What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Internet Explorer

17 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
My Internet Explorer has been recently hanging when accessed initially or after several searches. Receive error message "…Cannot find server or DNS Error Internet Explorer…" after several minutes in waiting mode. Suspect a conflict between a recent update with Zonealarm and Norton Internet Security on or around 5/27/04.

This issue is driving me batty!

Please see my scan results below:

Logfile of HijackThis v1.97.7
Scan saved at 12:42:35 AM, on 6/5/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\WINDOWS\System32\PackethSvc.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\APC\PowerChute Business Edition\agent\pbeagent.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Norton Internet Security\ccPxySvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\AIM95\aim.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\AOL Companion\companion.exe
C:\WINDOWS\System32\devldr32.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Adaptec\USBControl\Ausbctrl.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Microsoft Office\Office\1033\msoffice.exe
C:\Program Files\America Online 9.0\waol.exe
C:\Program Files\America Online 9.0\shellmon.exe
C:\Program Files\America Online 9.0\aolwbspd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\unzipped\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.net
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxycfg.netsetter.com/gencfg.asp?i…p=1&nsv=[removed]
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.gateway.net/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: USBControl.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Encarta Encyclopedia (HKLM)
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia (HKLM)
O9 - Extra button: Define (HKLM)
O9 - Extra 'Tools' menuitem: Define (HKLM)
O9 - Extra button: AOL Instant Messenger (SM) (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: MoneySide (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Sametime Meeting Toolkit ST25 - file://C:\WINDOWS\Java\ControlF1\STMeeting25.cab
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\DoMore\DoMoreRunExe.CAB
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…director/sw.cab
O16 - DPF: {2A91A4B4-B0A8-44D9-A63F-7C2AABA5C6B0} (DoMoreControl.DoMore) - file://C:\Program Files\Gateway\DoMore\DoMoreControl.CAB
O16 - DPF: {3CC943C7-3C99-11D4-8135-0050041A5144} (RunExeActiveX.UserControl1) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…7865.3009837963
O16 - DPF: {EC8C56B1-D027-4AB2-AF63-F845CCEE59B5} (DocumentAccessor Class) - https://billmanager.aol.com/billmanager/ins…loginHelper.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{958F51BF-77A1-478B-813D-7F3BE048EEAE}: NameServer = 205.188.146.146
Post #2
Hi tank,

Welcome to TomCoyote Forums. Thanks for your patience in waiting for us to get to your log; as you have seen there are MANY logs and few helpers. We appreciate your courtesy.

First, open your Control Panel and click on the "Add/Remove programs" icon. If there are any programs you DO NOT BOTH RECOGNIZE AND WANT, DELETE THEM! (DO NOT delete your Windows and Internet Explorer updates, which are listed with a "Q" and a bunch of numbers.) Then reboot your computer.

Now, download and run Spybot-Search&Destroy and Ad-Aware; they are the standard programs for finding and cleaning crapware off your system, and can also help prevent its downloading and installation in some cases. Here are links to both programs, and instructions for their proper configuration and use.

Get Spybot - Search & Destroy from http://security.kolla.de (This is the NEW Version 1.3)
Get AdAware 6 from http://www.lavasoft.de/support/download

Download and install these programs in their own PERMANENT folders if you don't already have them. If you do have them, make sure they are UPDATED AND CONFIGURED AS DESCRIBED.

To run Spybot S&D:

After installing first press "Online", click on "Search for Updates", then select all updates. Beside the download button is a little down-pointed arrow, which gives you a choice of several download sites; select one of the servers listed (the Australian server usually works well). Now, press "Download Updates." If that site doesn't work or you get an error message, try a different server.

When the updates are finished, close your browser and ALL WINDOWS EXCEPT THE ONE SPYBOT IS RUNNING IN, then press 'Check for Problems'; THE SCAN WILL TAKE SEVERAL MINUTES. Have SpyBot remove all it finds THAT ARE MARKED IN RED. When it's finished, reboot your system.

Then, Run ADAWARE:

Before you scan with AdAware, check for updates of the reference file by using the "webupdate" button at the lower right of the panel. The current ref file should read at least 01R315 06.06.2004 or a higher number/later date. Updates for this program come out frequently to keep up with new malware. THIS IS CRITICAL; updating is as important as installing these programs.

