What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

My computer keeps getting stuck

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #17
Here it is: * DLLCompare Log version(1.0.0.127) Files Found that Windows does not See or cannot Access *Not everything listed here means you are infected! ________________________________________________ C:\PROGRA~1\ACCESS~1\mspcx32.dll Mon 16 Aug 1999 22:22:00 …H. 53,248 52.00 K C:\PROGRA~1\ACCESS~1\HYPERT~1\hypertrm.dll Mon 16 Aug 1999 22:22:00 …H. 491,520 480.00 K C:\PROGRA~1\ACCESS~1\HYPERT~1\hticons.dll Mon 16 Aug 1999 22:22:00 …H. 40,960 40.00 K ________________________________________________ 1,268 items found: 1,267 files (3 H/S), 1 directory. Total of file sizes: 231,264,950 bytes 220.55 M ——————–End log———————
Post #21
The computer has the same problem, it gets stuck (but that can be for other reasons not only because of spy, viruses etc.)
More annoying is the Trojan.StartPage.M that Symantec keeps reporting, I have a few other computers but none report this trojan with Symantec.







Logfile of HijackThis v1.99.1
Scan saved at 21:42:29, on 05/06/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.50 (5.50.4134.0600)
Windows folder: C:\WINDOWS
System folder: C:\WINDOWS\SYSTEM
Hosts file: C:\WINDOWS\hosts

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\SYMANTEC ANTIVIRUS\RTVSCN95.EXE
C:\PROGRAM FILES\SYMANTEC ANTIVIRUS\DEFWATCH.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\TASKMON.EXE
C:\PROGRAM FILES\SYMANTEC ANTIVIRUS\VPTRAY.EXE
C:\PROGRAM FILES\WINAMP\WINAMPA.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\MOUSE\POINT32.EXE
C:\PROGRAM FILES\HUJACKTHIS\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE
C:\WINDOWS\START MENU\PROGRAMS\STARTUP\WINVNC.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\HUJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = wwwproxy.bbc.com:8080
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\HUJACK~1\SPYBOT~1\SDHELPER.DLL (filesize 744960 bytes, MD5 ABF5BA518C6A5ED104496FF42D19AD88)
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exeC:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\vptray.exeC:\PROGRA~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun (filesize 86016 bytes, MD5 61446B66AD4214B5E3FF8A738C34F72B)
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme (filesize 24576 bytes, MD5 1B71907E4665A1EE5188F0458C16F2C3)
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exeC:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [POINTER] point32.exe (filesize 73728 bytes, MD5 CF662CC44E401D07F1284891CC76F807)
O4 - HKLM\..\RunServices: [rtvscn95] C:\PROGRA~1\SYMANT~1\rtvscn95.exeC:\PROGRA~1\SYMANT~1\rtvscn95.exe
O4 - HKLM\..\RunServices: [defwatch] C:\PROGRA~1\SYMANT~1\defwatch.exeC:\PROGRA~1\SYMANT~1\defwatch.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme (filesize 24576 bytes, MD5 1B71907E4665A1EE5188F0458C16F2C3)
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\hujackthis\Spybot - Search & Destroy\TeaTimer.exeC:\Program Files\hujackthis\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: WinVNC.exe
O4 - Startup: Shortcut to WinVNC.lnk = C:\Program Files\ORL\VNC\WinVNC.exe (filesize 208896 bytes, MD5 F4910E28A285A13E642CDFE302E4AD91)
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = bbc.com
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 128.139.6.1,128.
Post #22
There are some weird things going on. Restart your computer in Safe Mode. Press the F8 key until the startup menu appears. Choose the Safe Mode option then press Enter. Wait until it comes all the way up. Now shutdown and restart normal. "copy/paste" a new log file into this thread. When was the last time you ran Scandisk and Defrag?
Post #23
I did scan disk and defrag about a month ago





Logfile of HijackThis v1.99.1
Scan saved at 22:02:32, on 05/06/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.50 (5.50.4134.0600)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\SYMANTEC ANTIVIRUS\RTVSCN95.EXE
C:\PROGRAM FILES\SYMANTEC ANTIVIRUS\DEFWATCH.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\TASKMON.EXE
C:\PROGRAM FILES\SYMANTEC ANTIVIRUS\VPTRAY.EXE
C:\PROGRAM FILES\WINAMP\WINAMPA.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\MOUSE\POINT32.EXE
C:\PROGRAM FILES\HUJACKTHIS\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE
C:\WINDOWS\START MENU\PROGRAMS\STARTUP\WINVNC.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\HUJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = wwwproxy.bbc.com:8080
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\HUJACK~1\SPYBOT~1\SDHELPER.DLL (filesize 744960 bytes, MD5 ABF5BA518C6A5ED104496FF42D19AD88)
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exeC:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\vptray.exeC:\PROGRA~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun (filesize 86016 bytes, MD5 61446B66AD4214B5E3FF8A738C34F72B)
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme (filesize 24576 bytes, MD5 1B71907E4665A1EE5188F0458C16F2C3)
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exeC:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [POINTER] point32.exe (filesize 73728 bytes, MD5 CF662CC44E401D07F1284891CC76F807)
O4 - HKLM\..\RunServices: [rtvscn95] C:\PROGRA~1\SYMANT~1\rtvscn95.exeC:\PROGRA~1\SYMANT~1\rtvscn95.exe
O4 - HKLM\..\RunServices: [defwatch] C:\PROGRA~1\SYMANT~1\defwatch.exeC:\PROGRA~1\SYMANT~1\defwatch.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme (filesize 24576 bytes, MD5 1B71907E4665A1EE5188F0458C16F2C3)
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\hujackthis\Spybot - Search & Destroy\TeaTimer.exeC:\Program Files\hujackthis\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: WinVNC.exe
O4 - Startup: Shortcut to WinVNC.lnk = C:\Program Files\ORL\VNC\WinVNC.exe (filesize 208896 bytes, MD5 F4910E28A285A13E642CDFE302E4AD91)
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = bbc.com
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 128.139.6.1,128.
Post #24
Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Do NOT run a scan yet.


Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.


Then please run Ewido, and run a full scan. Save the logfile from the scan.


Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.
Post #26
The best tool for scanning the system for malware is mwavscan.
It won't fix anything (unless you buy it) but it gives us a report.
If you want, run it.


Click here http://www.mwti.net/download/tools/mwav.exe to download mwavscan.
Double-click it to run it, select all local drives, scan all files, press 'scan' and when it is completed, anything found will be displayed in the lower pane.
Highlight it, CTRL C and paste it in your next reply.
It's going to take a while to scan and if you get a pop-up to buy the program, just X it out.
Post #27
I am sorry it took a long time to reply.
I have tried to dowmload that program you suggested: http://www.mwti.net/download/tools/mwav.exe
but my computer will not open it and let it work, I have tried it a few times, even directly from the company's web page, soon after downloading a Escan program from http://www.mwti.net/ my web page was hijacked and I have pop ups now.
I don't know if it's from the web page or it's that Trojan.StartPage.M that will not be removed.

Should I just Format/ghost the computer or do you still have the patience to continue finding out what this pest is all about?




Logfile of HijackThis v1.99.1
Scan saved at 21:05:18, on 09/06/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.50 (5.50.4134.0600)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\TASKMON.EXE
C:\PROGRAM FILES\WINAMP\WINAMPA.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\MOUSE\POINT32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\HUJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = wwwproxy.bbc.com:8080
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\HUJACK~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: (no name) - {003EA6A0-D92A-11D9-8C6B-00034F0D5045} - C:\WINDOWS\SYSTEM\BJGAD.DLL
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [MailScan Dispatcher] "C:\Program Files\hujackthis\Mwav\LAUNCH.EXE"
O4 - HKLM\..\Run: [sp] rundll32 C:\WINDOWS\TEMP\SE.DLL,DllInstall
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\hujackthis\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: WinVNC.exe
O4 - Startup: Shortcut to WinVNC.lnk = C:\Program Files\ORL\VNC\WinVNC.exe
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = bbc.com
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 128.139.6.1,128.
O18 - Filter: text/html - {54F99382-D925-11D9-8C6B-000378B89A84} - C:\WINDOWS\SYSTEM\BJGAD.DLL
O18 - Filter: text/plain - {54F99382-D925-11D9-8C6B-000378B89A84} - C:\WINDOWS\SYSTEM\BJGAD.DLL
Post #28
Here is also a recent log of viruses from Symantec, note that this pest has disabled Symantec Antivirus and I now have to manual activate and manual scan, I have no live protection. Date,Filename,Virus Name,Virus Type,Action Taken,Computer,User,Original Location,Status,Current Location,Primary Action,Secondary Action,Scan Type 09/06/05 se.dll,Trojan.StartPage,File,Left alone,LIBRARY_,library,C:\WINDOWS\TEMP\,Infected,C:\WINDOWS\TEMP\,Clean virus from file,Quarantine infected file,Manual scan 09/06/05 bjgad.dll,Trojan.StartPage.M,File,Left alone,LIBRARY_,library,C:\WINDOWS\SYSTEM\,Infected,C:\WINDOWS\SYSTEM\,Clean virus from file,Quarantine infected file,Manual scan 06/06/05 gcn.dll,Trojan.StartPage.M,File,Left alone in Quarantine,LIBRARY_,library,C:\WINDOWS\SYSTEM\,Infected,Quarantine,Clean virus from file,Leave alone (log only),Defwatch Scan 06/06/05 m[1].bin,Trojan.StartPage.M,File,Left alone in Quarantine,LIBRARY_,library,C:\WINDOWS\Temporary Internet Files\Content.IE5\7YOCIOO0\,Infected,Quarantine,Clean virus from file,Leave alone (log only),Defwatch Scan 06/06/05 eko.dll,Trojan.StartPage.M,File,Left alone in Quarantine,LIBRARY_,library,C:\WINDOWS\SYSTEM\,Infected,Quarantine,Clean virus from file,Leave alone (log only),Defwatch Scan
Post #29
Where did the About Blank come from :scratch: You have a new infection

Please save these instructions to a text file in Wordpad or print them out because we will be restarting in Safe Mode and you will have no Internet Connection
  • Download CWShredder.
  • Save CWShredder.exe to a convenient location.
  • Please Do Not Use It Yet.
  • Download AboutBuster.
  • Unzip AboutBuster.zip and it will install in it's own folder.
  • Double-click on AboutBuster.exe and then click 'OK' then 'Update'
  • Click "Check For Update" and then "Download Update".
  • Click "Exit"
  • Please Do Not Use It Yet.
Disconnect From The Internet

Boot into Safe Mode:
Restart your computer and tap F8 repeatedly while booting up and choose Safe Mode at the menu.

In Safe Mode Please Clean with CWShredder
  • Please Double-click on CWShredder.exe.
  • Click "Fix ->" and click "OK" at the prompt.
  • CWShredder will scan and clean your system of CWS files.
  • Click "Next->" and then "Exit".
In Safe Mode Please Use AboutBuster
  • Please Double-click on AboutBuster.exe.
  • Click "OK" then "Start" and then "OK" to allow AboutBuster to scan for all bad files.
  • Click "Yes" when About Buster asks if you will allow it to shutdown explorer.exe.
  • Allow AboutBuster to scan for all malicious files.
  • Repeat the scan if it asks to do another.
  • After the scan, click "Save Log". Post the log in your next post as it is necessary to make sure all has been cleaned
  • Then Click "Exit"
This infection often deletes necessary system files.
Reboot your computer back into normal mode so that we can see if any files need to be restored.
  • This infection deletes the windows file, shell.dll.

    If you are using XP,2000, or NT please download shell.dll from here: shell-dll.zip. Once the file is downloaded uncompress the zip file and copy shell.dll to the following locations:
    C:\Windows\system32
    C:\Windows\system

    If you are using Windows 98/ME please download shell.dll from here: shell98-dll.zip. Once the file is downloaded uncompress the zip file and copy shell.dll to the following locations
    C:\Windows\system
  • Download the Hoster from here. Press "Restore Original Hosts" and press "OK". Exit Program. This will restore the original deleted Hosts file.
  • If you have Spybot S&D installed you will also need to replace one file. Go here: Merijn's Files (sdhelper) and download SDHelper.dll. Copy the file to the folder containing you Spybot S&D program (normally C:\Program Files\Spybot - Search & Destroy). Then click Start > Run > regsvr32 "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" and press the OK button
  • If you are using Windows 95, 98, or ME it is possible that the malware deleted your control.exe. Please check for the existence of this file by going to to Merijn Files control.exe and examine where the file should be for your operating system. If the file is missing then download the appropriate file and place it in the proper place according to this information.
  • There are several other files that are not targeted as often as the above, but new copies of them can be downloaded from
    Merijn Files
Online Antivirus Scan
  • Please go to The TrendMicro Housecall website.
  • Allow it to scan and fix anything that it finds.
  • Please Clean out temporary files:
  • Start> Run> then type cleanmgr and click enter
  • Please put a check mark beside Temporary Files, Temporary Internet Files, and Recycle Bin
  • Let cleanmgr scan your system and remove the files indicated
Reboot and Post a New HijackThis Log and your About Buster Log in this thread, using Add Reply to see what is left to clean.
Post #30
I was Scanning with AboutBuster, then it told me it finished the scan and then a box appeared this error:

Run-time error `339`.

Componnent `comctl32.ocx` or one of its dependencies not correctly registered: a file is missing or invalid


I downloaded it again and again but I could not get a report from AboutBuster because this error always appeared at the end.

I did not have any files missing.
The virus scan found 6 trojans but this file se.dll keeps comming back no matter how many times it's deleted.





Logfile of HijackThis v1.99.1
Scan saved at 16:09:16, on 10/06/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.50 (5.50.4134.0600)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\TASKMON.EXE
C:\PROGRAM FILES\WINAMP\WINAMPA.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\MOUSE\POINT32.EXE
C:\PROGRAM FILES\HUJACKTHIS\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\HUJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = wwwproxy.bbc.com:8080
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\HUJACK~1\SPYBOT~1\SDHELPER.DLL
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [MailScan Dispatcher] "C:\Program Files\hujackthis\Mwav\LAUNCH.EXE"
O4 - HKLM\..\Run: [vptray] C:\Program Files\Symantec antivirus\vptray.exe
O4 - HKLM\..\Run: [sp] rundll32 C:\WINDOWS\TEMP\SE.DLL,DllInstall
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\hujackthis\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [CleanUp!] C:\PROGRAM FILES\HUJACKTHIS\CLEANUP40\CLEANUP.exe /WindowsRestart
O4 - Startup: WinVNC.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = bbc.com
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 128.139.6.1,128.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI