wskesler
asked on
HijackThis Log
I've cleaned a lot of spyware, adware, and viruses from a PC running Win 98. It still freezes temporarily or runs slow sometimes.
Here's the HJT log. Can someone look through it and tell me what looks like a potential problem in it?
Logfile of HijackThis v1.99.1
Scan saved at 12:32:40 PM, on 04/20/2006
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32
C:\WINDOWS\SYSTEM\MSGSRV32
C:\WINDOWS\SYSTEM\MPREXE.E
C:\WINDOWS\SYSTEM\mmtask.t
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.
C:\WINDOWS\SYSTEM\QTTASK.E
C:\WINDOWS\SYSTEM\STIMON.E
C:\PROGRAM FILES\GRISOFT\AVG7\AVGCC.E
C:\PROGRAM FILES\GRISOFT\AVG7\AVGEMC.
C:\PROGRAM FILES\GRISOFT\AVG7\AVGAMSV
C:\PROGRAM FILES\MICROSOFT BROADBAND NETWORKING\MSBNTRAY.EXE
C:\PROGRAM FILES\OLYMPUS\CAMEDIA MASTER 4.2\CM_CAMERA.EXE
C:\WINDOWS\SYSTEM\DDHELP.E
C:\WINDOWS\SYSTEM\WMIEXE.E
C:\PROGRAM FILES\MICROSOFT BROADBAND NETWORKING\IPHLPSVR.EXE
C:\PROGRAM FILES\GRISOFT\AVG7\AVGW.EX
C:\HJT\HIJACKTHIS.EXE
R0 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R0 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R0 - HKCU\Software\Microsoft\In
R3 - URLSearchHook: (no name) - {16053E0E-8AE3-FE17-C1AF-F
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-2
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-0
O3 - Toolbar: Cox Popup Blocker - {64634180-B0EA-48B6-82B7-9
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-A
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPw
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.E
O4 - HKLM\..\Run: [Windows Plug and Play Service 32 BIT] WINMANAGER32.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVG7\A
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVG7\A
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVG7\A
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPw
O4 - HKLM\..\RunServices: [Windows Plug and Play Service 32 BIT] WINMANAGER32.EXE
O4 - HKLM\..\RunServices: [CurtainsSysSvc] c:\program files\cox\applications\app
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Startup: Microsoft Broadband Networking.lnk = C:\Program Files\Microsoft Broadband Networking\MSBNTray.exe
O4 - Startup: CAMEDIA Master.lnk = C:\Program Files\OLYMPUS\CAMEDIA Master 4.2\CM_camera.exe
O6 - HKCU\Software\Policies\Mic
O6 - HKCU\Software\Policies\Mic
O8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~1
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-0
O9 - Extra button: MSN - {E19D474D-B5FD-11D2-AE0E-0
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugi
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGI
O14 - IERESET.INF: START_PAGE_URL=http://www.att.net
O15 - Trusted Zone: *.elitemediagroup.net
O16 - DPF: {8EF27A70-DD04-11D6-B7F6-0
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C
O16 - DPF: {FFFF0001-0001-101A-A3C9-0
Here's the HJT log. Can someone look through it and tell me what looks like a potential problem in it?
Logfile of HijackThis v1.99.1
Scan saved at 12:32:40 PM, on 04/20/2006
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32
C:\WINDOWS\SYSTEM\MSGSRV32
C:\WINDOWS\SYSTEM\MPREXE.E
C:\WINDOWS\SYSTEM\mmtask.t
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.
C:\WINDOWS\SYSTEM\QTTASK.E
C:\WINDOWS\SYSTEM\STIMON.E
C:\PROGRAM FILES\GRISOFT\AVG7\AVGCC.E
C:\PROGRAM FILES\GRISOFT\AVG7\AVGEMC.
C:\PROGRAM FILES\GRISOFT\AVG7\AVGAMSV
C:\PROGRAM FILES\MICROSOFT BROADBAND NETWORKING\MSBNTRAY.EXE
C:\PROGRAM FILES\OLYMPUS\CAMEDIA MASTER 4.2\CM_CAMERA.EXE
C:\WINDOWS\SYSTEM\DDHELP.E
C:\WINDOWS\SYSTEM\WMIEXE.E
C:\PROGRAM FILES\MICROSOFT BROADBAND NETWORKING\IPHLPSVR.EXE
C:\PROGRAM FILES\GRISOFT\AVG7\AVGW.EX
C:\HJT\HIJACKTHIS.EXE
R0 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R0 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R0 - HKCU\Software\Microsoft\In
R3 - URLSearchHook: (no name) - {16053E0E-8AE3-FE17-C1AF-F
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-2
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-0
O3 - Toolbar: Cox Popup Blocker - {64634180-B0EA-48B6-82B7-9
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-A
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPw
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.E
O4 - HKLM\..\Run: [Windows Plug and Play Service 32 BIT] WINMANAGER32.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVG7\A
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVG7\A
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVG7\A
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPw
O4 - HKLM\..\RunServices: [Windows Plug and Play Service 32 BIT] WINMANAGER32.EXE
O4 - HKLM\..\RunServices: [CurtainsSysSvc] c:\program files\cox\applications\app
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Startup: Microsoft Broadband Networking.lnk = C:\Program Files\Microsoft Broadband Networking\MSBNTray.exe
O4 - Startup: CAMEDIA Master.lnk = C:\Program Files\OLYMPUS\CAMEDIA Master 4.2\CM_camera.exe
O6 - HKCU\Software\Policies\Mic
O6 - HKCU\Software\Policies\Mic
O8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~1
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-0
O9 - Extra button: MSN - {E19D474D-B5FD-11D2-AE0E-0
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugi
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGI
O14 - IERESET.INF: START_PAGE_URL=http://www.att.net
O15 - Trusted Zone: *.elitemediagroup.net
O16 - DPF: {8EF27A70-DD04-11D6-B7F6-0
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C
O16 - DPF: {FFFF0001-0001-101A-A3C9-0
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I've scanned the PC multiple times with updated Spybot and Ad-Aware SE. Also installed, updated, and ran AVG antivirus. All found lots of stuff that I deleted. Not sure about some of the entries found in the HJT log, as this is a friend's teenager's PC (explains all the garbage).
Ewido doesn't support Win 98, but I did use just now load and run Avast...it found about 15 more things that it removed. I'm worried about what it couldn't repair, though...
File Name: C:\\Windows\System.Dat
Malware Name: Win32:Volage-G (wrm)
Also, AVG scans find and can seem to remove a problem with C:\Windows\System\iniwin32
Ewido doesn't support Win 98, but I did use just now load and run Avast...it found about 15 more things that it removed. I'm worried about what it couldn't repair, though...
File Name: C:\\Windows\System.Dat
Malware Name: Win32:Volage-G (wrm)
Also, AVG scans find and can seem to remove a problem with C:\Windows\System\iniwin32
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
For the files that could not be fixed by AV programs, boot into DOS mode, then rename the offending files, then boot in normal windows mode and re-run the scan. That should fix those.
ASKER
Thx for all the help so far. Did most of what was recommended, and all of the scans that I run now come up clean. When I start the PC, I can open and close Excel, Word, etc. multiple times with no problem. Once I open Internet Explorer (which works fine), close it, and try again to open another application the PC just freezes, though.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thanks for all the help. I split up points based on recommendations that progressively solved the problems. Thanks again.
http://hijackthis.de/logfiles/cac5f1e789d405034a83fd82231373dc.html
Remove the "Nasty" entries and also the "Possibly Nasty" entries that you don't recognize
---
Harish