# Frozen taskbar



## Danboy (Feb 1, 2001)

Hello

I posted earlier about the taskbar problem I was having but now their is a new wrinkle involved. Now all of the icons next to the clock are missing. The Norton icon is gone.. Only icon left is the volume icon. Thier was 3 or 4 different ones but now they are all gone. Could this be part of the Start botton problem from the last post?????????


----------



## Byteman (Jan 24, 2002)

Hi, Check the taskbar properties> right click empty spot near the clock (former clock) and hit Properties....under Taskbar Options, does "Show Clock" and "Always on top" have checks next to them?


----------



## TonyKlein (Aug 26, 2001)

It sounds like you experienced an Explorer crash.

Try rebooting; are the icons in your System Tray back again?


----------



## Danboy (Feb 1, 2001)

Hello Byteman and Tony,

Thanks for your reply. I checked the 2 boxes and they were checked. The icons have seem to come back after about 6 hours of inactivity on the computer. I guess I will keep an eye on it.

Danboy


----------



## Danboy (Feb 1, 2001)

Hello Everyone,

Logged on this morning and it happened again. After watching it for 3 minutes the web site I wanted (TSG of course) came up. When this happens everything freezes. Also when it freezes the clock does not disappear justs stops working. Thanks for any advice.

Danboy


----------



## Danboy (Feb 1, 2001)

Hello Everyone,

Still having the same problem. Is there a safe way to shut down the computer other than hitting the reset button? When I do that the message comes up about improperly shutting down and may have caused disk damage. I know this hard on the computer but I do not know what else to do. It has froze up 4 times in the last 6 hours. It freezes when I hit the start button. Then while it is froze if I hit a desktop icon all the icons down by the clock disappear.

Thanks Danboy


----------



## Byteman (Jan 24, 2002)

Danboy- Hitting the Reset button restarts the computer, not sure what you mean by that....you can usually press and hold the Power button to shut down when you freeze up. No way is good, but if you cant shut down, well there is hardly anything else you can do. CTRL ALT DEL dont usually work, either, when system freezes up bad. 
There are quite a few causes of freezing- a list:
overheating
power supply problems
resources- not just memory, but a combination of other things, CPU functions...
misbehaving programs
hardware bad
RAM bad or going bad
I suppose viruses and worms add to the problem
SOoooooooooo
Let's see if we can get a Starup List from ya....
go here, download StartupList and copy/pase the whole thing into a reply....don't skimp....we do this a lot...

http://www.lurkhere.com/~nicefiles/
Win98se, 98, 95 and if its 95 , A B or C?
What is the computer, a brand name, if so, make and model-
CPU speed and type....AMD, Intel, etc....
RAM in megabytes, type, speed if you know it...pc 100, or if SIMMS, is it FPM or EDO, ECC....
Check system resources....Right click My Computer, Properties, Perofrmance
Delete Temporary Internet Files, Temp files....use Disk Cleanup
Scandisk and Defrag
Run an AV scan if you can. Turn off UNEEDED programs, and screensavers....uncheck "Active Desktop" for better performance.\
Get the Belarc Advisor www.belarc.com
You want the Free Download link.....put it on the desktop, run to install, then start the program with the desktop icon that it creates. It's free. 
Will show you much of what I asked for above.
Check inside, with cover off while computer is on, are all the fans, power supply and CPU and any other fans turning??
Do you hear anything unusual when computer starts??
Post the amount of free space and total space of hard drive C: and any others, if more than one drive or disk. Belarc will show this, too.


----------



## Danboy (Feb 1, 2001)

Click here for Belarc's PC Management products, for large and small companies.

Operating System System Model 
Windows 98 SE VIA Technologies, Inc. VT8363 
Processor a Main Circuit Board 
700 megahertz AMD Duron
32 kilobyte primary memory cache
4096 kilobyte secondary memory cache Board: http://www.abit.com.tw 8363-686A(KT7,KT7-RAID) 
Bus Clock: 100 megahertz
BIOS: Award Software International, Inc. 6.00 PG 08/25/2000 
Drives Memory Modules 
9.99 Gigabytes Usable Hard Drive Capacity
4.48 Gigabytes Hard Drive Free Space

CREATIVE CD5233E [CD-ROM drive]
NERO IMAGEDRIVE2 [CD-ROM drive]
SONY CD-RW CRX100E [CD-ROM drive]
Generic floppy disk drive (3.5")

FUJITSU MPG3102AT E (10.01 GB) [Hard drive] -- drive 0 256 Megabytes Installed Memory
128 Megabyte Module Size - 2 Installed
2 Memory Sockets are Empty 
Local Drive Volumes

c: (on drive 0) 9.99 GB 4.48 GB free

Network Drives

Controllers Printers 
Standard Floppy Disk Controller
Primary IDE controller (dual fifo)
Secondary IDE controller (dual fifo)
VIA Bus Master PCI IDE Controller HP DeskJet 840C Series on LPT1: 
HP DeskJet 850C on LPT1:

Display 
NVIDIA GeForce2 MX/MX 400 [Display adapter]
Plug and Play Monitor 
Bus Adapters Multimedia 
NERO IMAGEDRIVE SCSI Controller
VIA Tech 3038 PCI to USB Universal Host Controller
VIA Tech 3038 PCI to USB Universal Host Controller Creative Gameport Joystick
Sound Blaster AudioPCI
Sound Blaster AudioPCI Legacy Device
Wave Device for Voice Modem 
Communications Other Devices 
SupraMax 56i Voice PCI [Modem]
Microsoft Virtual Private Networking Adapter SUP2750 PCI Modem Enumerator
Standard 101/102-Key or Microsoft Natural Keyboard
USB Root Hub
USB Root Hub 
Software Licenses

Microsoft - Internet Explorer 55736-418-2090055-04626 
Microsoft - MediaPlayer 53199-853-4788152-04359 
Microsoft - Money 2002 55234-OEM-0300506-00000 
Microsoft - Money 2002 55234-OEM-0300506-00000 
Microsoft - MS Office 97 Professional 27397-OEM-0025284-72018 
Microsoft - Windows 98 SE 01901-OEM-0076717-41438 (Key: DMPWM-4PXHP-R6RF6-FRYCW-698QT)

Software Versions 
Activision - Spider-Man Display Adapter Selector Version 01.000*
Adobe Acrobat Reader Version 5.0.0.0*
Adobe Acrobat Version 4.05*
Ahead Software AG Karlsbad Germany Phone: ++49-7248-911-800 Fax: ++49-7248-911-888 e-mail: [email protected] - LANGUAGE_English2 Version 5, 5, 8, 2*
ahead software gmbh, karlsbad - Cover Designer Version 2, 1, 1, 1*
Armada WONswap *
Banner Blue Software Incorporated - Microsoft Organization Chart Version 2,0,0,1016*
Belarc Advisor and BelLive - Belarc's Content Personalization with Privacy Version 5.0h*
CDKnet, LLC. - CDK Video Player Version 10.1.0.1*
CNET, Inc. - CatchUp Version 1.3*
Creative Disc Detector Version 1.55*
Creative LAVA! Version 2.50*
Creative Mixer Loader Version 6.01.1*
Creative On-line Registration System Version 1.0.0.1*
Creative PlayCenter Version 1.55*
Creative Recorder Version 1.02*
CryptoLogic Inc - Casino Version 4, 0, 0, 0*
Cryptologic Inc. - Upgrade Assistant Version 0, 1, 0, 1*
DeskPlayer.exe*
EA Sports - Course Architect Version 1, 0, 0, 0*
EA SPORTS - TW2003 Application Version 1, 0, 0, 0*
Electronic Arts (Canada), Inc. - 3DSetup Application Version 2.05*
Electronic Arts - EA.COM Update.exe Version 1, 0, 0, 2*
Electronic Arts System Information Version 2, 1, 0, 5*
EReg Application Version 2, 0, 0, 2*
EReg Application Version 3, 0, 0, 0*
Erik Deppe - DriveSpeed Application Version 1, 6, 0, 0*
Erik Deppe - Nero CD Speed Version 0, 8, 5, 0*
Headgate Studios Inc. - Course Utilities Version 2.01.0075*
Hewlett-Packard Co. - HP DeskJet A.03.01.03*
ImageDrive Application Version 1,0,0,1*
Install Heat Software For Online Play *
InterAct Accessories Incorporation - PROPAD 6 Version 2, 0, 0, 930*
LucasArts Entertainment Company LLC - The TIE Fighter Launcher Version 1, 0, 0, 1*
Madden NFL (TM) 2001 *
MediaRing Talk Version 7.2*
Microsoft (r) Windows Script Host Version 5.6.0.6626*
Microsoft Corporation - Clip Gallery 3.0 for Windows Version 3.0*
Microsoft Corporation - DirectShow Version 6.4.07.1121*
Microsoft Corporation - Internet Explorer Version 6.00.2800.1106*
Microsoft Corporation - MSN(tm) Messenger Service Version 3.0*
Microsoft Corporation - Windows® NetMeeting® Version 3.0*
Microsoft Excel Version 8.0a*
Microsoft Money Version 10.00.0809* Microsoft Office Binder Version 8.0.3501*
Microsoft Office Version 8.0*
Microsoft Office Version 8.0.3512*
Microsoft Outlook Version 8.0*
Microsoft Outlook Version 8.02*
Microsoft PowerPoint for Windows Version 8.0*
Microsoft(R) Windows Media Player Version 7.10.00.3068*
Microsoft® Plus! for Windows® 95 Version 4.40.500*
Microsoft® Access Version 8.0.4122*
Microsoft® DirectX for Windows® 95 and 98 Version 4.08.01.0881*
Microsoft® Find Fast Version 8.0*
Microsoft® Schedule+ for Windows 95(TM) Version 7.5*
Microsoft® Word for Windows® 97 Version 8.0*
MooSoft Development - TC Monitor Version 1.0.0.0*
NHL 2001 *
PepiMK Software - SpyBot-S&D Version 1.1r3*
PGWARE - PCMedik Version 2.2.6.2002*
PixAround - PixScreen Application Version 1.1.0.21*
PixAround.com - PixMaker Version 1.00*
RealNetworks, Inc. - RealOne Player (32-bit) Version 0.1.0.1599*
RealNetworks, Inc. - RealOne Player (32-bit) Version 6.0.11.818*
RealNetworks, Inc. - RealOne Player (32-bit) Version 7.0.0.1168*
ReplCD.exe*
Sierra Auto Run Version 1, 0, 0, 0*
Spider-Man *
Symantec Corporation - LiveUpdate Version 1.70.22.0*
Symantec Corporation - Norton AntiVirus Version 7.07.00.23*
Symantec Corporation - Norton Core Technology Version 14.20.0.88*
Symantec Corporation - Norton SystemWorks Version 4.00.84*
Symantec ScriptBlocking Version 1, 1, 0, 126*
The Game of Life *
The Webshots Corporation - Webshots Tray Application Version 1.3.0.3826*
The Webshots Corporation Swebexec Version 1.3.0.3826*
Thinking Man Software - Dimension 4 Version 4.2.1005*
TNN Outdoor Pro Hunter *
TypingMaster 2002 Version 6.2*
Virtos GmbH - WaveEdit DLL Version 1, 0, 3, 0*
Visit www.lucasarts.com *
Voodoo Lounge *
WayTech Development, Inc. - Versato System Version 1, 1, 9, 8*
WinZip Version 8.1 (4319)*
WinZip Version 8.1 (4331)*
x- Safe Mode *

--------------------------------------------------------------------------------

* Click to see where software is installed.
a. Megahertz measurement may be inaccurate if other programs were busy during last analysis. 
Copyright 2000-1, Belarc, Inc. All rights reserved. 
Legal notice. U.S. Patent 5665951 and Patents pending.

--------------------------------------------------------------------------------

StartupList report, 2/5/03, 6:41:18 AM
StartupList version: 1.51
Started from : C:\UNZIPPED\STARTUPLIST151[1]\STARTUPLIST.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\RNATHCHK.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\MICROSOFT MONEY\SYSTEM\MONEY EXPRESS.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\HPZSTATX.EXE
C:\PROGRAM FILES\MICROSOFT MONEY\SYSTEM\URLMAP.EXE
C:\UNZIPPED\STARTUPLIST151[1]\STARTUPLIST.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
Microsoft Office Shortcut Bar.lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

SystemTray = SysTray.Exe
EnsoniqMixer = starter.exe
Norton Auto-Protect = C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
QuickTime Task = C:\WINDOWS\SYSTEM\QTTASK.EXE
NAV DefAlert = C:\PROGRA~1\NORTON~1\DEFALERT.EXE
LoadQM = loadqm.exe
MoneyStartUp10.0 = "C:\Program Files\Microsoft Money\System\Activation.exe"
TkBellExe = C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
nwiz = nwiz.exe /install
Dimension4 = C:\PROGRAM FILES\D4\D4.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

SchedulingAgent = mstask.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

MoneyAgent = "C:\Program Files\Microsoft Money\System\Money Express.exe"
Taskbar Display Controls = RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY

--------------------------------------------------

File association entry for .SCR:
HKEY_CLASSES_ROOT\SCR_auto_file\shell\open\command

(Default) = C:\WINDOWS\Explorer.exe "%1"

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 4/2/2003, 11:6:46)

[rename]
nul=C:\WINDOWS\TEMP\~e5d141.tmp
nul=C:\WINDOWS\TEMP\~e5d141.tmp

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET BLASTER=A220 I7 D1 H7 P330 T6
SET SBPCI=C:\PROGRA~1\CREATIVE\AUDIO\DOSDRV

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - (no file) - {1678F7E1-C422-11D0-AD7D-00400515CAAA}
CSBrBHO - C:\PROGRAM FILES\COMET\INSTALL\TEMP\BRBHO12A.DLL (file missing) - {96DA5BEE-4ACC-476C-B3EC-54C6730C4293}
(no name) - C:\Program Files\Microsoft Money\System\mnyviewer.dll - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Scan for Viruses.job
Symantec NetDetect.job
Maintenance-Defragment programs.job
Maintenance-ScanDisk.job
Maintenance-Disk cleanup.job

--------------------------------------------------

Enumerating Download Program Files:

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\DIRECTOR\SWDIR.DLL
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[WildTangent Control]
InProcServer32 = C:\WINDOWS\WT\WEBDRIVER\WEBDRIVER.DLL
CODEBASE = http://www.wildtangent.com/install/wdriver/racing/dodgespeedway/microsoft/wtinst.cab

[WONWebLauncher Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\FLIPSIDEWEBLAUNCHERCONTROL.OCX
CODEBASE = http://212.153.46.5/tools/FlipsideWebLauncherControl.cab

[{5F03EAB4-1AD5-11D4-AE99-0050DAC24E8F}]
CODEBASE = http://www.iwon.com/ct/in_wn/iwonslot1,0,1,5.cab

[iWon Progressive Counter]
InProcServer32 = C:\PROGRAM FILES\IWON\IWONSLOT\3.BIN\IWONSLOT.DLL
CODEBASE = http://www.iwon.com/ct/pm2/iwonpm1,0,2,3.cab

[Loader Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\LOADER.OCX
CODEBASE = https://gamingclub.microgaming.com/gamingclub/loader.cab

[{41F17733-B041-4099-A042-B518BB6A408C}]
CODEBASE = http://a224.g.akamai.net/7/224/52/2...apple.com/qt503/us/win/QuickTimeInstaller.exe

[sys Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\PCPITSTOP.DLL
CODEBASE = http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

[SnoopyCtrl Class]
InProcServer32 = C:\PROGRAM FILES\EACOM\UPDATE\NPSNPY.DLL
CODEBASE = http://www.ea.com/downloads/games/common/snoopy/iesnoopy.cab

[MSN Chat Control 4.0]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\MSNCHAT40.OCX
CODEBASE = http://fdl.msn.com/public/chat/msnchat4.cab

[ContentAuditX Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\CONTEN~1.OCX
CODEBASE = http://a840.g.akamai.net/7/840/5805...ch.com/audit/includes/ContentAuditControl.cab

[CWDL_DownLoadControl Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\CWDL_DOWNLOAD.DLL
CODEBASE = http://www.callwave.com/include/cab/CWDL_DownLoad.CAB

[{4E888414-DB8F-11D1-9CD9-00C04F98436A}]
CODEBASE = https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37617.1518171296

[OPUCatalog Class]
InProcServer32 = C:\WINDOWS\SYSTEM\OPUC.DLL
CODEBASE = http://office.microsoft.com/productupdates/content/opuc.cab

--------------------------------------------------
End of report, 7,394 bytes
Report generated in 0.094 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

Thanks for your reply Byteman. The computer is not making strange sounds. I have not removed the cover but I can hear a fan running. I have the computer set up to run scan disk and defrag at a regular time, but I do not know for sure if it is doing it. The computer is not a brand name, and is about 3 years old. Thanks again for your help.

Danboy


----------



## Byteman (Jan 24, 2002)

Danboy, 

Excellent job posting the information. I have asked Tony K to stop by and try to sort this out- although I see you have used SpyBot, you still have some Active X components that could be removed, and there is a lot running at startup that can be set not to, such as MS Office stuff, MS Find Fast....
Between that, Norton AV, MSN Chat, and all else, you seem to have a software conflict. I have to go out and will not be back till late tonite, so hang on for some help, OK?
If you set up Scheduled Tasks to run at certain times, say 3AM every Wednesday....the computer has to be left on for the task to start.  Have you tried the Internet Explorer Repair Tool?
Control Panel>>Add/Remove Programs>>look for Microsoft Internet Explorer 6.0 and Internet Tools>>click add/remove>>
select "Repair this installation of IE" and run the repair, post what it tells you....either it tried to fix and could not, or it did.
Then try Intenet again. 
Empty TEMPS not dated within the last few days.

Empty Temp Internet Files (System Tools, Disk Cleanup).
Run Scandisk from Safe Mode 
Defrag

If you use Norton System Work's Speed Disk, do not defrag with Windows defrag, not good to use both back and forth.
Are you using Norton Unerase, or Clean Sweep?


----------



## Danboy (Feb 1, 2001)

Hi Byteman,

Went into and ran repair this installation of IE. It never said weather it fixed anything or not. It acted like everything was ok and rebooted the computer. Emptied temp files and removed programs that I do not use anymore and I am thinking about getting rid of more that I really do not use anymore. Could a screensaver cause this? Most of the MS money and Office were add ons that I got at work and put them on my computer. The only Norton I use is the anti virius. The computer is on all the time. I learned it had to be on for the scan disk and defrag to work on TSG. (see I am paying attention LOL ) 

Thanks Danboy


----------



## Byteman (Jan 24, 2002)

Danboy- Excellent idea to remove what you do not need- always uninstal the right way, though, use the programs built in uninstall feature, or Contro Panel, Add/Remove Programs. 
For Norton (Symantec) You can install selectively what you want from your install CD- if you use just the Antivirus, that is fine, long as you keep it updated. I use Win Doctor and find it useful at straightening out Registry and ActiveX things.
I was not sure what you meant- whether you custom installed as above, or the whole System Works suite is installed now, so posted the info. You would need to remove it all- I am not sure what your version does, whether you can uninstall parts of the suite or not....and then you would need to reinstall Antivirus, Live Update....and, get all the updates from the Net. Take a look in Help for the SystemWorks and see what you can do about uninstalling the parts of the suite you do not use if you have the whole thing installed. 
Office- well, thats your choice, uninstall it if you like. You do not need it starting at Windows startup is all I meant, and the Find Fast feature does not do a whole lot, most people turn it off from starting up at boot, also. 
If you leave the computer on 24/7- your tasks may still not be running, since you use screensavers... which have to be turned off
for defrag and scandisk to complete....we answer posts about this every day. Some other things running in the background also can affect the tasks. You should reboot once in awhile- to refresh Windows, recover resources, clear RAM. 
Just to check- Open My Computer.....right click Drive C:, Properties, Tools.....what does it say for the last time you scandisked and defragged?? If it is the same as the setting you have for Tasks....the all is OK. If not, it is not finishing. 
Did you mean that your computer is acting right after you ran the repair tool? No desktop problems now?


----------



## Byteman (Jan 24, 2002)

Danboy- Forgot to answer the screensaver question you have.
They are not usually needed at all these days....old monitors used to require them to keep from having images burnt into the screen, most if not all modern monitors do not require them...unless there is some type I am not aware of, like the new LCD type- anyone have any input?
Lots of viruses can fake being screensavers, using the .SCR file extension, but your antivirus, if kept updated, should catch most of those....if you scan your downloads before you run or install them. 
They do use resources, as well. Nice toys, though....
I am still looking over the info you posted....


----------



## Danboy (Feb 1, 2001)

Hi Byteman,

Everything that you said I should do is already done. Checked the scan disk and defrag and was done 3-5 days ago. Decided to get rid of my favorite screen saver and so far have not had any problem. I don't understand that either. As far as the words,office and the such, I didn't have it before and I can get rid of it know if I need too. As far as the rest, if you see something that I should get rid of let me know. Thanks Byteman for all your help and Thanks to TSG for the wonderful site.

Thanks again Danboy


----------



## Danboy (Feb 1, 2001)

Hello All,

Thanks to the help from Byteman I thought that we fixed my problem by removing the screensaver. But I was wrong. Press the start button and the computer freezes. Icons on desktop can be opened then they freeze also. It is better, so far 4 hours using computer and has only happened once. Also had MSN as my homepage, tried to open it this morning and it had changed to some screensaver site. Strange. Thought you needed a update.

Thanks Danboy


----------



## jm100dm (May 26, 1999)

Danboy

Just to get up to speed. Did you run an up to date scan for viri? Did you remove findfast as it is a major resource hog? Are you running anything to track your resources? How does your startup list look now?

I researched the following items that were in your startups. None of them are needed and all of them can be unchecked. Unchecking just keeps them from running at windows startup. And any can be re-checked if you like. The programs can be started when needed instead of running all the time.

Office Startup 
Osa.exe & Osa9.exe 
Resource hog that launches common MS Office components to help speed up the launch of Office programs. Osa9.exe is the Office 2000 equivalent. Some users claim there's no difference with or without it but it isn't required anyway

Microsoft Find Fast 
Findfast.exe
Complete utter waste of space! Part of MS Office - searches disk drives for Office file types and creates an index to make opening them easier

QuickTime Task
or
qttask Qttask.exe 
System Tray access to Apple's "Quick Time" viewer from version 5 onwards 
not needed

Realsched 
realsched.exe 
Application Scheduler installed along with RealOne Player. Runs independently of RealOne Player, to remind AutoUpdate and Message Center to perform their tasks at pre-scheduled intervals. If it can't be disabled try deleting or renaming realsched.exe and then delete the entry in the registry

TkBellExe
evntsvc.exe 
-osboot Application Scheduler installed along with RealOne Player. Once installed, it runs independently of RealOne Player. See here for more information, including how to disable it. Also see evntsvc and Realsched 
not needed

Could this progam be part of the problem?

nwiz
nwiz.exe 
Associated with the newer versions of nVidia graphics cards drivers. Allows you to immensely improve desktop layouts by setting preferences and optimizations. However, this isn't necessary for the operation of your system 


I used the startups full list as a reference located at this link.

http://www.spywareinfo.org/startup_pages/startup_full.htm


----------



## Byteman (Jan 24, 2002)

jm100dm- Thanks for stepping in, I am working TOO much lately and cannot be here as much as I am used to being. 
It sounds like a hijacking to me-:: 

_______________
"It is better, so far 4 hours using computer and has only happened once. Also had MSN as my homepage, tried to open it this morning and it had changed to some screensaver site. Strange"

Time for Hijack This???


----------



## jm100dm (May 26, 1999)

Byteman 

Anytime.

Probably but I am not to familiar with it as to what can safely be removed. I have to leave for tonight now too.


----------



## Danboy (Feb 1, 2001)

Hello Byteman and jm100dm,

Here is the startup list as of now.....

StartupList version: 1.51
Started from : C:\UNZIPPED\STARTUPLIST151[1]\STARTUPLIST.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\MICROSOFT MONEY\SYSTEM\MONEY EXPRESS.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\RNATHCHK.EXE
C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
C:\PROGRAM FILES\MICROSOFT MONEY\SYSTEM\URLMAP.EXE
C:\UNZIPPED\STARTUPLIST151[1]\STARTUPLIST.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
Microsoft Office Shortcut Bar.lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

SystemTray = SysTray.Exe
EnsoniqMixer = starter.exe
Norton Auto-Protect = C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
QuickTime Task = C:\WINDOWS\SYSTEM\QTTASK.EXE
NAV DefAlert = C:\PROGRA~1\NORTON~1\DEFALERT.EXE
LoadQM = loadqm.exe
MoneyStartUp10.0 = "C:\Program Files\Microsoft Money\System\Activation.exe"
TkBellExe = C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
nwiz = nwiz.exe /install
Dimension4 = C:\PROGRAM FILES\D4\D4.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

SchedulingAgent = mstask.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

MoneyAgent = "C:\Program Files\Microsoft Money\System\Money Express.exe"
Taskbar Display Controls = RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY

--------------------------------------------------

File association entry for .SCR:
HKEY_CLASSES_ROOT\SCR_auto_file\shell\open\command

(Default) = C:\WINDOWS\Explorer.exe "%1"

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 5/2/2003, 10:43:0)

[rename]
NUL=C:\WINDOWS\TEMP\GLB1A2B.EXE
NUL=C:\WINDOWS\TEMP\GLB1A2B.EXE

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET BLASTER=A220 I7 D1 H7 P330 T6
SET SBPCI=C:\PROGRA~1\CREATIVE\AUDIO\DOSDRV

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - (no file) - {1678F7E1-C422-11D0-AD7D-00400515CAAA}
CSBrBHO - C:\PROGRAM FILES\COMET\INSTALL\TEMP\BRBHO12A.DLL (file missing) - {96DA5BEE-4ACC-476C-B3EC-54C6730C4293}
(no name) - C:\Program Files\Microsoft Money\System\mnyviewer.dll - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Scan for Viruses.job
Symantec NetDetect.job
Maintenance-Defragment programs.job
Maintenance-ScanDisk.job
Maintenance-Disk cleanup.job

--------------------------------------------------

Enumerating Download Program Files:

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\DIRECTOR\SWDIR.DLL
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[WildTangent Control]
InProcServer32 = C:\WINDOWS\WT\WEBDRIVER\WEBDRIVER.DLL
CODEBASE = http://www.wildtangent.com/install/wdriver/racing/dodgespeedway/microsoft/wtinst.cab

[WONWebLauncher Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\FLIPSIDEWEBLAUNCHERCONTROL.OCX
CODEBASE = http://212.153.46.5/tools/FlipsideWebLauncherControl.cab

[{5F03EAB4-1AD5-11D4-AE99-0050DAC24E8F}]
CODEBASE = http://www.iwon.com/ct/in_wn/iwonslot1,0,1,5.cab

[{70522FA2-4656-11D5-B0E9-0050DAC24E8F}]
CODEBASE = http://www.iwon.com/ct/pm2/iwonpm1,0,2,3.cab

[Loader Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\LOADER.OCX
CODEBASE = https://gamingclub.microgaming.com/gamingclub/loader.cab

[{41F17733-B041-4099-A042-B518BB6A408C}]
CODEBASE = http://a224.g.akamai.net/7/224/52/2...apple.com/qt503/us/win/QuickTimeInstaller.exe

[sys Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\PCPITSTOP.DLL
CODEBASE = http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

[SnoopyCtrl Class]
InProcServer32 = C:\PROGRAM FILES\EACOM\UPDATE\NPSNPY.DLL
CODEBASE = http://www.ea.com/downloads/games/common/snoopy/iesnoopy.cab

[MSN Chat Control 4.0]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\MSNCHAT40.OCX
CODEBASE = http://fdl.msn.com/public/chat/msnchat4.cab

[ContentAuditX Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\CONTEN~1.OCX
CODEBASE = http://a840.g.akamai.net/7/840/5805...ch.com/audit/includes/ContentAuditControl.cab

[CWDL_DownLoadControl Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\CWDL_DOWNLOAD.DLL
CODEBASE = http://www.callwave.com/include/cab/CWDL_DownLoad.CAB

[{4E888414-DB8F-11D1-9CD9-00C04F98436A}]
CODEBASE = https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37617.1518171296

[OPUCatalog Class]
InProcServer32 = C:\WINDOWS\SYSTEM\OPUC.DLL
CODEBASE = http://office.microsoft.com/productupdates/content/opuc.cab

--------------------------------------------------
End of report, 7,321 bytes
Report generated in 0.316 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

If you could let me know I will get rid of whatever you 2 think I should. Also please tell me how to do this. All I do for virius is run Norton. As far as tracking my resources I do not know how or what you mean. Thanks too you both for all your help.

Danboy


----------



## Mosaic1 (Aug 17, 2001)

This is not normal. I believe it is your other problem. 
The File association entry for .SCR: 
HKEY_CLASSES_ROOT\SCR_auto_file\shell\open\command

EDIT: I gave you registry directions to change the screensaver association. But wait and don't do that yet. First run Spybot.

Then do a free online Virus Scan here:

http://housecall.antivirus.com/pc_housecall/

You have a lot of Spyware. Rather than go over it one by one, I think you need to install and the Spybot Search and destroy. After you have done that, do another StartupList and post the results, please.

Here's a link to a page with getting started directions. There's a link to the download at the bottom of the page.

http://tomcoyote.org/

If you still have the screensaver registry change after that, I'll help you to manually change it back.

Also. after you run StartupList please Download and run HijackThis. Post those results. Do not remove anything using HijackThis until you have help. It lists everything it finds, but you have to know what to remove. If you remove everything, you will be in trouble. It lists both normal and abnormal items.

http://www.spywareinfo.com/files/hijackthis.zip


----------



## Danboy (Feb 1, 2001)

Mosaic1,

Going back to work today, will do what you said asap.


Thanks Danboy


----------



## jm100dm (May 26, 1999)

Not to get you too confused start by following what Mosaic1 suggests in his last post.



> _Originally posted by Danboy:_
> *
> If you could let me know I will get rid of whatever you 2 think I should. Also please tell me how to do this. All I do for virius is run Norton. As far as tracking my resources I do not know how or what you mean. Thanks too you both for all your help.
> 
> Danboy *


From my last post: I researched the following items that were in your startups. None of them are needed and all of them can be unchecked. Unchecking just keeps them from running at windows startup. And any can be re-checked if you like. The programs can be started when needed instead of running all the time.

nwiz.exe 
evntsvc.exe
realsched.exe
Qttask.exe
Findfast.exe
Osa.exe

Go to start\run type in msconfig then hit ok.
Click selective startup thenthe last tab that says startup.
You will find several listed items and you can uncheck all of the six I listed above that are there. When asked to reboot say yes. Windows will boot much quicker now. Any that you want to have start at startup can be rechecked preferably after we solve your problem. Or you can start them throught their progam.

As for resources. I asked concerned that you may have used them all causing a freeze up. As long as you are in the green you should be okay. Usually windows will warn if very low.
Click start run type RSRCMTR now there should be a resoure meter in your tray show your resources.

Norton is fine as long as you keep it updated (also required for any other antivirus program)


----------



## Danboy (Feb 1, 2001)

Hi Mosaic1 and all,

Here is the hijack this list........

ogfile of HijackThis v1.91.2
Scan saved at 8:00:35 PM, on 2/7/03
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.yahoo.com/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {1678F7E1-C422-11D0-AD7D-00400515CAAA} - (no file)
O2 - BHO: CSBrBHO - {96DA5BEE-4ACC-476C-B3EC-54C6730C4293} - C:\PROGRAM FILES\COMET\INSTALL\TEMP\BRBHO12A.DLL (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\SYSTEM\QTTASK.EXE
O4 - HKLM\..\Run: [NAV DefAlert] C:\PROGRA~1\NORTON~1\DEFALERT.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Dimension4] C:\PROGRAM FILES\D4\D4.EXE
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Office Shortcut Bar.lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O9 - Extra button: MoneySide (HKLM)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FA13A9FA-CA9B-11D2-9780-00104B242EA3} (WildTangent Control) - http://www.wildtangent.com/install/wdriver/racing/dodgespeedway/microsoft/wtinst.cab
O16 - DPF: {A031D222-B496-11D2-9CC8-00105A10AAF6} (WONWebLauncher Class) - http://212.153.46.5/tools/FlipsideWebLauncherControl.cab
O16 - DPF: {5F03EAB4-1AD5-11D4-AE99-0050DAC24E8F} - http://www.iwon.com/ct/in_wn/iwonslot1,0,1,5.cab
O16 - DPF: {70522FA2-4656-11D5-B0E9-0050DAC24E8F} - http://www.iwon.com/ct/pm2/iwonpm1,0,2,3.cab
O16 - DPF: {00CB77FC-0F09-458A-8BE8-9176423305EB} (Loader Control) - https://gamingclub.microgaming.com/gamingclub/loader.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a224.g.akamai.net/7/224/52/2...apple.com/qt503/us/win/QuickTimeInstaller.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (sys Class) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {525A15D0-4938-11D4-94C7-0050DA20189B} (SnoopyCtrl Class) - http://www.ea.com/downloads/games/common/snoopy/iesnoopy.cab
O16 - DPF: {E87A6788-1D0F-4444-8898-1D25829B6755} (MSN Chat Control 4.0) - http://fdl.msn.com/public/chat/msnchat4.cab
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai.net/7/840/5805...ch.com/audit/includes/ContentAuditControl.cab
O16 - DPF: {1DEFB8C0-22A7-4E58-B735-43A169CDA2AB} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37617.1518171296
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003012801/housecall.antivirus.com/housecall/xscan53.cab

Here is the startup list after Spybot and housecalls.........

StartupList report, 2/7/03, 7:53:39 PM
StartupList version: 1.51
Started from : C:\UNZIPPED\STARTUPLIST151[1]\STARTUPLIST.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\MICROSOFT MONEY\SYSTEM\MONEY EXPRESS.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\MICROSOFT MONEY\SYSTEM\URLMAP.EXE
C:\PROGRAM FILES\WINZIP\WINZIP32.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\UNZIPPED\STARTUPLIST151[1]\STARTUPLIST.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
Microsoft Office Shortcut Bar.lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

SystemTray = SysTray.Exe
EnsoniqMixer = starter.exe
Norton Auto-Protect = C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
QuickTime Task = C:\WINDOWS\SYSTEM\QTTASK.EXE
NAV DefAlert = C:\PROGRA~1\NORTON~1\DEFALERT.EXE
LoadQM = loadqm.exe
MoneyStartUp10.0 = "C:\Program Files\Microsoft Money\System\Activation.exe"
TkBellExe = C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
nwiz = nwiz.exe /install
Dimension4 = C:\PROGRAM FILES\D4\D4.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

SchedulingAgent = mstask.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

MoneyAgent = "C:\Program Files\Microsoft Money\System\Money Express.exe"
Taskbar Display Controls = RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY

--------------------------------------------------

File association entry for .SCR:
HKEY_CLASSES_ROOT\SCR_auto_file\shell\open\command

(Default) = C:\WINDOWS\Explorer.exe "%1"

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 5/2/2003, 10:43:0)

[rename]
NUL=C:\WINDOWS\TEMP\GLB1A2B.EXE
NUL=C:\WINDOWS\TEMP\GLB1A2B.EXE

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET BLASTER=A220 I7 D1 H7 P330 T6
SET SBPCI=C:\PROGRA~1\CREATIVE\AUDIO\DOSDRV

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - (no file) - {1678F7E1-C422-11D0-AD7D-00400515CAAA}
CSBrBHO - C:\PROGRAM FILES\COMET\INSTALL\TEMP\BRBHO12A.DLL (file missing) - {96DA5BEE-4ACC-476C-B3EC-54C6730C4293}
(no name) - C:\Program Files\Microsoft Money\System\mnyviewer.dll - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Scan for Viruses.job
Symantec NetDetect.job
Maintenance-Defragment programs.job
Maintenance-ScanDisk.job
Maintenance-Disk cleanup.job

--------------------------------------------------

Enumerating Download Program Files:

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\DIRECTOR\SWDIR.DLL
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[WildTangent Control]
InProcServer32 = C:\WINDOWS\WT\WEBDRIVER\WEBDRIVER.DLL
CODEBASE = http://www.wildtangent.com/install/wdriver/racing/dodgespeedway/microsoft/wtinst.cab

[WONWebLauncher Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\FLIPSIDEWEBLAUNCHERCONTROL.OCX
CODEBASE = http://212.153.46.5/tools/FlipsideWebLauncherControl.cab

[{5F03EAB4-1AD5-11D4-AE99-0050DAC24E8F}]
CODEBASE = http://www.iwon.com/ct/in_wn/iwonslot1,0,1,5.cab

[{70522FA2-4656-11D5-B0E9-0050DAC24E8F}]
CODEBASE = http://www.iwon.com/ct/pm2/iwonpm1,0,2,3.cab

[Loader Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\LOADER.OCX
CODEBASE = https://gamingclub.microgaming.com/gamingclub/loader.cab

[{41F17733-B041-4099-A042-B518BB6A408C}]
CODEBASE = http://a224.g.akamai.net/7/224/52/2...apple.com/qt503/us/win/QuickTimeInstaller.exe

[sys Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\PCPITSTOP.DLL
CODEBASE = http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

[SnoopyCtrl Class]
InProcServer32 = C:\PROGRAM FILES\EACOM\UPDATE\NPSNPY.DLL
CODEBASE = http://www.ea.com/downloads/games/common/snoopy/iesnoopy.cab

[MSN Chat Control 4.0]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\MSNCHAT40.OCX
CODEBASE = http://fdl.msn.com/public/chat/msnchat4.cab

[ContentAuditX Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\CONTEN~1.OCX
CODEBASE = http://a840.g.akamai.net/7/840/5805...ch.com/audit/includes/ContentAuditControl.cab

[CWDL_DownLoadControl Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\CWDL_DOWNLOAD.DLL
CODEBASE = http://www.callwave.com/include/cab/CWDL_DownLoad.CAB

[{4E888414-DB8F-11D1-9CD9-00C04F98436A}]
CODEBASE = https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37617.1518171296

[OPUCatalog Class]
InProcServer32 = C:\WINDOWS\SYSTEM\OPUC.DLL
CODEBASE = http://office.microsoft.com/productupdates/content/opuc.cab

[HouseCall Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\XSCAN53.OCX
CODEBASE = http://a840.g.akamai.net/7/840/537/2003012801/housecall.antivirus.com/housecall/xscan53.cab

--------------------------------------------------
End of report, 7,457 bytes
Report generated in 0.409 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

After running housecalls this is the only one that came up...

Virus RegseekerC File C:\windows\home.reg

I hope that covers everything. With my limited ability and lack of knowledge that only took 1 hour and 5 tries. LOL Thanks to you ALL........ for the help.

Daniel


----------



## Danboy (Feb 1, 2001)

Hi jm100dm,

Went in and removed all that I could find that you told me to get rid of. Typed in RSRCMTR and it came back saying that it could not find that file. Don't know if important but thought you may want to know.......

Danboy


----------



## Mosaic1 (Aug 17, 2001)

Hi, I'll look at your StartupList in a few minutes. But could you please post a new HijackThis? This looks to be an old one from before you ran Spybot. No sense in going over it. Hopefully Spybot cleaned out a lot of these.

Also, start Spybot and update to be sure.
REboot.
Run spybot again. You seem to still have a lot of junk in there. In fact nothing seems to have changed. You have to choose to "Fix checked" did You?

Thanks,

Mo


----------



## Danboy (Feb 1, 2001)

Morning Mosaic 1,

Ran Spybot updated and found 8 updates. Downloaded them and ran Spybot. It came up with 7 items which I fixed by pushing the fix selected problem button. Left the ones in green alone. Rebooted and ran it again and found 0 problems. ran Hijack and this is what came up........

Logfile of HijackThis v1.91.2
Scan saved at 6:00:47 AM, on 2/8/03
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.yahoo.com/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {1678F7E1-C422-11D0-AD7D-00400515CAAA} - (no file)
O2 - BHO: CSBrBHO - {96DA5BEE-4ACC-476C-B3EC-54C6730C4293} - C:\PROGRAM FILES\COMET\INSTALL\TEMP\BRBHO12A.DLL (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [NAV DefAlert] C:\PROGRA~1\NORTON~1\DEFALERT.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Dimension4] C:\PROGRAM FILES\D4\D4.EXE
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Office Shortcut Bar.lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O9 - Extra button: MoneySide (HKLM)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FA13A9FA-CA9B-11D2-9780-00104B242EA3} (WildTangent Control) - http://www.wildtangent.com/install/wdriver/racing/dodgespeedway/microsoft/wtinst.cab
O16 - DPF: {A031D222-B496-11D2-9CC8-00105A10AAF6} (WONWebLauncher Class) - http://212.153.46.5/tools/FlipsideWebLauncherControl.cab
O16 - DPF: {5F03EAB4-1AD5-11D4-AE99-0050DAC24E8F} - http://www.iwon.com/ct/in_wn/iwonslot1,0,1,5.cab
O16 - DPF: {70522FA2-4656-11D5-B0E9-0050DAC24E8F} - http://www.iwon.com/ct/pm2/iwonpm1,0,2,3.cab
O16 - DPF: {00CB77FC-0F09-458A-8BE8-9176423305EB} (Loader Control) - https://gamingclub.microgaming.com/gamingclub/loader.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a224.g.akamai.net/7/224/52/2...apple.com/qt503/us/win/QuickTimeInstaller.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (sys Class) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {525A15D0-4938-11D4-94C7-0050DA20189B} (SnoopyCtrl Class) - http://www.ea.com/downloads/games/common/snoopy/iesnoopy.cab
O16 - DPF: {E87A6788-1D0F-4444-8898-1D25829B6755} (MSN Chat Control 4.0) - http://fdl.msn.com/public/chat/msnchat4.cab
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai.net/7/840/5805...ch.com/audit/includes/ContentAuditControl.cab
O16 - DPF: {1DEFB8C0-22A7-4E58-B735-43A169CDA2AB} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37617.1518171296
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003012801/housecall.antivirus.com/housecall/xscan53.cab

I have to work today, will try to keep in touch but will be on tonight.

Thanks Danboy


----------



## jm100dm (May 26, 1999)

RSRCMTR = this will start resource meter if you have it installed from your windows disk. It is not necessary but if you want it and have your win98 disk go to start\settings control panel\add remove programs\windows setup\system tools\ system resource meter.

Are you still having problems with your taskbar? Cleaning with spybot may have already got you where you need to be. I'm not good at reading hijack this list but will give it a shot.


----------



## jm100dm (May 26, 1999)

I see that you still have office and findfast loading at start up. This is fine for office if you use it all the time and want it available as soon as you start windows. If not just open it using your short cut key to it when you want it. But find fast should go. Just slows your system down.

run hijackthis 
click config in the low right corner.
See that you are on the main tab.
the second third and fourth boxes should be checked.
Hit the back key.
run scan.

To remove findfast click this line
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE 

It looks to me that all I have suggested is still running. Maybe you don't want to make any changes. Thats your choice. Please let me know what you want to do as I don't want to waste my time if you don't want to remove anything that is unnecessary. If you want help and had trouble removing some items let me know. And remember if you remove something and need it back it can be restored.


----------



## Mosaic1 (Aug 17, 2001)

I agre with jm100dm about the Office items running. At the very least you should stop Findfast.

Here's a list of item to Fix:

O2 - BHO: CSBrBHO - {96DA5BEE-4ACC-476C-B3EC-54C6730C4293} - C:\PROGRAM FILES\COMET\INSTALL\TEMP\BRBHO12A.DLL (file missing)

O4 - HKLM\..\Run: [LoadQM] loadqm.exe

O4 - Startup: Microsoft Office Shortcut Bar.lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE

O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE

O16 - DPF: {FA13A9FA-CA9B-11D2-9780-00104B242EA3} (WildTangent Control) - http://www.wildtangent.com/install/...soft/wtinst.cab

O16 - DPF: {A031D222-B496-11D2-9CC8-00105A10AAF6} (WONWebLauncher Class) - http://212.153.46.5/tools/FlipsideW...cherControl.cab

O16 - DPF: {5F03EAB4-1AD5-11D4-AE99-0050DAC24E8F} - http://www.iwon.com/ct/in_wn/iwonslot1,0,1,5.cab

O16 - DPF: {70522FA2-4656-11D5-B0E9-0050DAC24E8F} - http://www.iwon.com/ct/pm2/iwonpm1,0,2,3.cab

O16 - DPF: {00CB77FC-0F09-458A-8BE8-9176423305EB} (Loader Control) - https://gamingclub.microgaming.com/...club/loader.cab


----------



## Danboy (Feb 1, 2001)

Hi jm100dm,

Here is a list of things stiil checked instartup.....

taskbar display controls
system tray
ensoniqmixer
norton auto protect
nav defalert
load qm
nvcpldaemon
dimension 4
tkbell ex

I did remove office, must have overlooked it, also removed findfast ( I hope)

checked boxes and the second third and fourth were checked.
hit back and ran scan.......

Logfile of HijackThis v1.91.2
Scan saved at 9:47:48 AM, on 2/8/03
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.yahoo.com/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {1678F7E1-C422-11D0-AD7D-00400515CAAA} - (no file)
O2 - BHO: CSBrBHO - {96DA5BEE-4ACC-476C-B3EC-54C6730C4293} - C:\PROGRAM FILES\COMET\INSTALL\TEMP\BRBHO12A.DLL (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [NAV DefAlert] C:\PROGRA~1\NORTON~1\DEFALERT.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Dimension4] C:\PROGRAM FILES\D4\D4.EXE
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O9 - Extra button: MoneySide (HKLM)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FA13A9FA-CA9B-11D2-9780-00104B242EA3} (WildTangent Control) - http://www.wildtangent.com/install/wdriver/racing/dodgespeedway/microsoft/wtinst.cab
O16 - DPF: {A031D222-B496-11D2-9CC8-00105A10AAF6} (WONWebLauncher Class) - http://212.153.46.5/tools/FlipsideWebLauncherControl.cab
O16 - DPF: {5F03EAB4-1AD5-11D4-AE99-0050DAC24E8F} - http://www.iwon.com/ct/in_wn/iwonslot1,0,1,5.cab
O16 - DPF: {70522FA2-4656-11D5-B0E9-0050DAC24E8F} - http://www.iwon.com/ct/pm2/iwonpm1,0,2,3.cab
O16 - DPF: {00CB77FC-0F09-458A-8BE8-9176423305EB} (Loader Control) - https://gamingclub.microgaming.com/gamingclub/loader.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a224.g.akamai.net/7/224/52/2...apple.com/qt503/us/win/QuickTimeInstaller.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (sys Class) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {525A15D0-4938-11D4-94C7-0050DA20189B} (SnoopyCtrl Class) - http://www.ea.com/downloads/games/common/snoopy/iesnoopy.cab
O16 - DPF: {E87A6788-1D0F-4444-8898-1D25829B6755} (MSN Chat Control 4.0) - http://fdl.msn.com/public/chat/msnchat4.cab
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai.net/7/840/5805...ch.com/audit/includes/ContentAuditControl.cab
O16 - DPF: {1DEFB8C0-22A7-4E58-B735-43A169CDA2AB} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37617.1518171296
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003012801/housecall.antivirus.com/housecall/xscan53.cab

Hope this helps and I did it right this time. Be back home at lunch, Thanks Danboy


----------



## Mosaic1 (Aug 17, 2001)

Danboy,

HijackThis still shows the items. You have to place a check next to the item youwant to remove and then click on Fix Checked.

Have a look at my Screenshot.

Mo


----------



## jm100dm (May 26, 1999)

Danboy,
Are you still experiencing the problems? Did you reboot your computer after all the changes? I think you are almost there. Just remove those items that Mosaic suggested.


----------



## Danboy (Feb 1, 2001)

Hi Mo and jm,

I think I removed the items that you 2 wanted...........

Logfile of HijackThis v1.91.2
Scan saved at 3:21:08 PM, on 2/8/03
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.yahoo.com/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {1678F7E1-C422-11D0-AD7D-00400515CAAA} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [NAV DefAlert] C:\PROGRA~1\NORTON~1\DEFALERT.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Dimension4] C:\PROGRAM FILES\D4\D4.EXE
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O9 - Extra button: MoneySide (HKLM)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a224.g.akamai.net/7/224/52/2...apple.com/qt503/us/win/QuickTimeInstaller.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (sys Class) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {525A15D0-4938-11D4-94C7-0050DA20189B} (SnoopyCtrl Class) - http://www.ea.com/downloads/games/common/snoopy/iesnoopy.cab
O16 - DPF: {E87A6788-1D0F-4444-8898-1D25829B6755} (MSN Chat Control 4.0) - http://fdl.msn.com/public/chat/msnchat4.cab
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai.net/7/840/5805...ch.com/audit/includes/ContentAuditControl.cab
O16 - DPF: {1DEFB8C0-22A7-4E58-B735-43A169CDA2AB} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37617.1518171296
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003012801/housecall.antivirus.com/housecall/xscan53.cab

Been it and out from work all day. I hope that I got it this time, I am sure you all do too. I think we should give it a day to see if things are back to normal. Thanks again for all your help. I will let you know how things are going........

Danboy


----------



## jm100dm (May 26, 1999)

Yes you got them all. The main thing that we are trying to do is get it back to where you are happy with the way it is running. So yes please let us know.


----------



## Danboy (Feb 1, 2001)

Hi Everyone,

Just thought I would let you know that my puter is running like a dream now. Thanks to Byteman, Mosaic1, and last but not least jm100dm for all of their patience and help. When a problem like this comes up I always seem to learn a few things while trying to fix it. Would a firewall help stop things from getting in to my computer that causes trouble? Thanks again to a great site and great people. 

    

Danboy


----------



## Mosaic1 (Aug 17, 2001)

Danboy,

Hi. Looks good. But there was one thing which showed in your previous StartupList which I would like to double check now. The Screensaver Association.

Please run one more StartupList and post the new one here. We can fix that problem too if it still exists.


Mo


----------



## Danboy (Feb 1, 2001)

Hi MO,

Here is the latest startup list..........That screensaver assn. sounds like the one that took over my homepage that I told you all about........

tartupList report, 2/11/03, 6:20:42 PM
StartupList version: 1.51
Started from : C:\UNZIPPED\STARTUPLIST151[1]\STARTUPLIST.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\HPZSTATX.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\RNATHCHK.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\MICROSOFT MONEY\SYSTEM\URLMAP.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\UNZIPPED\STARTUPLIST151[1]\STARTUPLIST.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

SystemTray = SysTray.Exe
EnsoniqMixer = starter.exe
Norton Auto-Protect = C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
NAV DefAlert = C:\PROGRA~1\NORTON~1\DEFALERT.EXE
NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
Dimension4 = C:\PROGRAM FILES\D4\D4.EXE
TkBellExe = C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

SchedulingAgent = mstask.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Taskbar Display Controls = RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY

--------------------------------------------------

File association entry for .SCR:
HKEY_CLASSES_ROOT\SCR_auto_file\shell\open\command

(Default) = C:\WINDOWS\Explorer.exe "%1"

--------------------------------------------------

C:\WINDOWS\WININIT.INI listing:
(Created 11/2/2003, 14:2:2)

[rename]
nul=C:\WINDOWS\TEMP\~e5d141.tmp
nul=C:\WINDOWS\TEMP\~e5d141.tmp
nul=C:\WINDOWS\TEMP\~e5d141.tmp

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 5/2/2003, 10:43:0)

[rename]
NUL=C:\WINDOWS\TEMP\GLB1A2B.EXE
NUL=C:\WINDOWS\TEMP\GLB1A2B.EXE

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET BLASTER=A220 I7 D1 H7 P330 T6
SET SBPCI=C:\PROGRA~1\CREATIVE\AUDIO\DOSDRV

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - (no file) - {1678F7E1-C422-11D0-AD7D-00400515CAAA}
(no name) - C:\Program Files\Microsoft Money\System\mnyviewer.dll - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Scan for Viruses.job
Symantec NetDetect.job
Maintenance-Defragment programs.job
Maintenance-ScanDisk.job
Maintenance-Disk cleanup.job

--------------------------------------------------

Enumerating Download Program Files:

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\DIRECTOR\SWDIR.DLL
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[{41F17733-B041-4099-A042-B518BB6A408C}]
CODEBASE = http://a224.g.akamai.net/7/224/52/2...apple.com/qt503/us/win/QuickTimeInstaller.exe

[sys Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\PCPITSTOP.DLL
CODEBASE = http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

[SnoopyCtrl Class]
InProcServer32 = C:\PROGRAM FILES\EACOM\UPDATE\NPSNPY.DLL
CODEBASE = http://www.ea.com/downloads/games/common/snoopy/iesnoopy.cab

[MSN Chat Control 4.0]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\MSNCHAT40.OCX
CODEBASE = http://fdl.msn.com/public/chat/msnchat4.cab

[ContentAuditX Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\CONTEN~1.OCX
CODEBASE = http://a840.g.akamai.net/7/840/5805...ch.com/audit/includes/ContentAuditControl.cab

[CWDL_DownLoadControl Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\CWDL_DOWNLOAD.DLL
CODEBASE = http://www.callwave.com/include/cab/CWDL_DownLoad.CAB

[{4E888414-DB8F-11D1-9CD9-00C04F98436A}]
CODEBASE = https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37617.1518171296

[OPUCatalog Class]
InProcServer32 = C:\WINDOWS\SYSTEM\OPUC.DLL
CODEBASE = http://office.microsoft.com/productupdates/content/opuc.cab

[HouseCall Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\XSCAN53.OCX
CODEBASE = http://a840.g.akamai.net/7/840/537/2003012801/housecall.antivirus.com/housecall/xscan53.cab

--------------------------------------------------
End of report, 6,141 bytes
Report generated in 0.516 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


----------

