What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Software

AOL Art Files

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I'm not sure what's going on with my computer. My son and I were doing a school project and printing pictures from AOL Art files. Next thing I know, the computer was really lagging, then locking up. When I logged off AOL, a box would pop up that said, "Please wait while we close AOL Art Files." I did a google search on how to disable art files, and one site said something about an art file "jgdw400.dll". The site said that this file could harm your computer. Well, I ran a seach of my files, and the bad file was listed. The modified date was 5/26/2006. Now here's the funny part… I come to Tom Coyote's site (which, by the way, I just found by chance) and search for others who had a problem with this jgdw400.dll. file and what do I come across?… a person who has a problem with a lagging computer, and his hijack this log showed the same bad file and the same date of 5/26/2006. The same date? Is that of any significance? Does anyone think these art files could be the cause of my problems? This mommy has no clue about this stuff and any help would be VERY much appreciated. Thank you in advance.
Post #2
Hi leshabs,

How much RAM does your machine have?
Are you having this problem on a computer running Windows 98?
Microsoft posts some information about related vulnerabilities, here"
http://www.microsoft.com/technet/security/…n/MS06-022.mspx

The file itself (jgdw400.dll) appears to be legitimate and specific to AOL to facilitate Internet Explorer handling of "files.art" from AOL Art File Support Library.

However, there appear to be "vulnerabilities" that have been exploited, possibly just beginning as recently as this last year in summer 2006.

That the "vulnerabilities" exist, does not mean that your machine has been attacked, only that through the use of AOL Art File Support Library (jgdw400.dll) functions, your machine is "open" to such vulnerabilities to attack.

Additionally, if you are running Windows 98, it is also most likely that your machine itself has low resources, meaning a "slower" CPU and "smaller" amounts of RAM. Both are important for brisk, smooth functioning of your computer, especially when handling graphics (Art).

Your machine could simply be "stalling" because it has low basic resources for a complicated task "AOL .art"
Years ago I was a fan of AOL for a while, but they have made use of there internet portal increasingly complex in their efforts to "customize" their user's experience. Many people still use AOL and AOL utilities, but the cost of "performance" has grown steeply, and AOL has become an increasingly unsatisfactory product to use. It's just too cumbersome to me.

What you could/should do:

1.
You may have run afoul of some malicious programs - of the virus/spyware type.
Please carefully follow the instructions in our Malware Removal forum, here:
http://forums.tomcoyote.org/index.php?showtopic=34502

2.
Since jgdw400.dll all by itself (and possibly worse with other AOL portal utilities) is very "cumbersome", it could be monopolizing most of your system resources, particularly your RAM.
Here's an important "fix" that could help in this particular situation, and will most likely help your machine in general.

Win9x unload DLLs:
Go to Start - Run - type in "REGEDIT" without quotes and press enter. The Registry Editor opens up. Now use the lefthand explorer pane to find this key:
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" In the Righthand pane, right click in an empty space and choose "New… - String Value" and name it: "AlwaysUnloadDll" (without quotes and capital letters are important). Give this new string a value of 1, close the Registry Editor, and reboot Windows.



3.
If you have not fully updated your Windows 98 operating system, Microsoft no longer supports you will updates. Fortunately, there is an excellent and trustworthy source for Windows 98 (SE) updates.
http://exuberant.ms11.net/98sesp.html
Note: This site is for updates to Windows 98 SE (second edition) If your machine is running the earlier Windows 98 prior to SE, then there are no updates available to my knowledge.

4.
Consider uninstalling any all utilities associated with AOL.
Please do not consider this a general broadside bashing of AOL. I am making this recommendation, specifically because you are having difficulty with the AOL product.

Don't hesitate to post back here with any additional questions.
I am mindful that you've described yourself as a Mom helping a child, and that in the process you became overwhelmed. We don't want our "help" to become additionally "overwhelming", so we are glad to assist with step-by-step instructions when asked.


I am also a Windows 98SE user and still relatively happy with it. Others say that it is old and obsolete, which it is. But it's what I have, and I am making the best of it. I'll be glad to help you with yours, if in fact you are running Windows 98SE.

Best Regards
Post #3
At the risk of sounding stupid :unsure: , I think I have 56K RAM (does that sound right?). The problem I'm having is on the computer running Windows 98. I'm not sure if it's Windows 98SE though. I have downloaded most of the updates from Microsoft (especially the critical ones). I've followed your directions about "AlwaysUnloadDll", then gave the data a value of 1. Rebooted my computer and looked to see if the dll file was still there, and it is. I will be leaving for work shortly, so I'm unable to complete the rest of the steps today, but I'd like to thank you in advance for taking the time to help me with this problem. What a wonderful site. TTYS, Beth
Post #4
The steps didnt take as long as I thought it would, so I did the next step. I read the instruction on the Malware removal and realized I had already installed Adaware and Spybot (my sister recommended I do that) and I completed the hijack this download. Here is the log:
By the way, I guess I have Windows SE (lol).

Logfile of HijackThis v1.99.1
Scan saved at 8:22:08 AM, on 01/25/2007
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe
c:\windows\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\GWHOTKEY.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\WINDOWS\STARTER.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\MICROSOFT MONEY\SYSTEM\REMINDER.EXE
C:\PROGRAM FILES\SIBER SYSTEMS\AI ROBOFORM\ROBOTASKBARICON.EXE
C:\PROGRAM FILES\AMERICA ONLINE 7.0\AOLTRAY.EXE
C:\PROGRAM FILES\GREETINGS WORKSHOP\GWREMIND.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\WRSSSDK.EXE
C:\PROGRAM FILES\AMERICA ONLINE 7.0\WAOL.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: (no name) - {EEC1633C-C399-19A6-71D9-37290C4DFE89} - C:\WINDOWS\Ebqgzcvl.dll (file missing)
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Freeprod Toolbar - {77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F} - C:\PROGRAM FILES\FREEPROD TOOLBAR\FREEPROD.DLL (file missing)
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Multi-function Keyboard] GWHotKey.exe
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AdwareAlert] C:\PROGRAM FILES\ADWAREALERT\ADWAREALERT.Exe -boot
O4 - HKLM\..\Run: [SpySweeper] "C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE" /startintray
O4 - HKLM\..\Run: [EnsoniqMixer] C:\WINDOWS\starter.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [winmodem] WINMODEM.101\wmexe.exe
O4 - HKLM\..\RunServices: [KB891711] c:\windows\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [KB918547] C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [Reminder] C:\Program Files\Microsoft Money\System\reminder.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - Startup: America Online 7.0 Tray Icon.lnk = C:\Program Files\America Online 7.0\aoltray.exe
O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: PowerReg Scheduler.exe
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePokerMaster\EmpirePoker\RunEPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePokerMaster\EmpirePoker\RunEPoker.exe (file missing)
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O12 - Plugin for .mid: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .wav: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.aol.com
O16 - DPF: {70522FA2-4656-11D5-B0E9-0050DAC24E8F} - http://download.iwon.com/ct/pm3/iwonpm_5_1,0,2,5.cab
O16 - DPF: {785EA525-5066-495F-ADF6-3B8316515DEF} (Collapse Control) - http://mirror.worldwinner.com/games/v47/co…se/collapse.cab
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://www.taxsimple.com/TSWeb/msrdp.cab
O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} (Live Collaboration) - https://livewc01.custhelp.com/7520-b289h-tu…l/java/RntX.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab


I await your reply :-)
Post #5
No. 56mb of RAM is not likely the amount you have. In fact, it is almost impossible. GoTo: Start - Programs - Accessories - System Tools - System Information The amount of RAM will be listed as an item in the Right-Hand panel Please include that information in your next reply. ___________ Your machine does have a variety of annoying/crippling spyware that is very likely compromising the function of your machine, and possibly giving away important personal information you may have entered in your machine. Please Post a New Topic, over in the Malware Removal forum and copy/paste your HJT Log into the body of that topic, for analysis and recommendations from a Malware Removal expert. ____________________ When you have completed the Malware Removal, please post back here. There are definitely additional steps that we can take from the "systems" perspective here in this Forum. But it would be best to get rid of the Malware first. Best Regards
Post #6
System Information says I have 64 MB of RAM. I will do as you recommend and post my HJT log into that forum. Thank you again, and I'll be back to this topic as soon as I get that malware taken care of.
Post #7
Hi again, I posted my HJT log a few days ago and haven't had a reply as of yet. I've went through the self help area, downloaded Registry Booster and deleted a few files and my computer seems to be running alot more quickly, and without the aol art file problem I was having before. The items I can't fix are: 1. problem with my cursor (arrow). If it sits idle for a few seconds, it locks up. I have to either right click it or jar it to get it to move. Do you think it might be associated with the malware problem I have.? 2. Just happened to go through my buddy list and realized that I have 7 recent buddies (ugh :blink: ) added to my list. They all say "PleaseUpgrade000, PleaseUpgrade001, PleaseUpgrade002" all the way through 006. Ever hear of this.? I fear the worst, but trying to stay optimistic. Thank you again for your anticipated help.
Post #8
Hi leshabs, Please be patient while waiting for your response from Malware Removal. They are all volunteers and very busy, just like the helpers here in "other computer problems". After you get the Malware cleaned up we can take any remaining steps here. Your "mouse cursor" requires input/output and video display resources. Maybe not much, but still just like any other application. If your machine resources are already being called upon by other application routines, there may not be "enough" remaining resources for smooth operation of other routines, even mouse functions. Hopefully, your Malware Removal Expert will help remove any "malicious and unwanted" burdens on your machine resources, then we can address the difficult decisions about what "wanted" applications your machine can handle effectively. Best Regards

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI