What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Where To Start?

23 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Windows 98

I have been running SpyBot, Norton, and AdAware for weeks. By AdAware kept freezing when I asked it to delete items, so I uninstalled it, and tried to re-install it. It says 'checking for previous files (or whatever) and disappears. I can't search for old files using 'start' 'find'; trying to use the 'find' on my computer freezes it. When I use 'alt-cnt-del' it says AdAware (not responding) and I have to 'end task'. Often, when I 'alt-ctrl-del' it tells me WinStat and WinStatKeep are running - this just started.

Here's some of my problems:
Can't delete items; they just stay where ever they are. This applies to the desktop shortcuts as well as programs I don't want.
Can't empty the 'recycle bin'.
Computer won't acknowledge it has an 'a' drive, cd player, printer, etc.
Occassionally, the home page gets redirected.
When I click a link on a webpage, browser freezes (crazy browser and IE6).
I tried to run Trend Micro Scan, but it says an ActiveX setting is wrong, and my security won't allow it to run. I have run this often before. Is something changing my settings? I lowered the security to 'low' and tried again, but it freezes the browser.

I just installed 'BullGuard' and ran a scan, it said I had 1 virus, but didn't identify it.
SpyBot ran clean, so did Norton.

I noticed some QuickTime task has suddenly shown up on my system. I also noticed Window AdStatus is there.

I also can't run WindowsUpdates; when I go to their site, it says preparing to install, but never does anything.

Can I run SpyBot, Norton and BullGuard on the same machine?

Here is my first scan log:

Logfile of HijackThis v1.99.0
Scan saved at 2:47:14 PM, on 2/2/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\RTVSCN95.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\DEFWATCH.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\COMMON FILES\BULLGUARD\BULLGUARD SCAN SERVER\BDSS.EXE
C:\PROGRAM FILES\COMMON FILES\BULLGUARD\BULLGUARD COMMUNICATOR\XCOMMSVR.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\VPTRAY.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\BULLGUARD\VSSERV.EXE
C:\PROGRAM FILES\BULLGUARD\BDMCON.EXE
C:\PROGRAM FILES\BULLGUARD\BGNEWSAG.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\ULEAD SYSTEMS\ULEAD PHOTO EXPRESS 4.0 SE\CALCHECK.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\CRAZY BROWSER\CRAZY BROWSER.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: IYBookmarkHO Class - {8B11A219-80C8-4B42-B558-B8C14D1AA8C4} - C:\PROGRAM FILES\YAHOO!\BROWSER\YBMHO.DLL
O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)
O2 - BHO: (no name) - {1D7E3B41-23CE-469B-BE1B-A64B877923E1} - C:\PROGRA~1\SEARCH~2\SEARCH~1.DLL (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\Norton AntiVirus\vptray.exe
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [DeskAd Service] C:\PROGRAM FILES\DESKAD SERVICE\DESKADSERV.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [Windows AdStatus] C:\PROGRAM FILES\WINDOWS ADSTATUS\WINSTAT.EXE
O4 - HKLM\..\Run: [BullGuard Virus Shield] C:\Program Files\BullGuard\\vsserv.exe
O4 - HKLM\..\Run: [BDMCon] C:\Program Files\BullGuard\\bdmcon.exe
O4 - HKLM\..\Run: [BGNewsAgent] C:\Program Files\BullGuard\\bgnewsag.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [ATIPOLAB] ati2evxx.exe
O4 - HKLM\..\RunServices: [Hidserv] Hidserv.exe run
O4 - HKLM\..\RunServices: [rtvscn95] C:\Program Files\Norton AntiVirus\rtvscn95.exe
O4 - HKLM\..\RunServices: [defwatch] C:\Program Files\Norton AntiVirus\defwatch.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [BullGuard Scan Server] C:\Program Files\Common Files\BullGuard\BullGuard Scan Server\\bdss.exe
O4 - HKLM\..\RunServices: [BullGuard Communicator] C:\Program Files\Common Files\BullGuard\BullGuard Communicator\\xcommsvr.exe
O4 - HKLM\..\RunServices: [BullGuard Live! Init] C:\Program Files\BullGuard\\bdinit.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRAM FILES\YAHOO!\MESSENGER\ypager.exe -quiet
O4 - HKCU\..\Run: [Update Manager] "C:\Program Files\Rogers\Update Manager\UpdateManager.exe" /background
O4 - HKCU\..\Run: [RHSI SHS] "C:\Program Files\Rogers\SelfHealing\SHS.exe" /background
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O15 - Trusted Zone: http://*.windowsupdate.com
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…290/mcfscan.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://dgl.microsoft.com/downloads/outc.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.bigfishgames.com/online/zuma/popcaploader_v5.cab
O16 - DPF: {11818680-FCF6-11D0-9808-0800092A4865} (FormFlow Form Control) - https://www.cbs.gov.on.ca/obra/forms/Codebase/FormCtl.cab
O16 - DPF: {87067F04-DE4C-4688-BC3C-4FCF39D609E7} - http://download.websearch.com/Dnl/T_50099/QDow_AS2.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/…loadcontrol.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/ClickYes…/bridge-c18.cab
O18 - Filter: text/html - {D7806F98-C55E-4555-8ACF-A62EB03AB008} - (no file)

Please help me!!!

Mandy
Post #2
Hi Mandy, Welcome to TomCoyote forum. If you still are looking for help, I will see what I can do. Take what time you need, be careful. When you do an Add Reply, I will get a message.

First, it appears you are running two antivirus programs:
BitDefender Virus Shield
NORTON ANTIVIRUS
This is not a good thing as conflicts between them may leave you much less safe than running one good program and keeping it updated and well maintained. Please choose one antivirus program and either remove one or turn one off so it can not run.

Mandy, one or more of these items indicated the possibility of CoolWebSearch. This may or may not be, but I wish to be sure. Use the link below, review the information then download CWShredder, the download link is in the information. When you open this tool, update it first then make sure you click on FIX, not scan. Please let me know if it located anything.
http://www.bleepingcomputer.com/forums/tutorial47.html

Some items may be running, we must stop that to delete them. Open your Task Manager (click Ctrl, Alt, Delete at the same time) locate then highlite and end process on each of these If they are there.
DeskAd Service
Windows AdStatus
FINDFAST.EXE

The bad files may be hidden, in the link below, follow the instructions for your operating system to enable hidden files:
http://www.xtra.co.nz/help/0,,4155-1916458,00.html


Next open HijackThis and click on SCAN. Then put a check in the box in front of each of these line items. I will offer information in red, make sure not to miss any.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)
DyFuCa/Internet Optimizer
O2 - BHO: (no name) - {1D7E3B41-23CE-469B-BE1B-A64B877923E1} - C:\PROGRA~1\SEARCH~2\SEARCH~1.DLL (file missing)
BlazeFind/SearchRelevancy hijacker
O4 - HKLM\..\Run: [DeskAd Service] C:\PROGRAM FILES\DESKAD SERVICE\DESKADSERV.EXE
O4 - HKLM\..\Run: [Windows AdStatus] C:\PROGRAM FILES\WINDOWS ADSTATUS\WINSTAT.EXE
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
(read the info in the link)
http://computercops.biz/startuplist-1227.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {87067F04-DE4C-4688-BC3C-4FCF39D609E7} - http://download.websearch.com/Dnl/T_50099/QDow_AS2.cab
-WebSearch Toolbar
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/ClickYes…/bridge-c18.cab
-Blazefind Windupdates Adware

Close all programs but HJT and all browser windows then click on "Fix Checked:

RIGHT click on Start, then click Explore. The tree that opens, use it to locate and delete these files or folders:

C:\PROGRAM FILES\DESKAD SERVICE\ >>> folder

C:\PROGRAM FILES\WINDOWS ADSTATUS\ >>> folder

C:\Program Files\Microsoft Office\Office\FINDFAST.EXE > file

Clean Like this: Start, Run type "cleanmgr" without the quotes then ok. Check
and remove anything windows locates.

Empty the recycle bin and restart the computer. Surf a little to see how it's running, then post a new log along with any information you think we should have. Please include the results of the CWS search also.
Use the following two links to stay in the thread.
When replying to your topic, please use the
http://forums.tomcoyote.org/style_images/1/t_reply.gif
button NOT the
http://forums.tomcoyote.org/style_images/1/t_new.gif
button.

Mandy, I am giving these links to you now, wait until after you are all cleaned. I believe some of this bad suff should have been removed by Spybot and Ad-aware. Later, use these links to check to make sure you have the newest version, they are updated and they are configured like it says in the tutorials. Thanks.
Spybot:
http://www.bleepingcomputer.com/forums/tutorial43.html
Ad-aware:
http://www.bleepingcomputer.com/forums/tutorial48.html


Thanks…pskelley
TomCoyote forum
Slyware Warrior
If you get help here consider a donation:
http://tomcoyote.com/donate.php
Post #3 last edited
Mandy, I made an error and deleted your comments, please just go on to the next post, I do apologize. Please try to get me a new log and I will continue after I see what has been removed. We will move slowly a step at a time, Please be patient with yourself. Thanks…pskelley
Post #4 last edited
OK Mandy, :) You have a badly infected computer, you must be patience and do your best to follow directions and we can fix it. Lets look at what you said:

First, I have never heard of BitDefender Virus Shield, I believed I was only running Norton. Iwill try to get rid of it.


Look at all of the BullGuard items in the log, look at this one, I will highlite in red: O4 - HKLM\..\Run: [BullGuard Virus Shield] C:\Program Files\BullGuard\\vsserv.exe
Until you can get a little control of the situation, go into the program and see if you can figure out how to turn it off. I can show you how to remove it, but for now, just shut it down, If you have to look in MSCONFIG and uncheck all BullGuard items, that will stop it from starting.

When I downloaded CWShredder, when I updated it and then tried to install it, when it asked me if I agreed to the Licence, the page kept freezing


It is not unusal to have problems removing bad stuff, it does not want to go and some of the other bad stuff is probably causing this.

We ran CWShredder; it kept saying 'not present' beside the list of files.

MY QUOTE

Mandy, one or more of these items indicated the possibility of CoolWebSearch. This may or may not be, but I wish to be sure.


Mandy, you need to try to read and follow my directions just as I spell them out, I tell you here that there may be no CWS, I am trying to clean your computer and wish to be sure, that is a nasty virus. If CWShredder runs and says there is none, then there is none.

Then we went to HiJackThis, and checked all the items you pointed out. We clicked on 'Fix Checked' and it told us it had fixed 13 problems.


This is a good thing, 13 problems were fixed…lol

Then we went to Start, Explore. The tree came up, but it wouldn't expand the way it usually does.


Not sure about this, but we will work around it until all the bad stuff is gone, You can click on Start then Search then type the name in files and folders. When it locates the item, you right click on it and delete it. You must have the hidden files enabled or else you may not be able to see the bad stuff. It does not want you to find and delete it.

I can't open Internet Explorer, I can't open Crazy Browser, I can't open any games, I can't open excel, etc, etc, etc. I can't open HiJackThis to run a new scan


Humm…we need to find something you can do. I need a new HJT log. If you can't get me one, I suggest you try to find someone to help you. We can fix these malware issues, but not unless you want to. Rather you reformat or not is up to you. I will wait for a new log and continue if you wish.

Thanks…pskelley
TomCoyote forum
Slyware Warrior
Post #5
It co-operated this time! I shut it down completely, and then rebooted it, and now I can open ie, and I ran another hjt scan. Here is the new log:

Logfile of HijackThis v1.99.0
Scan saved at 8:21:44 PM, on 2/4/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\RTVSCN95.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\DEFWATCH.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\COMMON FILES\BULLGUARD\BULLGUARD SCAN SERVER\BDSS.EXE
C:\PROGRAM FILES\COMMON FILES\BULLGUARD\BULLGUARD COMMUNICATOR\XCOMMSVR.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\VPTRAY.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\ULEAD SYSTEMS\ULEAD PHOTO EXPRESS 4.0 SE\CALCHECK.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS.EXE

O2 - BHO: IYBookmarkHO Class - {8B11A219-80C8-4B42-B558-B8C14D1AA8C4} - C:\PROGRAM FILES\YAHOO!\BROWSER\YBMHO.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\Norton AntiVirus\vptray.exe
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [BullGuard Virus Shield] C:\Program Files\BullGuard\\vsserv.exe
O4 - HKLM\..\Run: [BDMCon] C:\Program Files\BullGuard\\bdmcon.exe
O4 - HKLM\..\Run: [BGNewsAgent] C:\PROGRAM FILES\BULLGUARD\bgnewsag.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [ATIPOLAB] ati2evxx.exe
O4 - HKLM\..\RunServices: [Hidserv] Hidserv.exe run
O4 - HKLM\..\RunServices: [rtvscn95] C:\Program Files\Norton AntiVirus\rtvscn95.exe
O4 - HKLM\..\RunServices: [defwatch] C:\Program Files\Norton AntiVirus\defwatch.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [BullGuard Scan Server] C:\Program Files\Common Files\BullGuard\BullGuard Scan Server\\bdss.exe
O4 - HKLM\..\RunServices: [BullGuard Communicator] C:\Program Files\Common Files\BullGuard\BullGuard Communicator\\xcommsvr.exe
O4 - HKLM\..\RunServices: [BullGuard Live! Init] C:\Program Files\BullGuard\\bdinit.exe
O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4\ashServ.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRAM FILES\YAHOO!\MESSENGER\ypager.exe -quiet
O4 - HKCU\..\Run: [Update Manager] "C:\Program Files\Rogers\Update Manager\UpdateManager.exe" /background
O4 - HKCU\..\Run: [RHSI SHS] "C:\Program Files\Rogers\SelfHealing\SHS.exe" /background
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O15 - Trusted Zone: http://*.windowsupdate.com
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…290/mcfscan.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://dgl.microsoft.com/downloads/outc.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.bigfishgames.com/online/zuma/popcaploader_v5.cab
O16 - DPF: {11818680-FCF6-11D0-9808-0800092A4865} (FormFlow Form Control) - https://www.cbs.gov.on.ca/obra/forms/Codebase/FormCtl.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/…loadcontrol.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
Post #6 last edited
OK Mandy, Your HJT log looks good as far as malware goings. I believe many of your problems are being caused by the fact that you are having conflictions with all of the antivirus software your are running. It is suggested that only one program be on a computer at a time. You have three. I will work with you if you wish to clean out two, but you have to let me know what you wish to keep. If you are paying for Norton, then remove the other two. Here is what you have now:

1) Real-time virus scanner component of Norton Anti-Virus Corporate Edition
C:\PROGRAM FILES\NORTON ANTIVIRUS\RTVSCN95.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\DEFWATCH.EXE


2) Avast Anti-virus Suite
O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4\ashServ.exe

3) BitDefender antivirus
http://www.bitdefender.com/index.php

You will need to do this, go into your Add Remove programs and one by one uninstall the two you do not wish to run. The only other thing you can do is open the program and look for a place to turn it off completely. I will stick with you as long as you stay online. Let me know which you want to do. Take your time, don't let this upset you, someone had to install those programs on this computer.
pskelley
Post #7 last edited
After you feel you have either turned the two you do not want to use off or uninstalled them, post a log and I will se if they are gone. If something is left, I may be able to show you how to remove it with HijackThis. Don't forget to refresh your browser when you are waiting or if I post you will not know it. pskelley
Post #8
Okay, I'm trying to do this. With the bitdefender, I think I went to that website once and ran an online scan. I cannot find any reference to it in my Add/Remove program list. However, in my Add/Remove programs, I now have Windows AdServer. Can I remove it from here? When I try to remove Avast, I get an error: RUNDLL Error loading c:\program~1\ …. setiface.dll System cannot find file specified.
Post #9 last edited
Yes, if Windows AdServer is there, uninstall it.

http://www.bullguard.com/productinfo_html.aspx
C:\PROGRAM FILES\COMMON FILES\BULLGUARD\BULLGUARD SCAN SERVER\BDSS.EXE
C:\PROGRAM FILES\COMMON FILES\BULLGUARD\BULLGUARD COMMUNICATOR\XCOMMSVR.EXE
O4 - HKLM\..\Run: [BullGuard Virus Shield] C:\Program Files\BullGuard\\vsserv.exe
O4 - HKLM\..\Run: [BDMCon] C:\Program Files\BullGuard\\bdmcon.exe
O4 - HKLM\..\Run: [BGNewsAgent] C:\PROGRAM FILES\BULLGUARD\bgnewsag.exe
O4 - HKLM\..\RunServices: [BullGuard Scan Server] C:\Program Files\Common Files\BullGuard\BullGuard Scan Server\\bdss.exe
O4 - HKLM\..\RunServices: [BullGuard Communicator] C:\Program Files\Common Files\BullGuard\BullGuard Communicator\\xcommsvr.exe
O4 - HKLM\..\RunServices: [BullGuard Live! Init] C:\Program Files\BullGuard\\bdinit.exe
O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4\ashServ.exe
all of that is stuff is installed with that item

This item:
O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4\ashServ.exe
has probably been uninstalled wrong and that part of it is left, that is why you are getting the message.

You want to decide then if you are going to use NORTON or BULLGUARD then uninstall one of them and post a new log. I will see if I can can clean the rest with HJT. What a mess.
Post #10
Okay, I would like to keep Norton; I have had it for a while and I know how to run it. I just got BullGuard a few days ago, recommended by someone when they heard about my problem. It is a trial copy, good for 90 days. The only thing is, I think it is a firewall as well? Is Norton considered a firewall? Avast is the same thing - a trial version I installed a few days ago. I can get rid of it too, except neither BullGuard or Avast will uninstall properly.
Post #11 last edited
OK Mandy, We have learned a little in the last few days. Remember that you can't just download programs, you have to make sure things will run together, and all of these AV programs conflicting with each other may be many of your problems. I can not say if the Norton software contains a firewall, but if it does not, I can link you to a free version of Zone Alarm that I myself use and install on lots of computers when needed. You understand the version of Norton you have installed is a Corporate version, click on this link and see what it says:
http://www.liutilities.com/products/wintas…brary/defwatch/ What I want you to do is your very best to uninstall the programs you do not want on the computer. Then post a new log, I will look at what is left and advise you. Once you have this multiple AV programs situation somewhat sorted out, then I will give you the link to Zone alarm if you need it. Get your Norton box and see what is installed. I know Norton System Suite also has a firewall, but I know little about this corporate version. In fact I am surprised anyone sold it to you for a home computer. Good luck, when the next log is posted I will be notified. pskelley
Post #12
There are things on my computer that I do not want, but I don't know how to get rid of them. For example, mirc. I used it for a while and hated it, now I'd like to get rid of it. There is an icon for it in 'My Download files', but not in my control panel under Add/Remove. So how do I get rid of programs like that? Then there are programs that come zipped. Once I unzip them and install them, do I keep the zip file too? For example, tonight when I downloaded CWShredder. Now I have it zipped and unzipped; do I keep them both? I have Norton corporate version because my husband used to do work at home, so his office gave us that for the home computer. I update it 2x per week, and it runs every night. I don't know how to uninstall BullGuard and Avast; they won't uninstall from my control panel.
Post #14 last edited
You don't want to see me on this. I'm basically computer illiterate. JOHN

But here's a new hjt scan:
Logfile of HijackThis v1.99.0
Scan saved at 10:25:05 PM, on 2/4/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\NORTON ANTIVIRUS\RTVSCN95.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\DEFWATCH.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\VPTRAY.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\ULEAD SYSTEMS\ULEAD PHOTO EXPRESS 4.0 SE\CALCHECK.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\CRAZY BROWSER\CRAZY BROWSER.EXE
C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS.EXE

O2 - BHO: IYBookmarkHO Class - {8B11A219-80C8-4B42-B558-B8C14D1AA8C4} - C:\PROGRAM FILES\YAHOO!\BROWSER\YBMHO.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\Norton AntiVirus\vptray.exe
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [BullGuard Virus Shield] C:\Program Files\BullGuard\\vsserv.exe
O4 - HKLM\..\Run: [BDMCon] C:\Program Files\BullGuard\\bdmcon.exe
O4 - HKLM\..\Run: [BGNewsAgent] C:\PROGRAM FILES\BULLGUARD\bgnewsag.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [ATIPOLAB] ati2evxx.exe
O4 - HKLM\..\RunServices: [Hidserv] Hidserv.exe run
O4 - HKLM\..\RunServices: [rtvscn95] C:\Program Files\Norton AntiVirus\rtvscn95.exe
O4 - HKLM\..\RunServices: [defwatch] C:\Program Files\Norton AntiVirus\defwatch.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [BullGuard Scan Server] C:\Program Files\Common Files\BullGuard\BullGuard Scan Server\\bdss.exe
O4 - HKLM\..\RunServices: [BullGuard Communicator] C:\Program Files\Common Files\BullGuard\BullGuard Communicator\\xcommsvr.exe
O4 - HKLM\..\RunServices: [BullGuard Live! Init] C:\Program Files\BullGuard\\bdinit.exe
O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4\ashServ.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRAM FILES\YAHOO!\MESSENGER\ypager.exe -quiet
O4 - HKCU\..\Run: [Update Manager] "C:\Program Files\Rogers\Update Manager\UpdateManager.exe" /background
O4 - HKCU\..\Run: [RHSI SHS] "C:\Program Files\Rogers\SelfHealing\SHS.exe" /background
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O15 - Trusted Zone: http://*.windowsupdate.com
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…290/mcfscan.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://dgl.microsoft.com/downloads/outc.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.bigfishgames.com/online/zuma/popcaploader_v5.cab
O16 - DPF: {11818680-FCF6-11D0-9808-0800092A4865} (FormFlow Form Control) - https://www.cbs.gov.on.ca/obra/forms/Codebase/FormCtl.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/…loadcontrol.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
Post #15 last edited
OK Mandy, consider this:

There are things on my computer that I do not want, but I don't know how to get rid of them.
For example, mirc. I used it for a while and hated it, now I'd like to get rid of it. There is an icon for it in 'My Download files', but not in my control panel under Add/Remove. So how do I get rid of programs like that?


If you know how to get to the Downloaded Program files, once you are there, highlite the name of the item, then hit your delete key. You may be asked if you want to delete the item, say yes and click your way out.

Then there are programs that come zipped. Once I unzip them and install them, do I keep the zip file too? For example, tonight when I downloaded CWShredder. Now I have it zipped and unzipped; do I keep them both?


No, once you have unzipped a zip file, you do not need that part. You can even delete the CWShredder now if you wish. I keep mine because I know if I ever get infected it is hard to download it. I just check it for updates. You can put it anywhere you wish. I keep mine on my C drive.

I have Norton corporate version because my husband used to do work at home, so his office gave us that for the home computer. I update it 2x per week, and it runs every night.


I understand, but I do not know if it has a firewall. I would contact Symantec (Norton) support either by phone or email and clear that up before installing another firewall.

I don't know how to uninstall BullGuard and Avast; they won't uninstall from my control panel.


Since this is effecting your security I will help you with this. If you are sure of what you want, and you will post asking me to remove it for you, I will give you instructions. I do wish to see another fresh HJT log before I proceed though. Thanks…pskelley

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI