[spydevil]

Hi.. friends.. am unable to open d hidden files. I think its due to some virus problems.
Here is my hijackthis log

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\hffsrv.exe
C:\WINDOWS\Explorer.EXE
G:\INSOFT\Mozilla Firefox\firefox.exe
G:\INSOFT\Kaspersky Internet Security 6.0\avp.exe
G:\INSOFT\Kaspersky Internet Security 6.0\avp.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\INSOFT\Adobe\Acrobat Reader 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\INSOFT\JAVA\JRE\bin\ssv.dll
O8 - Extra context menu item: &Download with &DAP - G:\INSOFT\DAP\dapextie.htm
O8 - Extra context menu item: Add to Anti-Banner - G:\INSOFT\Kaspersky Internet Security 6.0\ie_banner_deny.htm
O8 - Extra context menu item: Download &all with DAP - G:\INSOFT\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\INSOFT\JAVA\JRE\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\INSOFT\JAVA\JRE\bin\ssv.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - G:\INSOFT\Kaspersky Internet Security 6.0\scieplugin.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - G:\INSOFT\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - G:\INSOFT\MESSEN~1\YPAGER.EXE
O10 - Unknown file in Winsock LSP: g:\insoft\spyware doctor\filterlsp.dll
O10 - Unknown file in Winsock LSP: g:\insoft\spyware doctor\filterlsp.dll
O10 - Unknown file in Winsock LSP: g:\insoft\spyware doctor\filterlsp.dll
O10 - Unknown file in Winsock LSP: g:\insoft\spyware doctor\filterlsp.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{80689E7D-F132-441A-8AC7-624189463F35}: NameServer = 218.248.240.23 218.248.240.135
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - G:\INSOFT\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Kaspersky Lab - G:\INSOFT\Kaspersky Internet Security 6.0\avp.exe
O23 - Service: Hide Files and Folders (HideFilesAndFolders_S) - Unknown owner - C:\WINDOWS\system32\hffsrv.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - Unknown owner - G:\INSOFT\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - G:\INSOFT\Spyware Doctor\swdsvc.exe

[GTO]

Hi spydevil

Your HijackThis log is incomplete. It should begin with the lines like these:
Logfile of HijackThis v1.99.1
Scan saved at 15:49:09, on 14-04-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Please post the full log.

[spydevil]

The full log is here.

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 2:51:24 PM, on 5/16/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hffsrv.exe
G:\INSOFT\Mozilla Firefox\firefox.exe
G:\INSOFT\Kaspersky Internet Security 6.0\avp.exe
G:\INSOFT\Kaspersky Internet Security 6.0\avp.exe
G:\INSOFT\HijackThis v.2 Beta\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\INSOFT\Adobe\Acrobat Reader 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\INSOFT\JAVA\JRE\bin\ssv.dll
O8 - Extra context menu item: &Download with &DAP - G:\INSOFT\DAP\dapextie.htm
O8 - Extra context menu item: Add to Anti-Banner - G:\INSOFT\Kaspersky Internet Security 6.0\ie_banner_deny.htm
O8 - Extra context menu item: Download &all with DAP - G:\INSOFT\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\INSOFT\JAVA\JRE\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\INSOFT\JAVA\JRE\bin\ssv.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - G:\INSOFT\Kaspersky Internet Security 6.0\scieplugin.dll
O10 - Unknown file in Winsock LSP: g:\insoft\spyware doctor\filterlsp.dll
O10 - Unknown file in Winsock LSP: g:\insoft\spyware doctor\filterlsp.dll
O10 - Unknown file in Winsock LSP: g:\insoft\spyware doctor\filterlsp.dll
O10 - Unknown file in Winsock LSP: g:\insoft\spyware doctor\filterlsp.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{80689E7D-F132-441A-8AC7-624189463F35}: NameServer = 218.248.240.23 218.248.240.135
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - G:\INSOFT\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Kaspersky Lab - G:\INSOFT\Kaspersky Internet Security 6.0\avp.exe
O23 - Service: Hide Files and Folders (HideFilesAndFolders_S) - Unknown owner - C:\WINDOWS\system32\hffsrv.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - Unknown owner - G:\INSOFT\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - G:\INSOFT\Spyware Doctor\swdsvc.exe

--
End of file - 2741 bytes

[GTO]

Hi spydevil

We don't accept HijackThis 2.0.0 logs yet. This version is still BETA. Please use HijackThis 1.99.1.

[spydevil]

OK. My hijackthis 1.99 log is here.

Logfile of HijackThis v1.99.1
Scan saved at 12:10:46 AM, on 5/17/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hffsrv.exe
G:\INSOFT\Mozilla Firefox\firefox.exe
G:\INSOFT\Kaspersky Internet Security 6.0\avp.exe
G:\INSOFT\Kaspersky Internet Security 6.0\avp.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\INSOFT\Adobe\Acrobat Reader 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\INSOFT\JAVA\JRE\bin\ssv.dll
O8 - Extra context menu item: &Download with &DAP - G:\INSOFT\DAP\dapextie.htm
O8 - Extra context menu item: Add to Anti-Banner - G:\INSOFT\Kaspersky Internet Security 6.0\ie_banner_deny.htm
O8 - Extra context menu item: Download &all with DAP - G:\INSOFT\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\INSOFT\JAVA\JRE\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\INSOFT\JAVA\JRE\bin\ssv.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - G:\INSOFT\Kaspersky Internet Security 6.0\scieplugin.dll
O10 - Unknown file in Winsock LSP: g:\insoft\spyware doctor\filterlsp.dll
O10 - Unknown file in Winsock LSP: g:\insoft\spyware doctor\filterlsp.dll
O10 - Unknown file in Winsock LSP: g:\insoft\spyware doctor\filterlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O10 - Unknown file in Winsock LSP: g:\insoft\spyware doctor\filterlsp.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{80689E7D-F132-441A-8AC7-624189463F35}: NameServer = 218.248.240.23 218.248.240.135
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - G:\INSOFT\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - G:\INSOFT\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: Hide Files and Folders (HideFilesAndFolders_S) - Unknown owner - C:\WINDOWS\system32\hffsrv.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - G:\INSOFT\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - G:\INSOFT\Spyware Doctor\swdsvc.exe

[HJT Analyzer]

Hello, visitor!

The Hijack This log analyzer has analyzed your log. Please take a closer look on the results.

Your log does not indicate any spyware or virus infection. However, there are some entries that you might want to fix. Please follow the steps below.

The following entries are not malicious, but some of them are not used anymore. You may use HijackThis to fix a few of them. However, please keep in mind that some of the entries marked as Questionable or Not Needed are fully legitimate and might be required by installed software to work properly, while some others might be related to certain parasites. It is up to you to decide whether you need any of them, or not.
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O8 - Extra context menu item: Add to Anti-Banner - G:\INSOFT\Kaspersky Internet Security 6.0\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\INSOFT\JAVA\JRE\bin\ssv.dll
O9 - Extra ''Tools'' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\INSOFT\JAVA\JRE\bin\ssv.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - G:\INSOFT\Kaspersky Internet Security 6.0\scieplugin.dll
O10 - Unknown file in Winsock LSP: g:\insoft\spyware doctor\filterlsp.dll
O10 - Unknown file in Winsock LSP: g:\insoft\spyware doctor\filterlsp.dll
O10 - Unknown file in Winsock LSP: g:\insoft\spyware doctor\filterlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O10 - Unknown file in Winsock LSP: g:\insoft\spyware doctor\filterlsp.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{80689E7D-F132-441A-8AC7-624189463F35}: NameServer = 218.248.240.23 218.248.240.135
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - G:\INSOFT\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)


The following files and Windows registry entries are marked as "unknown". Currently, the HijackThis Log Analyzer cannot provide required information on these items. The files and entries in the list below can be both malicious and fully legitimate. Because of this, please do not take any action! Wait for the forum responders or other forum users to provide you with necessary details and further instructions.
C:\WINDOWS\system32\hffsrv.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - G:\INSOFT\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Hide Files and Folders (HideFilesAndFolders_S) - Unknown owner - C:\WINDOWS\system32\hffsrv.exe

If you want to see more detailed analysis of your log, click here.

Thank you for using the 2-Spyware.com HijackThis log analyzer beta 2!

[GTO]

Hi spydevil

Use HijackThis to fix the following entries:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

The rest of your log looks clean to me.

The reason why you cannot open hidden files is that you have the Hide Files & Folders program running on your computer. It is represented by the C:\WINDOWS\system32\hffsrv.exe process. You should uninstall or reconfigure this program.

[spydevil]

Thanx GTO for ur help. I use hide files & folders application to hide certain files & folders.But
am not able to see other hidden files & folders -these are not hided by the above software.
In folder option, when I click to show hidden files & folders, still these are not visible.This
problem started in last week.This is not related to hide files & folders software.So what is
the problem? I have scanned my PC with various anti-viruses.Nothing found.

[GTO]

Hi spydevil

Might be some system problem, but not a spyware-related issue. It's really difficult to say, where it is. You can try using System Restore. If this doesn't work, I really don't know what to say. I never had such problem. You should try asking for help in special Windows forums, such as www.computing.net.

[spydevil]

Ok. Anyway..thanx.