« previous next »
Pages: 1 [2]

Author Topic: computer slow, desktop hijacker & daosearch  (Read 8076 times)

Offline rmccabe

  • Jr. Member
  • **
  • Posts: 59
  • Karma: +0/-0
    • View Profile
computer slow, desktop hijacker & daosearch
« Reply #20 on: July 04, 2005, 03:51:27 AM »
Hello there,
I uninstalled spysweeper.  Things seem to run faster.  Mouse still seems to get stuck in places. Also unistalled my usb hub for notebooks program the computer locked up while the error message was on the screen.  Said it was searching for usb file missing.
After reloading the program it did not seem to change the way the computer starts but there was no lock up, just said that the file is missing.

In the device manager there was one yellow exclamation mark in:
PCMCIA Socket " PCIC or Compatiable PCMCIA Controller"

I have my usb hub for my printer in one slot and my modem card in the other.

what kind of protection should I be running I have norton 2005 and the downloads you had me get? Just thinking ahead alittle. http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/smile.gif\' class=\'bbc_emoticon\' alt=\':)\' />


Here are the two files you wanted to see.


File:  Aucbpnp.exe  
Status:  OK (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)  
MD5  d3ce18754278aaa610a0c01a7cae4015  
Packers detected:  -
Scanner results  
AntiVir  Found nothing
ArcaVir  Found nothing
Avast  Found nothing
AVG Antivirus  Found nothing
BitDefender  Found nothing
ClamAV  Found nothing
Dr.Web  Found nothing
F-Prot Antivirus  Found nothing
Fortinet  Found nothing
Kaspersky Anti-Virus  Found nothing
NOD32  Found nothing
Norman Virus Control  Found nothing
UNA  Found nothing
VBA32  Found nothing
 

File:  Clgamma.exe  
Status:  OK  
MD5  3356c3c2f9df79e9b0ac76edd75412cb  
Packers detected:  -
Scanner results  
AntiVir  Found nothing
ArcaVir  Found nothing
Avast  Found nothing
AVG Antivirus  Found nothing
BitDefender  Found nothing
ClamAV  Found nothing
Dr.Web  Found nothing
F-Prot Antivirus  Found nothing
Fortinet  Found nothing
Kaspersky Anti-Virus  Found nothing
NOD32  Found nothing
Norman Virus Control  Found nothing
UNA  Found nothing
VBA32  Found nothing

Thanks for the help.  Happy 4th
rob
Logged

Offline rmccabe

  • Jr. Member
  • **
  • Posts: 59
  • Karma: +0/-0
    • View Profile
computer slow, desktop hijacker & daosearch
« Reply #21 on: July 04, 2005, 07:33:39 PM »
this mornig I run Ad Aware and SpyBot and Norton did live updates for all and shut down and restart for computer.  I noticed a line in the HJL that looks like [TkBellExe] not sure what it is?


 Logfile of HijackThis v1.99.1
Scan saved at 4:12:53 PM, on 7/4/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\COMMON FILES\EPSON\EBAPI\SAGENT2.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\CLGAMMA.EXE
C:\WINDOWS\SYSTEM\USBMONIT.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\AUCBPNP.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\ADAPTEC\USBCONTROL\AUSBCTRL.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\HJT\HIJACKTHIS.EXE

F1 - win.ini: run=C:\WINDOWS\hpfsched.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ColorCorrection] C:\WINDOWS\CLGAMMA.EXE
O4 - HKLM\..\Run: [Gene USB Monitor] C:\WINDOWS\SYSTEM\USBMonit.exe
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [AUCBPNP] C:\WINDOWS\SYSTEM\aucbpnp.exe
O4 - HKLM\..\Run: [Ink Monitor] C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\RunServices: [SAgent2ExePath] C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - Startup: USBControl.lnk = C:\Program Files\Adaptec\USBControl\Ausbctrl.exe
O4 - Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM\E_SRCV02.EXE
O4 - Startup: EPSON CardMonitor.lnk = C:\Program Files\EPSON\EPSON CardMonitor\EPSON CardMonitor1.0.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

Thanks for your help.
Logged

Offline rmccabe

  • Jr. Member
  • **
  • Posts: 59
  • Karma: +0/-0
    • View Profile
computer slow, desktop hijacker & daosearch
« Reply #22 on: July 09, 2005, 02:42:14 AM »
bump
just thinking I got lost in the holiday shuffle.  Here is a current HJL.
Today when  look at my computer it said that NORTON ANTI-VIRUS file was missing and HEWLET-PACKER file was missing.  As I said before I don't use hp.

Logfile of HijackThis v1.99.1
Scan saved at 11:24:44 PM, on 7/8/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\COMMON FILES\EPSON\EBAPI\SAGENT2.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\CLGAMMA.EXE
C:\WINDOWS\SYSTEM\USBMONIT.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\AUCBPNP.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\ADAPTEC\USBCONTROL\AUSBCTRL.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\HJT\HIJACKTHIS.EXE

F1 - win.ini: run=C:\WINDOWS\hpfsched.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ColorCorrection] C:\WINDOWS\CLGAMMA.EXE
O4 - HKLM\..\Run: [Gene USB Monitor] C:\WINDOWS\SYSTEM\USBMonit.exe
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [AUCBPNP] C:\WINDOWS\SYSTEM\aucbpnp.exe
O4 - HKLM\..\Run: [Ink Monitor] C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\RunServices: [SAgent2ExePath] C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - Startup: USBControl.lnk = C:\Program Files\Adaptec\USBControl\Ausbctrl.exe
O4 - Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM\E_SRCV02.EXE
O4 - Startup: EPSON CardMonitor.lnk = C:\Program Files\EPSON\EPSON CardMonitor\EPSON CardMonitor1.0.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

Thanks rob
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
computer slow, desktop hijacker & daosearch
« Reply #23 on: July 09, 2005, 03:09:50 AM »
Wow, sorry, I forgot all about your post  http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/blink.gif\' class=\'bbc_emoticon\' alt=\':blink:\' />

You need to do a few things
Your log is clean, most of what you need to do is ensure that your programs are running properly and all drivers installed properly

Can you try this please

Do another scan with Hijackthis and put a check next to these entries:

F1 - win.ini: run=C:\WINDOWS\hpfsched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE  < not needed on startup

After you have ticked the above entries, close All other open windows, including this one
Leave Hijackthis open and click FIX CHECKED
OK the prompt and exit Hijackthis

Restar your computer

Back in Windows

Uninstall Norton Anti-virus completely
Make  sure you get rid of all of it
Look on Symantec's site for removal instructions if it won't uninstall properly
Norton is know to have a hard time with uninstallation
Restart your computer after removal

Can you please do the following

Download and UNZIP it to a folder
RegSeeker 1.45
Open RegSeeker.exe
Click the "Clean Registry" on the left menu
Ensure there is a check in "Backup before deletion" in the new window
Then click OK on the right
Let it finish scanning
Afterward the scan is done click "Select All" at the bottom and then right click in the
Results pane and Delete All objects
Exit RegSeeker and Restart your computer

Ensure all programs are working ok
Post a final hijackthis log and let me know how things are running
Make sure you have all proper drivers installed for your computer
If your having troubles identifying the appropriate drivers please visit the manufacturers website

Also, a great tool to help identify the software and hardware installed
Take a look at EVEREST
http://www.lavalys.com/products/overview.php?pid=1〈=en

When was the last time you did a Disk Defrag, now would be a good time

Reinstall Norton's at this time and run a full system scan
« Last Edit: July 09, 2005, 03:13:25 AM by guestolo »
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline rmccabe

  • Jr. Member
  • **
  • Posts: 59
  • Karma: +0/-0
    • View Profile
computer slow, desktop hijacker & daosearch
« Reply #24 on: July 11, 2005, 01:05:56 AM »
Hello I did all the steps as requested.  Have also been running Spybot, Adaware, Windows cleaner, And RegSeeker.  The RegSeeker is a really cool program.  And after running it it found 913 problems.  I had uninstalled Norton before running Regseeker.  After the restart Everything was faster they every before!!!!!  But I reinstalled Norton and the speed dropped to Way Pookeyyy.  It took forever to get Hijack to run.  I also downloaded EVEREST. The program is full of info that is way out of my league but it does help with what is what on my computer.

Is it that my computer does not have enough memory and/or ram to run the norton program properly.  And with all the other programs that I now have to keep me protected on the internet.

Do you have an option on external hard drives-would it help with my computer?

I have tried to do a defrag but it won't complete.  I keep getting and window that say's need to perform scan disk.  I have run that little circle around 6-8 times.  Still no defrag!  Im thinking you have a cool little program in your box of fixes for this one.

Well thats it for now Im still amazed at your talent.  Being a mechanic myself I can seen how you get enjoyment from helping people fix there messed up computer I wish I knew more about how these things worked?
 
Thanks for all your help.




Logfile of HijackThis v1.99.1
Scan saved at 9:15:06 PM, on 7/10/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\COMMON FILES\EPSON\EBAPI\SAGENT2.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\CLGAMMA.EXE
C:\WINDOWS\SYSTEM\USBMONIT.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\AUCBPNP.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\ADAPTEC\USBCONTROL\AUSBCTRL.EXE
C:\PROGRAM FILES\EPSON\EPSON CARDMONITOR\EPSON CARDMONITOR1.0.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\HJT\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ColorCorrection] C:\WINDOWS\CLGAMMA.EXE
O4 - HKLM\..\Run: [Gene USB Monitor] C:\WINDOWS\SYSTEM\USBMonit.exe
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [AUCBPNP] C:\WINDOWS\SYSTEM\aucbpnp.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\RunServices: [SAgent2ExePath] C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - Startup: USBControl.lnk = C:\Program Files\Adaptec\USBControl\Ausbctrl.exe
O4 - Startup: EPSON CardMonitor.lnk = C:\Program Files\EPSON\EPSON CardMonitor\EPSON CardMonitor1.0.exe
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
computer slow, desktop hijacker & daosearch
« Reply #25 on: July 11, 2005, 07:11:54 PM »
Norton's can use quite a few resources
Are you willing to try a different Anti-Virus on your computer to see if the performance improves???

Also, I use diskeeper lite on my 98SE computer, don't think you can get the free version anymore
But you shouldn't have a problem running 98's defragger

Try this
Right click an empty spot on your desktop
Left click Properties
Under the Screen Saver tab
Screen Saver drop down bar set to (NONE)
Click the SETTINGS button under Power settings

Under Power Schemes set to Always ON

Apply this and OK out of there

Restart your computer into SAFE MODE>>This is important

Once in safe mode
Go to START>>Programs>>Accessories>>System Tools>>ScanDisk
In scandisk have STANDARD selected
and check "Automatically fix errors"
Then click START
Let this finish and then exit

Go back to START>>Programs>>Accessories>>System Tools
And do a Disk Defrag on your computer
Let this do it's job, don't use your computer while it's running
This could take a while if it hasn't been completed in some time
I recommend you do this at least once a month

When it's done restart back to Normal mode

If it's still bogged down because of Norton's we can find you another AV to try for free
Any protection we have added shouldn't slow down your computer
Actually I would like you to add a bit more protection
The good news is neither of these utilities run in the background using valuable resources

SpywareBlaster 3.4 by JavaCool
*Will block bad ActiveX Controls
*Block Malevolent cookies in Internet Explorer and Firefox
*Restrict actions of potentially dangerous sites in Internet Explorer
After installation, Check for updates and then click the "Enable all protection"

IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
Here is a tutorial and download link
TUTORIAL==Link to Tutorial
Download link

With both, Check for updates every couple of weeks
Keep the link to IE-Spyad bookmarked so you can check for updates
SpywareBlaster, after every update just simply click the "enable all protection"
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline rmccabe

  • Jr. Member
  • **
  • Posts: 59
  • Karma: +0/-0
    • View Profile
computer slow, desktop hijacker & daosearch
« Reply #26 on: July 15, 2005, 05:44:51 AM »
Hello,
Sorry took so long to get back.  Work and forest fires and second job.
Anyway I have downloaded IE-SPYAD and installed it.  I already have SpywareBlaster 3.4.  I have tried Many many times to defrag  in safe mode and in normal mode, still get error message can't defrag need to scan disk!!!!!! over and over and over takes about 10 - 15 mins before the error message comes up.  This is the Defrag ID NO. Defrag00205.  hope this may help.
 

Yes I would be open to trying a diffrent AV
Well I was going to give you a current  hj scan but IT wont run tried several times and it keeps gettting stuck at 015 trusted zone Enumeration
The hj screen wont even come up now its locked up like theres to many thing running but all that is open is this screen and hj.
I think Im being haunted by NORTON. really slow typing.
Well it finished  it said that a RO HKCU has changed, Registry value has changed then it said it was restored to current page?

Logfile of HijackThis v1.99.1
Scan saved at 2:32:26 AM, on 7/15/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\COMMON FILES\EPSON\EBAPI\SAGENT2.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\CLGAMMA.EXE
C:\WINDOWS\SYSTEM\USBMONIT.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\AUCBPNP.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\ADAPTEC\USBCONTROL\AUSBCTRL.EXE
C:\PROGRAM FILES\EPSON\EPSON CARDMONITOR\EPSON CARDMONITOR1.0.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\HJT\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ColorCorrection] C:\WINDOWS\CLGAMMA.EXE
O4 - HKLM\..\Run: [Gene USB Monitor] C:\WINDOWS\SYSTEM\USBMonit.exe
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [AUCBPNP] C:\WINDOWS\SYSTEM\aucbpnp.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\RunServices: [SAgent2ExePath] C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - Startup: USBControl.lnk = C:\Program Files\Adaptec\USBControl\Ausbctrl.exe
O4 - Startup: EPSON CardMonitor.lnk = C:\Program Files\EPSON\EPSON CardMonitor\EPSON CardMonitor1.0.exe


help????????
rob
Logged

Guest

  • Guest
computer slow, desktop hijacker & daosearch
« Reply #27 on: July 15, 2005, 11:32:13 PM »
Not trying to ignore you Rob
But take a look at how I described to run Scandisk first and then run Disk Defrag
All in safe mode
Don't worry about Hijackthis not being able to run right now
The only reason this is happening is probably because you installed
IE-Spyad <<< This is a good program
Ie-spyad adds a lot of reg entries into your restricted sites
Hijackthis checks this area and on a 98 machine sometimes seems to freeze at this point
If you want to run a Hijackthis scan
First go to C:/Ie-Spyad directory
Double click on Install.bat
Follow the prompts to uninstall IE-Spyad
Try running a hijackthis log again
Don't forget to reinstall IE-Spyad with the same instructions
Do that after every update
But use the Install option

EDIT>>We'll deal with Nortons' later, but please run a Disk defrag with the proper instructions
Scandisk for errors first and then Disk Defrag
All in safe mode
« Last Edit: July 15, 2005, 11:38:30 PM by guestolo »
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
computer slow, desktop hijacker & daosearch
« Reply #28 on: July 16, 2005, 01:42:15 AM »
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline rmccabe

  • Jr. Member
  • **
  • Posts: 59
  • Karma: +0/-0
    • View Profile
computer slow, desktop hijacker & daosearch
« Reply #29 on: July 17, 2005, 12:41:35 PM »
Hello Guestolo,
I went to the link for microsoft.  In my properties I did not have a web tab?? I went and searched for the applog file and found it and deleted it as they requested.
 
Scan disk and defraged have been completed.
I did windows cleanup and reg seeker then restarted,
the file "HIMEN.SYS is missing" once again and it comes up the same as before, only when I select to restart.  Not when I power the computer down then start back up with the power button.
 
When I hooked up to the internet this time I got the password windows screen.  Its the same screen you get when windows is restarted to log on to windows. I don't have the password system enabled??? I just closed the screen out.  Not sure why it popped up?

Could not get HJT to load the mouse locked up when I clicked on it.  waited for about an hour then control, alt, del and shut it down!
Any Ideas????
thank you for all your help.
Rob
Logged

Offline rmccabe

  • Jr. Member
  • **
  • Posts: 59
  • Karma: +0/-0
    • View Profile
computer slow, desktop hijacker & daosearch
« Reply #30 on: July 24, 2005, 01:56:13 PM »
Hello there,  been really busy, but nothing has changed computer wise. Still the same problems as the last post.
any ideas??
Thanks Rob
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
computer slow, desktop hijacker & daosearch
« Reply #31 on: July 24, 2005, 02:56:28 PM »
Quote
Could not get HJT to load the mouse locked up when I clicked on it. waited for about an hour then control, alt, del and shut it down!
Any Ideas????
If you read my previous posts, I suggested how to uninstall IE-Spyad
Run the Hijackthis scan and then reinstall IE-Spyad
Of course, you should check for updates first

Quote
When I hooked up to the internet this time I got the password windows screen. Its the same screen you get when windows is restarted to log on to windows. I don't have the password system enabled??? I just closed the screen out. Not sure why it popped up?
Please see the below link
http://support.microsoft.com/default.aspx?...&NoWebContent=1

Quote
"HIMEN.SYS is missing"
I assume you mean Himem.sys
See the following link please
http://support.microsoft.com/?kbid=296636
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Pages: 1 [2]
« previous next »