[autumnraine]

I did what you said by putting the marks next to the ones listed but what do I do with the rest of the info, they were not part of the hijack log that the rest of them were. Thank you.

C:\PROGRAM FILES\CHARTER HIGH-SPEED SECURITY SUITE\Common\FSM32.EXE
C:\PROGRAM FILES\CHARTER HIGH-SPEED SECURITY SUITE\TNB <- this folder
C:\WINDOWS\SYSTEM\IJ75P2PS.EXE
C:\PROGRAM FILES\CHARTER HIGH-SPEED SECURITY SUITE\Common\FSMA32.EXE
C:\PROGRAM FILES\CHARTER HIGH-SPEED SECURITY SUITE\Common\fsaa.exe
C:\WINDOWS\SYSTEM\PowerReg Scheduler V3.exe

[Advertisements]

Can we please see a new hijack this log?

[admin]

Can we please see a new hijack this log?

[autumnraine]

I assumed the ones with the bold were to be removed, the following were not found, FSM32.EXE, TNB, FSMA32.EXE, FSAA.EXE, POWERREG SCHEDULER V3.EXE,

the only one found and deleted was IJ75P2Ps.exe, in the process of trying to run AVG again, here is my log as of now, thank you.


Logfile of HijackThis v1.98.2
Scan saved at 10:44:12 PM, on 8/17/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\SUPPORT.COM\BIN\TGCMD.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\PROGRAM FILES\SAVE\SAVE.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\WEATHERCAST\WEATHER.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\PROGRAM FILES\WORDWEB\WWEB32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\UNZIPPED\HIJACKTHIS[1]\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://google.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - Default URLSearchHook is missing
F1 - win.ini: run=HPFsched
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server /startmonitor /deaf
O4 - HKLM\..\Run: [SSRunScript] "C:\Program Files\Support.com\Charter\bin\SSRunScript.exe" /script "C:\Program Files\Support.com\Charter\vbs\verifyconnection.vbs" /args //b startupdelay
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [CompaqPrinTray] PrinTray.exe
O4 - HKLM\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] c:\windows\SYSTEM\mstask.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - HKCU\..\Run: [WeatherCast] "C:\Program Files\WeatherCast\Weather.exe" /q
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Startup: WORDWEB.LNK = C:\Program Files\WordWeb\wweb32.exe
O8 - Extra context menu item: AltaVista Home - http://jump.altavista.com/avie5/home
O8 - Extra context menu item: AV Search This Term - http://jump.altavista.com/avie5/search
O8 - Extra context menu item: AV Translate this Web Page - http://jump.altavist...avie5/babelfish
O8 - Extra context menu item: AV Translate Selection - http://jump.altavist...avie5/babelfish
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn...UC/MsnPUpld.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.chart...oad/tgctlcm.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.h.../qdiagh.cab?322

[autumnraine]

Well, don't know what to do now. Hate to take up anymore of your time. I appreciate your having taken the time to help me, looks as if I just have to live with it I guess. Just ran AVG again and it crashed at the same point as before, starting to scan into the D: drive. I am assuming there is nothing else I can do? Thank you very much.

[admin]

Hey Lisa, I'm not giving up, are you? We're making progress, and we'll get it.

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items, then click fix checked.
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe"

Reboot in safe mode (by tapping F8 at startup and select safe mode from the menu).
Be sure you're able to view hidden files, and remove the following files in bold (if found):
C:\Program Files\Save <- this folder

Reboot your PC.

If you would please, rescan with HijackThis and post a fresh log.

[autumnraine]

Glad one of us is seeing progress, thanx for not giving up on me. Did all that you said, below is fresh log. By the way, I started scanning for viruses using BitDefender (since I could not get the one you suggested to work) it came up with lots of trojans but my son turned the computer off in the middle so I will rescan while I sleep. Do you think the one problem I had re: startup the screen saying a fill is missing has anything to do with viruses or just a missing file and is that something you guys can help me with or is there another website specifically for that? Thank you very very much.



Logfile of HijackThis v1.98.2
Scan saved at 12:59:46 AM, on 8/18/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\SUPPORT.COM\BIN\TGCMD.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\WEATHERCAST\WEATHER.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\PROGRAM FILES\WORDWEB\WWEB32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\UNZIPPED\HIJACKTHIS[1]\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://google.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F1 - win.ini: run=HPFsched
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server /startmonitor /deaf
O4 - HKLM\..\Run: [SSRunScript] "C:\Program Files\Support.com\Charter\bin\SSRunScript.exe" /script "C:\Program Files\Support.com\Charter\vbs\verifyconnection.vbs" /args //b startupdelay
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [CompaqPrinTray] PrinTray.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] c:\windows\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - HKCU\..\Run: [WeatherCast] "C:\Program Files\WeatherCast\Weather.exe" /q
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Startup: WORDWEB.LNK = C:\Program Files\WordWeb\wweb32.exe
O8 - Extra context menu item: AltaVista Home - http://jump.altavista.com/avie5/home
O8 - Extra context menu item: AV Search This Term - http://jump.altavista.com/avie5/search
O8 - Extra context menu item: AV Translate this Web Page - http://jump.altavist...avie5/babelfish
O8 - Extra context menu item: AV Translate Selection - http://jump.altavist...avie5/babelfish
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn...UC/MsnPUpld.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.chart...oad/tgctlcm.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.h.../qdiagh.cab?322
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefend...bitdefender.cab

[autumnraine]

Not sure if this makes a difference or not but this is the result of the virus scan by Bitdefender.

C:\WINDOWS\SYSTEM\csrxrb.0xe=>(Upx) infected: Trojan.Downloader.Agent.AE
C:\WINDOWS\SYSTEM\csrxrb.0xe deleted
C:\WINDOWS\POLTT.0XE=>(Upx) infected: Trojan.Downloader.Agent.AE
C:\WINDOWS\POLTT.0XE deleted
C:\WINDOWS\POLMX.0XE=>(Upx) infected: Trojan.Downloader.Agent.AE
C:\WINDOWS\POLMX.0XE deleted
C:\WINDOWS\TEMP\optimize.0xe=>(Upx) infected: Trojan.Downloader.Dyfuca.BQ
C:\WINDOWS\TEMP\optimize.0xe deleted
C:\WINDOWS\TEMP\polmx.0xe=>(Upx) infected: Trojan.Downloader.Agent.AE
C:\WINDOWS\TEMP\polmx.0xe deleted
C:\WINDOWS\TEMP\alchem.cab infected: Trojan.Downloader.Alchemic.A
C:\WINDOWS\TEMP\alchem.cab deleted
C:\WINDOWS\TEMP\DelF130.TMP infected: Adware.1088
C:\WINDOWS\TEMP\DelF130.TMP deleted
C:\WINDOWS\TEMP\omnigate.exe infected: Trojan.Blazefind.A
C:\WINDOWS\TEMP\omnigate.exe deleted
C:\WINDOWS\Downloaded Program Files\jao.dll infected: Trojan.Spy.Briss.H
C:\WINDOWS\Downloaded Program Files\jao.dll deleted
C:\WINDOWS\Downloaded Program Files\QDow_AS2.dll infected: Trojan.Downloader.QDown.L
C:\WINDOWS\Downloaded Program Files\QDow_AS2.dll deleted
C:\WINDOWS\Downloaded Program Files\MediaTicketsInstaller.ocx infected: Trojan.Spy.MediaInstaller.A
C:\WINDOWS\Downloaded Program Files\MediaTicketsInstaller.ocx deleted
C:\WINDOWS\Temporary Internet Files\Content.IE5\V3YXEAZP\wbk20F3.TMP suspect: Exploit.Iframe.Vulnerability
C:\WINDOWS\Temporary Internet Files\Content.IE5\V3YXEAZP\wbk20F3.TMP copied
C:\WINDOWS\Temporary Internet Files\Content.IE5\CXYZ05M3\wbk2073.TMP suspect: Exploit.Iframe.Vulnerability
C:\WINDOWS\Temporary Internet Files\Content.IE5\CXYZ05M3\wbk2073.TMP copied
C:\WINDOWS\Temporary Internet Files\Content.IE5\IPFSLKBM\wbk3100.TMP suspect: Exploit.Iframe.Vulnerability
C:\WINDOWS\Temporary Internet Files\Content.IE5\IPFSLKBM\wbk3100.TMP copied
C:\WINDOWS\Temporary Internet Files\Content.IE5\IPFSLKBM\wbk3B5.TMP suspect: Exploit.Iframe.Vulnerability
C:\WINDOWS\Temporary Internet Files\Content.IE5\IPFSLKBM\wbk3B5.TMP copied
C:\WINDOWS\Temporary Internet Files\Content.IE5\IPFSLKBM\wbkD102.TMP suspect: Exploit.Iframe.Vulnerability
C:\WINDOWS\Temporary Internet Files\Content.IE5\IPFSLKBM\wbkD102.TMP copied
C:\WINDOWS\Temporary Internet Files\Content.IE5\IPFSLKBM\wbk4120.TMP suspect: Exploit.Iframe.Vulnerability
C:\WINDOWS\Temporary Internet Files\Content.IE5\IPFSLKBM\wbk4120.TMP copied
C:\WINDOWS\Temporary Internet Files\Content.IE5\89O7WRWR\wbk60B4.TMP suspect: Exploit.Iframe.Vulnerability
C:\WINDOWS\Temporary Internet Files\Content.IE5\89O7WRWR\wbk60B4.TMP copied
C:\WINDOWS\Temporary Internet Files\Content.IE5\89O7WRWR\wbk42D5.TMP suspect: Exploit.Iframe.Vulnerability
C:\WINDOWS\Temporary Internet Files\Content.IE5\89O7WRWR\wbk42D5.TMP copied
C:\WINDOWS\wsem218.0ll infected: Trojan.Download.Dyfuca.AD
C:\WINDOWS\wsem218.0ll copied
C:\WINDOWS\edow.exe infected: Trojan.Downloader.QDown.M
C:\WINDOWS\edow.exe copied
C:\unzipped\hijackthis[1]\backups\backup-20040817-211941-892-PowerReg Scheduler V3.exe infected: Application.Adware.PowerReg.3.0
C:\unzipped\hijackthis[1]\backups\backup-20040817-211941-892-PowerReg Scheduler V3.exe copied

[admin]

Your log looks clear now, and it looks like BitDefender was able to run successfully. Are you still having any problems?

[autumnraine]

Well, thank you for trying to help me. My problems must lie in another place besides the log because my probs have not changed.
These are still my problems: I still can not complete windows update, there are errors on some of the pages I download, when I use the tab button to tab from space to space (like to fill in info) it takes forever, like it just hangs in cyberspace for 10 seconds or more. When I press enter to go from link to link it hangs for a bit also. I get different errors popping up now and again. Also when I am at my desktop and hit my outlook express button it takes a full minute to get to my mail and then another full minute to reply or make new mail. Not sure what my problem is if spyware/adware/viruses are not to blame. I still get that error in the beginning at startup so maybe I am just missing some files needed to run smooth. Not sure how to go about getting them, is there another board for that? All my problems started when I switched to 3meg and downloaded the charter security suite. When trying to fix the problems with that anti virus software I am afraid I may have deleted and important file or something. Thank you again for taking the time to help me. If you have any other thoughts on what my problems can be that would be great. Thank you again, you guys are doing a great thing!!

Lisa

[admin]

Try this click Run > Start, type sfc /scannow

Have you Win98 CD handy in case any system files have been modified and need to be replaced.

[autumnraine]

Just did it, nothing was corrupt (so it said). Thank you though. Any other thoughts?

Lisa

[admin]

Can you give us the exact text of any error messages you're getting?

[autumnraine]

When I reboot my computer (or just start it) a black screen comes up and it says "Can't find device file needed to run windows or a windows application. Windows registry or System.INI file refers to this device file but the device file no longer exists. C:/progra~1\charte~1\Anti-V~1\Win9X\FSGK95.vxd then it says push a button to continue...

Not sure if that is why windows won't update completely or what. Thanx.

Lisa

[admin]

Let's try this. Uninstall ALL anti-virus programs from this system. Reboot.

Next, install Charter's AV software suite. Reboot.

Remove Charter's AV software, using add/remove programs.

If successful, reinstall the AV of your choice (only one).

[autumnraine]

Well, that is part of the problem. I had the Security Suite Agent from charter, then removed it and had Norton and then removed that. I keep seeing remnants of both on my computer and not sure how to get rid of every part of it. I did go through the add/remove programs and deleted them that way but don't know how else to do it. Any suggestions? Thank you.

Lisa