Then ……..
Make sure the following settings are made and on ——-"ON=GREEN"
From main window :Click "Start" then " Activate in-depth scan"

then……
click "Use custom scanning options>Customize" and have these options ON: "Scan within archives" ,"Scan active processes","Scan registry", "Deep scan registry" ,"Scan my IE Favorites for banned URL" and "Scan my host-files"

then………
go to settings(the gear icon on top of AdAware)>Tweak>Scanning engine and click "Unload recognized processes during scanning" ………..then…….."Cleaning engine" and "Let windows remove files in use at next reboot"

then…… click "proceed" to save your settings. To scan, click NEXT. This scan will also take several minutes.

When the scan is finished, mark everything for removal and get rid of it. (Right-click the window and choose"select all" from the drop down menu) then press "next" and then say yes to the prompt, "do you want to remove all these entries?" Reboot again.

After you have run them, run HijackThis. CLOSE YOUR BROWSER AND ALL WINDOWS EXCEPT THE ONE IT'S RUNNING IN, and put a check in the box at the left end of ONLY the line below. (It may not still be there if you have run those programs. Then click on FIX CHECKED and let it run.

(THIS IS A TROJAN)
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe

When the program finishes, reboot into SAFE MODE (press F8 after the BIOS loads). Be sure you are configured to SHOW ALL FILES AND FOLDERS, including System and Hidden Files. If you don't know how to do that, follow this link http://www.xtra.co.nz/help/0,,4155-1916458,00.html and follow the step-by-step directions for your Windows version.

Now find and DELETE the following file (IF it's still there):

C:\WINDOWS\Updreg.exe

REBOOT into Normal Mode and post a fresh log so we can see what else may be needed.

As for any conflict between Norton and Zone Alarm, do you have BOTH their firewall programs running? I'm not familiar with what features can be turned off in the Norton suite, and which can't. It's usually best to have only ONE firewall or Anti-Virus program running at a time, so you might want to consider disabling one or the other and seeing if the problem goes away. If it does, the answer is obvious. Please mention what happened in your next post.
Post #3
:rofl:

Hi k3dc,

Thank you for the nice welcome to TomCoyote Forums. My Internet Explorer is still giving me issues, however, I think I may have added to the issue.

First off: I followed your instructions very carefully:

Executed Spybot: nothing found
Executed Adaware (with adjusted settings): three issues found and deleted and did a system restore
Ran Hijackthis and checked the Trojan (updreg.exe)
Ran Windows in Safe Mode and deleted the Trojan (updreg.exe)
Rebooted into Normal Mode

Checked Internet Explorer which seemed to be back to normal, however, after several successful different website drill downs finally received a ZoneAlarm msg on Internet Explorer stating that ZoneAlarm had detected a problem with my installation, and therefore has restricted Internet access from my PC for protection.

Latest Potential Gaffe:

I had already removed ZoneAlarm from my PC, however, I did note it was on my Hijackthis which I then promptly deleted (e.g., at the time it made logical sense). As a result of this action (possibly a mistake on my part due to a rising frustration level) I now cannot bring up anything on Internet Explorer: receive cannot find server msg immediately

Please note what I deleted from HijackThis:

O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe

Please note my latest HijackThis AFTER the above delete of the Zone Labs Client:

Logfile of HijackThis v1.97.7
Scan saved at 11:03:43 PM, on 6/9/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\WINDOWS\System32\PackethSvc.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\APC\PowerChute Business Edition\agent\pbeagent.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Norton Internet Security\ccPxySvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\devldr32.exe
C:\PROGRA~1\AIM95\aim.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\AOL Companion\companion.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Microsoft Office\Office\1033\msoffice.exe
C:\unzipped\hijackthis\HijackThis.exe
C:\unzipped\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.net
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.gateway.net/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Encarta Encyclopedia (HKLM)
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia (HKLM)
O9 - Extra button: Define (HKLM)
O9 - Extra 'Tools' menuitem: Define (HKLM)
O9 - Extra button: AOL Instant Messenger (SM) (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: MoneySide (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Sametime Meeting Toolkit ST25 - file://C:\WINDOWS\Java\ControlF1\STMeeting25.cab
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\DoMore\DoMoreRunExe.CAB
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…director/sw.cab
O16 - DPF: {2A91A4B4-B0A8-44D9-A63F-7C2AABA5C6B0} (DoMoreControl.DoMore) - file://C:\Program Files\Gateway\DoMore\DoMoreControl.CAB
O16 - DPF: {3CC943C7-3C99-11D4-8135-0050041A5144} (RunExeActiveX.UserControl1) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…7865.3009837963
O16 - DPF: {EC8C56B1-D027-4AB2-AF63-F845CCEE59B5} (DocumentAccessor Class) - https://billmanager.aol.com/billmanager/ins…loginHelper.cab

Thank you in advance for your attention on this matter and I promise to keep my delete paws off my HijackThis going forward.
Post #4
Hi tank,

Well, we're now in DAMAGE CONTROL mode. Start HijackThis and open the Quarantine file. Select the entry you should not have deleted, and mark it. Follow the prompts to RESTORE it, and you should be out of trouble.

If this is not detailed enough, please let me know and I'll provide step-by-step instructions. The main thing is, DO NOT DELETE THAT QUARANTINE FOLDER! As long as it's there, you can get back to Square One.
Post #5
Hi K3dc, :huh: Thanks again for the timely help, I will do the restore to Hijackthis this evening to get back to square one. Yes, I got carried away, my fault on this (and I am a stickler for following instructions). I will keep you posted with the Zonealarm conflict that interfered with my Internet Browser and surfaced after the Trojan was moved. Bye for now, Tankengine
Post #6
Hi tank,

Just a bit of information; that O4 entry was for a "client." That makes me think it was set up to receive your incoming email from the ISP and act as a local host for Internet Explorer. Did you change your IE account settings to include a "Localhost" when you installed ZoneAlarm? I know I did that with my McAfee, so it makes me wonder. The more I think about it, the more I'm convinced this is your problem.

If you uninstalled ZoneAlarm, that file was probably deleted even before you zapped the O4 entry. Look and see if the Zone Labs folder (C:\PROGRAM FILES\ZONELA~1\ZONEAL~1\) is there or not. If it IS gone, there's no need even trying to restore the HJT entry. If it is there, see if "zlclient.exe' is in it.

If it's not there you have no choice except restoring your IE settings back to where they were prior to installing ZoneAlarm. Your ISP's Customer Service should be able to give you the browser settings if you don't remember them.

The good news out of all this is, this seems to be a conflict in your browser settings, not a malware problem. That's really good, because they're stable and easier to cure.
Post #7
Hi K3dc, I think I still have "zlclient.exe" in my trash can. If I restore it and fix the Hijackthis entry will I be OK? I do not remember changing my IE account settings for the original ZoneAlarm install. If I can find the Browser settings in the above zlclient how would I go about the re-entry process? As you can see my first preference is not to go to the ISP Customer Service to obtain those Browser settings. Obviously, you mean AOL here, not MicroSoft for Internet Explorer. On the otherhand, I will do what you think is best under the circumstances. Thanks again for your "Johnny on the Spot" timely input. Warm regards, Tankengine
Post #8
HI tank, If it's there, try it- you can't lose anything. IF you uninstalled ZoneAlarm you might have to completely reinstall ZoneAlarm to get it to work, because the Registry entries that tell Windoze where it is may have gotten deleted. Give it a go- nothing ventured, nothing gained.
Post #9
Hi K3dc, Where would drop in those IE settings from the zlclient? Sounds like I cannot do it with a reinstall of ZoneAlarm??? I hate to reinstall ZoneAlarm because it was preventing me from bringing up AOL after my last incremental update on 5/27. Hey, if calling AOL to obtain the IE settings is the way to go, I will do just that. I now realize that when it comes to all this protective software, less is indeed more. Further note, my Internet Explorer issues (e.g., Trojan) also surfaced coincidently after that 5/27 update of Zonealarm. Hence, the reason for my "deep six" of this package. Besides as you correctly pointed out, why have two firewalls (already have Norton Internet already)? Well what do you think K3dc? Warm regards, tankengine
Post #10
Hi Tank,

Well, I know ZoneAlarm has always been clean; something like that would destroy their reputation, and their business as well. Simetimes when you visit a site, you get more than you bargained for because other things also download, either from that site or from others. We call it "Drive-by Downloads", and it's a real problem. Usually it has to do with a person's settings being too loose on Active-X controls.

One infection famous for that is the CoolWebSearch parasite; it often installs through a flaw in Microsoft Java's handling of Active-X controls. Since Microsoft no longer even supports their version of Java, I personally recommend uninstalling it and getting Sun Microsystems' version. It's not only still supported by the company, it's a more secure implementation of Java in the first place. It's also FREEWARE. That's what I did, and I have NO REGRETS about it. Here's a link to it: http://java.com/en/index.jsp Just remember to uninstall M$ Java first, and reboot before installing SunJava.

To sum it up, I don't think Zone Labs would ever put out an infected product. I could be wrong, but I'd bet money on it.

Unfortunately, this does nothing to help your situation. I suppose you are going to have to bite the bullet and ask AOL to help get your email account straightened up again. They get such requests all the time, it won't be unusual to them at all. They should be able to give you the settings in a minute or two, and you may even be able to set it on line for you.

Open your browser, go to AOL's home page and find the HELP tab- then you should be able to get someone to help you through a chat connection with Tech Support. Don't call them on the phone, that takes all night and often costs money, while the online support is free.

Good luck.
Post #11
:scratch:

Hi K3dc,

What you mentioned regarding Drive-by Downloads may very well have introduced my IE issue when I performed the incremental update of ZoneAlarm on 5/27. You are right, ZA business is to protect your PC, therefore, not being clean would be beyond blasphemy. I am just down right frustrated because I can closely trace when, but not why, my issues commenced with not being able to bring up AOL initially followed by the IE issue you are now painfully aware of.

I will follow-up on your suggestion on installing the Sun Microsystems' version of Java after I tackle this IE issue first.

Latest news: I was able to restore the Zone Labs folder (C:\PROGRAM FILES\ZONELA~1\ZONEAL~1\) as well as the the HJT entry as you first suggested. Now when I open up the Internet Explorer I receive the following immediately:

Zone Labs:VSM Mon - Lockup Server - Microsoft Internet Explorer.

Because I no longer have the ZA application interface available I cannot easily address this via Windows (as per their instructions). I am forced to follow the following:

Advanced instructions:

You have been taken to this area if you have tried previous steps to restore Internet access and have been unsuccessful. Thank you for your patience.

Removal will require using Safe Mode and editing the registry. If you are not comfortable using these, you should seek out someone more knowledgeable in their use. Please click here to view the instructions necessary to restore Internet access. This will take approximately 15 minutes.

If you are unable to complete these steps yourself, you may contact Zone Labs Technical Support via fax at 415/343-0057. Someone will contact you as quickly as possible and in the order your fax was received and will follow the exact steps above with you by phone.

How does the above sound by you? I cannot click here when in IE (for the Safe Mode part) for obvious reasons, so I will use the AOL browser. Included my latest HJT (for the record):

Logfile of HijackThis v1.97.7
Scan saved at 12:56:10 AM, on 6/11/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\PackethSvc.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\APC\PowerChute Business Edition\agent\pbeagent.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Norton Internet Security\ccPxySvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\AIM95\aim.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\AOL Companion\companion.exe
C:\WINDOWS\System32\devldr32.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Microsoft Office\Office\1033\msoffice.exe
C:\Program Files\America Online 9.0\waol.exe
C:\Program Files\America Online 9.0\shellmon.exe
C:\Program Files\America Online 9.0\aolwbspd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\WINDOWS\msagent\AgentSvr.exe
C:\unzipped\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.net
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxycfg.netsetter.com/gencfg.asp?i…p=1&nsv;=[removed]
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.gateway.net/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Encarta Encyclopedia (HKLM)
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia (HKLM)
O9 - Extra button: Define (HKLM)
O9 - Extra 'Tools' menuitem: Define (HKLM)
O9 - Extra button: AOL Instant Messenger (SM) (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: MoneySide (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Sametime Meeting Toolkit ST25 - file://C:\WINDOWS\Java\ControlF1\STMeeting25.cab
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\DoMore\DoMoreRunExe.CAB
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…director/sw.cab
O16 - DPF: {2A91A4B4-B0A8-44D9-A63F-7C2AABA5C6B0} (DoMoreControl.DoMore) - file://C:\Program Files\Gateway\DoMore\DoMoreControl.CAB
O16 - DPF: {3CC943C7-3C99-11D4-8135-0050041A5144} (RunExeActiveX.UserControl1) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…7865.3009837963
O16 - DPF: {EC8C56B1-D027-4AB2-AF63-F845CCEE59B5} (DocumentAccessor Class) - https://billmanager.aol.com/billmanager/ins…loginHelper.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{958F51BF-77A1-478B-813D-7F3BE048EEAE}: NameServer = 205.188.146.146

