# Systray error in kernel32.dll



## SilverStar73 (Aug 22, 2004)

My friend has been having problems with her computer the last few days. She has Windows ME, and when she turns the computer on, an error message comes up: SISTRAY HAS CAUSED AN ERROR IN KERNEL32.DLL. SYSTRAY WILL NOW CLOSE.

Then when that's closed, another message says A REQUIRED DLL FILE, AUHKNEW.DLL WAS NOT FOUND.

Also, the sound has completely gone, and the colours on the screen are dodgy, a lot of it's black, and you can't read a lot of things. She's tried running Spybot and Spy Sweeper, and also PC cillin and scandisk, but the problem's still there. Please can anyone help?


----------



## ~Candy~ (Jan 27, 2001)

Hi and welcome.

Sounds like it could be spyware related.

Download and run Adaware.

http://www.lavasoftusa.com/support/download/


----------



## SilverStar73 (Aug 22, 2004)

Thanks, I'll tell her to try that.


----------



## SilverStar73 (Aug 22, 2004)

Hi, I got my friend to download and run Adaware, and although it's got rid of a lot of stuff, the problem's still there. Is there anything else she can try? Thanks.


----------



## tracer357#1 (Jul 19, 2004)

this time do the same thing but this time run everything in safe mode
including scandisk apparently you still have spyware in your system and 
needs to be removed.


----------



## SilverStar73 (Aug 22, 2004)

Ah, ok. Is that when you press F8 while starting the computer?


----------



## SilverStar73 (Aug 22, 2004)

Hi, although my friend's done that, and got rid of a lot of spyware, the kernal32.dll problem is still there. Is there anything else we can try?


----------



## ~Candy~ (Jan 27, 2001)

Can you download hijack this and get a log posted from that?


----------



## SilverStar73 (Aug 22, 2004)

The hijack this log is:

Platform Windows ME (Win 9x 4.90 3000)
MSIE : Internet Explorer V.600 SPI (6.00.2800.1106)

Running Processes

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\TREND PC-CILLIN 2000\PCCIOMON.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\LEXMARK X1100 SERIES\LXBKBMGR.EXE
C:\PROGRAM FILES\LEXMARK X1100 SERIES\LXBKMON.EXE
C:\WINDOWS\TEMP\TD_0001.DIR\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar = http://www.freeserve.com/iesearch/default.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Main, Start Page = http://aol

R0 - HKLM\Software\Microsoft\Internet Explorer\Main, Start Page = http://aol

R1 - HKCU\Software\Microsoft\Internet Explorer\Main, Window Title = Microsoft Internet Explorer provided by Freeserve

03 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX

04 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\Scanregw.exe\autorun

04 - HKLM\..\Run: [System Tray] Systray.Exe

04 - HKLM\..\Run: [MSConfigReminder] C:\WINDOWS\SYSTEM\MsConfig.exe\reminder

04 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\Realplay.exe SYSTEMBOOTHIDEPLAYER

04 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"

09 - Extra button: Messenger - {FB5F1910-F110-11d2-98FE-00C0F0318AFE} - C\ROGRA~1\MSMSGS.EXE

09 - Extra 'Tools' menuitem:MSM Messenger Service - {FB5F1910-F110-11d2 BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE

09 - Extra button: rEAL.COM - {CD67F990-DBE9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll

014 - IERESET.INF: START_PAGE_URL = http://www.freeserve.com

016 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} (WTHoster Class) - http://www.wildtangent.com/install/wdriver/sportsgames/ssxtricky/ea/wtinst.cab

017 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = aoldsl.net

I was advised by someone in a private message to get her to run msconfig, and uncheck everything except system tray and scan registry. And also to remove a lot of unneccessary stuff from the Add/Remove program bit, because of program conflict. There are now no error messages when the system restarts, but there is still no sound, and the dodgy colour problems are still there.

When she tried to print, an error came up that the Windows Display settings needed changing to 800x600 resolution, and 16 bit colour. But when she went to the Display Properties tab, and tried to change it, there was no way of changing to 16 bit colour, and the little arrow you slide to change the screen area wouldn't move from 640x480 pixels. There is no volume icon beside the clock on the screen.


----------



## DCplin (Jul 27, 2004)

Hi SilverStar73,

If you still recieve the "AUHKNEW.DLL WAS NOT FOUND" error message. I recommend You try all available Spyware removing utilities. Each utility will recognize only a limited group of spyware, I recommend you to try all possible to completely remove the spyware from the computer.

If you no longer recieve the above mentioned error message.. Continue reading..

Kernel32.dll is the 32-bit dynamic link library of the operating system kernel. Kernel32.dll handles memory management, input/output operations, and interrupts. When Windows boots up, Kernel32.dll is loaded into a protected memory space.

The error messages you mentioned occur only when another application tries to access the "protected memory space".

The issue you are currently facing could be due to corrupted windows registry or windows files.

1. Download the Boot Floppy Setup file to the Computer you are using to chat with me from the following URL:

http://pesona.mmu.edu.my/~panzheng/bootup/bootme.exe

2. Insert a blank formatted floppy and double-click the downloaded file to start the startup disk creation.

3. Boot the System that is currently facing the problem with the Windows startup disk. Once the A: prompt appears type:

a. Type CD C:\windows\options\cabs or (C:\windows\options\install) Press Enter.
b. When command prompt appears type "SETUP" (without Quotes)
c. Press Enter. 
d. Follow the directions and prompts for the installation process.

This will restore the Operating System without erasing any existing data.

I believe performing these steps will resolve the issue for you, SilverStar73.

Hope this information helps,

DCplin


----------



## ~Candy~ (Jan 27, 2001)

Whoever sent you the private message telling you to remove things via msconfig prior to posting the hijack log is WRONG.

Please put things back, scan again and post the complete log.

I would also be interested in who is pm'ing giving out bad information.

AND PLEASE DO NOT do a Windows overinstall as mentioned above!


----------



## SilverStar73 (Aug 22, 2004)

Okay, thanks for your advice. 

I'll tell my friend to do that, but it may be a couple of days before I can post the new log.

The person didn't actually tell me to post the log after removing stuff with msconfig. He was trying to suggest things to try, and since I hadn't heard from him in a few days, I posted the log in reply to your mail anyway. Sorry, don't want to cause any trouble, I appreciate all the help


----------



## ~Candy~ (Jan 27, 2001)

Ok, thanks for the clarification. I wish folks wouldn't circumvent the forums by using PMs which most often end up confusing new users 

Per chance, did she try a system restore? Or from start, run, scanreg /restore to see if she could go back to when she had sound? And then we can work our way forward from there?


----------



## SilverStar73 (Aug 22, 2004)

We've tried running scanreg, and after we pressed enter, it said Rebuilding Registry. Then the C:\WINDOWS> prompt appeared again, and an error box came up, saying "About Screen" in the top, and Program not responding, Wait, End Task, Cancel. The machine then restarted. And the problem was still there. This was before removing stuff with msconfig, and removing stuff in the add/remove program bit. 

But to be honest, I'm not at all sure how to restore to when she had sound.


----------



## ~Candy~ (Jan 27, 2001)

ME has a system restore volume. Someone more familiar with ME will have to pop in with instructions. It should be found somewhere in the control panel I would think....Let me see what Mr. Google will find


----------



## ~Candy~ (Jan 27, 2001)

http://www.microsoft.com/windowsME/using/computerhealth/articles/systemrestore.asp


----------



## SilverStar73 (Aug 22, 2004)

Thankyou very much for that, we will try it


----------



## Cookiegal (Aug 27, 2003)

Candy asked me to take a look but I think the system restore might be the best way to go so we'll see what the log looks like after a restore. 

There was only one entry in the original log relating to WildTangent that I would delete but let's wait a see what the new log looks like.


----------



## SilverStar73 (Aug 22, 2004)

Thanks. Can I just clarify the order we have to do things?

1. Add stuff back in msconfig
2.Run Hijack this 
3. System restore

Or do we try system restore first?

Thanks


----------



## ~Candy~ (Jan 27, 2001)

System restore first. 

BUT, make a restore point for today, so if something goes really bad, you can get back to where you are right now.


----------



## SilverStar73 (Aug 22, 2004)

Ok thanks. Won't be able to try it till tomorrow/sat, but I will post as soon as we have. Thanks again


----------



## Cookiegal (Aug 27, 2003)

No problem.


----------



## SilverStar73 (Aug 22, 2004)

We tried to run System Restore, and it says its doing it, but when the blue bar gets about halfway, the computer restarts itself. On restarting, it has the error message:

Rstui has caused an error in KERNAL32.DLL
Rstrui will now close

Then it says: Restoration was unsuccessful. No changes were made.

We tried this for different restore points and it was always the same.

Now when the computer is restarted, the error message is:
Qttask has caused an error in KERNAL32.DLL
Qttask will now close.

After adding the stuff back on with Msconfig, the Hijack This log is:

Logfile of HijackThis v1.98.2
Scan saved at 16:16:09, on 04/09/2004
Platform Windows ME (Win 9x 4.90 3000)
MSIE : Internet Explorer V.600 SPI (6.00.2800.1106)

Running Processes

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\PROGRAM FILES\TREND PC-CILLIN 2000\PCCIOMON.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\ACS\AOLACSD.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\LEXMARK X1100 SERIES\LXBKBMGR.EXE
C:\WINDOWS\TAXMON.EXE
C:\PROGRAM FILES\LEXMARK X1100 SERIES\LXBKMON.EXE
C:\WINDOWS\PTVOICE.EXE
C:\WINDOWS\SYSTEM RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\TREND PC-CILLIN 2000\POP3TRAP.EXE
C:\PROGRAM FILES\TREND PC-CILLIN 2000\WEBTRAP.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\ACS\AOLDIAL.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\COREL\SUITES\PROGRAMS\DADS8.EXE
C:\PROGRAM FILES\AOL 9.0\AOLTRAY.EXE
C:\PROGRAM FILES\AOL COMPANION\COMPANION.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\1033\MSOFFICE.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\WINDOWS\TEMP\TD_0001.DIR\HIJACKTHIS.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar = http://www.freeserve.com/iesearch/default.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Main, Start Page = http://aol

R0 - HKLM\Software\Microsoft\Internet Explorer\Main, Start Page = http://aol

R1 - HKCU\Software\Microsoft\Internet Explorer\Main, Window Title = Microsoft Internet Explorer provided by Freeserve

03 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX

04 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\Scanregw.exe\autorun

04 - HKLM\..\Run: [System Tray] Systray.Exe

04 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"

04 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe

04 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe s

04 - HKLM\..\Run: [LoadPowerProfile] Run 1132.exe powrprof.dll, LoadCurrentPwrScheme

04 - HKLM\..\Run: [CountrySelection] pctptt.exe

04 - HKLM\..\Run: [PCTVOICE] pctvoice.exe

04 - HKLM\..\Run: [C-Media Mixer] C:\Program Files\PCI Audio Applications\Mixer.exe/Startup

04 - HKLM\..\Run: [Internat.exe] internat.exe

04 - HKLM\..\Run: [PCCIOMON.EXE] C:\Program Files\Trend PC-cillin 2000\PCCIOMON.EXE

04 - HKLM\..\Run: [pop3trap.exe] C:\Program Files\Trend PC-cillin 2000\pop3trap.exe

04 - HKLM\..\Run: [WebTrap.exe] C:\Program Files\Trend PC-cillin 2000\WebTrap.exe

04 - HKLM\..\Run: [Lexstart] lexstart.exe

04 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\SYSTEM\LXSUPMON.EXE.RUN

04 - HKLM\..\Run: [Quicktime Task] C:\WINDOWS\SYSTEM\QTTASK.EXE  at boottime

04 - HKLM\..\Run: [MicroDialler] C:\Freeserve\Freeserve Connection Kit\atdialler1.exe

04 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\Realplay.exe SYSTEMBOOTHIDEPLAYER

04 - HKLM\..\Run: [AOL Dialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

04 - HKLM\..\Run: [Spysweeper] :\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE/0

04 - HKLM\..\Runservices: [Load Power Profile] Rund1132.exe powrprof.dll, LoadCurrentPwrScheme

04 - HKLM\..\Runservices: [SchedulingAgent] mstask.exe

04 - HKLM\..\Runservices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe

04 - HKLM\..\Runservices: [*stateMgr] C:\WINDOWS\SYSTEM\Restore\StateMgr.exe

04 - HKLM\..\Runservices: [PCCIOMON.EXE] C:\Program Files\Trend PC-cillin 2000\PCCIOMON.EXE

04 - HKLM\..\Runservices: [AolAcsDaemon1] C:\PROGRAM FILES\COMMON FILES\AOL\ACS\AOLACSDI.EXE

04  Startup: Corel Desktop Application Director 8.LNK = C:\Corel\Suite8\Programs\DAD8.EXE

04  Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\OSA9.EXE

04  Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

04  Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe

04  Startup: AOL Companion lnk = C:\Program Files\AOL Companion\Companion.exe

09 - Extra button: Messenger - {FB5F1910-F110-11d2-98FE-00C0F0318AFE} - C\ROGRA~1\MSMSGS.EXE

09 - Extra 'Tools' menuitem:MSM Messenger Service - {FB5F1910-F110-11d2 BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE

09 - Extra button: Real.com - {CD67F990-DBE9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll

014 - IERESET.INF: START_PAGE_URL = http://www.freeserve.com

016 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} (WTHoster Class) - http://www.wildtangent.com/install/wdriver/sportsgames/ssxtricky/ea/wtinst.cab

017 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = aoldsl.net


----------



## Cookiegal (Aug 27, 2003)

Please download and run:

*SPYBOT SEARCH & DESTROY*

http://majorgeeks.com/download2471.html

Open Spybot Search & Destroy (Click Start, Programs, Spybot S&D (Advanced Mode). Click online, Search for updates, Download all available updates. Close all Browser windows, Click ''Check for Problems''. Anything that needs to be fixed it will show in red and have a green check in the box to the left. Click ''Fix Selected Problems'', Then restart your computer.

Then do a couple of on-line virus scans at these links:

http://housecall.trendmicro.com/ http://www.pandasoftware.com/activescan/

Then, after rebooting, please post another log and well see whats left to get rid of.


----------



## ~Candy~ (Jan 27, 2001)

I'm also wondering about a system restore in safe mode?


----------



## SilverStar73 (Aug 22, 2004)

Hi, I havent been able to get online myself for a couple of weeks as I was having some probs with my own computer. I hope you can still help.

Weve run Spybot, and also the 2 other online checks.

We also tried a system restore in safe mode and it didnt work. I saw somewhere else on these forums that you needed to get a patch for Windows ME before system resore works, so we got that too, and it does now work, but we can only go back to the day when we got the patch, not before.

After rebooting the system, the Hijack This log is:

Logfile of HijackThis v1.98.2
Scan saved at 17:16:50, on 09/09/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\PROGRAM FILES\TREND PC-CILLIN 2000\PCCIOMON.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\ACS\AOLACSD.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\LEXMARK X1100 SERIES\LXBKBMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\PROGRAM FILES\LEXMARK X1100 SERIES\LXBKBMON.EXE
C:\WINDOWS\PCTVOICE.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\TREND PC-CILLIN 2000\POP3TRAP.EXE
C:\PROGRAM FILES\TREND PC-CILLIN 2000\WEBTRAP.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\ACS\AOLDIAL.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\COREL\SUITE8\PROGRAMS\DAD8.EXE
C:\PROGRAM FILES\AOL 9.0\AOLTRAY.EXE
C:\PROGRAM FILES\AOL COMPANION\COMPANION.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\1033\MSOFFICE.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\WINDOWS\TEMP\TD_0001.DIR\HIJACKTHIS.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.freeserve.com/iesearch/default.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://aol
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://aol
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Freeserve
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [PCTVOICE] pctvoice.exe
O4 - HKLM\..\Run: [C-Media Mixer] C:\Program Files\PCI Audio Applications\Mixer.exe /startup
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [PCCIOMON.EXE] "C:\Program Files\Trend PC-cillin 2000\PCCIOMON.EXE"
O4 - HKLM\..\Run: [pop3trap.exe] "C:\Program Files\Trend PC-cillin 2000\pop3trap.exe"
O4 - HKLM\..\Run: [WebTrap.exe] "C:\Program Files\Trend PC-cillin 2000\WebTrap.exe"
O4 - HKLM\..\Run: [LexStart] lexstart.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\SYSTEM\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [MicroDialler] C:\Freeserve\FreeserveConnectionKit\atdialler1.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [PCCIOMON.EXE] "C:\Program Files\Trend PC-cillin 2000\PCCIOMON.EXE"
O4 - HKLM\..\RunServices: [AolAcsDaemon1] "C:\PROGRAM FILES\COMMON FILES\AOL\ACS\AOLACSD.EXE"
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE" /0
O4 - Startup: Corel Desktop Application Director 8.LNK = C:\Corel\Suite8\Programs\DAD8.EXE
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} (WTHoster Class) - http://www.wildtangent.com/install/wdriver/sportsgames/ssxtricky/ea/wtinst.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = aoldsl.net


----------



## Cookiegal (Aug 27, 2003)

Rescan with Hijack This, close all browser windows except Hijack This, put a check mark beside these entries and click fix checked.

O4 - HKLM\..\Run: [internat.exe] internat.exe

O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} (WTHoster Class) - http://www.wildtangent.com/install/...y/ea/wtinst.cab


----------



## ~Candy~ (Jan 27, 2001)

O4 - HKLM\..\Run: [internat.exe] internat.exe

Isn't that for the keyboard? I think I have that loading with my Spanish keyboard in Mexico, but I can't check that right now.


----------



## Cookiegal (Aug 27, 2003)

Yes, it's the language selection icon but doesn't need to run at start-up. It's not a bad thing.

I don't see anything in the log to account for the problems. We could try this as it doesn't always show in the log:

Download the VX2Finder.exe tool. Click on the VX2Finder.exe and then click on the Click to Find VX2.Betterinternet button. It will display the files, the Guardian Key and User Agent string. Now click the Make Log button. It will open the log in notepad. Copy and paste that log here and wait for further instructions.

http://download.broadbandmedic.com/


----------



## ~Candy~ (Jan 27, 2001)

Thanks Cookie....yes, I agree it doesn't need to start....but if you need to toggle back and forth to get that ñ symbol, it's handy to have in the lower right hand corner 

Just keeping you in check


----------



## Cookiegal (Aug 27, 2003)

> Just keeping you in check


Si si seniorita 

I have programmed Ctrl-Alt to switch from French to English, which I have to do quite often. It was handy to have the icon but I dumped it to make room for other stuff. One of these days I'll get a 17" screen


----------



## SilverStar73 (Aug 22, 2004)

Hi,

She has unchecked the 2 entries in the hijack this bit, and nothing is different. I will tell her to try the VX2Finder. She only has a dial up connection, so will this still work as it says broadband medic?


----------



## Cookiegal (Aug 27, 2003)

That's just the name of the site. You can also get it here:

http://tools.zerosrealm.com/VX2Finder9x.exe


----------



## SilverStar73 (Aug 22, 2004)

Ok, thanks


----------



## SilverStar73 (Aug 22, 2004)

Ok, she has done this and the log is:

Log for VX2.BetterInternet File Finder (ver126)

Files Found---


User Agent String---
CDsource=v2.15e.01 IEAK


----------



## Cookiegal (Aug 27, 2003)

Do a couple of on-line virus scans at these links:

http://housecall.trendmicro.com/ http://www.pandasoftware.com/activescan/

*Delete temporary files*

In safe mode, go to the C:\Windows\Temp folder. Open the Temporary folder. Click on Edit - select all, then Edit - delete to empty the contents.

Next, navigate to the C:\Documents and Settings\Owner\Local Settings\Temp folder. Open the Temp folder and go to Edit - Select All then Edit - Delete to delete the entire contents of the Temp folder.

Go to Tools - Internet Options - General tab - delete temporary Internet files  put a check beside delete off-line contents then click OK

*Empty your recycle bin.*


----------

