Windows 98 system infected with I-Worm.Klez.H and other viruses. [RESO, My old Windows 98 system, Compaq Presario computer needs cleaning, AVG |
Discover the best free computer help!
Learn more about Geeks to Go by taking the tour. Want to ask a question, reply to a topic, or remove all advertising? It's easy, fast and free. Join today!
Spyware, virus, trojan, fake security or privacy alerts? Please start with our malware cleaning guide.
Learn more about Geeks to Go by taking the tour. Want to ask a question, reply to a topic, or remove all advertising? It's easy, fast and free. Join today!
Spyware, virus, trojan, fake security or privacy alerts? Please start with our malware cleaning guide.
  |
 Aug 11 2007, 07:39 PM
Post
#1
|
|
|
New Member  Posts: 9 OS: Windows 98  |
I am trying to clean out my old computer. It's a Compaq Presario, has Windows 98 operating system. It was taken over by various viruses years ago. I've since bought a new new computer and am working with Windows XP now, but my old computer has some files and music that I would like to retrieve. This computer is still functioning but it's very slow. I came across your website while seeking a remedy for this. I managed to download HiJack This and SmitFraudFix. After I tried the SmitFraud, my computer is now able to stay on long enough to do some work and go online. I also ran the Yahoo Anti Spy from my browser and it found the following: AdWare: Cydoor, HiWire and WhenU Save. It also found hijackers: Comet Systems, I-Lookup, WurldMedia and WurldMedia.bpboh. I know the Compaq computer has so many viruses that's what prompted me to get a new computer. I just want to know if the old one can be cleaned out because I have some files and music that I didn't back up and would like to know if they can be saved. I tried doing a Panda scan but the computer shuts down before it's done. I don't know if it's from the viruses or the fact that it doesn't have much memory left.  The original post was edited to show the latest HijackThis log. I've had help getting some of the viruses removed but it's still infected. Below is the latest Hijack This log. Logfile of HijackThis v1.99.1 Scan saved at 12:45:33 AM, on 8/16/07 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MSTASK.EXE c:\windows\SYSTEM\KB891711\KB891711.EXE C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\CPQS\BWTOOLS\SCCENTER.EXE C:\WINDOWS\SYSTEM\CIJ3P2PS.EXE C:\PROGRAM FILES\YAHOO!\BROWSER\YBRWICON.EXE C:\PROGRAM FILES\SBC YAHOO!\CONNECTION MANAGER\IP INSIGHT\IPMON32.EXE C:\WINDOWS\SYSTEM\QTTASK.EXE C:\PROGRAM FILES\2WIRE\2PORTALMON.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\PROGRAM FILES\GRISOFT\AVG7\AVGCC.EXE C:\PROGRAM FILES\GRISOFT\AVG7\AVGEMC.EXE C:\PROGRAM FILES\GRISOFT\AVG7\AVGAMSVR.EXE C:\WINDOWS\ptsnoop.exe C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\PROGRAM FILES\YAHOO!\MESSENGER\YMSGR_TRAY.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE C:\WINDOWS\SYSTEM\PSTORES.EXE C:\PROGRAM FILES\HIJACKTHIS\HJT.EXE R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/.../search/ie.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN1\YT.DLL N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.altavista.com"); (C:\Program Files\Netscape\Users\ausetcat\prefs.js) O1 - Hosts: 207.68.176.250 auto.search.msn.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN1\YT.DLL O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN1\YT.DLL O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [Service Connection] c:\cpqs\bwtools\sccenter.exe O4 - HKLM\..\Run: [CountrySelection] pctptt.exe O4 - HKLM\..\Run: [CompaqPrinTray] PrinTray.exe O4 - HKLM\..\Run: [CIJ3P2PSERVER] CIJ3P2PS.EXE O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\WINDOWS\SYSTEM\PRISMSVR.EXE" /APPLY O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\PROGRAM FILES\SBC YAHOO!\CONNECTION MANAGER\IP INSIGHT\IPMon32.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime O4 - HKLM\..\Run: [2wSysTray] C:\PROGRAM FILES\2WIRE\2PORTALMON.EXE O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVG7\AVGCC.EXE /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVG7\AVGEMC.EXE O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVG7\AVGAMSVR.EXE O4 - HKLM\..\Run: [PTSNOOP] ptsnoop.exe O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [KB891711] c:\windows\SYSTEM\KB891711\KB891711.EXE O4 - HKLM\..\RunServices: [KB918547] C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRAM FILES\YAHOO!\MESSENGER\ypager.exe -quiet O12 - Plugin for .hpb: C:\PROGRA~1\INTERN~1\PLUGINS\nphpipb.dll O12 - Plugin for .wma: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npdsplay.dll O12 - Plugin for .asx: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npdsplay.dll O16 - DPF: {451FCDEE-DCED-11D3-87DD-0090278F1040} (Yahoo! Voicemail Engine) - http://phone.yahoo.com/plugin/yumscom.cab This post has been edited by Auset: Aug 16 2007, 03:09 AM |
 |
 
|
|
Aug 18 2007, 09:56 AM
Post
#2
|
|
 Malware Staff  Posts: 2,618 From: The center of the earth OS: Vista, Xp, 98, 3.1, Dos 5.1 |
Hi Auset,
Welcome to Geekstogo. Sorry about the wait, we are very busy at the moment. I will be handling your log to get you cleaned up. As it has been a while since you posted this log, can you please post a fresh one. This is because your computers condition may have changed. I want you to show hidden files. There are instructions HERE to help you do this. You should have Administrator rights to perform the fixes. Some of the instructions I give may need to be printed or saved for reference during the fix. Some of the fix will be done in safe mode so you will be unable to access this thread at that time. These instructions should be read first, then followed. If you do not understand something, don't be afraid to ask. |
|
|
|
|
Aug 19 2007, 07:35 PM
Post
#3
|
|
|
New Member Posts: 9 OS: Windows 98 |
Hello sarahw,
Thank you for your time. I know you all are very busy so thank you very much. Here is a new Hijack This log. Logfile of HijackThis v1.99.1 Scan saved at 6:27:47 PM, on 8/19/07 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MSTASK.EXE c:\windows\SYSTEM\KB891711\KB891711.EXE C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\CPQS\BWTOOLS\SCCENTER.EXE C:\WINDOWS\SYSTEM\CIJ3P2PS.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\PROGRAM FILES\YAHOO!\BROWSER\YBRWICON.EXE C:\PROGRAM FILES\SBC YAHOO!\CONNECTION MANAGER\IP INSIGHT\IPMON32.EXE C:\WINDOWS\SYSTEM\QTTASK.EXE C:\PROGRAM FILES\2WIRE\2PORTALMON.EXE C:\PROGRAM FILES\GRISOFT\AVG7\AVGCC.EXE C:\PROGRAM FILES\GRISOFT\AVG7\AVGEMC.EXE C:\PROGRAM FILES\GRISOFT\AVG7\AVGAMSVR.EXE C:\WINDOWS\ptsnoop.exe C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\PROGRAM FILES\YAHOO!\MESSENGER\YMSGR_TRAY.EXE C:\PROGRAM FILES\GRISOFT\AVG7\AVGW.EXE C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\WINDOWS\SYSTEM\PSTORES.EXE C:\PROGRAM FILES\HIJACKTHIS\HJT.EXE R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/.../search/ie.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.downloadalot.com R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN1\YT.DLL N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.altavista.com"); (C:\Program Files\Netscape\Users\ausetcat\prefs.js) O1 - Hosts: 207.68.176.250 auto.search.msn.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN1\YT.DLL O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN1\YT.DLL O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [Service Connection] c:\cpqs\bwtools\sccenter.exe O4 - HKLM\..\Run: [CountrySelection] pctptt.exe O4 - HKLM\..\Run: [CompaqPrinTray] PrinTray.exe O4 - HKLM\..\Run: [CIJ3P2PSERVER] CIJ3P2PS.EXE O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\WINDOWS\SYSTEM\PRISMSVR.EXE" /APPLY O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\PROGRAM FILES\SBC YAHOO!\CONNECTION MANAGER\IP INSIGHT\IPMon32.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime O4 - HKLM\..\Run: [2wSysTray] C:\PROGRAM FILES\2WIRE\2PORTALMON.EXE O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVG7\AVGCC.EXE /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVG7\AVGEMC.EXE O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVG7\AVGAMSVR.EXE O4 - HKLM\..\Run: [PTSNOOP] ptsnoop.exe O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [KB891711] c:\windows\SYSTEM\KB891711\KB891711.EXE O4 - HKLM\..\RunServices: [KB918547] C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRAM FILES\YAHOO!\MESSENGER\ypager.exe -quiet O12 - Plugin for .hpb: C:\PROGRA~1\INTERN~1\PLUGINS\nphpipb.dll O12 - Plugin for .wma: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npdsplay.dll O12 - Plugin for .asx: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npdsplay.dll O16 - DPF: {451FCDEE-DCED-11D3-87DD-0090278F1040} (Yahoo! Voicemail Engine) - http://phone.yahoo.com/plugin/yumscom.cab This post has been edited by Auset: Aug 19 2007, 07:38 PM |
|
|
|
|
Aug 20 2007, 06:19 AM
Post
#4
|
|
|
Malware Staff Posts: 2,618 From: The center of the earth OS: Vista, Xp, 98, 3.1, Dos 5.1 |
Before we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done in Safe mode, and you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding.