Bye for now,
Tankengine
Post #12
Hi K3dc, Was able to obtain instructions to remove ZoneAlarm, please let me know if I should follow given my present situation: WARNING - The instructions below are for users who have uninstalled a Zone Labs product, and have lost ALL Internet access. ** STEP 1 ** Boot into Safe Mode: If you have Windows 98/2000/ME/XP, Reboot your system into Safe Mode (with NO networking if you have that option). Click on Start, Help, and type “Safe Mode” if you don’t know how to do this. ** STEP 2 ** Remove Registry Entry (Windows 95/98/ME ONLY) : Important Advisory: Deleting registry entries incorrectly may cause serious problems to your operating system (OS) which may necessitate the need to reinstall the OS. Please make sure you are able to perform these deletions correctly before you decide to edit the entries. If you are not sure, you should seek help from someone who is familiar with editing the registry. For information about how to edit the registry in Windows, click Start, Run, and type "regedit.exe". Click "Help," then "Help Topic." Click "Changing Keys and Values." Also, you should always make a backup (see your help files) of the registry before editing it. - To edit the registry, go to Start/Run and type: "regedit." - Navigate in the left pane to this entry and delete the appropriate key: W95/98/Me/XP HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\VSDATA95 Click File, Exit to finish. (NOTE - If on reboot you get a VXD error, hit Enter. In this case, you will need to perform the REGEDIT sequence again from the normal Windows, since Windows didn't allow registry changes while in Safe Mode.) ** STEP 3 ** Remove Files: To make sure that you can see the ZA/ZAP system files, if they are still on your computer, click Start, Help, then type either “hidden files” or “show all files” – one of these should tell you how to make sure ALL files are visible. Follow the instructions given. Be sure to change this back after you are done. - Click Start, Find or Search, select your local hard drive, type in "VSDATA*.*" and click on the Search button. - If you find any files named VSDATA95 or VSDATANT, delete them (you can do this from the search window). - Now in the find field, type in "INTERNET LOGS", and click Search. - You should see a folder - delete the folder. This removes the database files. They are recreated if you run ZA/ZAP again. ** STEP 4 ** Clean up deletions: - Empty the trash (recycle) bin. - Reboot your machine normally. ** STEP 5 ** Finish Uninstalling: Now you should have your access back. Point your browser to www.zonelabs.com, click on Support, then on Technical Support, and then on Install/Uninstall. Select your operating system. Follow the instructions there to complete the uninstall. If any do not apply, simply continue on to the next. NOTES FOR FUTURE UNINSTALLING: - If you reinstall ZA/ZAP, and need to UNinstall again, be sure you always say Yes to delete all files, and say Yes to allow Truevector to shut down, or it cannot remove files properly. It is also a good idea to keep the file that you downloaded to install with. - If you ever need to shut down ZA/ZAP while figuring out any configuration issues – On the Configure Panel, UNcheck the boxes to “Load At Startup” and “Show Shell Toolbar” if you have one (if not, then Right-click on the gray taskbar along the bottom of your screen, select Toolbars, and Uncheck the ZoneAlarm DeskBand). You can now reboot with no ZA/ZAP process running OK K3dc, how does it sound by you, am I almost home yet??? Tankengine out of gas - bye for now.
Post #13
:D Hi K3dc, Best course of action: You know what, I will reinstall ZA and then uninstall it as per the previous instructions. Hopefully, this will put an end to this chapter. You mentioned this before, it just took a night of little sleep to have it finally sink into my brain. Again, under my current situation how does this sound by you? Thanks again for all your timely assistance on this matter, Tankengine (almost running on full steam)
Post #14
Hi tank,

Do whatever you feel best to get that resolved; I see nothing wrong in what you're talking about. We do really depend on email today, don't we?

While you're uninstalling the Microsoft Java, I'd suggest also uninstalling the Adobe Acrobat Reader Version 5.0 that you are currently running. There have been several security problems with that version, and while you CAN get updates if you want to keep it, I'd recommend installing the newer Version 6.0; it's really neat! That way, you'll be able to read documents made with the newer version as well as with the older ones. It's free, of course; you can download it from Adobe. Just follow this link: http://www.adobe.com/products/acrobat/readstep2.html

Your newest log looks pretty good, but there are a few lines I'd recommend removing. Run HijackThis as usual, and fix the following lines:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxycfg.netsetter.com/gencfg.asp?i…p=1&nsv;=5.1.0.4

(This is a RESOURCE HOG! it's legit, but can be deleted without penalty.)
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…director/sw.cab
O16 - DPF: {2A91A4B4-B0A8-44D9-A63F-7C2AABA5C6B0} (DoMoreControl.DoMore) - file://C:\Program Files\Gateway\DoMore\DoMoreControl.CAB
O16 - DPF: {3CC943C7-3C99-11D4-8135-0050041A5144} (RunExeActiveX.UserControl1) - hcp://system/RunExeActiveX.CAB

Reboot and post a fresh log; with any luck, it'll be the final one. :D
Post #15
Good morning K3dc,

:thumbup: :thumbup: :thumbup: ;)

Thank you for all the help. The reininstall and uninstall of the ZoneAlarm worked like a charm. ZA prefers that you use their software to uninstall as opposed to what I did using the Add/Remove Programs which obviously left some artifacts behind that were affecting my Internet Explorer.

All my tests with IE after the uninstall of ZA passed with flying colors. I was even able to download the new AOL Optimized (9a) package without issue. I had tried several time before the fix and failed miserably each time.

Also followed your instructions and made those six fixes to HiJackThis as you stipulated in your prior memo. Will attach a new HJT at the end of this post as you suggested. I agree, I hope it is my last for a good while, WHEWWW!

OK, now that I have my system stable wanted to ask you for a little more detail
about your prior recommendation to uninstall M$ Java first, and then reboot before installing SunJava. Do you mean the Java 2 Runtime Environment Standard Edition 1.3 that appears on my Add or Remove Programs?

Your link to replace it via the FREEWARE is fine (no brainer) after I do the uninstall above. The FREEWARE link as you mentioned: http://java.com/en/index.jsp

Regarding the Adobe Acrobat Reader Version 5.0 to be replaced by 6.0, I plan to do the 5.0 delete via my Add/Remove Programs.

OK, K3dc. My latest HJT as requested:

Logfile of HijackThis v1.97.7
Scan saved at 7:04:02 AM, on 6/12/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\Program Files\APC\PowerChute Business Edition\agent\pbeagent.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Norton Internet Security\ccPxySvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\devldr32.exe
C:\PROGRA~1\AIM95\aim.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Microsoft Office\Office\1033\msoffice.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLDial.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSPS~1.EXE
C:\PROGRA~1\AMERIC~1.0A\aoltray.exe
C:\PROGRA~1\AOLCOM~1\COMPAN~1.EXE
C:\Program Files\America Online 9.0a\waol.exe
C:\Program Files\America Online 9.0a\shellmon.exe
C:\Program Files\Common Files\Aol\aoltpspd.exe
C:\unzipped\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = C:\Program Files\AOL Toolbar\welcome.html
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.gateway.net/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM95\aim.exe -cnetwait.odl
O4 - HKLM\..\RunOnce: [1] C:\WINDOWS\system32\cmd.exe /c erase "C:\DOCUME~1\Owner\LOCALS~1\Temp\AcsInstall.dll"
O4 - HKLM\..\RunOnce: [2] C:\WINDOWS\system32\cmd.exe /c erase "C:\DOCUME~1\Owner\LOCALS~1\Temp\insmac2k.dll"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0a\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Encarta Encyclopedia (HKLM)
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia (HKLM)
O9 - Extra button: AOL Toolbar (HKLM)
O9 - Extra 'Tools' menuitem: AOL Toolbar (HKLM)
O9 - Extra button: Define (HKLM)
O9 - Extra 'Tools' menuitem: Define (HKLM)
O9 - Extra button: AOL Instant Messenger (SM) (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: MoneySide (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Sametime Meeting Toolkit ST25 - file://C:\WINDOWS\Java\ControlF1\STMeeting25.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…7865.3009837963
O16 - DPF: {EC8C56B1-D027-4AB2-AF63-F845CCEE59B5} (DocumentAccessor Class) - https://billmanager.aol.com/billmanager/ins…loginHelper.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{958F51BF-77A1-478B-813D-7F3BE048EEAE}: NameServer = 205.188.146.146

One Mo' Time K3dc:

Mucho thanks for your timely feedback, patience and help/assistance and recommendations on this sticky matter (it was certainly keeping me up nights). I also learned something here (thanks for that as well)!

Finally, you are on target with your opening comment, "Where would we be without E-Mail today?" How did we ever live without it before is the big question???

Have a great weekend!! :wavey: :wavey:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI