[RachelK]

nope and nope

[Advertisements]

hmm wow u sure AVG is still on then? seems very hard that the program would continue to stay there

[Hemal]

hmm wow u sure AVG is still on then? seems very hard that the program would continue to stay there

[RachelK]

That's what one of the other administrators told me... because I keep on getting error messages from AVG when i start my computer.

[admin]

Have you tried to install it again, and then remove it using add/remove programs?

[RachelK]

No I haven't... is that what I should be doing? Because the "computer guy" apparently uninstalled it anyway. So what would cause it to have error messages if it was uninstalled properly?

[admin]

Hmmm, I'm confused now. Can you give us the exact error message, and a new Hijack This log.

[RachelK]

"Driver(CORE) not found winerr=2"

Logfile of HijackThis v1.98.1
Scan saved at 1:57:08 AM, on 27/08/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Messenger Plus! 2\MsgPlus.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Utilites\PestPatrol\PPMemCheck.exe
C:\Utilites\PestPatrol\CookiePatrol.exe
C:\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\Program Files\SECRETMAKER\secretmaker.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\RK\My Documents\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_11_0.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [AVG_CC] C:\Utilites\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [PPMemCheck] C:\Utilites\PestPatrol\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\Utilites\PestPatrol\CookiePatrol.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - Global Startup: SECRETMAKER.lnk = C:\Program Files\SECRETMAKER\secretmaker.exe
O9 - Extra button: AOL Instant Messenger ™ - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab28578.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4D0F67AD-8D61-4FDE-9600-2BEEC28B3F15}: NameServer = 192.168.2.1

[admin]

Look in C:\WINDOWS\System32\ do you see shell.dll? If not, copy shell.dll located in C:\WINDOWS\System\ to the C:\WINDOWS\System32\ folder.

Shell.dll is removed by some viruses and trojans and can cause this error.

A trojan can also cause this error. Try these free online scans:
Run a free online virus scan here:
http://housecall.antivirus.com/

another one here:
http://www.pandasoft...n_principal.htm

And a free trojan scan here:
http://www.moosoft.com/

[RachelK]

The shell.dll file is where it should be, and I ran one of the scans and I don't have any Trojans. Should I go ahead and delete the AVG file in the hijackthis log?

[admin]

Strange

Fix this entry: O4 - HKLM\..\Run: [AVG_CC] C:\Utilites\Grisoft\AVG6\avgcc32.exe /STARTUP

Reboot and delete this folder: C:\Utilites\Grisoft