What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

hijack this log

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
My logfile is below. My questions are about

04 PowerRegScheduler
04 Folder.HTT
07 Disable RegEdit=1
016 UGO20.exe
016 WebP2P
I am not sure of the above although I suspect 07 has hijacked my ability to edit the registry. I was planning to delete all of the above if they do not interfere with essential operations.

As for other entries, I was going to delete all of the R0 entries. Instant Buzz, although I agreed to download it, I did not agree to let it freeze my home page after I uninstalled it. They also have an 09 entry.

O1 and 016 Callwave are also on my delete list.

I would appreciate any feedback you could give me about these items and if I've missed any obvious ones.

Many thanks
meathpark

Logfile of HijackThis v1.99.1
Scan saved at 7:57:38 PM, on 7/20/05
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\CRAZY BROWSER\CRAZY BROWSER.EXE
C:\WINDOWS\DESKTOP\ESSENTIAL EBIZ WEB TOOLS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\Program Files\Copernic Agent\CopernicAgentExt.dll/INTEGRATION_BAND_SEARCHBAR_HTML
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.inet2000.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www2.instantbuzz.com/members.php?us…1747965ee65044c
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.trafficswarm.com/cgi-bin/swarm….319b3183062fa94
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.shareware.us/srchasst.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = INET2000 Internet Explorer
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
O1 - Hosts: 64.211.149.11 www.callwave.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: MonsterHosting.ca Toolbar - {5A098C30-7AF2-48E9-BD7C-4E980D8D1E11} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\MONSTERHOSTING.CA.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: FOLDER.HTT
O4 - Startup: Who I Am In Christ Complete Edition v1.0.lnk = C:\WHOIAM\WHOIAM\WHOIAM\WHOIAM\WHOIAM\WHOIAM.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Search Using Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.dll/INTEGRATION_MENU_SEARCHEXT
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: Instant Buzz - {066040F0-5018-4E15-8AA0-81D36136D989} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: Win32 Classes - file://C:\WINDOWS\Java\classes\win32ie4.cab
O16 - DPF: {E9041F85-3C18-4A7E-A29D-E24F84B79BF1} - http://64.7.220.98/downloads/UGO20.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {5A098C30-7AF2-48E9-BD7C-4E980D8D1E11} (MonsterHosting.ca Toolbar) - http://www.monsterhosting.ca/toolbar/insta…rhosting.ca.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {89D75D39-5531-47BA-9E4F-B346BA9C362C} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by105fd.bay105.hotmail.msn.com/resources/MsnPUpld.cab
Post #2
meathpark,

Wekcome to the forum, sorry about the delay.

What I would like you to do is move HJT to its own folder and post a new log as your system may have changed since your last post. I would not recommend making any changes on your own with HJT as you can make your system inoperable with removing the wrong entries.

DO THIS FIRST
Your HIJACKTHIS program is current, but it is very important that it resides in its own folder.
We will use Hijackthis (HJT) to make changes to your system and HJT will make backups of those changes,
If HJT is not in its own folder, those backups could be lost.

Easy to fix,
* just go to MY COMPUTER > YOUR C:\ DRIVE and create a new folder and name it HIJACKTHIS .
* Now scroll to where you have HJT currently, right click on the HJT icon and select CUT .
* Now open the new folder you just created and right click within that folder and select PASTE .
* Now HJT should reside in C:\HIJACKTHIS\HIJACKTHIS.EXE
Post #3
Dear Ken545
Thank you for your help. Here is my new logfile scan

Logfile of HijackThis v1.99.1
Scan saved at 9:46:12 PM, on 7/30/05
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\Program Files\Copernic Agent\CopernicAgentExt.dll/INTEGRATION_BAND_SEARCHBAR_HTML
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.inet2000.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www2.instantbuzz.com/members.php?us…1747965ee65044c
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.trafficswarm.com/cgi-bin/swarm….319b3183062fa94
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.shareware.us/srchasst.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = INET2000 Internet Explorer
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
O1 - Hosts: 64.211.149.11 www.callwave.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: MonsterHosting.ca Toolbar - {5A098C30-7AF2-48E9-BD7C-4E980D8D1E11} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\MONSTERHOSTING.CA.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: FOLDER.HTT
O4 - Startup: TalkSender.lnk = C:\WINDOWS\MagixRec.exe
O4 - Startup: Who I Am In Christ Complete Edition v1.0.lnk = C:\WHOIAM\WHOIAM\WHOIAM\WHOIAM\WHOIAM\WHOIAM.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Search Using Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.dll/INTEGRATION_MENU_SEARCHEXT
O8 - Extra context menu item: Use webcow on this &Selection - C:\WINDOWS\DESKTOP\ESSENTIAL EBIZ WEB TOOLS\wcie.iemenu2.htm
O8 - Extra context menu item: &Use webcow on this Page - C:\WINDOWS\DESKTOP\ESSENTIAL EBIZ WEB TOOLS\wcie.iemenu.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: Instant Buzz - {066040F0-5018-4E15-8AA0-81D36136D989} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: Win32 Classes - file://C:\WINDOWS\Java\classes\win32ie4.cab
O16 - DPF: {E9041F85-3C18-4A7E-A29D-E24F84B79BF1} - http://64.7.220.98/downloads/UGO20.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {5A098C30-7AF2-48E9-BD7C-4E980D8D1E11} (MonsterHosting.ca Toolbar) - http://www.monsterhosting.ca/toolbar/insta…rhosting.ca.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {89D75D39-5531-47BA-9E4F-B346BA9C362C} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by105fd.bay105.hotmail.msn.com/resources/MsnPUpld.cab
Post #4
meathpark,

Do you use Monster Hosting?? If not than remove that program using the ADD-REMOVE PROGRAMS IN THE CONTROL PANEL.

Run HJT Scan Only, put a checkmark in the following entries, close your browser and any open windows and click on FIX CHECKED.

* O3 - Toolbar: MonsterHosting.ca Toolbar - {5A098C30-7AF2-48E9-BD7C-4E980D8D1E11} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\MONSTERHOSTING.CA.DLL
* O16 - DPF: {5A098C30-7AF2-48E9-BD7C-4E980D8D1E11} (MonsterHosting.ca Toolbar) - http://www.monsterhosting.ca/toolbar/insta…rhosting.ca.cab
Only if you removed Monster Hosting


* R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www2.instantbuzz.com/members.php?us…1747965ee65044c
* O4 - Startup: PowerReg Scheduler.exe
* O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
* O16 - DPF: {E9041F85-3C18-4A7E-A29D-E24F84B79BF1} - http://64.7.220.98/downloads/UGO20.exe
* O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -


Please use the links in my signature to download and install both of the followning free programs.

Spybot Search and Destroy 1.4

* If you have the older version 1.3, remove it via ADD-REMOVE PROGRAMS in the Control Panel.

Go to START/ CONTROL PANEL/ PERFORMANCE AND MAINTAINENCE/ ADD-REMOVE
PROGRAMS scroll to that program and click on REMOVE.

* During Installation, just follow all the defaults.
* Go to MODE and click on ADVANCED MODE.
* Then to SETTINGS / FILE SETS and take the checkmark out of USAGE TRACKS.
* Then to TOOLS/ HOSTS FILE and then on the top click on ADD SPYBOT S & D HOSTS FILES.
* Then to TOOLS/ IE TWEAKS and put a checkmark in LOCK THE HOSTS FILES
* Then check for UPDATES.
* Then to Immunize. then up at the top by the GREEN SIGN, click on IMMUNIZE.
* Then go to the top to SPYBOT and run a FULL SYSTEM SCAN.
* Then to FIX PROBLEMS and fix all it finds.

Then RE-BOOT your computer.


AD-AWARE SE PERSONAL 1.06

If you have an older version of Ad-Aware, no need to uninstall it, it will prompt you to uninstall it during the set up process

* During installation, follow all the defaults.
* Start the program and CHECK FOR UPDATES
* Choose PERFORM FULL SYSTEM SCAN
* Take the checkmark out of SEARCH FOR NEGLIGIBLE RISK FILES
* Run the scan
* When it is done, RIGHT CLICK ON ONE OF THE ENTRIES/ SELECT ALL/ NEXT and let it remove all that if finds.

Now lets run a couple of online virus scanners, have them set to AUTO-CLEAN.

http://housecall.trendmicro.com/
http://www.bitdefender.com/scan/licence.php

When done, post a new log please.
Post #5
Hi

I followed all of these instructions except that regarding Monster Hosting as I DO use them.

I notice callwave is still here. I DO NOT use them and have had trouble trying to get rid of it.

The good news…I got back my browser start page control and my regedit isn't blocked anymore!!! Thank you!

