Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

had PSGuard, think it is gone...still have problem [CLOSED]

Started by omegjs , Sep 03 2005 11:24 AM

  • Please log in to reply

#16
tampabelle
Posted 06 September 2005 - 11:26 AM

tampabelle

    Member 5k

  • Retired Staff
  • 6,363 posts
I have no idea how these lines made it to your autoexec.bat file ????

Please right click on autoexec.bat file and then click on edit.

Delete the two lines -

C:\>attrib -s -h -r C:\WINDOWS\SYSTEM\WININET.DLL

C:\>del C:\WINDOWS\SYSTEM\WININET.DLL



Save the file.


Reboot the PC. Reinstall IE. This will get you the latest version of wininet.dll file onto your PC.

Let me know how it goes. Post a fresh HJT log and also the contents of the autoexec.bat file. I want to see what else is in there !!!!!

Edited by tampabelle, 06 September 2005 - 11:29 AM.

  • 0

Advertisements

#17
omegjs
Posted 06 September 2005 - 05:21 PM

omegjs

    Member

  • Topic Starter
  • Member
  • PipPip
  • 41 posts
The autoexec.bat (which is found at C:\autoexec.bat) now contains only one line:

SET PATH=%PATH%;C:\WINDOWS\Twain_32\Scanwiz;C:\WINDOWS\Twain\Scanwiz

<><><><><><><><><><><><><><><><><><><><>

I have another autoexec.bat on my computer under C:\WINDOWS\COMMAND\EBD, but I don't know if it runs when windows starts up.

It contains the following lines:

@ECHO OFF
set EXPAND=YES
SET DIRCMD=/O:N
set LglDrv=27 * 26 Z 25 Y 24 X 23 W 22 V 21 U 20 T 19 S 18 R 17 Q 16 P 15
set LglDrv=%LglDrv% O 14 N 13 M 12 L 11 K 10 J 9 I 8 H 7 G 6 F 5 E 4 D 3 C
cls
call setramd.bat %LglDrv%
set temp=c:\
set tmp=c:\
path=%RAMD%:\;a:\;%CDROM%:\
copy command.com %RAMD%:\ > NUL
set comspec=%RAMD%:\command.com
copy extract.exe %RAMD%:\ > NUL
copy readme.txt %RAMD%:\ > NUL

:ERROR
IF EXIST ebd.cab GOTO EXT
echo Please insert Windows 98 Startup Disk 2
echo.
pause
GOTO ERROR

:EXT
%RAMD%:\extract /y /e /l %RAMD%: ebd.cab > NUL
echo The diagnostic tools were successfully loaded to drive %RAMD%.
echo.

IF "%config%"=="NOCD" GOTO QUIT
IF "%config%"=="HELP" GOTO HELP
LH %ramd%:\MSCDEX.EXE /D:mscd001 /L:%CDROM%
echo.
GOTO QUIT

:HELP
cls
call help.bat
echo Your computer will now restart and the startup menu will appear.
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo.
restart.com
GOTO QUIT

:QUIT
echo To get help, type HELP and press ENTER.
echo.
rem clean up environment variables
set CDROM=
set LglDrv=


<><><><><><><><><><><><><><><><><><><><><><>


Logfile of HijackThis v1.99.1
Scan saved at 6:12:40 PM, on 9/6/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\ATITASK.EXE
C:\WINDOWS\SYSTEM\ATICWD32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\ATI\ATIDESK\ATISCHED.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\PROGRAM FILES\OPENOFFICE.ORG1.1.4\PROGRAM\SOFFICE.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\DESKTOP\SPYWARE FIXERS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YT.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Atikey] Atitask.exe
O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
O4 - HKLM\..\Run: [LexStart] Lexstart.exe
O4 - HKLM\..\Run: [LexmarkPrinTray] PrinTray.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [supelek bogiego] c:\my documents\supelek bogiego\supb.exe -spr
O4 - Startup: ATI Scheduler.lnk = C:\ati\atidesk\atisched.exe
O4 - Startup: OpenOffice.org 1.1.4.lnk = C:\Program Files\OpenOffice.org1.1.4\program\quickstart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...nst20040510.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
  • 0

#18
tampabelle
Posted 06 September 2005 - 08:02 PM

tampabelle

    Member 5k

  • Retired Staff
  • 6,363 posts
Lets do this one more time !!!


Please reboot the PC in Safe Mode.

Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.

Reboot the PC in Normal Mode.

Post a fresh HJT log along with smitfiles.txt here
  • 0

#19
omegjs
Posted 08 September 2005 - 06:02 PM

omegjs

    Member

  • Topic Starter
  • Member
  • PipPip
  • 41 posts
smitRem log file
version 2.3

by noahdfear


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run Files Present


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system folder ~~~


oleext.dll


~~~ Icons in system folder ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~



~~~~ wininet.dll ~~~~

wininet.dll Present!!


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Post-run Files Present


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system folder ~~~


oleext.dll


~~~ Icons in system folder ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~



~~~~ wininet.dll ~~~~

wininet.dll Clean!! :tazz:


<><><><><>><><><><><><><><>><><>

Logfile of HijackThis v1.99.1
Scan saved at 7:00:30 PM, on 9/8/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\ATITASK.EXE
C:\WINDOWS\SYSTEM\ATICWD32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\ATI\ATIDESK\ATISCHED.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\PROGRAM FILES\OPENOFFICE.ORG1.1.4\PROGRAM\SOFFICE.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\DESKTOP\SPYWARE FIXERS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YT.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Atikey] Atitask.exe
O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
O4 - HKLM\..\Run: [LexStart] Lexstart.exe
O4 - HKLM\..\Run: [LexmarkPrinTray] PrinTray.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [supelek bogiego] c:\my documents\supelek bogiego\supb.exe -spr
O4 - Startup: ATI Scheduler.lnk = C:\ati\atidesk\atisched.exe
O4 - Startup: OpenOffice.org 1.1.4.lnk = C:\Program Files\OpenOffice.org1.1.4\program\quickstart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...nst20040510.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
  • 0

#20
tampabelle
Posted 08 September 2005 - 06:40 PM

tampabelle

    Member 5k

  • Retired Staff
  • 6,363 posts
Delete the file -

C:\Windows\system\oleext.dll.

Let me know how your PC is behaving now !!!!!
  • 0

#21
omegjs
Posted 08 September 2005 - 07:14 PM

omegjs

    Member

  • Topic Starter
  • Member
  • PipPip
  • 41 posts
It is running so much better. I don't notice the things I did before. The only problem I have is that it is not shutting down completely. It gets to the screen that says windows is shutting down, but it never finishes. Also I was wondering what protection you recommend to help prevent problems like this from happening again. You have been so much help. When I get some money I will not forget to come back and donate some to you through pay pal.
  • 0

#22
tampabelle
Posted 09 September 2005 - 03:21 PM

tampabelle

    Member 5k

  • Retired Staff
  • 6,363 posts
Hi,


I think that the shutdowwn problems are due to driver conflicts.

Unfortunately I cannot pinpoint the issues. However, Microsoft has this page which should help you in trouble shooting the issue - http://support.micro...kb;en-us;202633.

Let me know how it goes.

We can then fine tune your PC for a better performance
  • 0

#23
tampabelle
Posted 24 September 2005 - 06:49 AM

tampabelle

    Member 5k

  • Retired Staff
  • 6,363 posts
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0

#24
tampabelle
Posted 25 September 2005 - 08:51 AM

tampabelle

    Member 5k

  • Retired Staff
  • 6,363 posts
Topic reopened at the request of the user
  • 0

#25
omegjs
Posted 25 September 2005 - 08:05 PM

omegjs

    Member

  • Topic Starter
  • Member
  • PipPip
  • 41 posts
Hello,

Still not sure why computer is not shutting down all the way. But would like to know how to keep spyware and adware off my computer in the future, and you mentioned fine tuning the computer.

Thanks.
  • 0

Advertisements

#26
tampabelle
Posted 26 September 2005 - 07:30 AM

tampabelle

    Member 5k

  • Retired Staff
  • 6,363 posts
Fine tuning was to get adequate protection on your PC to prevent infections in future.

Regarding the problems with shutdown, did you visit the Microsoft page I gave you and try to troubleshoot the issue???
  • 0

#27
omegjs
Posted 26 September 2005 - 08:36 AM

omegjs

    Member

  • Topic Starter
  • Member
  • PipPip
  • 41 posts
I did go to the website you gave me and did what it said. I am thinking it might be something that I have installed, but I recently installed everything (the computer was wiped clean when I bought it). I don't know where to even begin on that one.
  • 0

#28
tampabelle
Posted 26 September 2005 - 03:40 PM

tampabelle

    Member 5k

  • Retired Staff
  • 6,363 posts
Hi,

Could you check the system logs and let me know if any error messages or warnings show up in it ??


For the error logs, click on Start ---> Settings ---> Control Panel.

Double click on Administrative Tools ---> Computer Management.

Click on System Tools ---> Event Viewer.

There are three categories under it. Check the System logs first. Also check if you can find anything in the other two categories.

Specifically look for any errors / warnings around the time of shutdown (or before any boot ups).
  • 0

#29
omegjs
Posted 27 September 2005 - 08:08 PM

omegjs

    Member

  • Topic Starter
  • Member
  • PipPip
  • 41 posts
I don't have an administrative tools icon in the control Panel.
  • 0

#30
tampabelle
Posted 28 September 2005 - 07:29 AM

tampabelle

    Member 5k

  • Retired Staff
  • 6,363 posts
Hi,

My bad. Those instructions are valid only for Windows XP.

Can we ty to run through these suggestions y Microsoft - http://support.micro....com/kb/238096/ ???
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP