# Do I Have A Bug???



## Russ_R (Apr 12, 2003)

I have been having more & more problems with my computer(laptop) w/each use. ..I have Windows ME & *CompuServe is my internet browser.* ..Some of the error messages I've been getting are Qttask (not responding), Wuauboot(caused error), VSUI50.DLL., GBROWSER.DLL., & others I didn't write down. ..My Computer is continuously idling after a couple mins of use. ..QuickTime cause the computer to freeze if clicking the icon or if I try to run something on it. ..My mother let the MacAfee AntiVirus expire & now the computer will freeze if I click on anything to do with MacAfee. ...Ad-aware doesn't detect anything wrong, niether does ScanDisk. ..Defrag does nothing helpful anymore. ..A couple days ago, I reloaded the settings back to what they were a month ago, but I still have problems. ..*Most of the FREE AntiVirus software requires Internet Explorer or AOL, we don't use either*. ..I don't know much about computers, so take that into consideration when replying.

Thank you for your time.

-Russ


----------



## Gordon7000 (Mar 22, 2003)

Hi Russ,

It's been a number of years since I've used Compuserve, so I don't know if this will work. However, if you can manage it and as a first step, could you try connecting to the online virus scanner below and run a full system scan:

http://housecall.trendmicro.com/housecall/start_corp.asp

Let's know how you get on.

Regards, Gordon


----------



## flavallee (May 12, 2002)

Russ_R:

Click Start - Run, type in MSCONFIG, then click OK - Startup(tab). Look for the Quicktime task command, uncheck it, click Apply - OK, then reboot your computer.

Click Start - Run, type in REGEDIT, then click OK. Click the + in HKEY_LOCAL_MACHINE - Software - Microsoft - Windows - CurrentVersion, then click directly on the Run folder to expose its entries in the right pane. If the Quicktime task command is still present among the list, right-click its icon, click Delete - Yes, close the registry, then reboot your computer again.

If you're no longer using McAfee VirusScan, read the article in my website which will show you the steps to completely clean it out of your computer. Just uninstalling it in Add/Remove Programs won't do it.

Frank's Windows 95/98 Tips


----------



## Russ_R (Apr 12, 2003)

> _Originally posted by flavallee:_
> *Russ_R:
> 
> Click Start - Run, type in MSCONFIG, then click OK - Startup(tab). Look for the Quicktime task command, uncheck it, click Apply - OK, then reboot your computer.
> ...


Thanks.

..Now with Quicktime task gone, don't I need something to replace it with?

None of the links to your website will work(I did a search to find more). ..I get: "504 Gateway Timeout
This Web page could not be opened. There may be too many people accessing this page or the page may be unavailable. Please try again later." ..I have tried numerous times to access your site, with no success. ..Will you post the step to completely clean my computer of McAfee?

Another problem I'm having is with hidden files, they continue to grow -from 809(before I had probs) to 835 now. 
I have hade a ESSDaemon window pop-up a few times, when starting up the computer. ..What is ESSDaemon for? Also I have notice files that read DIR000(with a number &/or letter following the last zero), what are these files?
The computer still has a loud idle, not a grinding or threatening sounding idle, just louder than normal. ..Any more suggestions, will be helpful, thanks.


----------



## Russ_R (Apr 12, 2003)

..Anyone???


----------



## AAPlus (Oct 29, 2001)

Hello,Russ_R & Welcome

Well first thing i think you should do is 
clean out the OS try this it will clean all
the Temp file also any index files

http://www.x9000.net/downloads/xen.zip

Now if you like have a look at AVG one of the
best free Virus scanners out

http://www.grisoft.com/html/us_downl.htm

& have you updated to Ad-Aware 6 build 0162
with new Reffile # 136 09.04.2003 if you do
please make sure that you Uninstall any other
Ver's of Ad-Aware first & if you have the Refupdate Tool
remove it as well you do not need it

once you Install Ad-Aware start it up then goto
the top of the scanner & look for the Globe click it
& it will update that Reffile # for you

Good luck


----------



## Russ_R (Apr 12, 2003)

> _Originally posted by AAPlus:_
> *Hello,Russ_R & Welcome
> 
> Well first thing i think you should do is
> ...


..Sorry for my ignorance, but whats the OS? 
..And what program do I use to open xen.zip? ..I don't see an un-pack option.



> _Originally posted by AAPlus:_
> *Now if you like have a look at AVG one of the
> best free Virus scanners out
> 
> ...


..I have Ad-Aware 5.0, do I download 6 from http://www.grisoft.com/html/us_downl.htm or do I look for it somewhere else? ..I new to this sort of thing.
Thanks.


----------



## TonyKlein (Aug 26, 2001)

You can download it here .

After installing AAW, and before running the program, first press "check for updates now".
Click "Connect" and install all updated components available. Click 'Finish'.

Shut down and relaunch Ad-Aware. It should now say "Reference File 0R 136"

Press "Scan Now", then 'next', and let Ad-Aware scan your drives.
It will probably find some "bad" files and registry keys. Click 'Next' again.
Check all found items, and click 'next' once more.
It will ask you whether you'd like to remove all checked items. Click OK.

Finally, close Ad-Aware, and reboot.


----------



## Russ_R (Apr 12, 2003)

> _Originally posted by TonyKlein:_
> *You can download it here .
> 
> After installing AAW, and before running the program, first press "check for updates now".
> ...


..I should uninstall Ad-Aware 5, first, right? ..How do I *fully* get rid of it?
Thanks, Tony.



> _Originally posted by AAPlus:_
> *Hello,Russ_R & Welcome
> 
> Well first thing i think you should do is
> ...


..Sorry for my ignorance, but whats the OS? 
..And what program do I use to open xen.zip? ..I don't see an un-pack option.


----------



## TonyKlein (Aug 26, 2001)

> _Originally posted by Russ_R:_
> *..I should uninstall Ad-Aware 5, first, right? ..How do I fully get rid of it?
> Thanks, Tony.
> 
> *


Ad-Aware doesn't write a lot to the registry.

Just close the program down if it's running, then go to Control Panel > Add/Remove programs, and uninstall it.
Finally, remove the Lavasoft\Ad-Aware folder in Program Files and your Start Menu shortcut, if they're still there. That's it.

An OS is an Operating System.

Xen.zip is a compressed file. 
You need to decompress it with a utility like WinZip

Many downloads come in the shape of a compressed file, so it's an indispensible tool, really.
It has an evaluation version which you can use for a month or so

Here are a couple of tutorials:

WinZip Tutorial

Using Winzip Tutorial

And QuickZip is an excellent alternative to WinZip that's freeware: http://www.tucows.com/system/preview/194312.html

After unzipping the file to a folder of your choice, you'll end up with the file itself.

Cheers,


----------



## Russ_R (Apr 12, 2003)

..Thanks for your help, Tony!


----------



## TonyKlein (Aug 26, 2001)

No prob!


----------



## AAPlus (Oct 29, 2001)

Hello,Russ_R

Please do all that Tony ask of you

Hey,TK

you the MAN

Good luck


----------



## TonyKlein (Aug 26, 2001)

Hi AAPlus!


----------



## walkeriam (Feb 19, 2002)

He really should go to Housecall and run a full system scan, like Gordon7000 said above.
http://housecall.trendmicro.com/hou.../start_corp.asp

Also the ESSDAEMON you refer to is related to a sound card. You may have an ESS Sound Card in your system and the driver may need updated? 
http://www.soundcard-drivers.com/companies/382.htm

Just my humble opinion!


----------



## TonyKlein (Aug 26, 2001)

> _Originally posted by walkeriam:_
> *He really should go to Housecall and run a full system scan, like Gordon7000 said above.
> [*


He should do that as well, if he hasn't already. 

It would also be useful to have a look at his configuration.

Go to http://www.spywareinfo.com/downloads.php#det, and download 'Hijack This!'.

Unzip it, launch Hijack This, then press "Config" > "Miscellaneous Tools", and press "Generate Startuplist Log"

This will generate a text file that will list all running processes, _all_ applications that are loaded automatically when you start Windows, and more.

Go to Edit > select all, copy it and post its contents here.


----------



## Russ_R (Apr 12, 2003)

> _Originally posted by walkeriam:_
> *He really should go to Housecall and run a full system scan, like Gordon7000 said above.
> http://housecall.trendmicro.com/hou.../start_corp.asp *


..I would but it won't let me download it, because I uses the *CompuServe* browser & not Explorer or the other browsers.

..After I downloaded the QuickZip & restarted my computer & then shut it down for the day. ..The next times I started the computer it would freeze everytime windows would come up. ..So I restored my settings from 3/03/03. ..Just a random date. ..My computer still has the continuous idle going on, and when I run Ad-Aware I see files(of numbers) that I've never used to see when the computer was running correctly.


----------



## TonyKlein (Aug 26, 2001)

Please run Hijack This and post a log, as I requested.

That should tell us a little more.


----------



## Russ_R (Apr 12, 2003)

> _Originally posted by TonyKlein:_
> *Please run Hijack This and post a log, as I requested.
> 
> That should tell us a little more. *


..I need a zip program to use Hijack This, before when I downloaded Quick Zip my computer wouldn't work. So I don't have it anymore, now that I've gone back to my old settings. If I try to download the zip program again, I'm sure it will freeze as before. ..I'd download the other zip program$$, but I if it doesn't work(makes the computer freeze) I'll have to go back to my old setting so the program will be gone & I'll lose money.


----------



## TonyKlein (Aug 26, 2001)

You won't need to pay for WinZip for the first 30 days. It's a trial version.


----------



## Russ_R (Apr 12, 2003)

> _Originally posted by TonyKlein:_
> *You won't need to pay for WinZip for the first 30 days. It's a trial version. *


..I'll try it. ..That's WinZip 2.(something) right? ...On day 31 do I get charged automaticlly or do I have to click something first? ..Sorry Tony, I'm paranoid about these kind of things.


----------



## TonyKlein (Aug 26, 2001)

No, it's like any other trial version: After day 30 it will just refuse to work any longer and insist you either uninstall it or purchase the full version.

Nothing scary about it.


----------



## Russ_R (Apr 12, 2003)

> _Originally posted by TonyKlein:_
> *No, it's like any other trial version: After day 30 it will just refuse to work any longer and insist you either uninstall it or purchase the full version.
> 
> Nothing scary about it. *


...Cool, thank you Tony.

I'll download the WinZip and then I'll run Hijack This. ..I will write back soon, if my computer still works.


----------



## Russ_R (Apr 12, 2003)

Here yah go...

StartupList report, 4/16/2003, 4:14:43 AM
StartupList version: 1.52
Started from : C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE
Detected: Windows ME (Win9x 4.90.3000)
Detected: Internet Explorer v5.50 (5.50.4134.0600)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSHWIN32.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\WEBSCANX.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSSTAT.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\ESSD.EXE
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPLPR.EXE
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPENH.EXE
C:\PROGRAM FILES\ONE-TOUCH\CP32NBTN.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\S3TRAYHP.EXE
C:\WINDOWS\SYSTEM\PRPCUI.EXE
C:\WINDOWS\WT\WCMDMGR.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\ALOGSERV.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\AVCONSOL.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\PROGRAM FILES\COMPUSERVE 7.0\CSTRAY.EXE
C:\PALM\HOTSYNC.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\COMPUSERVE 7.0\WCS2000.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
MICROSOFT WORKS CALENDAR REMINDERS.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
CompuServe 7.0 Tray Icon.lnk = C:\Program Files\CompuServe 7.0\cstray.exe
PowerReg Scheduler.exe
America Online 5.0 Tray Icon.lnk = C:\America Online 5.0\aoltray.exe
MICROSOFT OFFICE.LNK = C:\Program Files\Microsoft Office\Office10\OSA.EXE
HOTSYNC MANAGER.LNK = C:\Palm\HOTSYNC.EXE
WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
TaskMonitor = C:\WINDOWS\taskmon.exe
PCHealth = C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
SystemTray = SysTray.Exe
ESS Daemon = C:\WINDOWS\ESSD.exe
SynTPLpr = C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
SynTPEnh = C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
CP32NOT = C:\PROGRA~1\ONE-TO~1\CP32NBTN.EXE
WorksFUD = C:\Program Files\Microsoft Works\wkfud.exe
Microsoft Works Portfolio = C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
Microsoft Works Update Detection = C:\Program Files\Microsoft Works\WkDetect.exe
S3TRAYHP = S3trayhp.exe
PRPCMonitor = PRPCUI.exe
wcmdmgr = C:\WINDOWS\wt\wcmdmgrl.exe -launch
AlogServEXE = C:\Program Files\McAfee\McAfee VirusScan\AlogServ.exe
AvconsoleEXE = C:\Program Files\McAfee\McAfee VirusScan\avconsol.exe /minimize
Vshwin32EXE = C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSHWIN32.EXE
McAfeeWebScanX = C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\WebScanX.Exe
RealTray = C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
QuickTime Task = "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent = mstask.exe
SSDPSRV = C:\WINDOWS\SYSTEM\ssdpsrv.exe
*StateMgr = C:\WINDOWS\System\Restore\StateMgr.exe
Vshwin32EXE = C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSHWIN32.EXE
McAfeeWebScanX = C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\WebScanX.Exe /RUNSERVICES
VsecomrEXE = C:\Program Files\McAfee\McAfee VirusScan\VSEcomR.EXE
VsStatEXE = C:\Program Files\McAfee\McAfee VirusScan\VSSTAT.EXE /SHOWWARNING

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

MoneyAgent = "C:\Program Files\Microsoft Money\System\Money Express.exe"

--------------------------------------------------

C:\WINDOWS\WININIT.INI listing:
(Created 16/4/2003, 3:54:46)

[rename]
nul=C:\PROGRA~1\WINZIP~1\wzse32.dll
nul=C:\PROGRA~1\WINZIP~1\WZIPSE32.EXE
nul=C:\PROGRA~1\WINZIP~1

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 14/4/2003, 12:51:58)

[Rename]
NUL=C:\PROGRA~1\REAL\REALPL~1\REALPLAY.EXE
C:\PROGRA~1\REAL\REALPL~1\REALPLAY.EXE=C:\_RESTORE\EXTRACT\A0356791.CPY
NUL=C:\PROGRA~1\COMMON~1\REAL\COMMON\RPCL3260.DLL
C:\PROGRA~1\COMMON~1\REAL\COMMON\RPCL3260.DLL=C:\_RESTORE\EXTRACT\A0356725.CPY
NUL=C:\PROGRA~1\COMMON~1\REAL\COMMON\PNGU3266.DLL
C:\PROGRA~1\COMMON~1\REAL\COMMON\PNGU3266.DLL=C:\_RESTORE\EXTRACT\A0356730.CPY
NUL=C:\PROGRA~1\COMMON~1\REAL\COMMON\PNRS3260.DLL
C:\PROGRA~1\COMMON~1\REAL\COMMON\PNRS3260.DLL=C:\_RESTORE\EXTRACT\A0356731.CPY
NUL=C:\PROGRA~1\REAL\REALPL~1\RPAP3260.DLL
C:\PROGRA~1\REAL\REALPL~1\RPAP3260.DLL=C:\_RESTORE\EXTRACT\A0356735.CPY
NUL=C:\PROGRA~1\REAL\REALPL~1\RNMS3260.DLL
C:\PROGRA~1\REAL\REALPL~1\RNMS3260.DLL=C:\_RESTORE\EXTRACT\A0356736.CPY
NUL=C:\PROGRA~1\COMMON~1\REAL\UPDATE\UPGR3260.DLL
C:\PROGRA~1\COMMON~1\REAL\UPDATE\UPGR3260.DLL=C:\_RESTORE\EXTRACT\A0356699.CPY
NUL=C:\PROGRA~1\COMMON~1\REAL\UPDATE\RPUP3260.DLL
C:\PROGRA~1\COMMON~1\REAL\UPDATE\RPUP3260.DLL=C:\_RESTORE\EXTRACT\A0356700.CPY
NUL=C:\PROGRA~1\COMMON~1\REAL\UPDATE\RNQU3260.DLL
C:\PROGRA~1\COMMON~1\REAL\UPDATE\RNQU3260.DLL=C:\_RESTORE\EXTRACT\A0356702.CPY
NUL=C:\PROGRA~1\COMMON~1\REAL\UPDATE\SETU3260.DLL
C:\PROGRA~1\COMMON~1\REAL\UPDATE\SETU3260.DLL=C:\_RESTORE\EXTRACT\A0356703.CPY
C:\WINDOWS\powerpnt.ini=C:\_RESTORE\EXTRACT\powerpnt.ini
C:\WINDOWS\wavemix.ini=C:\_RESTORE\EXTRACT\wavemix.ini
C:\WINDOWS\tasks\desktop.ini=C:\_RESTORE\EXTRACT\desktop.ini
C:\WINDOWS\win.ini=C:\_RESTORE\EXTRACT\win.ini
C:\WINDOWS\system.ini=C:\_RESTORE\EXTRACT\system.ini
C:\WINDOWS\USER.DAT=C:\_RESTORE\EXTRACT\USER.DAT
C:\WINDOWS\SYSTEM.DAT=C:\_RESTORE\EXTRACT\SYSTEM.DAT
C:\WINDOWS\CLASSES.DAT=C:\_RESTORE\EXTRACT\CLASSES.DAT

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET windir=C:\WINDOWS
SET winbootdir=C:\WINDOWS
SET COMSPEC=C:\WINDOWS\COMMAND.COM
SET PATH=C:\WINDOWS;C:\WINDOWS\COMMAND
SET PROMPT=$p$g
SET TEMP=C:\WINDOWS\TEMP
SET TMP=C:\WINDOWS\TEMP

--------------------------------------------------

C:\WINDOWS\WINSTART.BAT listing:

C:\WINDOWS\tmpcpyis.bat

--------------------------------------------------

Enumerating Task Scheduler jobs:

Tune-up Application Start.job
PCHealth Scheduler for Data Collection.job

--------------------------------------------------

Enumerating Download Program Files:

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[QuickTime Object]
InProcServer32 = C:\WINDOWS\SYSTEM\QTPLUGIN.OCX
CODEBASE = http://www.apple.com/qtactivex/qtplugin.cab

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\DIRECTOR\SWDIR.DLL
CODEBASE = http://active.macromedia.com/director/cabs/sw.cab

[Corel Presentations Show It!]
InProcServer32 = C:\WINDOWS\DOWNLO~1\AXPRSHOW.OCX
CODEBASE = http://www.corel.com/products/wordperfect/cwps8/plugin/axprshow.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL
UPnPMonitor: C:\WINDOWS\SYSTEM\UPNPUI.DLL
AUHook: C:\WINDOWS\SYSTEM\AUHOOK.DLL

--------------------------------------------------
End of report, 8,753 bytes
Report generated in 1.037 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


----------



## Russ_R (Apr 12, 2003)

> _Originally posted by TonyKlein:_
> *He should do that as well, if he hasn't already.
> 
> It would also be useful to have a look at his configuration.
> ...


So what looks wrong here?.....

StartupList report, 4/16/2003, 4:14:43 AM
StartupList version: 1.52
Started from : C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE
Detected: Windows ME (Win9x 4.90.3000)
Detected: Internet Explorer v5.50 (5.50.4134.0600)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSHWIN32.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\WEBSCANX.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSSTAT.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\ESSD.EXE
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPLPR.EXE
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPENH.EXE
C:\PROGRAM FILES\ONE-TOUCH\CP32NBTN.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\S3TRAYHP.EXE
C:\WINDOWS\SYSTEM\PRPCUI.EXE
C:\WINDOWS\WT\WCMDMGR.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\ALOGSERV.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\AVCONSOL.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\PROGRAM FILES\COMPUSERVE 7.0\CSTRAY.EXE
C:\PALM\HOTSYNC.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\COMPUSERVE 7.0\WCS2000.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
MICROSOFT WORKS CALENDAR REMINDERS.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
CompuServe 7.0 Tray Icon.lnk = C:\Program Files\CompuServe 7.0\cstray.exe
PowerReg Scheduler.exe
America Online 5.0 Tray Icon.lnk = C:\America Online 5.0\aoltray.exe
MICROSOFT OFFICE.LNK = C:\Program Files\Microsoft Office\Office10\OSA.EXE
HOTSYNC MANAGER.LNK = C:\Palm\HOTSYNC.EXE
WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
TaskMonitor = C:\WINDOWS\taskmon.exe
PCHealth = C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
SystemTray = SysTray.Exe
ESS Daemon = C:\WINDOWS\ESSD.exe
SynTPLpr = C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
SynTPEnh = C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
CP32NOT = C:\PROGRA~1\ONE-TO~1\CP32NBTN.EXE
WorksFUD = C:\Program Files\Microsoft Works\wkfud.exe
Microsoft Works Portfolio = C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
Microsoft Works Update Detection = C:\Program Files\Microsoft Works\WkDetect.exe
S3TRAYHP = S3trayhp.exe
PRPCMonitor = PRPCUI.exe
wcmdmgr = C:\WINDOWS\wt\wcmdmgrl.exe -launch
AlogServEXE = C:\Program Files\McAfee\McAfee VirusScan\AlogServ.exe
AvconsoleEXE = C:\Program Files\McAfee\McAfee VirusScan\avconsol.exe /minimize
Vshwin32EXE = C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSHWIN32.EXE
McAfeeWebScanX = C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\WebScanX.Exe
RealTray = C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
QuickTime Task = "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent = mstask.exe
SSDPSRV = C:\WINDOWS\SYSTEM\ssdpsrv.exe
*StateMgr = C:\WINDOWS\System\Restore\StateMgr.exe
Vshwin32EXE = C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSHWIN32.EXE
McAfeeWebScanX = C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\WebScanX.Exe /RUNSERVICES
VsecomrEXE = C:\Program Files\McAfee\McAfee VirusScan\VSEcomR.EXE
VsStatEXE = C:\Program Files\McAfee\McAfee VirusScan\VSSTAT.EXE /SHOWWARNING

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

MoneyAgent = "C:\Program Files\Microsoft Money\System\Money Express.exe"

--------------------------------------------------

C:\WINDOWS\WININIT.INI listing:
(Created 16/4/2003, 3:54:46)

[rename]
nul=C:\PROGRA~1\WINZIP~1\wzse32.dll
nul=C:\PROGRA~1\WINZIP~1\WZIPSE32.EXE
nul=C:\PROGRA~1\WINZIP~1

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 14/4/2003, 12:51:58)

[Rename]
NUL=C:\PROGRA~1\REAL\REALPL~1\REALPLAY.EXE
C:\PROGRA~1\REAL\REALPL~1\REALPLAY.EXE=C:\_RESTORE\EXTRACT\A0356791.CPY
NUL=C:\PROGRA~1\COMMON~1\REAL\COMMON\RPCL3260.DLL
C:\PROGRA~1\COMMON~1\REAL\COMMON\RPCL3260.DLL=C:\_RESTORE\EXTRACT\A0356725.CPY
NUL=C:\PROGRA~1\COMMON~1\REAL\COMMON\PNGU3266.DLL
C:\PROGRA~1\COMMON~1\REAL\COMMON\PNGU3266.DLL=C:\_RESTORE\EXTRACT\A0356730.CPY
NUL=C:\PROGRA~1\COMMON~1\REAL\COMMON\PNRS3260.DLL
C:\PROGRA~1\COMMON~1\REAL\COMMON\PNRS3260.DLL=C:\_RESTORE\EXTRACT\A0356731.CPY
NUL=C:\PROGRA~1\REAL\REALPL~1\RPAP3260.DLL
C:\PROGRA~1\REAL\REALPL~1\RPAP3260.DLL=C:\_RESTORE\EXTRACT\A0356735.CPY
NUL=C:\PROGRA~1\REAL\REALPL~1\RNMS3260.DLL
C:\PROGRA~1\REAL\REALPL~1\RNMS3260.DLL=C:\_RESTORE\EXTRACT\A0356736.CPY
NUL=C:\PROGRA~1\COMMON~1\REAL\UPDATE\UPGR3260.DLL
C:\PROGRA~1\COMMON~1\REAL\UPDATE\UPGR3260.DLL=C:\_RESTORE\EXTRACT\A0356699.CPY
NUL=C:\PROGRA~1\COMMON~1\REAL\UPDATE\RPUP3260.DLL
C:\PROGRA~1\COMMON~1\REAL\UPDATE\RPUP3260.DLL=C:\_RESTORE\EXTRACT\A0356700.CPY
NUL=C:\PROGRA~1\COMMON~1\REAL\UPDATE\RNQU3260.DLL
C:\PROGRA~1\COMMON~1\REAL\UPDATE\RNQU3260.DLL=C:\_RESTORE\EXTRACT\A0356702.CPY
NUL=C:\PROGRA~1\COMMON~1\REAL\UPDATE\SETU3260.DLL
C:\PROGRA~1\COMMON~1\REAL\UPDATE\SETU3260.DLL=C:\_RESTORE\EXTRACT\A0356703.CPY
C:\WINDOWS\powerpnt.ini=C:\_RESTORE\EXTRACT\powerpnt.ini
C:\WINDOWS\wavemix.ini=C:\_RESTORE\EXTRACT\wavemix.ini
C:\WINDOWS\tasks\desktop.ini=C:\_RESTORE\EXTRACT\desktop.ini
C:\WINDOWS\win.ini=C:\_RESTORE\EXTRACT\win.ini
C:\WINDOWS\system.ini=C:\_RESTORE\EXTRACT\system.ini
C:\WINDOWS\USER.DAT=C:\_RESTORE\EXTRACT\USER.DAT
C:\WINDOWS\SYSTEM.DAT=C:\_RESTORE\EXTRACT\SYSTEM.DAT
C:\WINDOWS\CLASSES.DAT=C:\_RESTORE\EXTRACT\CLASSES.DAT

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET windir=C:\WINDOWS
SET winbootdir=C:\WINDOWS
SET COMSPEC=C:\WINDOWS\COMMAND.COM
SET PATH=C:\WINDOWS;C:\WINDOWS\COMMAND
SET PROMPT=$p$g
SET TEMP=C:\WINDOWS\TEMP
SET TMP=C:\WINDOWS\TEMP

--------------------------------------------------

C:\WINDOWS\WINSTART.BAT listing:

C:\WINDOWS\tmpcpyis.bat

--------------------------------------------------

Enumerating Task Scheduler jobs:

Tune-up Application Start.job
PCHealth Scheduler for Data Collection.job

--------------------------------------------------

Enumerating Download Program Files:

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/...ash/swflash.cab

[QuickTime Object]
InProcServer32 = C:\WINDOWS\SYSTEM\QTPLUGIN.OCX
CODEBASE = http://www.apple.com/qtactivex/qtplugin.cab

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\DIRECTOR\SWDIR.DLL
CODEBASE = http://active.macromedia.com/director/cabs/sw.cab

[Corel Presentations Show It!]
InProcServer32 = C:\WINDOWS\DOWNLO~1\AXPRSHOW.OCX
CODEBASE = http://www.corel.com/products/wordp...in/axprshow.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL
UPnPMonitor: C:\WINDOWS\SYSTEM\UPNPUI.DLL
AUHook: C:\WINDOWS\SYSTEM\AUHOOK.DLL

--------------------------------------------------
End of report, 8,753 bytes
Report generated in 1.037 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


----------



## Russ_R (Apr 12, 2003)

> _Originally posted by TonyKlein:_
> *You can download it here .
> 
> After installing AAW, and before running the program, first press "check for updates now".
> ...


38 "Wild Tangent" objects, I clicked the 'ok' button to remove all checked items & the computer froze. ..So I restarted the computer & after widows loaded & things wouldn't work, I had to do Ctrl/Alt/Delete: *Taskmon {Not responding}* so I clicked on *end task* & went to see If Ad-Aware deleted the files. ..It read *Objects Quarantined - 38* & froze again- *Stmgr {Not responding}*, so I restarted the computer. *ScanDisk* wouldn't work so I restarted. ..When Windows came up, I got an hourglass next to the mouse pointer, so I restarted again. ..In Windows nothing I clicked on would work- *Ddhelp {Not responding}*, so I clicked *end task* & tried to get online. ..*Compuserve {Not responding}*. ..I tried again & the *screen turned black*, so I restarted the Computer & *ScanDisk* checked for errors before Windows came up(It found none, like always). ..When Windows came up the computer foze, so I restarted again. ..When Windows came on, I rushed to get online & here I am. ..What happened??? ...*Anyone*.


----------



## TonyKlein (Aug 26, 2001)

No idea what happened. Your computer shouldn't react so violently to having a few Wild Tangent objects removed by Ad-Aware.

I think you would benefit by upgrading Internet Explorer to 6.0 SP1. That would replace and upgrade an awful lot of system files.

But there are a few other things you must do.

For a start, you really have too many applications starting up automatically as Windows starts, and you would benefit considerably by trimming down that list.

Go to Start > Run > Msconfig, and uncheck _everything_ but the absolutely necessary on the 'Startup' tab.

Then click OK, close Msconfig, and reboot.

You can use Pacman's List of Startup Applications to help you determine what should stay and what should go.

In case of doubt, please don't hesitate to ask

After doing that, repair and compact your Registry by running the Scanreg /fix command.
Here's how to go about that: ScanRegW - Or How to Repair the Registry in WinME

Finally, upgrade Internet Explorer.

Before doing that empty the contents of your C:\Windows\*Temp* folder _in its entirety_.
Also go to Internet Options, and press "delete files". Also clear History.
Next, on that same tab, press Settings > Show files, and delete everything you see in there.

Good luck,


----------



## Russ_R (Apr 12, 2003)

> _Originally posted by TonyKlein:_
> *No idea what happened. Your computer shouldn't react so violently to having a few Wild Tangent objects removed by Ad-Aware.
> 
> I think you would benefit by upgrading Internet Explorer to 6.0 SP1. That would replace and upgrade an awful lot of system files.
> ...


..Even with the info from 'pacs-portal', I still have *no* idea of what should stay in the Startup & what should go. ..This is way over my head. ..I'm thinking about smashing this computer up, so I can feel like I've accomplished something.


----------



## TonyKlein (Aug 26, 2001)

Uncheck the following, then click OK:

MICROSOFT WORKS CALENDAR REMINDERS.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
PowerReg Scheduler.exe
MICROSOFT OFFICE.LNK = C:\Program Files\Microsoft Office\Office10\OSA.EXE
WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
SynTPEnh = C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
WorksFUD = C:\Program Files\Microsoft Works\wkfud.exe
Microsoft Works Portfolio = C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
Microsoft Works Update Detection = C:\Program Files\Microsoft Works\WkDetect.exe
S3TRAYHP = S3trayhp.exe
wcmdmgr = C:\WINDOWS\wt\wcmdmgrl.exe -launch
RealTray = C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
QuickTime Task = "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
VsecomrEXE = C:\Program Files\McAfee\McAfee VirusScan\VSEcomR.EXE
MoneyAgent = "C:\Program Files\Microsoft Money\System\Money Express.exe"


----------



## Russ_R (Apr 12, 2003)

> _Originally posted by TonyKlein:_
> *Uncheck the following, then click OK:
> 
> MICROSOFT WORKS CALENDAR REMINDERS.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
> ...


..The computer froze again, after I clicked 'ok'. ..So I had to restart it again. I haven't been able to use 'My Computer' without the computer freezing. ..So I can't run most of the programs like 'Hijack This'. ..The computer seems to freeze after I do any kind of changes.


----------



## TonyKlein (Aug 26, 2001)

Start your computer in Safe Mode, and uncheck these items there.
Click OK, but do not reboot right away.

Then go to the General tab in Msconfig, choose Selective startup, and uncheck "process Autoexec.bat" and "process config.sys".

Click OK and reboot.

Does that work?


----------



## Russ_R (Apr 12, 2003)

> _Originally posted by TonyKlein:_
> *Start your computer in Safe Mode, and uncheck these items there.
> Click OK, but do not reboot right away.*


..The files I unchecked when the computer froze are unchecked. ..Are these the files you're talking about? ..& would I need to uncheck them in safe mode if they're already unchecked in the 'Selective Startup' mode that I'm in now?



> _Originally posted by TonyKlein:_
> *Then go to the General tab in Msconfig, choose Selective startup, and uncheck "process Autoexec.bat" and "process config.sys".
> 
> Click OK and reboot.
> ...


..I don't see those files(process Autoexec.bat" and "process config.sys) in Msconfig. ..'Selective Startup' was already chosen.


----------



## Russ_R (Apr 12, 2003)

..I don't see those files(process Autoexec.bat" and "process config.sys) in Msconfig. ..'Selective Startup' was already chosen. [/B][/QUOTE]

..I see: 
Process System.ini file
Process Win.ini file
Load static VxDs
Load startup group items(this has a check, but not as dark as the others)
Load environment variables


----------



## Russ_R (Apr 12, 2003)

...Any suggestions?


----------



## TonyKlein (Aug 26, 2001)

Now that you've apparently managed to uncheck thoses Msconfig entries, please follow the other steps I'detailed below. (Scanreg /fix, clear Temp folder)


----------



## Russ_R (Apr 12, 2003)

> _Originally posted by TonyKlein:_
> *After doing that, repair and compact your Registry by running the Scanreg /fix command.
> Here's how to go about that: ScanRegW - Or How to Repair the Registry in WinME*


...Done.


----------



## Russ_R (Apr 12, 2003)

> _Originally posted by TonyKlein:_
> *Finally, upgrade Internet Explorer.
> 
> Before doing that empty the contents of your C:\Windows\Temp folder in its entirety.
> ...


...How do I get to the 'C:\Windows\*Temp* folder'? ..I can't get into 'My Computer' without the computer freezing & having to unplug the computer to shut it off.


----------



## TonyKlein (Aug 26, 2001)

Aaah, it's still freezing, is it? 

Can you still start your computer in Safe Mode?

Try doing it there.

How to start the computer in Safe Mode


----------



## Russ_R (Apr 12, 2003)

> _Originally posted by TonyKlein:_
> *Aaah, it's still freezing, is it? *
> 
> Yeah, and it stll has the semi-loud idling sound.
> ...


----------



## TonyKlein (Aug 26, 2001)

It may really be a hardware issue, which frankly isn't my cup of tea...  

Others here are much better equipped to help you woith that.


----------



## Russ_R (Apr 12, 2003)

> _Originally posted by TonyKlein:_
> *It may really be a hardware issue, which frankly isn't my cup of tea...
> 
> Others here are much better equipped to help you with that. *


..I've had this Topic up for awhile now, why haven't the hardware guys chimed in yet? ..Thanks Tony.


----------



## Russ_R (Apr 12, 2003)

I did Scanreg in Safe Mode & now I can use 'My Computer'. ..I still have the idling prob. ...I run Hijack This, for kicks. ..Do you see anymore probs. ..I'll delete the Temp files next....

StartupList report, 4/19/2003, 4:56:52 AM
StartupList version: 1.52
Started from : C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE
Detected: Windows ME (Win9x 4.90.3000)
Detected: Internet Explorer v5.50 (5.50.4134.0600)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSHWIN32.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\WEBSCANX.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSSTAT.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\ESSD.EXE
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPLPR.EXE
C:\PROGRAM FILES\ONE-TOUCH\CP32NBTN.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\PRPCUI.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\ALOGSERV.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\AVCONSOL.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\PROGRAM FILES\COMPUSERVE 7.0\CSTRAY.EXE
C:\PALM\HOTSYNC.EXE
C:\PROGRAM FILES\COMPUSERVE 7.0\WCS2000.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
MICROSOFT WORKS CALENDAR REMINDERS.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
CompuServe 7.0 Tray Icon.lnk = C:\Program Files\CompuServe 7.0\cstray.exe
America Online 5.0 Tray Icon.lnk = C:\America Online 5.0\aoltray.exe
MICROSOFT OFFICE.LNK = C:\Program Files\Microsoft Office\Office10\OSA.EXE
HOTSYNC MANAGER.LNK = C:\Palm\HOTSYNC.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
TaskMonitor = C:\WINDOWS\taskmon.exe
PCHealth = C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
SystemTray = SysTray.Exe
ESS Daemon = C:\WINDOWS\ESSD.exe
SynTPLpr = C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
CP32NOT = C:\PROGRA~1\ONE-TO~1\CP32NBTN.EXE
Microsoft Works Portfolio = C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
PRPCMonitor = PRPCUI.exe
AlogServEXE = C:\Program Files\McAfee\McAfee VirusScan\AlogServ.exe
AvconsoleEXE = C:\Program Files\McAfee\McAfee VirusScan\avconsol.exe /minimize
Vshwin32EXE = C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSHWIN32.EXE
McAfeeWebScanX = C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\WebScanX.Exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent = mstask.exe
SSDPSRV = C:\WINDOWS\SYSTEM\ssdpsrv.exe
*StateMgr = C:\WINDOWS\System\Restore\StateMgr.exe
Vshwin32EXE = C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSHWIN32.EXE
McAfeeWebScanX = C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\WebScanX.Exe /RUNSERVICES
VsStatEXE = C:\Program Files\McAfee\McAfee VirusScan\VSSTAT.EXE /SHOWWARNING

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 17/4/2003, 2:57:34)

[Rename]
NUL=c:\windows\wt\wt3d.ini
NUL=c:\windows\wt\wtlog.txt
NUL=c:\windows\wt\stopwcmdr.bat
NUL=c:\windows\wt\updatenow.bat
NUL=c:\windows\wt\wcmdmgrl.exe
NUL=c:\windows\wt\backup\2.0.3.0\stopwcmdr.bat
NUL=c:\windows\wt\backup\2.0.3.0\updatenow.bat
NUL=c:\windows\wt\backup\2.0.3.0\wcmdmgrl.exe

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET windir=C:\WINDOWS
SET winbootdir=C:\WINDOWS
SET COMSPEC=C:\WINDOWS\COMMAND.COM
SET PATH=C:\WINDOWS;C:\WINDOWS\COMMAND
SET PROMPT=$p$g
SET TEMP=C:\WINDOWS\TEMP
SET TMP=C:\WINDOWS\TEMP

--------------------------------------------------

C:\WINDOWS\WINSTART.BAT listing:

C:\WINDOWS\tmpcpyis.bat

--------------------------------------------------

Enumerating Task Scheduler jobs:

Tune-up Application Start.job
PCHealth Scheduler for Data Collection.job

--------------------------------------------------

Enumerating Download Program Files:

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[QuickTime Object]
InProcServer32 = C:\WINDOWS\SYSTEM\QTPLUGIN.OCX
CODEBASE = http://www.apple.com/qtactivex/qtplugin.cab

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\DIRECTOR\SWDIR.DLL
CODEBASE = http://active.macromedia.com/director/cabs/sw.cab

[Corel Presentations Show It!]
InProcServer32 = C:\WINDOWS\DOWNLO~1\AXPRSHOW.OCX
CODEBASE = http://www.corel.com/products/wordperfect/cwps8/plugin/axprshow.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL
UPnPMonitor: C:\WINDOWS\SYSTEM\UPNPUI.DLL
AUHook: C:\WINDOWS\SYSTEM\AUHOOK.DLL

--------------------------------------------------
End of report, 6,057 bytes
Report generated in 0.830 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


----------



## TonyKlein (Aug 26, 2001)

Looks OK to me.

The following can also be unchecked in Msconfig > Startup:

MICROSOFT WORKS CALENDAR REMINDERS.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
MICROSOFT OFFICE.LNK = C:\Program Files\Microsoft Office\Office10\OSA.EXE

The following may also be unchecked if you think you feel OK with launching them manually:

CompuServe 7.0 Tray Icon.lnk = C:\Program Files\CompuServe 7.0\cstray.exe
America Online 5.0 Tray Icon.lnk = C:\America Online 5.0\aoltray.exe

Otherwise, no further recommendations in that department.


----------



## Russ_R (Apr 12, 2003)

..Cool, thanks Tony!!


----------



## Russ_R (Apr 12, 2003)

> _Originally posted by TonyKlein:_
> *Looks OK to me.
> 
> The following can also be unchecked in Msconfig > Startup:
> ...


...I spoke too soon. ..I don't see any of those even listed, except the AOL & Compuserve Trays.

I see...
MICROSOFT WORKS Portfolio = C:\Program Files\Microsoft Works\WksSB.exe/AllUsers
MICROSOFT OFFICE STARTUP = C\PROGRA~1\MICROS~4\OFFICE10\OSA.EXE

...Should I leave these checked?


----------



## TonyKlein (Aug 26, 2001)

Well, they're listed so they ought to be there:



> Listing of startup folders:
> 
> Shell folders Startup:
> [C:\WINDOWS\Start Menu\Programs\StartUp]
> MICROSOFT WORKS CALENDAR REMINDERS.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe


Unless you posted an old log.

You can uncheck all of them. They just eat resources (memory)


----------



## Russ_R (Apr 12, 2003)

> _Originally posted by TonyKlein:_
> *Well, they're listed so they ought to be there:
> 
> 
> ...


..Nope, it's a *new* log. ..So it's ok to uncheck the folders I listed, or a you saying it ok to uncheck the folders you listed that I can't find? ...Is there another way I can find those folders, to uncheck them? ..Thanks.


----------



## TonyKlein (Aug 26, 2001)

If you can't find them in Msconfig > Startup, don't worry about it.

It's not a big thing.


----------



## walkeriam (Feb 19, 2002)

You may be able to delete them by going to: 
Right click START, OPEN, PROGRAMS, STARTUP then delete them from there.

Also go to START, SETTINGS, CONTROL PANEL, POWER OPTIONS or (POWER MANAGEMENT) and un-check HIBERNATE.

Hibernate has been known to cause WINDOWS ME to freeze up.

Also RUSS if you click on POST REPLY at the bottom of this thread you will quit QUOTING and save thread length.


----------



## Russ_R (Apr 12, 2003)

Tony or anyone... In my 'C:\WINDOWS\TEMP' folder I have a file called 'WebPoolFileFile'. ..It's 16.0KB & it can't be removed. ..Do you know what this is?

walkeriam... So I should select & delete "C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe" from - Right click START, OPEN, PROGRAMS, STARTUP? ..And nothing bad will come from this?


----------



## Russ_R (Apr 12, 2003)

If I click on *McAfee VirusScan*, I get *"Vsmain has caused an error in VSUI50.DLL."* .."Vsmain will now close". ..What happened?


----------



## Russ_R (Apr 12, 2003)

What does "Wcs2000 has caused an error in GKWIDET.DDL." (or it was "GKWIDGET.DLL.", I cant remember) mean??

...*PLEASE HELP!!! ...ANYONE*

..And how do I get rid of McAfee*completely!*


----------



## walkeriam (Feb 19, 2002)

Quote: *walkeriam... So I should select & delete "C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe" from - Right click START, OPEN, PROGRAMS, STARTUP? ..And nothing bad will come from this?*

wkcalrem.exe is Microsoft Works Calender Reminder. If it isn't necessary for you to have this on all the time then delete it from that folder.

It will not hurt to delete anything from this folder, however if you use CALLWAVE, PAGOO or another call forwarding service I would leave them in there.

You may want to un-install McAfee and re-install it, then update it.
START, SETTINGS, CONTROL PANEL, ADD and REMOVE PROGRAMS, McAFEE to un-install.


----------



## bandit429 (Feb 12, 2002)

Wcs2000 is a compuserve EXE,, Is there a reason why you have AOL and compuserve installed? Are you using them both? I know on one computer here we had Earthlink and AOL on one computer and it caused a lot of errors,,ecspecially when clicking shortcuts to email or things with saved passwords like messenger. Which version of macafee do you have?


----------



## Russ_R (Apr 12, 2003)

> _Originally posted by bandit429:_
> *Wcs2000 is a compuserve EXE,, Is there a reason why you have AOL and compuserve installed? Are you using them both? I know on one computer here we had Earthlink and AOL on one computer and it caused a lot of errors,,ecspecially when clicking shortcuts to email or things with saved passwords like messenger. Which version of macafee do you have? *


 ..I use CompuServe 7.0 & tried to uninstall AOL *just before* my computer started having problems, now that I think of it. ..But, I still have AOL because I went back to my old settings, after the all the computer probs.

I believe the version of McAfee I use is just called "McAfee VirusScan"? ...I don't see any 1.0, 5.0 or whatever.


----------



## Russ_R (Apr 12, 2003)

> _Originally posted by walkeriam:_
> *Quote: You may want to un-install McAfee and re-install it, then update it.
> START, SETTINGS, CONTROL PANEL, ADD and REMOVE PROGRAMS, McAFEE to un-install. *


*
...I don't see it there.*


----------



## walkeriam (Feb 19, 2002)

It may be in START, PROGRAMS, ACCESSORIES, SYSTEM TOOLS and then look for McAfee UN-INSTALL.

Also, do you use the ONE-TOUCH buttons on your KEYBOARD?
If not you can disable: 
CP32NOT = C:\PROGRA~1\ONE-TO~1\CP32NBTN.EXE
In MSCONFIG.

Here is a step by step on how to un-install AOL. Make sure you ALT, CTRL, DELETE first and END TASK on AOL.
http://www.adservio.net/support/uninstallaol.html


----------



## Russ_R (Apr 12, 2003)

..I deleted McAfee & the strange idling sound is gone, so for now *knock on wood*. ..So, I think I'm done. THANK YOU *EVERYONE* for helping me get to know my computer & showing me ways to fix it.


----------



## gotrootdude (Feb 19, 2003)

Windows working right? Somebody call microsoft and report it so Bill can break it again!


----------



## tjamnz (Jun 15, 2004)

I was infected to the bone with spyware that some of my anti-spy programs were not picking up. I ran Hijack this and deleted all kinds of uneeded processes. :up:


----------