I would still like to get rid of any other 'dead weight' that is obvious below.

meathpark



Logfile of HijackThis v1.99.1
Scan saved at 11:26:30 PM, on 7/31/05
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\Program Files\Copernic Agent\CopernicAgentExt.dll/INTEGRATION_BAND_SEARCHBAR_HTML
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.inet2000.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://statcounter.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.trafficswarm.com/cgi-bin/swarm….319b3183062fa94
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.shareware.us/srchasst.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = INET2000 Internet Explorer
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
O1 - Hosts: 64.211.149.11 www.callwave.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: MonsterHosting.ca Toolbar - {5A098C30-7AF2-48E9-BD7C-4E980D8D1E11} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\MONSTERHOSTING.CA.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: FOLDER.HTT
O4 - Startup: Who I Am In Christ Complete Edition v1.0.lnk = C:\WHOIAM\WHOIAM\WHOIAM\WHOIAM\WHOIAM\WHOIAM.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Search Using Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.dll/INTEGRATION_MENU_SEARCHEXT
O8 - Extra context menu item: Use webcow on this &Selection - C:\WINDOWS\DESKTOP\ESSENTIAL EBIZ WEB TOOLS\wcie.iemenu2.htm
O8 - Extra context menu item: &Use webcow on this Page - C:\WINDOWS\DESKTOP\ESSENTIAL EBIZ WEB TOOLS\wcie.iemenu.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: Instant Buzz - {066040F0-5018-4E15-8AA0-81D36136D989} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {5A098C30-7AF2-48E9-BD7C-4E980D8D1E11} (MonsterHosting.ca Toolbar) - http://www.monsterhosting.ca/toolbar/insta…rhosting.ca.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {89D75D39-5531-47BA-9E4F-B346BA9C362C} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by105fd.bay105.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
Post #6
meathpark,

Glad your doing better, look for the Callwave program in the Add-Remove Programs in the Control Panel. If it is there, uninstall it.

Run HJT and fix the following entries.

* O1 - Hosts: 64.211.149.11 www.callwave.com
* O4 - Startup: PowerReg Scheduler.exe
* O4 - Startup: FOLDER.HTT
* O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -


These 2 may be part of Monster Hosting…if you recognize them, then leave them alone, if not you can fix them
* O8 - Extra context menu item: Use webcow on this &Selection - C:\WINDOWS\DESKTOP\ESSENTIAL EBIZ WEB TOOLS\wcie.iemenu2.htm
* O8 - Extra context menu item: &Use webcow on this Page - C:\WINDOWS\DESKTOP\ESSENTIAL EBIZ WEB TOOLS\wcie.iemenu.htm

Download HOSTER and unzip it to your desktop from here..
Hoster

Close your browser and all open windows, start the program and click on Restore Original Hosts.

Download CCleaner, it will clean out all your temp files and such, a very safe program, But it will delete your cookies, so when you run the program, go to OPTIONS> COOKIES and move the ones you want to keep from the left window to the right window.
http://www.ccleaner.com/

Post a new HJT log and lets see how your doing.
Post #7
Hi,

I've been able to get rid of everything except FOLDER.HTT.

HiJack This can't delete it as it is always running.

This is a very stubborn item that ccleaner does not detect as a startup item. It rechecks itself in the msinfo32 start info even though I have tried to uncheck it several times.

I ran 'find' and discovered folder.htt files in virtually every program I have including my backup WIN98 boot files. Is this normal? Is it only the FOLDER.HTT
(notice the case difference) I have to worry about?

I feel like everytime I uncheck it from the startup programs, something else reloads it. There are several previous 'FOLDER.HTT' entries unchecked in the startup.

I've tried to find a registry key for this but I don't really know where to look. (Now that I have my registry back. Again thank you.) I am comfortable cleaning some simple, obvious things from my registry but leave the unknowns alone.
Logfile of HijackThis v1.99.1

My current logfile is as follows

Scan saved at 11:45:21 AM, on 8/1/05
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\Program Files\Copernic Agent\CopernicAgentExt.dll/INTEGRATION_BAND_SEARCHBAR_HTML
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.inet2000.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://statcounter.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://statcounter.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.shareware.us/srchasst.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = INET2000 Internet Explorer
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: MonsterHosting.ca Toolbar - {5A098C30-7AF2-48E9-BD7C-4E980D8D1E11} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\MONSTERHOSTING.CA.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\RunServices: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - Startup: FOLDER.HTT
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Search Using Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.dll/INTEGRATION_MENU_SEARCHEXT
O8 - Extra context menu item: Use webcow on this &Selection - C:\WINDOWS\DESKTOP\ESSENTIAL EBIZ WEB TOOLS\wcie.iemenu2.htm
O8 - Extra context menu item: &Use webcow on this Page - C:\WINDOWS\DESKTOP\ESSENTIAL EBIZ WEB TOOLS\wcie.iemenu.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {5A098C30-7AF2-48E9-BD7C-4E980D8D1E11} (MonsterHosting.ca Toolbar) - http://www.monsterhosting.ca/toolbar/insta…rhosting.ca.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by105fd.bay105.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
Post #8
meathpark,

Not to worry about the FOLDER HTT at the moment, I am going to do some research on that line.

Let HJT fix these entries, if you use Bitdefender in the future, it will prompt you to download it again

* O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
* O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
* O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab

Outside of these, I see nothing really earthshattering on your log. I want to have someone else at TC to look it over also.

Post a new log when done and if your log is ok, I want to have you install some free programs to help keep the bad guys out along with some tips to keep you safe.

Ken :D
Post #9
Hi,
Here is my most recent logfile after those three deletions. Thanx much!
meathpark

Logfile of HijackThis v1.99.1
Scan saved at 2:34:03 PM, on 8/1/05
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\Program Files\Copernic Agent\CopernicAgentExt.dll/INTEGRATION_BAND_SEARCHBAR_HTML
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.inet2000.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://statcounter.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://statcounter.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.shareware.us/srchasst.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = INET2000 Internet Explorer
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: MonsterHosting.ca Toolbar - {5A098C30-7AF2-48E9-BD7C-4E980D8D1E11} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\MONSTERHOSTING.CA.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\RunServices: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - Startup: FOLDER.HTT
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Search Using Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.dll/INTEGRATION_MENU_SEARCHEXT
O8 - Extra context menu item: Use webcow on this &Selection - C:\WINDOWS\DESKTOP\ESSENTIAL EBIZ WEB TOOLS\wcie.iemenu2.htm
O8 - Extra context menu item: &Use webcow on this Page - C:\WINDOWS\DESKTOP\ESSENTIAL EBIZ WEB TOOLS\wcie.iemenu.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {5A098C30-7AF2-48E9-BD7C-4E980D8D1E11} (MonsterHosting.ca Toolbar) - http://www.monsterhosting.ca/toolbar/insta…rhosting.ca.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by105fd.bay105.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
Post #10 last edited
Meathpark, I am still trying to find info on that line, Just hang in there, I haven't forgotten about you and will most likely be back in the AM with an answer. Outside of that one line, your log looks OK, but just want to make sure. Ken :D
Post #11 last edited
Ok, I am wondering if this is being used when you access MonsterHosting as it helps when you customize a folder or things of that nature. You can read about it here.
http://support.microsoft.com/kb/181689/EN-US/

Make sure that you have windows enabled to show all files and folders and look for it in C:\Windows\Web. If it is in that folder it may be legit.
FOLDER.HTT

SHOW HIDDEN FILES AND FOLDERS

* Click on MY COMPUTER
* Then on your C: Drive
* Then to TOOLS/ FOLDER OPTIONS/ VIEW
* Choose the radio button to SHOW HIDDEN FILES AND FOLDERS
* Take the checkmark out of HIDE EXTENSIONS FOR KNOWN FILE TYPES
* Then APPLY/ OK

* Don't forget to reverse this once your computer is clean

You can prevent it from starting up by going to START> RUN> MSCONFIG> STARTUP and if you see it in there you can take the checkmark out of the box and hit apply>ok. Next time you start windows it may tell you that you have selected SELECTIVE STARTUP, say ok and not to ask you again.

Then run HJT Scan Only and if that line is present you can fix it with HJT.

Then post a new log and let me know how things are running on your system.

Ken :D
Post #12
Hi again,

I have tried several time to uncheck this FOLDER.HTT but it simply rechecks itself each time I reboot for the new config settings to take effect.

The file you mentioned in C:\Windows\Web is there as Folder.htt

Again, notice the case difference.

I know FOLDER.HTT doesn't belong in Startup as I have always tried to keep it down to 4 items. I'm pretty sure it showed up about the time my regedit got hijacked which was a few months ago.

So, it doesn't seem to be harming me but I think something is 'lurking'.

I also downloaded and viewed processes with ProcView (as advised by the HiJack This program when it couldn't fix it). ProcView didn't find this file. You can download the program here. Maybe you'll understand it better than I do.

http://www.ltn.lv/~kblums/download/

Using 'find' also only comes up with the folder.htt and Folder.htt files which according to the microsoft site are usually valid. It does not find FOLDER.HTT.


Bottom line is my known problems are solved. Thank you, and I will make a donation. Thanx for all of your efforts! I'll repost if I ever figure it out.

:wavey:
meathpark

FYI……

Logfile of HijackThis v1.99.1
Scan saved at 11:31:02 PM, on 8/1/05
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\CRAZY BROWSER\CRAZY BROWSER.EXE
C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\Program Files\Copernic Agent\CopernicAgentExt.dll/INTEGRATION_BAND_SEARCHBAR_HTML
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.inet2000.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://statcounter.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://statcounter.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.shareware.us/srchasst.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = INET2000 Internet Explorer
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: MonsterHosting.ca Toolbar - {5A098C30-7AF2-48E9-BD7C-4E980D8D1E11} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\MONSTERHOSTING.CA.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - Startup: FOLDER.HTT
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Search Using Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.dll/INTEGRATION_MENU_SEARCHEXT
O8 - Extra context menu item: Use webcow on this &Selection - C:\WINDOWS\DESKTOP\ESSENTIAL EBIZ WEB TOOLS\wcie.iemenu2.htm
O8 - Extra context menu item: &Use webcow on this Page - C:\WINDOWS\DESKTOP\ESSENTIAL EBIZ WEB TOOLS\wcie.iemenu.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {5A098C30-7AF2-48E9-BD7C-4E980D8D1E11} (MonsterHosting.ca Toolbar) - http://www.monsterhosting.ca/toolbar/insta…rhosting.ca.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by105fd.bay105.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
Post #13 last edited
Good Morning Meathpark,

Re: O4 - Startup: FOLDER.HTT

The concencous that I am getting about this file is that it is a legit windows file. Do you have windows enabled to show all files and folders? If you do, reverse it and see if it shows up on your HJT log. This is supposed to be a hidden windows file. From what I have been reading, some viruses will infect this file, as long as your anti virus programs don't pick it up as a virus, it most likely is ok. When you ran the online virus scanners, you never mentioned if it picked that line up. So if it didn't, your likely ok.

This is just a shot in the dark but look in your startup folder and if it is in there delete it.

C:\Windows\Start Menu\Programs\Startup

Ken :D
Post #14
Hi,
That did it! It is a hidden file but it showed up in my log even when windows was set to hide those files. After deleting it, it no longer shows up. (I guess the upper case font was due to DOS?? It showed Folder.htt in the Startup file.)

Question, can I safely delete the desktop.ini file in the Start Up folder. It seems to go with the FOLDER.HTT according to microsoft and the previous instances of this. This file is still rechecking itself when I reboot.

Your help has been awesome. Thank you!

Logfile of HijackThis v1.99.1
Scan saved at 9:44:58 AM, on 8/2/05
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\Program Files\Copernic Agent\CopernicAgentExt.dll/INTEGRATION_BAND_SEARCHBAR_HTML
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.inet2000.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://statcounter.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://statcounter.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.shareware.us/srchasst.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = INET2000 Internet Explorer
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: MonsterHosting.ca Toolbar - {5A098C30-7AF2-48E9-BD7C-4E980D8D1E11} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\MONSTERHOSTING.CA.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Search Using Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.dll/INTEGRATION_MENU_SEARCHEXT
O8 - Extra context menu item: Use webcow on this &Selection - C:\WINDOWS\DESKTOP\ESSENTIAL EBIZ WEB TOOLS\wcie.iemenu2.htm
O8 - Extra context menu item: &Use webcow on this Page - C:\WINDOWS\DESKTOP\ESSENTIAL EBIZ WEB TOOLS\wcie.iemenu.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {5A098C30-7AF2-48E9-BD7C-4E980D8D1E11} (MonsterHosting.ca Toolbar) - http://www.monsterhosting.ca/toolbar/insta…rhosting.ca.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by105fd.bay105.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
Post #15
meathpark, Good Job :thumbup: Does desktop.ini show as a shortcut in your startup folder. Do you no what I mean by a shortcut, it will have the little arrow on it like some of the icons on your desktop. If it is shortcut, then you can delete it, if not, leave it alone until I check on it further. If you delete it, it will go into your recycle bin. Is the folder.htt in your recycle bin? Don't go away, as soon as we clear up this issue, you will be good to go and I have some tips and free programs for you to install that will help keep all the riff raff out of your system. Ken :D

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI