47 replies to this topic

[dianelt]

Computer has been going slow for the past few days and when I ran Search and Destroy it found 7 viruses, six of which were removed sucessfully. The seventh is causing problems. After a scan this appears: Error during check! Xuron55 [Datei C:\WIN98\win.ini kann nicht geoffnet werden. The process is being used by other process] Altnet I've tried several times to remove this Altnet without success. Help!!! I have great faith in you - you've helped me clean up my pc before, and I KNOW you will do it again Thanks in advance Diane

[daparker]

Please see the following thread if you have not received a response to your thread in 5 days:

http://forums.tomcoy...showtopic=31622

[daparker]

Hello and welcome to the forums!

Please download HijackThis from here.

Save it in a convenient permanent folder such as C:\HJT\, double click HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button.
Save the log, and copy its contents here. Most of what it lists will be harmless or essential, don't fix anything yet.

[dianelt]

Hi Daparker!
And thanks for replying to my plight - I really do appreciate your help.
I've followed your instructions and here are the results:Logfile of HijackThis v1.99.1
Scan saved at 10:45:22, on 04/12/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WIN98\SYSTEM\KERNEL32.DLL
C:\WIN98\SYSTEM\MSGSRV32.EXE
C:\WIN98\SYSTEM\MPREXE.EXE
C:\ARCHIVOS DE PROGRAMA\EXECUTIVE SOFTWARE\DISKEEPERLITE\DKSERVICE.EXE
C:\WIN98\SYSTEM\mmtask.tsk
C:\WIN98\EXPLORER.EXE
C:\WIN98\SYSTEM\HIDSERV.EXE
C:\WIN98\LOADQM.EXE
C:\ARCHIVOS DE PROGRAMA\LOGITECH\ITOUCH\ITOUCH.EXE
C:\ARCHIVOS DE PROGRAMA\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\WIN98\SYSTEM\LVCOMS.EXE
C:\WIN98\SYSTEM\STIMON.EXE
C:\ARCHIVOS DE PROGRAMA\ACD SYSTEMS\DEVDETECT\DEVDETECT.EXE
C:\ARCHIVOS DE PROGRAMA\GRISOFT\AVG FREE\AVGCC.EXE
C:\ARCHIVOS DE PROGRAMA\GRISOFT\AVG FREE\AVGEMC.EXE
C:\ARCHIVOS DE PROGRAMA\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\ARCHIVOS DE PROGRAMA\HP\DIGITAL IMAGING\BIN\HPQTRA08.EXE
C:\ARCHIVOS DE PROGRAMA\WLAN\GCONFIG\GCONFIG.EXE
C:\ARCHIVOS DE PROGRAMA\LOGITECH\ITOUCH\KBDTRAY.EXE
C:\ARCHIVOS DE PROGRAMA\YAHOO!\MESSENGER\YMSGR_TRAY.EXE
C:\WIN98\SYSTEM\SPOOL32.EXE
C:\WIN98\SYSTEM\DDHELP.EXE
C:\WIN98\SYSTEM\PSTORES.EXE
C:\WIN98\ESCRITORIO\WINZIP\WINZIP32.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.262.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://es.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\COMPANION\INSTALLS\CPN0\YCOMP5_6_2_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARCHIVOS DE PROGRAMA\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Archivos de programa\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WIN98\SYSTEM\MSDXM.OCX
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\COMPANION\INSTALLS\CPN0\YCOMP5_6_2_0.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WIN98\scanregw.exe /autorun
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Archivos de programa\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\ARCHIV~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [Alogserv] C:\Archivos de programa\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [mdac_runonce] C:\WIN98\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [LVComs] C:\WIN98\SYSTEM\LVComS.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WIN98\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [Camera Detector] C:\ARCHIV~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE -autorun
O4 - HKLM\..\Run: [AVG7_CC] C:\ARCHIV~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\ARCHIV~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\ARCHIV~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Archivos de programa\McAfee\McAfee VirusScan\AVSYNMGR.EXE
O4 - HKLM\..\RunServices: [Hidserv] Hidserv.exe run
O4 - HKLM\..\RunServices: [DkService] C:\Archivos de programa\Executive Software\DiskeeperLite\DkService.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Archivos de programa\Yahoo!\Messenger\ypager.exe -quiet
O4 - Startup: HP Digital Imaging Monitor.lnk = C:\Archivos de programa\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Startup: GConfig.lnk = C:\Archivos de programa\WLAN\GConfig\GConfig.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\COMMON\YHEXBMESES.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\COMMON\YHEXBMESES.DLL
O12 - Plugin for .mp3: C:\ARCHIV~1\INTERN~1\PLUGINS\npqtplugin4.dll
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildt...ter/install.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab27571.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...nst_current.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://213.96.242.94...sCamControl.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: JT's Blocks - http://download.game...ts/y/blt1_x.cab
O16 - DPF: Yahoo! Pyramids - http://download.game...ts/y/pyt1_x.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.co...ad/MsnPUpld.cab
O16 - DPF: Yahoo! Dominoes - http://download.game...ts/y/dot8_x.cab
O16 - DPF: Yahoo! Literati - http://download.game...nts/y/tt4_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.game...ts/y/pote_x.cab
O16 - DPF: Yahoo! MahJong Solitaire - http://download.game...s/y/mjst4_x.cab

Thanks again,
Diane

[daparker]

I notice that you are using more than one antivirus program. This is very dangerous, as multiple AVs can interfere with one another and actually allow MORE viruses to get through. I strongly suggest you either (1) configure only one antivirus program to enable automatic realtime scanning, and leave the rest disabled most of the time, or (2) go to Start -> Control Panel -> Add/Remove Programs and uninstall all but one antivirus program.

[dianelt]

Ok Daparker, but which should I remove and which should I leave???? Help appreciated

[daparker]

I recommend AVG. It does not eat up a lot of system resources and its free!

[dianelt]

Hi Dap Listen I want to remove the other antivirus programs but can you name them for me???? I'm sorry but I'm not at all sure which are antivirus programs and which are not, and I'm afraid of removing something I shouldn't. Sorry to be such a thickie Diane

[dianelt]

oops I'm sorry I repeated my post 3 times but each time I tried I got an error message apologies

[daparker]

It's not your fault about the duplicate posts. We are having some database issues here on the site. I deleted the extra posts. You'll want to go to Start-->Control Panel-->Add/Remove Programs and uninstall an McAfee product you see in there. Let me know if that helps to answer your question about which one to remove.

[dianelt]

Hi Dap Yesssss thanks now I know I have to remove Macafee - Trouble is I've tried about 8 times and it won't go away!!! Each time it says the program hasn't been modified! HELP!!

Edited by dianelt, 15 December 2005 - 07:23 AM.

[daparker]

Do you have the original disks for McAfee?

[dianelt]

Nope I haven't :-(

[daparker]

Well, you will have to work with McAfee on that then. When do you notice the slowness?

[dianelt]

Sorry I didn't answer before but wasn't in over Christmas. It's slow to start up and then it will suddenly go slow during a program at any time - I lose control and it starts making a clicking sort of noise. and all I can do is wait. It happens especially when the printer is switched on.