1. Open AVG Anti-Spyware
2. 1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below: R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/.../search/ie.html R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com 2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis. 3. Reboot into Safe Mode by continuously tapping the F8 key as soon as the computer begins to boot. A menu should come up where you will be given the option to enter Safe Mode. 3. Reboot into Safe Mode by continuously tapping the F8 key as soon as the computer begins to boot. A menu should come up where you will be given the option to enter Safe Mode. 4. IMPORTANT: Do not open any other windows or programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess: [*]Lauch AVG Anti-Spyware by double-clicking the icon on your desktop. [*]Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan". [*]AVG Anti-Spyware will now begin the scanning process, be patient this may take a little time. Once the scan is complete do the following: [*]If you have any infections you will prompted, then select "Apply all actions" [*]Next select the "Reports" icon at the top. [*]Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important). [*]Close AVG Anti-Spyware and reboot your system back into Normal Mode and post the results of the AVG Anti-Spyware report scan in your next reply. 6. Please go HERE to run Panda's ActiveScan
6. Reply with a fresh Hiajck This log the Panda scan and the AVG Anti spyware scan. 
|
|
|
|
|
Aug 25 2007, 04:03 AM
Post
#5
|
|
|
New Member Posts: 9 OS: Windows 98 |
Hello sarahw,
Sorry it took so long for me to get back. I had a little trouble with downloading a few things, this system is constantly telling me disk space is full. When I click OK to clean up disk space the table shows 0.00 mb but wants me to clean up disk space. Anyway, I managed to run the AVG Anti Virus scan as well as Panda ActiveScan. They both show NO Viruses. I still suspect something wrong but don't know what. Here is the AVG history log as well as a new HijackThis log: AVG history log: - <history> - <!-- 01c7e68065e29920 --> - <rec time="2007/08/14 04:10:27" user="" source="General"> <value>@HL_TestStarted</value> <attr name="testname">@TestName_12</attr> </rec> - <rec time="2007/08/14 04:10:27" user="" source="General"> <value>@HL_TestEnded</value> <attr name="testname">@TestName_12</attr> <attr name="infectedfiles">0</attr> </rec> - <rec time="2007/08/14 04:40:38" user="" source="General"> <value>@HL_TestStarted</value> <attr name="testname">@TestName_02</attr> </rec> - <rec time="2007/08/14 04:41:53" user="" source="General"> <value>@HL_TestStopped</value> <attr name="testname">@TestName_02</attr> <attr name="infectedfiles">0</attr> </rec> - <rec time="2007/08/14 04:48:36" user="" source="General"> <value>@HL_TestStarted</value> <attr name="testname">@TestName_02</attr> </rec> - <rec time="2007/08/14 05:37:32" user="" source="General"> <value>@HL_TestEnded</value> <attr name="testname">@TestName_02</attr> <attr name="infectedfiles">0</attr> </rec> - <rec time="2007/08/14 05:39:49" user="" source="General"> <value>@HL_TestStarted</value> <attr name="testname">@TestName_12</attr> </rec> - <rec time="2007/08/14 05:39:56" user="" source="General"> <value>@HL_TestEnded</value> <attr name="testname">@TestName_12</attr> <attr name="infectedfiles">0</attr> </rec> - <rec time="2007/08/14 08:43:40" user="" source="General"> <value>@HL_TestStarted</value> <attr name="testname">@TestName_02</attr> </rec> - <rec time="2007/08/14 09:02:18" user="" source="General"> <value>@HL_TestStopped</value> <attr name="testname">@TestName_02</attr> <attr name="infectedfiles">0</attr> </rec> - <rec time="2007/08/15 13:45:42" user="" source="General"> <value>@HL_TestStarted</value> <attr name="testname">@TestName_02</attr> </rec> - <rec time="2007/08/15 13:52:13" user="" source="Update"> <value>@HL_UpdateOK</value> <attr name="version">avi:1102-1100;helpsmus:466-437;iavi:965-961;setup:466-445;</attr> </rec> - <rec time="2007/08/15 14:52:32" user="" source="General"> <value>@HL_TestEnded</value> <attr name="testname">@TestName_02</attr> <attr name="infectedfiles">0</attr> </rec> - <rec time="2007/08/15 15:54:24" user="" source="General"> <value>@HL_TestStarted</value> <attr name="testname">@TestName_02</attr> </rec> - <rec time="2007/08/15 16:39:59" user="" source="General"> <value>@HL_TestEnded</value> <attr name="testname">@TestName_02</attr> <attr name="infectedfiles">0</attr> </rec> - <rec time="2007/08/15 18:07:52" user="" source="General"> <value>@HL_TestStarted</value> <attr name="testname">@TestName_13</attr> </rec> - <rec time="2007/08/15 19:39:50" user="" source="General"> <value>@HL_TestEnded</value> <attr name="testname">@TestName_13</attr> <attr name="infectedfiles">0</attr> </rec> - <rec time="2007/08/16 16:13:45" user="" source="Update"> <value>@HL_UpdateOKNeedRestart</value> <attr name="version">alertmgr:482-458;avgcc:480-460;avgui:482-470;avi:1103-1102;core:484-476;core9x:484-476;corent:484-476;dos:484-476;email:480-455;ems:482-474;helpsmus:482-466;iavi:967-965;kernel:480-475;lng:482-476;lngus:482-476;setup:482-466;update:477-473;</attr> </rec> - <rec time="2007/08/19 17:59:18" user="" source="General"> <value>@HL_TestStarted</value> <attr name="testname">@TestName_02</attr> </rec> - <rec time="2007/08/19 18:06:31" user="" source="Update"> <value>@HL_UpdateOK</value> <attr name="version">iavi:971-967;</attr> </rec> - <rec time="2007/08/19 19:13:54" user="" source="General"> <value>@HL_TestEnded</value> <attr name="testname">@TestName_02</attr> <attr name="infectedfiles">0</attr> </rec> - <rec time="2007/08/24 18:55:52" user="" source="General"> <value>@HL_TestStarted</value> <attr name="testname">@TestName_02</attr> </rec> - <rec time="2007/08/24 18:59:13" user="" source="Update"> <value>@HL_UpdateOK</value> <attr name="version">avi:1109-1103;iavi:981-971;</attr> </rec> - <rec time="2007/08/24 19:20:33" user="" source="General"> <value>@HL_TestStopped</value> <attr name="testname">@TestName_02</attr> <attr name="infectedfiles">0</attr> </rec> - <rec time="2007/08/24 19:31:35" user="" source="General"> <value>@HL_TestStarted</value> <attr name="testname">@TestName_02</attr> </rec> - <rec time="2007/08/24 19:31:51" user="" source="General"> <value>@HL_TestStopped</value> <attr name="testname">@TestName_02</attr> <attr name="infectedfiles">0</attr> </rec> - <rec time="2007/08/24 20:29:57" user="" source="General"> <value>@HL_TestStarted</value> <attr name="testname">@TestName_02</attr> </rec> - <rec time="2007/08/24 20:32:28" user="" source="General"> <value>@HL_TestStopped</value> <attr name="testname">@TestName_02</attr> <attr name="infectedfiles">0</attr> </rec> - <rec time="2007/08/24 20:34:05" user="" source="General"> <value>@HL_TestStarted</value> <attr name="testname">@TestName_13</attr> </rec> - <rec time="2007/08/24 22:11:13" user="" source="General"> <value>@HL_TestEnded</value> <attr name="testname">@TestName_13</attr> <attr name="infectedfiles">0</attr> </rec> - <rec time="2007/08/24 23:50:11" user="" source="General"> <value>@HL_TestStarted</value> <attr name="testname">@TestName_02</attr> </rec> - <rec time="2007/08/25 00:38:09" user="" source="General"> <value>@HL_TestEnded</value> <attr name="testname">@TestName_02</attr> <attr name="infectedfiles">0</attr> </rec> </history> HijackThis Log: Logfile of HijackThis v1.99.1 Scan saved at 3:02:04 AM, on 8/25/07 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MSTASK.EXE c:\windows\SYSTEM\KB891711\KB891711.EXE C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\CPQS\BWTOOLS\SCCENTER.EXE C:\WINDOWS\SYSTEM\CIJ3P2PS.EXE C:\PROGRAM FILES\YAHOO!\BROWSER\YBRWICON.EXE C:\PROGRAM FILES\SBC YAHOO!\CONNECTION MANAGER\IP INSIGHT\IPMON32.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\WINDOWS\SYSTEM\QTTASK.EXE C:\PROGRAM FILES\2WIRE\2PORTALMON.EXE C:\PROGRAM FILES\GRISOFT\AVG7\AVGCC.EXE C:\PROGRAM FILES\GRISOFT\AVG7\AVGEMC.EXE C:\PROGRAM FILES\GRISOFT\AVG7\AVGAMSVR.EXE C:\WINDOWS\ptsnoop.exe C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\PROGRAM FILES\YAHOO!\MESSENGER\YMSGR_TRAY.EXE C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\PROGRAM FILES\HIJACKTHIS\HJT.EXE R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN1\YT.DLL N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.altavista.com"); (C:\Program Files\Netscape\Users\ausetcat\prefs.js) O1 - Hosts: 207.68.176.250 auto.search.msn.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN1\YT.DLL O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN1\YT.DLL O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [Service Connection] c:\cpqs\bwtools\sccenter.exe O4 - HKLM\..\Run: [CountrySelection] pctptt.exe O4 - HKLM\..\Run: [CompaqPrinTray] PrinTray.exe O4 - HKLM\..\Run: [CIJ3P2PSERVER] CIJ3P2PS.EXE O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\WINDOWS\SYSTEM\PRISMSVR.EXE" /APPLY O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\PROGRAM FILES\SBC YAHOO!\CONNECTION MANAGER\IP INSIGHT\IPMon32.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime O4 - HKLM\..\Run: [2wSysTray] C:\PROGRAM FILES\2WIRE\2PORTALMON.EXE O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVG7\AVGCC.EXE /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVG7\AVGEMC.EXE O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVG7\AVGAMSVR.EXE O4 - HKLM\..\Run: [PTSNOOP] ptsnoop.exe O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [KB891711] c:\windows\SYSTEM\KB891711\KB891711.EXE O4 - HKLM\..\RunServices: [KB918547] C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRAM FILES\YAHOO!\MESSENGER\ypager.exe -quiet O12 - Plugin for .hpb: C:\PROGRA~1\INTERN~1\PLUGINS\nphpipb.dll O12 - Plugin for .wma: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npdsplay.dll O12 - Plugin for .asx: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npdsplay.dll O16 - DPF: {451FCDEE-DCED-11D3-87DD-0090278F1040} (Yahoo! Voicemail Engine) - http://phone.yahoo.com/plugin/yumscom.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab |
|
|
|
|
Aug 25 2007, 08:45 PM
Post
#6
|
|
|
Malware Staff Posts: 2,618 From: The center of the earth OS: Vista, Xp, 98, 3.1, Dos 5.1 |
Hi,
Please download Deckard's System Scanner (DSS) and save it to your Desktop.
|
|
|
|
|
Aug 29 2007, 09:18 AM
Post
#7
|
|
|
New Member Posts: 9 OS: Windows 98 |
Hello sarahw,
I downloaded the Deckard's System Scanner (DSS) to my desktop but it will not open. I double click on the dss.exe icon but nothing happens. That downlaodalot and searchalot browser hijack keeps coming back after I reboot the computer also. I even tried deleting and re-downloading the DSS and I get the same results. Don't know what to do at this point. |
|
|
|
|
Sep 1 2007, 09:19 AM
Post
#8
|
|
|
Malware Staff Posts: 2,618 From: The center of the earth OS: Vista, Xp, 98, 3.1, Dos 5.1 |
Hi,
Could you please run these tools. 1. Download and Save Blacklight to your desktop (choose "I ACCEPT" then click "DOWNLOAD" on the website). Double-click fsbl.exe then accept the agreement, click > "Scan" then > "Next". You'll see a list of all items found. There will also be a log on your desktop with the name "fsbl.xxxxxxxxxxxxxx.log" (the xxxxxxxxxxxxxx stand for numbers). Copy and paste this log in your next reply. Don't choose the rename option yet! I want to see the log first, because legitimate items can also be present there, such as "wbemtest.exe" 2. Please download SmitfraudFix (by S!Ri) to your Desktop. Double-click SmitfraudFix.exe Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present). Please copy/paste the content of that report into your next reply. **If the tool fails to launch from the Desktop, please move SmitfraudFix.exe directly to the root of the system drive (usually C:), and launch from there. Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user. http://www.beyondlogic.org/consulting/proc...processutil.htm This post has been edited by sarahw: Sep 1 2007, 09:22 AM |
|
|
|
|
Sep 4 2007, 03:09 AM
Post
#9
|
|
|
New Member Posts: 9 OS: Windows 98 |
Hello sarahw, for some reason I can't open any of these programs after downloading them. I keep getting "Disk Drive is full" messages. I had the SmitFraud Fix before and it ran very well, that's how I was able to get this computer working as it is now but for some reason it will not open. Other programs are fine. Whenever I try to update the AVG anti-virus it never goes through with the update, I get an error for this one also.
|
|
|
|
|
Sep 4 2007, 06:08 AM
Post
#10
|
|
|
Malware Staff Posts: 2,618 From: The center of the earth OS: Vista, Xp, 98, 3.1, Dos 5.1 |
Hi,
Could you tell me how much space is available on the Hard Drive(s)? |
|
|
|
|
Sep 7 2007, 11:46 AM
Post
#11
|
|
|
New Member Posts: 9 OS: Windows 98 |
Well, the total system has 63.0MB. It's a Windows 98 SE. Genuine Intel x86 Family 6 Model 8 Stepping 3.
63.0MB RAM Disk Drive: Compaq SC-14OS Processor: Celeron at 566MHZ Storage: A: Removable Drive (Floppy, LS120, Zip, Etc.) C: Hard Drive 7.439GB D: Hard Drive 1.856GB E: CD/PDCD/DVD/CDRW Drive It also says that the disk space is 69% free but the display panel illustration of the disk drive shows all the space is filled up. It reads, 7.43GB used and 7.10MB free but the capacity is 7.43GB. When I first started cleaning the computer I used the SmitFraud Fix and HiJack This downloads and everything was getting back to normal. Now I get the Not Enough space on drive C messages and the SmitFraud Fix won't open up, The AVG Anti-Virus will open but in the middle of any operation I get the not enough disk space message. Sometimes I don't get the message and am able to operate the computer (like now), but sometimes I can't operate the computer because of the messages that keep popping up. I was told the virus that had infected my system was causing the messages to pop up and that my disk space may not be full as the messages say they are. I am just trying to make sure I can retreive my music files and a few other documents if they are not already infected or corrupted by the Virus. This post has been edited by Auset: Sep 7 2007, 11:49 AM |
|
|
|
|
Nov 7 2007, 03:40 AM
Post
#12
|
|
|
Malware Staff Posts: 2,618 From: The center of the earth OS: Vista, Xp, 98, 3.1, Dos 5.1 |
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic. |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
Similar Topics
