are some google hits indicating its removal might cause connection problems.  And I'm guessing that if removing it can cause problems than a malfunction might do the same.

I would also like to see a HJT log when you have a chance.

[Stevepac]

Logfile of HijackThis v1.99.1
Scan saved at 11:16:56 PM, on 2007-07-12
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Laplink\RemoteAssist\shwSrvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\PROGRA~1\AIM\AIMWDI~1.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\PROGRA~1\Verizon\SMARTB~1\MotiveSB.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\LVComsX.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.49erswebzone.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [AIMWDInstallFilename] C:\PROGRA~1\AIM\AIMWDI~1.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\Verizon\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: winShadow - OmniCom Technologies - C:\Program Files\Laplink\RemoteAssist\shwSrvc.exe


This is the logfile, right now I gotta fix this Local Area Connection problem

[Lisandro]

Your log seems clean: http://www.wikifortio.com/759682/Stevepac.html

[Stevepac]

What is that

[mauserme]

As an experiment, download/install Winpatrol

http://www.winpatrol.com/download.html

Open the program by double clicking the dog icon in your system tray.  Under the Start Up Programs tab highlight the line that has AIMWDINSTALL.EXE in the command column.  Then click the Disable button.

Reboot and see if this makes any difference.

This process will not make any changes to your computer - it will simply stop the AIM/Wild Tangent games downloader from loading at startup.  If no difference is observed it can be re-enabled in WinPatrol and WinPatrol can be uninstalled if you don't want to continue using it.

[Stevepac]

Would it be ok if I skip that and just do the system restore point thing

[mauserme]

Sure, if you want to skip it that's fine.

I don't know for sure if that's what's causing the error messages you're getting but I think it might be related.  Some consider it spyware and others don't.