What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Scan Log

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Below is the log. Google searches are crazy. When I click on google search ling, other web pages appear other than the one supposed to. I had a mystery toolbar but it is gone. Computer super slow. I used Spybot and it found alot but computer still crazy. Spybot keeps finding something called Pipas.A. What it is it? Please help.



Logfile of HijackThis v1.99.1
Scan saved at 21:01:42, on 06/08/20
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe
C:\PROGRAM FILES\PLUS!\VIRUSCAN\VSHWIN32.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\IMEJP98M.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\ATITASK.EXE
C:\WINDOWS\SYSTEM\ATICWD32.EXE
C:\WINDOWS\STARTER.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\AIM\AIM.EXE
C:\PROGRAM FILES\EARTHLINK TOTALACCESS\TASKPANL.EXE
C:\ATI\ATIDESK\ATISCHED.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\EXIF LAUNCHER\QUICKDCF.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\ﾃﾞｽｸﾄｯﾌﾟ\HIJACKTHIS.EXE

R3 - URLSearchHook: (no name) - {AD938DDD-912F-8622-3657-7F3F6A5A148A} - porka_.dll (file missing)
O2 - BHO: IE_PopupBlocker Class - {656EC4B7-072B-4698-B504-2A414C1F0037} - C:\Program Files\EarthLink TotalAccess\Accelerator\prpl_IePopupBlocker.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Atikey] Atitask.exe
O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [VsecomrEXE] C:\PROGRA~1\PLUS!\Viruscan\VSECOMR.EXE
O4 - HKLM\..\Run: [Vshwin32EXE] C:\PROGRA~1\PLUS!\Viruscan\VSHWIN32.EXE
O4 - HKLM\..\Run: [EarthLink 5.0 Setup] "D:\WIN98\ACCESS\_SETUP.EXE" /C
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [RegShave] C:\Program Files\REGSHAVE\REGSHAVE.EXE /autorun
O4 - HKLM\..\Run: [xxtoolbar] ms-its.exe
O4 - HKLM\..\Run: [SetupExeDll] SysEntry.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [winmodem] WINMODEM.101\wmexe.exe
O4 - HKLM\..\RunServices: [Vshwin32EXE] C:\PROGRA~1\PLUS!\Viruscan\VSHWIN32.EXE /NoSplash
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [AOL Instant Messenger ™] C:\Program Files\Netscape\Communicator\Program\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Mirabilis ICQ] C:\Program Files\ICQ\NDetect.exe
O4 - HKCU\..\Run: [ftbar] sysmon12.exe
O4 - HKCU\..\Run: [cmon14] NukeSpan.exe
O4 - HKCU\..\Run: [E6TaskPanel] "C:\PROGRAM FILES\EARTHLINK TOTALACCESS\TASKPANL.EXE" -winstart
O4 - Startup: ATI Scheduler.lnk = C:\ati\atidesk\atisched.exe
O4 - Startup: Office ｽﾀｰﾄｱｯﾌﾟ.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Exif Launcher.lnk = C:\Program Files\Exif Launcher\QuickDCF.exe
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINDOWS\SYSTEM\E_SRCV03.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .tif: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 85.255.113.123,85.255.112.72
Post #3
Welcome to the forum, that is a sign of a Wareout infection. I don't remember using it on a Windows 98 machine, let's give it a try and see what happens.

thanks LonnyRJones, Swandog46, AutoDad and any others who helped with ths fix.

You may want to print out these instructions for reference, since you will have to restart your computer during the fix.

Please download FixWareout from one of these sites:
http://downloads.subratam.org/Fixwareout.exe
http://www.bleepingcomputer.com/files/lonny/Fixwareout.exe

Save it to your desktop and run it. Click Next, then Install, then make sure "Run fixit" is checked and click Finish. The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal.

At the end of the fix, you may need to restart your computer again.

Finally, please post a fresh HijackThis log, along with the contents of the logfile C:\fixwareout\report.txt

Thanks
Post #4
Thank you very much. I hope I did it correctly. This computer is in Japanese which I don't speak so I have to have my wife translate anything in Japanese. Below are the new logs.



Logfile of HijackThis v1.99.1
Scan saved at 0:00:05, on 06/08/26
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe
C:\PROGRAM FILES\PLUS!\VIRUSCAN\VSHWIN32.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\IMEJP98M.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\ATITASK.EXE
C:\WINDOWS\SYSTEM\ATICWD32.EXE
C:\WINDOWS\STARTER.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\AIM\AIM.EXE
C:\PROGRAM FILES\EARTHLINK TOTALACCESS\TASKPANL.EXE
C:\ATI\ATIDESK\ATISCHED.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\EXIF LAUNCHER\QUICKDCF.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\ﾃﾞｽｸﾄｯﾌﾟ\HJT\HIJACKTHIS.EXE

R3 - URLSearchHook: (no name) - {AD938DDD-912F-8622-3657-7F3F6A5A148A} - porka_.dll (file missing)
O2 - BHO: IE_PopupBlocker Class - {656EC4B7-072B-4698-B504-2A414C1F0037} - C:\Program Files\EarthLink TotalAccess\Accelerator\prpl_IePopupBlocker.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Atikey] Atitask.exe
O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [VsecomrEXE] C:\PROGRA~1\PLUS!\Viruscan\VSECOMR.EXE
O4 - HKLM\..\Run: [Vshwin32EXE] C:\PROGRA~1\PLUS!\Viruscan\VSHWIN32.EXE
O4 - HKLM\..\Run: [EarthLink 5.0 Setup] "D:\WIN98\ACCESS\_SETUP.EXE" /C
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [RegShave] C:\Program Files\REGSHAVE\REGSHAVE.EXE /autorun
O4 - HKLM\..\Run: [xxtoolbar] ms-its.exe
O4 - HKLM\..\Run: [SetupExeDll] SysEntry.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [winmodem] WINMODEM.101\wmexe.exe
O4 - HKLM\..\RunServices: [Vshwin32EXE] C:\PROGRA~1\PLUS!\Viruscan\VSHWIN32.EXE /NoSplash
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [AOL Instant Messenger ™] C:\Program Files\Netscape\Communicator\Program\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Mirabilis ICQ] C:\Program Files\ICQ\NDetect.exe
O4 - HKCU\..\Run: [ftbar] sysmon12.exe
O4 - HKCU\..\Run: [cmon14] NukeSpan.exe
O4 - HKCU\..\Run: [E6TaskPanel] "C:\PROGRAM FILES\EARTHLINK TOTALACCESS\TASKPANL.EXE" -winstart
O4 - Startup: ATI Scheduler.lnk = C:\ati\atidesk\atisched.exe
O4 - Startup: Office ｽﾀｰﾄｱｯﾌﾟ.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Exif Launcher.lnk = C:\Program Files\Exif Launcher\QuickDCF.exe
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINDOWS\SYSTEM\E_SRCV03.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .tif: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 85.255.113.123,85.255.112.72



Fixwareout ver 1.003
Last edited 8/11/2006
Post this report in the forums please

Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\zrgmd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\xedocne
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\gib_ogol
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\repiwoh
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llun
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\23plhps
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\mgcppp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\tesvaf
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\nlcalik


Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
"dmgrz.exe"=-
"csjxw.exe"=-
…

PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, There WILL be legitimate FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.

ｻｻｻｻｻ Search by size and names…

ｻｻｻｻｻ Misc files

ｻｻｻｻｻ
Search five digit cs, dm and jb files
This WILL/CAN also list Legit Files, Submit them at Virustotal
C:\WINDOWS\SYSTEM\CSWPR.EXE 51,217 2006-06-18
C:\WINDOWS\SYSTEM\CSJXW.EXE 51,217 2006-06-18
C:\WINDOWS\SYSTEM\DMGRZ.EXE 44,042 1998-06-12
Post #5
I apologize :( I am supposed to be notified when you post and this did not happen. Looking at your response now.

1) I need to know what this is: C:\WINDOWS\SYSTEM\IMEJP98M.EXE If you do not know, use one or more of these free online scans and post the results for me:

These are probably Wareout, please scan them also and delete them if they scan bad. Strange is that two are new and one is from 1998, I am inluding the dates for you to see and bolded the part you need to scan.
C:\WINDOWS\SYSTEM\CSWPR.EXE 51,217 2006-06-18
C:\WINDOWS\SYSTEM\CSJXW.EXE 51,217 2006-06-18
C:\WINDOWS\SYSTEM\DMGRZ.EXE 44,042 1998-06-12 <<< see the date??

http://virusscan.jotti.org/
http://www.kaspersky.com/scanforvirus
http://www.virustotal.com/flash/index_en.html

2) Windows 98
Open My Computer.
Select the View menu and click Folder Options.
Select the View Tab.
In the Hidden files section select Show all files.
Click OK.

3) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

R3 - URLSearchHook: (no name) - {AD938DDD-912F-8622-3657-7F3F6A5A148A} - porka_.dll (file missing)
O4 - HKLM\..\Run: [xxtoolbar] ms-its.exe
O4 - HKLM\..\Run: [SetupExeDll] SysEntry.exe
O4 - HKCU\..\Run: [ftbar] sysmon12.exe
O4 - HKCU\..\Run: [cmon14] NukeSpan.exe
(next two are Alexa related resource waster, remove them unless Alexa is used)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 85.255.113.123,85.255.112.72

Close all programs but HJT and all browser windows, then click on "Fix Checked"

4) RIGHT Click on Start then click on Explore. Locate and delete these items:

These are Wareout and they may be gone, you must use search to locate, do not miss them if there)

ms-its.exe
SysEntry.exe
sysmon12.exe
NukeSpan.exe

These are also Wareout, make sure you delete them once you are sure they are bad.

C:\WINDOWS\SYSTEM\CSWPR.EXE <<< delete the file
C:\WINDOWS\SYSTEM\CSJXW.EXE <<< delete the file
C:\WINDOWS\SYSTEM\DMGRZ.EXE <<< delete the file

5) Clean the temp stuff, this will help: http://www.helpwithwindows.com/techfiles/clean_hd.html or use Cleanmgr: Start > Run > type "cleanmgr" without the quotes then OK, allow the program to run and remove what Windows finds.
Post a new HJT log, let me know how the computer is running.

Thanks
Post #7
Service load: 0% 100% File: IMEJP98M.EXE Status: OK I scanned the program you were not sure about and it looks ok. Below is the scan. I will continue with your other instructions and then post a final HJT. Thanks. MD5 10875a4bf764f25db78526661515dca9 Packers detected: - Scanner results AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing Fortinet Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing UNA Found nothing VirusBuster Found nothing VBA32 Found nothing
Post #8
Below is the HJT scan. The computer seems to be better. My toolbar used to be locked and I could not unlock it. This happened after the mystery toolbar appeared. But now I have control of my toolbars. Also, google search links used to not work. I would be sent to other pages other than the one I clicked on. Now google searches are working again. Computer still seems slow but that may be because it is old and dial-up is slow. One thing that started around when the computer started really acting weird, the minimize and maximize buttons in the top right look weird. They don't look normal. Also, any clickbox or checkbox on a webpage or elswhere on the computer do not look normal, such as the boxes next to an email in my gmail. There is no box, just some weird symbol. I can click on it to check the box but it just seems weird. I don't know if it is related but I can't figure it out and they are still the same. I hope I was able to delete the ms-its.exe, SysEntry.exe, sysmon.exe, nukespan.exe, cswpr.exe, csjxw.exe and dmgrz.exe. The computer is mostly in Japanese and I could not find the search feature when I went to Start and Explore. I did a manual search and did not find the ms-its, SysEntry, sysmon or nukespan.exe files. I found the other three I am sure and I hope I deleted them. I look forward to your response. Thank you so much. Logfile of HijackThis v1.99.1 Scan saved at 20:58:32, on 06/08/29 Platform: Windows 98 Gold (Win9x 4.10.1998) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe C:\PROGRAM FILES\PLUS!\VIRUSCAN\VSHWIN32.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\SYSTEM\RNAAPP.EXE C:\WINDOWS\SYSTEM\IMEJP98M.EXE C:\WINDOWS\SYSTEM\TAPISRV.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\ATITASK.EXE C:\WINDOWS\SYSTEM\ATICWD32.EXE C:\WINDOWS\STARTER.EXE C:\WINDOWS\LOADQM.EXE C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\AIM\AIM.EXE C:\PROGRAM FILES\EARTHLINK TOTALACCESS\TASKPANL.EXE C:\ATI\ATIDESK\ATISCHED.EXE C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE C:\PROGRAM FILES\EXIF LAUNCHER\QUICKDCF.EXE C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\WINDOWS\ﾃﾞｽｸﾄｯﾌﾟ\HJT\HIJACKTHIS.EXE O2 - BHO: IE_PopupBlocker Class - {656EC4B7-072B-4698-B504-2A414C1F0037} - C:\Program Files\EarthLink TotalAccess\Accelerator\prpl_IePopupBlocker.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [Atikey] Atitask.exe O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe O4 - HKLM\..\Run: [VsecomrEXE] C:\PROGRA~1\PLUS!\Viruscan\VSECOMR.EXE O4 - HKLM\..\Run: [Vshwin32EXE] C:\PROGRA~1\PLUS!\Viruscan\VSHWIN32.EXE O4 - HKLM\..\Run: [EarthLink 5.0 Setup] "D:\WIN98\ACCESS\_SETUP.EXE" /C O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [RegShave] C:\Program Files\REGSHAVE\REGSHAVE.EXE /autorun O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [winmodem] WINMODEM.101\wmexe.exe O4 - HKLM\..\RunServices: [Vshwin32EXE] C:\PROGRA~1\PLUS!\Viruscan\VSHWIN32.EXE /NoSplash O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKCU\..\Run: [AOL Instant Messenger ™] C:\Program Files\Netscape\Communicator\Program\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [Mirabilis ICQ] C:\Program Files\ICQ\NDetect.exe O4 - HKCU\..\Run: [E6TaskPanel] "C:\PROGRAM FILES\EARTHLINK TOTALACCESS\TASKPANL.EXE" -winstart O4 - Startup: ATI Scheduler.lnk = C:\ati\atidesk\atisched.exe O4 - Startup: Office ｽﾀｰﾄｱｯﾌﾟ.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE O4 - Startup: Exif Launcher.lnk = C:\Program Files\Exif Launcher\QuickDCF.exe O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE O4 - Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINDOWS\SYSTEM\E_SRCV03.EXE O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O12 - Plugin for .tif: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
Post #9
Thanks for returning your information and for the feedback. Do us a favor and check another item for us. I think my scanners if see a ghost, but I want to be positive, here is the file:
O4 - HKLM\..\Run: [EarthLink 5.0 Setup] "D:\WIN98\ACCESS\_SETUP.EXE" /C I am highliting the file to scan, it is more than likely ok, but it will not hurt to check.

I rarely run my old Compaq with Windows 98SE on it and might have to boot it to remember the setting. Seems Wareout has changed some of your setting. Let me first say that besides the item I am asking you to verify, the log is clean and there is no sign of Wareout. Here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
http://forums.spybot.info/showthread.php?t=279
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml

See if you can do this in Windows 98 first:
Then go to: IE/Tools/Internet Options/Programs/Reset Web Settings

You can also try an IE repair, but it seems you don't have SE so it might not be available?
For Windows 98 Second Edition:

The IE Repair tool is not present in Add / Remove Programs (Control Panel) and is only available in the Uninstall Dialogue Box. Gazette Reader Michael W. sent me this information about accessing the IE Repair feature for Windows 98 SE:

Click Start -> Programs -> Accessories -> System Tools -> System Information
Click Tools (tool bar) -> Internet Explorer Repair Tool

YOu might find something on this page to help:
http://www.onecomputerguy.com/ie_tips.htm

Let me know if any of that helps.

Thanks…Phil
Post #10
Thank you very much. I will scan the file you are still unsure of tonight and post the result for you to look at. I am sorry for this extremely stupid question. Booting the computer is just shutting it off and turning it on again? I always thought that was what it was and I have already done that but the computer still seems a little weird. You stated I may need to Boot the computer to remember the settings. I assume your other instructions are to see if I can get the computer to reset back to normal. I will try it and let you know. Thanks again.
Post #11

I rarely run my old Compaq with Windows 98SE on it and might have to boot it to remember the setting. Seems Wareout has changed some of your setting

I am say here that I may have to turn on my old computer that I never us any more because I have forgotten may of the basic desktop setting and I may spot something that will help us. :)
Post #13
This is what I get when i scan the D:win98\access\_setup.exe with virusscan.jotti.org:

The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file

I don't know what that means.

I am going to try the other instructions you gave me and get back to you. Thanks.
Post #15
I reset the web settings. Regarding these instructions: Click Start -> Programs -> Accessories -> System Tools -> System Information Click Tools (tool bar) -> Internet Explorer Repair Tool When I go to Programs -> Accessories — there is no system tools and systme info. The minimize and maximize buttons and other check boxes on the computer are still weird. Unless you have any other advice, I will keep working on trying to figure out how to reset my computer settings. Otherwise, the computer is working better. No more toolbar problems or Google search problems and you say the HJT scan does not show anymore spyware/malware. Thank you very much for your help. I will recommend this forum to others.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI