[Slimn]

I recently posted these two messages on a different board but haven't gotten a reply yet. Any help at all is greatly appreciated:

I'm running Windows ME and it had been very buggy for about the past week. Yesterday, everything seemed to cascade downhill. I was having registry problems on both sides of signing onto windows and was getting error reports for most everything. Spybot would occasionally work but only look for 55 items. Ad-aware also occasionally worked but found nothing. I was getting so many error reports from my virus protection (McAfee), that I decided to uninstall it and try to reinstall. It had been having trouble with the auto updates and hadn't worked right for about a week. Problem was, I couldn't maintain an internet connection without getting multiple error reports and getting kicked off.

I attempted to rebuild the registry many times but was overwhelmed with registry errors and other error reports to the point where if I clicked on anything, I would get an error. I also tried to work with Hijack! but I may have done more harm than good. I eventually decided to go with a full System Recovery and things are up and running again.

The problems I'm having now are that I still get occasional error reports. When I first got into windows, I opened IE to check the settings. I was surprised to see "www.hpwis" as the home page. I'm in the process of downloading windows updates, Spybot, McAfee, Ad-aware, Hijack!, etc... I just looked at my first new log with Hijack! and "hpwis" is all over it. I'm also getting a Windows script error for "Windows\temp\Laun\Laun.js" when I sign onto windows and noticed that was in the Hijack! log as well. Instead of tinkering myself, I thought I would get some pro advice. Any help and advice is greatly appreciated.



R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.hpwis.com/
R3 - Default URLSearchHook is missing
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Keyboard Manager] C:\Program Files\Netropa\One-touch Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Delay] C:\WINDOWS\delayrun.exe
O4 - HKLM\..\Run: [MotiveMonitor] C:\Program Files\Motive\motmon.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Laun] wscript c:\windows\temp\Laun\Laun.js
O4 - HKLM\..\Run: [HPLogiFinder] \WINDOWS\OPTIONS\CABS\LOGITECH\HP_FINDER.EXE
O4 - HKLM\..\Run: [Adaptec DirectCD] C:\Program Files\ADAPTEC\DIRECTCD\DIRECTCD.EXE
O4 - HKLM\..\Run: [Tour] C:\WINDOWS\wincool.exe /30m
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - Startup: CompuServe 2000 Tray Icon.lnk = C:\CompuServe 2000b\cstray.exe
O4 - Startup: Resume Windows Update Installation.lnk = C:\WINDOWS\Windows Update Setup Files\ie6setup.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O9 - Extra button: Real.com (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://hp.my.yahoo.com
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupd...CAB?38013.96375
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcaf...76/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcaf...,16/mcgdmgr.cab

--------MESSAGE TWO:-------------

My computer is now as bad or worse than it was before I did the system recovery. I get error reports for most everything. I'm able to sign on to the internet for brief periods but then an error report will show up and I either click on it and the program stops or it just stops by itself. I get an error report every single time I click on IE.

Recently, when I do get online, I can't put a cursor into a field. I'm able to click on the address bar and get a cursor to go to a webpage but cannot input anything once I'm there. I've tried to download Virus Scan from McAfee 20+ times but it never finishes without error reports from my internet provider, IE, or McAfee. Last night I tried to get a free online virus scan to work (House Call I think), it loaded to 99% but then I got a error that it couldn't unzip it. I then tried signing up for it's trial virus scan (IC-Pillin?) but couldn't input anything in the required fields to sign up.

I'm at my wit's end as I thought my computer would be factory fresh after the recovery. I've only downloaded Spybot, Ad-aware (won't install), and the trial version of Registry Mechanic. Registry Mechanic works and recently found 24 errors (15 that it will fix in the trial) but I don't think it's fixing anything. It says I have 0 Days even though I just downloaded it. Any advice on what to do would help.

Edited by Slimn, 29 January 2004 - 04:37 PM.

[Advertisements]

Welcome Slimn

Restart Hijack This, check the selected entries, FIX, reboot, and post a new log.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.hpwis.com/
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [Laun] wscript c:\windows\temp\Laun\Laun.js
O4 - HKLM\..\Run: [Tour] C:\WINDOWS\wincool.exe /30m

[admin]

Welcome Slimn

Restart Hijack This, check the selected entries, FIX, reboot, and post a new log.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.hpwis.com/
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [Laun] wscript c:\windows\temp\Laun\Laun.js
O4 - HKLM\..\Run: [Tour] C:\WINDOWS\wincool.exe /30m

[Slimn]

Thanks for the reply Admin. I actually tried another Recovery last night and it didn't go well at all. I kept getting registry errors and was barely in Windows at all before it kicked me out and asked that I boot in DOS mode and run SCANREG. After doing this, I never got back to Windows at all. I just got a distorted HP picture and my computer would shut down by itself.

This morning I tried Recovery #3 and again I kept getting errors from the get go. Shortly into #3 I got a white error that said Explorer has caused an error...You must reinstall Windows.

Fourth times a charm. Recovery #4 went off without a hitch. Windows loaded with zero errors. I was able to install my ISP and then downloaded Mozilla, Spybot, Ad-Aware, and Hijack This. Everything installed and was updated without a single error. I'm still skeptical but everything seems to be running great now.

I ran Hijack and checked the five "hpwis" ones and also the "Tour" program. The "laun" one was only part of the first recovery. I am treating some things differently now. I decided not to update Spybot to include beta versions and I'm also just avoiding IE altogether. A friend recommended Mozilla and it seems to work fine.

Oh, I do have one question regarding Spybot. When I first run it after getting the updates, it finds 72 things wrong. This was the same as Recovery #1, so I wasn't surprised. The difference this time is I only fixed the ones that Spybot automatically checks which was only about 5-6. There's still 60+ red items and I believe they are all "Backweb lite" registry keys and values. Do you think I should go ahead and delete them all or maybe put "Backweb" on my exclude list? I'm thinking it's probably ok to delete them but I'm nervous about messing with anything that has to do with the registry that's at least not automatically checked. I know I've checked everything that Spybot comes up with before and my computer ran well (for the most part) for years. Ad-Aware found 15 problems also and they are all gone. After a reboot, I ran Ad-Aware again and they are truly gone which is nice.

Here's my new log and thanks again for the assistance:

Logfile of HijackThis v1.97.7
Scan saved at 8:06:58 PM, on 1/30/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v5.50 (5.50.4134.0600)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMKEYBD.EXE
C:\WINDOWS\SYSTEM\HPSYSDRV.EXE
C:\PROGRAM FILES\MOTIVE\MOTMON.EXE
C:\WINDOWS\MCBIN\AV\RT\MGAVRTCL.EXE
C:\WINDOWS\OPTIONS\CABS\LOGITECH\HP_FINDER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\PROGRAM FILES\ADAPTEC\DIRECTCD\DIRECTCD.EXE
C:\WINDOWS\RunDLL.exe
C:\COMPUSERVE 2000\CSTRAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\KEYBDMGR.EXE
C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.EXE
C:\WINDOWS\MCBIN\AV\RT\MGAVRTE.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
C:\PROGRAM FILES\BACKWEB\BACKWEB\PROGRAM\BWDELAY.EXE
C:\MY DOCUMENTS\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Keyboard Manager] C:\Program Files\Netropa\One-touch Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Delay] C:\WINDOWS\delayrun.exe
O4 - HKLM\..\Run: [MotiveMonitor] C:\Program Files\Motive\motmon.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [mgavrtclexe] C:\WINDOWS\MCBin\AV\Rt\mgavrtcl.exe
O4 - HKLM\..\Run: [HPLogiFinder] \WINDOWS\OPTIONS\CABS\LOGITECH\HP_FINDER.EXE
O4 - HKLM\..\Run: [HPStart] c:\hp\hpcoach\hpstart.wsf
O4 - HKLM\..\Run: [Adaptec DirectCD] C:\Program Files\ADAPTEC\DIRECTCD\DIRECTCD.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [mgavrtclexe] C:\WINDOWS\MCBin\AV\Rt\mgavrte.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - Startup: CompuServe 2000 Tray Icon.lnk = C:\CompuServe 2000\cstray.exe
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://hp.my.yahoo.com
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcaf...76/mcinsctl.cab

[admin]

Your log looks clean

Sounds like your restore problems may have been due to a dirty and/or scratched CD, else I've also seen a bad CD-ROM drive cause similar problems.

Backweb Lite is used by some legitimate programs to automatically check for available updates. I usually recommend it's removed, because even in these legitimate applications I'd consider it spyware. It'll track your Internet usage and report it to a central server. You'll just have to check for program updates manually every so often.

Just to be on the safe side, click here and run the cleaner. It's great at finding trojans that other programs may have missed.