Is it my computer or my ISP? [Archive] - Sitcoms Online Message Boards

View Full Version : Is it my computer or my ISP?

dawsongirl

04-25-2005, 11:08 PM

I wish I were smarter, because then I wouldn't have to annoy everyone with these computer questions.

Alas, here's my problem. My ISP used to only knock itself offline when I'd been online 4 hours. Well now, just on my laptop, not on my desktop, it will almost just randomly knock itself off. I could not do something for as little as 2 minutes and it'll go off. Last night I pressed 'File' and it went off. I have a pop up blocker and have to press control to open the pop up. Well, when I close them, the internet goes offline. Every time! It's forever giving me errors. Something has caused an error in something and will now close. I press okay and the window is supposed to just close and restart IE, but usually the computer will either freeze or I get one of the blue screen warnings. Sometimes it freezes completely and won't respond to ctrl+alt+del. It usually causes an error twice. three times a night. I can't stay online for more than 30 mins and there's no way possible to have more than one window open, because if I get done with one window and go to close it, another error, another freeze. The XP desktop doesn't do this, just my ME laptop. But before I went and did anything, I thought I'd ask if it was just the ISP, or if it was IE or ME or the damn computer.

Thanks in advance. :)

dawsongirl

04-25-2005, 11:09 PM

I guess I should also mention I'm on dialup with Netzero High Speed.

TripperFan

04-25-2005, 11:21 PM

From any experience I had that was similar, it turned out that I was using a Gateway desktop which can I found out could act funny when running certain software and when it was installed - (i.e. piece by piece rather than all at the same time). I ended up having to have a tech guy strip it, and reinstall everything cleanly. This was at work though, but I'd get the same things - only usually fatal error messages and then it would shut itself down.

Maybe someone else has other suggestions first though.

robyrob

04-25-2005, 11:23 PM

you have a lot more questions than answers in there.... it looks like it could be a combination of problems at work

you are going to have to do some process of elimination here to answer some of the questions - if the problem doesn't occur in firefox, you can assume IE has a problem, if you try a different dial-up ("borrow" a friend's dial-up or cable connection) and no problems, you can probably assume that you are having some ISP problems (NetZero has some programs that need to be running in the background, and they CAN cause some conflicts)

as for ME.... well it wouldn't be too much of a stretch to assume that you are having some problems there, but we'd have to have some more specific error codes to sort that out.

(might want to write down the "Something has caused an error in something and will now close" and blue screen error codes)

dawsongirl

04-25-2005, 11:28 PM

I'll have to write down the errors. I see them so much I don't even pay attention anymore.

Basically the only problem I've had offline was with the damn solitare game not opening.

I was just trying to decide whether or not to just give up and buy a new laptop. I WISH Qwest would install DSL in this area, then I wouldn't have all these dial up problems.

robyrob

04-25-2005, 11:44 PM

dawsongirl

04-26-2005, 12:16 AM

is it the Solitaire that came with windows? go to the Windows Setup tab in the "Add/Remove Programs" control panel applet, and under "accessories", click on "Details" then uncheck the games to remove them, then "OK" your way out - go back in there to recheck it and reinstall them.

Windows ME can be a real pain - so is dial-up, just too many things that can go wrong....
Yeah, it is. I just uninstalled it. Not that way though. I forgot how I did, but I did go to Add/Remove Programs.

Anyway...I'm trying to make this thing give me an error. Watch it not cooperate.

dawsongirl

04-26-2005, 12:30 AM

Here's one I get a lot. The first pic is when I clicked on the link in the second pic.

Oh, and when I just closed the pop up window to attach the pics, my disconnect? window came up. pissed:

robyrob

04-26-2005, 12:37 AM

Hollow

04-26-2005, 12:37 AM

it's god's first plague of the twenty-first century for you writing to FOX falsely saying that your son is dying of a terminal illness called tumorsyphillisisisosis and his last wish is for the producers to put gumbel 2 gumbel back on the air and going to lengths so incredible to keep up the charade that you started saying YOU were god.

it's payback time! pissed:

dawsongirl

04-26-2005, 12:49 AM

next time click on the to view technical information about the error report, click here.

copy the error codes - they may look confusing (unless you read hex) but they can help identify what is going on.

Oh darn. I actually did that, but it looked like it was 16 pages long, so I closed it. :doh:

dawsongirl

04-26-2005, 01:44 AM

Latest Blue Screen (and other) errors:

Error: 0E : 017F : BFF8E64B

then...

KERNEL32 caused a general protection fault in module KRNL386.EXE at 0001:000075a8

AVGCC caused a general protection fault in module KRNL386.EXE at 0001:000075a8

AVGEMC caused a general protection fault in module KRNL386.EXE at 0001:000075a8

AVGAMSVR caused a general pretection fault in module KRNL386.EXE at 0001:000075a8

then...

Error 0E : 017F : BFF6196B

Then I had to ctrl+alt+del to get it unstuck out of that mode.

dawsongirl

04-26-2005, 01:53 AM

next time click on the to view technical information about the error report, click here.

copy the error codes - they may look confusing (unless you read hex) but they can help identify what is going on.

I did that this second time, but I could highlight and copy the whole thing, so I tried copying it into paint, but paint ghave up on me after only 3 screen shots. :( Here's what I was able to get:

dawsongirl

04-26-2005, 01:57 AM

pissed: I closed the attachments pop up again and this time it didn't even give me the option, it just logged me off.

Anyway, shot 2:

dawsongirl

04-26-2005, 02:00 AM

And shot #3:

Rebel Queen 1980

04-26-2005, 04:51 PM

There's be something wrong with it,Some errors effect memory and other
stuff and sometimes your computer screen freezes and stuff. When I
get kicked online.My parents say it's because someone was trying to
call our house.That's probably we only have one phone line.

dawsongirl

04-27-2005, 10:22 PM

The latest error:

Exec has caused an error in KERNEL32.DLL. Exec will now close.

Then it got stuck.

Then WMP gets stuck every time it opens!

Whatever this KERNEL32 is, it's broken.

I am Roboto

04-27-2005, 11:11 PM

The latest error:

Exec has caused an error in KERNEL32.DLL. Exec will now close.

Then it got stuck.

Then WMP gets stuck every time it opens!

Whatever this KERNEL32 is, it's broken.

All those kernel errors and "illegal opperations" are really specific to Windows 9x. You don't see that kind of crap in NT/2000/XP/2003.

You really should focus on a move to the NT kernel - an OEM copy of 2K Pro w/SP4 can be had for under $50.

dawsongirl

04-28-2005, 12:52 AM

All those kernel errors and "illegal opperations" are really specific to Windows 9x. You don't see that kind of crap in NT/2000/XP/2003.

You really should focus on a move to the NT kernel - an OEM copy of 2K Pro w/SP4 can be had for under $50.

ahh, I see. Well, it doesn't seem to be getting any better, or worse and more often. :p on ME.

dawsongirl

04-28-2005, 01:10 AM

I am Roboto

04-28-2005, 05:40 AM

oh, nice thing: pissed:

The following conditions can cause KERNEL32.DLL error messages:

Damaged swap file
File allocation damage
Damaged password list
Damaged or incorrect version of the KERNEL32.DLL file
Damaged registry
Hardware, hot CPU, over clocking, broken power supply, RF noise, ground bounce, or bad hard disk controller
BIOS settings for Wait states, RAM timing, or other BIOS settings
Third-party software that is damaged or incorrectly installed
.DLL files that are saved to the desktop
Non-existent or broken Temp folder
A control panel (.CPL) file is damaged
Incorrect or damaged hardware driver
Incorrectly installed printer drivers or HP Jetadmin drivers
Damaged Java Machine
Damaged .LOG files
Damaged entries in the History folder
Incompatible or damaged dynamic link library files
Viruses
Damaged or incorrect MSINFO32.EXE file
Low disk space

Well, the damn thing has always had low disk space. I suppose it's causing more problems than ever. And I got rid of everything.

LOL Anything will cause that. Seriously - back up that data & format with a clean install of 2000.

The filesystem used with 9x isn't that great nowadays (at leat compared to the alternative).

FAT (File Allocation Table) There are now three basic types of FAT - FAT16, VFAT, and FAT32. FAT is a rudimentary file system which has its roots with the original IBM PC & the original version of DOS. FAT stores it's information on a space of information within the first 1023 sectors of the hard disk known as the Mastor Boot Record (MBR). This data, however, can get corrupted fairly easily, along with the File System itself. The original FAT was 12-bit, but with new & bigger HD's came the need for bigger partitions - and FAT16 came along - with a limit of 2,024 MB's or 2gigs (NT can stretch FAT16 partitions to the technical size of 4,048MB's or 4GB, but this is done by the inefficient use of very large clusters, and very little is gained in the end). FAT16 was the foundation for modern Windows - and is still very prevalent because of it's cross-platform capabilties (FAT16 can be accessed on DOS/Linux-Unix/Macs/& all versions of Windows ever released) It is still used today for Flash Drives & other data which requires small partitions. Mainstream use has died however - as FAT16 has no security, no long filename support, and no failsafe features. VFAT was a temorary solution to enhance the file system without addressing its overall limitations. VFAT, short for Virtual File Allocation Table, was implemented on early versions of Windows 95 as well as Windows NT version 3.5. It allowed for the use of Long Filenames (bigger than 8.3). By the mid-90's, with drive's getting bigger & bigger (and cheaper) - people wanted bigger partitions, something FAT could not provide. Enter FAT32 (File Allocation Table - 32 bit). By increasing the bits used as well as decreasing the cluster size, FAT32 resulted in an immediate improvement. It also allowed for the use of long filenames. FAT32 can technically be used on partitions up to 2 terabytes, but MS does not suppport it on more than 32GB partitions. Why? Fat32 becomes extremely unreliable when used on very large partitions. Cluster sizes become huge resulting in massive fragmentation and extreme disk space waste. FAT32 does not provide any security implementations, nor does it provide failsafe features.
Windows 95 & 95SR1 (4.00.950 & 4.00.950 A) - FAT16
Windows 95 OSR2 (4.00.950 B & 4.00.950 C) - FAT32/FAT16
Windows 98/98SE - FAT32/FAT16
Windows ME - FAT32/FAT16

NTFS (New Technology File System) is based in part on OS/2 code (it came out of the joint IBM-MS work on OS/2 & is actually a variant of HPFS - the high performance file system for OS/2 Warp & ecomstation). NTFS is extremely secure and uses a 32-bit addressing system along with very low cluster sizes to achieve maximum (down to the last KB actually). It also has failsafe measures in place - an NTFS disk can crash and will not loose data in 99% of cases. NTFS also has built in security features, such as filesystem permissions. Windows 2000 & higher includes Encrypted File System (EFS) support, allowing you to encrypt your files for even more security.
NTFS 1.0 - Windows NT 3.1
NTFS 1.1 - Windows NT 3.5
NTFS 1.2 - Windows NT 3.51 & Windows NT 4.0
NTFS 3.0 - Windows 2000
NTFS 3.1 - Windows XP & Windows Server 2003

NT4.0 can view & read to NTFS 3.x partitions with SP 5 or higher installed.

BTW - making IE angry can cause a Kernel Error, or so I hear..... ;)

robyrob

04-28-2005, 11:34 AM

The latest error:

Exec has caused an error in KERNEL32.DLL. Exec will now close.

Then it got stuck.

Then WMP gets stuck every time it opens!

Whatever this KERNEL32 is, it's broken.

the kernel is basically the lower level of the operating system - and it MAY INDEED be broke, of course depending on who you ask Windows ME COMES that way...

there could be a number of things going on here, we still don't have enough info - it could be bad memory, corrupted system files, dll or other file conflicts, spyware, the list goes on. for now though, could you run your AdAware and Spybot in SAFE MODE to see if it finds anything, then run
HijackThis (http://www.spywareinfo.com/~merijn/files/HijackThis.exe) and post a log to see if we can identify any obvious problems.

After that I would suggest you take a look at how much free space you have on the drive, I believe you mentioned that it was a fairly small drive, if you dont have much room for a swap file that could be a potential problem. I don't know how comfortable you would feel reseating the ram, but if you felt that you could do it, that wouldn't hurt.

Having done all of that, the next step would be to back up all of your data, and make a choice to either upgrade or reinstall the operating system.

dawsongirl

04-28-2005, 03:02 PM

Okay. How do you get it into safe mode? I know someone here posted that once, but I don't remember where.

dawsongirl

04-28-2005, 03:03 PM

BTW - making IE angry can cause a Kernel Error, or so I hear..... ;)

:lol: I'm sure my constant cursing at it isn't making it happy.

dawsongirl

04-28-2005, 03:07 PM

[QUOTE=dawsongirl]After that I would suggest you take a look at how much free space you have on the drive, I believe you mentioned that it was a fairly small drive, if you dont have much room for a swap file that could be a potential problem. I don't know how comfortable you would feel reseating the ram, but if you felt that you could do it, that wouldn't hurt.

Yeah, it's roughly 9GB. Last time I looked, it was about 8GB used, 1GB free. It's gone all the way down to like 500MB free.

Max Whittaker

04-28-2005, 03:09 PM

:lol: I'm sure my constant cursing at it isn't making it happy.

My aunt calls her computer evil. "You evil thing!" :lol: I've tried to tell her that maybe it wouldn't act up so often if she used kinder words! That's my advice to you. ;)

robyrob

04-28-2005, 03:18 PM

Okay. How do you get it into safe mode? I know someone here posted that once, but I don't remember where.
safe mode http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406 http://www.pchell.com/support/safemode.shtml

dawsongirl

04-28-2005, 10:07 PM

Results: You know, I oughta be paying for this, seeing as how this looks like a foreign language. :lol:

Adaware:

Ad-Aware SE Build 1.05
Logfile Created on:Thursday, April 28, 2005 8:27:25 PM
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R36 01.04.2005
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
MRU List(TAC index:0):12 total references
Tracking Cookie(TAC index:3):70 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan my Hosts file
Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects

4-28-2005 8:27:25 PM - Scan started. (Full System Scan)
MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\windows\currentversion\applets\paint\recent file list
Description : list of files recently opened using microsoft paint

MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\windows\currentversion\explorer\runmru
Description : mru list for items opened in start | run

MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru
Description : list of recently saved files, stored according to file extension

MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru
Description : list of recent programs opened

MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\windows\currentversion\explorer\recentdocs
Description : list of recent documents opened

MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\internet explorer
Description : last download directory used in microsoft internet explorer

MRU List Object Recognized!
Location: : software\microsoft\directdraw\mostrecentapplication
Description : most recent application to use microsoft directdraw

MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\internet explorer\typedurls
Description : list of recently entered addresses in microsoft internet explorer

MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\mediaplayer\preferences
Description : last playlist index loaded in microsoft windows media player

MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\mediaplayer\preferences
Description : last playlist loaded in microsoft windows media player

MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\windows media\wmsdk\general
Description : windows media sdk

MRU List Object Recognized!
Location: : C:\WINDOWS\Application Data\microsoft\office\recent
Description : list of recently opened documents using microsoft office

Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
#:1 [KERNEL32.DLL]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4279186673
Threads : 4
Priority : High
FileVersion : 4.90.3000
ProductVersion : 4.90.3000
ProductName : Microsoft(R) Windows(R) Millennium Operating System
CompanyName : Microsoft Corporation
FileDescription : Win32 Kernel core component
InternalName : KERNEL32
LegalCopyright : Copyright (C) Microsoft Corp. 1991-2000
OriginalFilename : KERNEL32.DLL
#:2 [MSGSRV32.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294930961
Threads : 1
Priority : Normal
FileVersion : 4.90.3000
ProductVersion : 4.90.3000
ProductName : Microsoft(R) Windows(R) Millennium Operating System
CompanyName : Microsoft Corporation
FileDescription : Windows 32-bit VxD Message Server
InternalName : MSGSRV32
LegalCopyright : Copyright (C) Microsoft Corp. 1992-1998
OriginalFilename : MSGSRV32.EXE
#:3 [MPREXE.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294941117
Threads : 3
Priority : Normal
FileVersion : 4.90.3000
ProductVersion : 4.90.3000
ProductName : Microsoft(R) Windows(R) Millennium Operating System
CompanyName : Microsoft Corporation
FileDescription : WIN32 Network Interface Service Process
InternalName : MPREXE
LegalCopyright : Copyright (C) Microsoft Corp. 1993-2000
OriginalFilename : MPREXE.EXE
#:4 [STMGR.EXE]
FilePath : C:\WINDOWS\SYSTEM\RESTORE\
ProcessID : 4294953153
Threads : 4
Priority : Normal
FileVersion : 4.90.0.2533
ProductVersion : 4.90.0.2533
ProductName : Microsoft (r) PCHealth
CompanyName : Microsoft Corporation
FileDescription : Microsoft (R) PC State Manager
InternalName : StateMgr.exe
LegalCopyright : Copyright (C) Microsoft Corp. 1981-2000
OriginalFilename : StateMgr.exe
#:5 [EXPLORER.EXE]
FilePath : C:\WINDOWS\
ProcessID : 4294938817
Threads : 5
Priority : Normal
FileVersion : 5.50.4134.100
ProductVersion : 5.50.4134.100
ProductName : Microsoft(R) Windows (R) 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Windows Explorer
InternalName : explorer
LegalCopyright : Copyright (C) Microsoft Corp. 1981-2000
OriginalFilename : EXPLORER.EXE
#:6 [DDHELP.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294817625
Threads : 2
Priority : Realtime
FileVersion : 4.09.00.0900
ProductVersion : 4.09.00.0900
ProductName : Microsoft® DirectX for Windows®
CompanyName : Microsoft Corporation
FileDescription : Microsoft DirectX Helper
InternalName : DDHelp.exe
LegalCopyright : Copyright © Microsoft Corp. 1994-2002
OriginalFilename : DDHelp.exe
#:7 [AD-AWARE.EXE]
FilePath : C:\PROGRAM FILES\LAVASOFT\AD-AWARE SE PERSONAL\
ProcessID : 4294954997
Threads : 2
Priority : Normal
FileVersion : 6.2.0.206
ProductVersion : VI.Second Edition
ProductName : Lavasoft Ad-Aware SE
CompanyName : Lavasoft Sweden
FileDescription : Ad-Aware SE Core application
InternalName : Ad-Aware.exe
LegalCopyright : Copyright © Lavasoft Sweden
OriginalFilename : Ad-Aware.exe
Comments : All Rights Reserved
Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 12

Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 12

Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 12

Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@landing.domainsponsor[1].txt
Category : Data Miner
Comment : Hits:1
Value : Cookie:bubbles2432@landing.domainsponsor.com/
Expires : 4-26-2005 8:19:10 PM
LastSync : Hits:1
UseCount : 0
Hits : 1
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@revenue[1].txt
Category : Data Miner
Comment : Hits:6
Value : Cookie:bubbles2432@revenue.net/
Expires : 6-10-2022 12:05:40 AM
LastSync : Hits:6
UseCount : 0
Hits : 6
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@casalemedia[2].txt
Category : Data Miner
Comment : Hits:1450
Value : Cookie:bubbles2432@casalemedia.com/
Expires : 4-18-2006 6:07:06 PM
LastSync : Hits:1450
UseCount : 0
Hits : 1450
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@overture[2].txt
Category : Data Miner
Comment : Hits:17
Value : Cookie:bubbles2432@overture.com/
Expires : 4-14-2006 9:28:26 PM
LastSync : Hits:17
UseCount : 0
Hits : 17
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@realmedia[1].txt
Category : Data Miner
Comment : Hits:45
Value : Cookie:bubbles2432@realmedia.com/
Expires : 12-31-2020 6:59:58 PM
LastSync : Hits:45
UseCount : 0
Hits : 45
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@atdmt[2].txt
Category : Data Miner
Comment : Hits:40
Value : Cookie:bubbles2432@atdmt.com/
Expires : 4-8-2010 7:00:00 PM
LastSync : Hits:40
UseCount : 0
Hits : 40
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@fastclick[2].txt
Category : Data Miner
Comment : Hits:943
Value : Cookie:bubbles2432@fastclick.net/
Expires : 4-27-2007 10:04:16 PM
LastSync : Hits:943
UseCount : 0
Hits : 943
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@www.uproar[1].txt
Category : Data Miner
Comment : Hits:1
Value : Cookie:bubbles2432@www.uproar.com/
Expires : 4-27-2005 12:21:08 AM
LastSync : Hits:1
UseCount : 0
Hits : 1
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@valueclick[1].txt
Category : Data Miner
Comment : Hits:19
Value : Cookie:bubbles2432@valueclick.com/
Expires : 4-16-2030 9:12:46 PM
LastSync : Hits:19
UseCount : 0
Hits : 19
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@bluestreak[1].txt
Category : Data Miner
Comment : Hits:4
Value : Cookie:bubbles2432@bluestreak.com/
Expires : 4-24-2015 9:21:10 PM
LastSync : Hits:4
UseCount : 0
Hits : 4
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@edge.ru4[1].txt
Category : Data Miner
Comment : Hits:9
Value : Cookie:bubbles2432@edge.ru4.com/
Expires : 4-2-2035 8:34:40 PM
LastSync : Hits:9
UseCount : 0
Hits : 9
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@tribalfusion[1].txt
Category : Data Miner
Comment : Hits:3
Value : Cookie:bubbles2432@tribalfusion.com/
Expires : 12-31-2037 7:00:00 PM
LastSync : Hits:3
UseCount : 0
Hits : 3
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@apmebf[1].txt
Category : Data Miner
Comment : Hits:1
Value : Cookie:bubbles2432@apmebf.com/
Expires : 4-22-2010 10:34:22 PM
LastSync : Hits:1
UseCount : 0
Hits : 1
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@bfast[1].txt
Category : Data Miner
Comment : Hits:7
Value : Cookie:bubbles2432@bfast.com/
Expires : 4-23-2025 9:50:18 PM
LastSync : Hits:7
UseCount : 0
Hits : 7
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@doubleclick[2].txt
Category : Data Miner
Comment : Hits:34
Value : Cookie:bubbles2432@doubleclick.net/
Expires : 4-8-2008 9:03:48 PM
LastSync : Hits:34
UseCount : 0
Hits : 34
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@advertising[1].txt
Category : Data Miner
Comment : Hits:62
Value : Cookie:bubbles2432@advertising.com/
Expires : 4-26-2010 2:27:08 AM
LastSync : Hits:62
UseCount : 0
Hits : 62
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@bs.serving-sys[1].txt
Category : Data Miner
Comment : Hits:1
Value : Cookie:bubbles2432@bs.serving-sys.com/
Expires : 1-1-2038 3:00:00 AM
LastSync : Hits:1
UseCount : 0
Hits : 1
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@serving-sys[2].txt
Category : Data Miner
Comment : Hits:9
Value : Cookie:bubbles2432@serving-sys.com/
Expires : 1-1-2038 3:00:00 AM
LastSync : Hits:9
UseCount : 0
Hits : 9
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@perf.overture[1].txt
Category : Data Miner
Comment : Hits:1
Value : Cookie:bubbles2432@perf.overture.com/
Expires : 4-24-2009 11:47:00 PM
LastSync : Hits:1
UseCount : 0
Hits : 1
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@questionmarket[1].txt
Category : Data Miner
Comment : Hits:2
Value : Cookie:bubbles2432@questionmarket.com/
Expires : 6-15-2006 1:46:00 PM
LastSync : Hits:2
UseCount : 0
Hits : 2
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@as-us.falkag[2].txt
Category : Data Miner
Comment : Hits:3
Value : Cookie:bubbles2432@as-us.falkag.net/
Expires : 5-23-2005 9:28:16 PM
LastSync : Hits:3
UseCount : 0
Hits : 3
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@servedby.advertising[2].txt
Category : Data Miner
Comment : Hits:73
Value : Cookie:bubbles2432@servedby.advertising.com/
Expires : 5-27-2005 8:55:56 PM
LastSync : Hits:73
UseCount : 0
Hits : 73
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@targetnet[2].txt
Category : Data Miner
Comment : Hits:2
Value : Cookie:bubbles2432@targetnet.com/
Expires : 5-17-2033 10:33:20 PM
LastSync : Hits:2
UseCount : 0
Hits : 2
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@hitbox[1].txt
Category : Data Miner
Comment : Hits:19
Value : Cookie:bubbles2432@hitbox.com/
Expires : 4-13-2006 9:17:34 PM
LastSync : Hits:19
UseCount : 0
Hits : 19
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@ehg-inforspaceinc.hitbox[1].txt
Category : Data Miner
Comment : Hits:9
Value : Cookie:bubbles2432@ehg-inforspaceinc.hitbox.com/
Expires : 4-13-2006 9:17:34 PM
LastSync : Hits:9
UseCount : 0
Hits : 9
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@2o7[2].txt
Category : Data Miner
Comment : Hits:111
Value : Cookie:bubbles2432@2o7.net/
Expires : 4-17-2010 9:00:58 PM
LastSync : Hits:111
UseCount : 0
Hits : 111
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@zedo[2].txt
Category : Data Miner
Comment : Hits:8
Value : Cookie:bubbles2432@zedo.com/
Expires : 4-25-2015 12:23:00 AM
LastSync : Hits:8
UseCount : 0
Hits : 8
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@mediaplex[2].txt
Category : Data Miner
Comment : Hits:38
Value : Cookie:bubbles2432@mediaplex.com/
Expires : 6-21-2009 7:00:00 PM
LastSync : Hits:38
UseCount : 0
Hits : 38
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@trafficmp[2].txt
Category : Data Miner
Comment : Hits:21
Value : Cookie:bubbles2432@trafficmp.com/
Expires : 4-23-2006 8:58:12 PM
LastSync : Hits:21
UseCount : 0
Hits : 21
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@centrport[1].txt
Category : Data Miner
Comment : Hits:20
Value : Cookie:bubbles2432@centrport.net/
Expires : 12-31-2029 7:00:00 PM
LastSync : Hits:20
UseCount : 0
Hits : 20
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@z1.adserver[1].txt
Category : Data Miner
Comment : Hits:33
Value : Cookie:bubbles2432@z1.adserver.com/
Expires : 4-27-2006 10:07:08 PM
LastSync : Hits:33
UseCount : 0
Hits : 33
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@maxserving[1].txt
Category : Data Miner
Comment : Hits:1
Value : Cookie:bubbles2432@maxserving.com/
Expires : 4-16-2015 10:02:04 PM
LastSync : Hits:1
UseCount : 0
Hits : 1
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@ads.addynamix[1].txt
Category : Data Miner
Comment : Hits:7
Value : Cookie:bubbles2432@ads.addynamix.com/
Expires : 4-25-2005 1:54:38 AM
LastSync : Hits:7
UseCount : 0
Hits : 7
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@ads.pointroll[1].txt
Category : Data Miner
Comment : Hits:28
Value : Cookie:bubbles2432@ads.pointroll.com/
Expires : 12-31-2009 7:00:00 PM
LastSync : Hits:28
UseCount : 0
Hits : 28
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@domainsponsor[2].txt
Category : Data Miner
Comment : Hits:4
Value : Cookie:bubbles2432@domainsponsor.com/
Expires : 4-26-2005 8:19:20 PM
LastSync : Hits:4
UseCount : 0
Hits : 4
Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 35
Objects found so far: 47

Deep scanning and examining files (c:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@atdmt[2].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@atdmt[2].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@apmebf[1].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@apmebf[1].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@fastclick[2].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@fastclick[2].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@edge.ru4[1].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@edge.ru4[1].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@zedo[2].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@zedo[2].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@casalemedia[2].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@casalemedia[2].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@hitbox[1].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@hitbox[1].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@2o7[2].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@2o7[2].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@questionmarket[1].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@questionmarket[1].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@doubleclick[2].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@doubleclick[2].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@overture[2].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@overture[2].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@bs.serving-sys[1].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@bs.serving-sys[1].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@serving-sys[2].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@serving-sys[2].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@domainsponsor[2].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@domainsponsor[2].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@z1.adserver[1].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@z1.adserver[1].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@ads.pointroll[1].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@ads.pointroll[1].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@perf.overture[1].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@perf.overture[1].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@tribalfusion[1].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@tribalfusion[1].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@ehg-inforspaceinc.hitbox[1].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@ehg-inforspaceinc.hitbox[1].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@centrport[1].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@centrport[1].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@bfast[1].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@bfast[1].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@revenue[1].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@revenue[1].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@maxserving[1].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@maxserving[1].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@trafficmp[2].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@trafficmp[2].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@bluestreak[1].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@bluestreak[1].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@www.uproar[1].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@www.uproar[1].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@valueclick[1].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@valueclick[1].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@as-us.falkag[2].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@as-us.falkag[2].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@mediaplex[2].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@mediaplex[2].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@ads.addynamix[1].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@ads.addynamix[1].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@realmedia[1].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@realmedia[1].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@advertising[1].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@advertising[1].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@targetnet[2].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@targetnet[2].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@landing.domainsponsor[1].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@landing.domainsponsor[1].txt
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : bubbles2432@servedby.advertising[2].txt
Category : Data Miner
Comment :
Value : c:\WINDOWS\Cookies\bubbles2432@servedby.advertising[2].txt
Disk Scan Result for c:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 82
Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
0 entries scanned.
New critical objects:0
Objects found so far: 82

Performing conditional scans...
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 82
8:42:14 PM Scan Complete
Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:14:49.300
Objects scanned:291350
Objects identified:70
Objects ignored:0
New critical objects:70

dawsongirl

04-28-2005, 10:09 PM

Hijack This:

Logfile of HijackThis v1.99.1
Scan saved at 8:56:50 PM, on 4/28/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\MY DOCUMENTS\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://my.netzero.net/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.net/s/search?r=minisearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dial
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://my.netzero.net/s/search?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydial/*http://www.yahoo.com/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.net/s/search?r=minisearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dial
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://my.netzero.net/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://my.netzero.net/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by AT&T WorldNet Service
R3 - URLSearchHook: URLSearchHook Class - {37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - C:\PROGRAM FILES\NZSEARCH\SEARCHENH1.DLL
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN2\YCOMP5_5_7_0.DLL
O2 - BHO: PeoplePC FixedBandBHO - {3DE88907-3E38-11D4-BEB2-CBE76C0598DD} - C:\PROGRAM FILES\ISP40\BIN\BANDOBJECT.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: X1IEHook Class - {52706EF7-D7A2-49AD-A615-E903858CF284} - C:\PROGRAM FILES\NETZERO\QSACC\X1IEBHO.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: ZeroBar - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - C:\PROGRAM FILES\NETZERO\TOOLBAR.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN2\YCOMP5_5_7_0.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [DadApp] C:\Program Files\DELL\AccessDirect\dadapp.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\DPPS2.EXE"
O4 - HKLM\..\Run: [LexStart] Lexstart.exe
O4 - HKLM\..\Run: [Bart Station] C:\Program Files\ISP40\hta\station.sbrt
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [SBC Yahoo! Connection Manager] "C:\Program Files\SBC Yahoo!\Connection Manager\ConnectionManager.exe"
O4 - HKLM\..\Run: [MotiveMonitor] C:\Program Files\Motive\motmon.exe
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\PROGRAM FILES\SBC YAHOO!\CONNECTION MANAGER\IP INSIGHT\IPMon32.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [MOSearch] C:\PROGRA~1\COMMON~1\SYSTEM\MOSEARCH\BIN\MOSEARCH.EXE
O4 - HKLM\..\RunServices: [MDM7] "C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VS7DEBUG\MDM.EXE"
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [uoltray] C:\PROGRAM FILES\NETZERO\EXEC.EXE regrun
O4 - HKCU\..\Run: [spc_w] "C:\Program Files\NZSearch\nzspc.exe" -w
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Startup: Resolution Assistant.lnk = C:\Program Files\DELL\Resolution Assistant\MotiveAssistant\bin\matcli.exe
O4 - Startup: Camio Viewer 3.2.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe
O4 - Startup: Encoder Agent.lnk = C:\Program Files\Windows Media Components\Encoder\WMENCAGT.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O8 - Extra context menu item: Display All Images with Full Quality - res://C:\PROGRAM FILES\NETZERO\QSACC\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality - res://C:\PROGRAM FILES\NETZERO\QSACC\appres.dll/227
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0521.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0521.DLL
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\PROGRAM FILES\YAHOO!\COMMON\YLOGIN.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\PROGRAM FILES\YAHOO!\COMMON\YLOGIN.DLL
O9 - Extra button: Dell Home - {90D7162F-5C08-4A00-B04B-6A5197462544} - http://www.dellnet.com (file missing) (HKCU)
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O16 - DPF: {2F0347EC-951D-11D2-846C-00A0C955B0C1} (GWNet.ctlGWNet) - file://C:\Program (file://C:Program) Files\Gateway\gateway.net\HTML\GWNet.CAB
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.25.152/code/PWActiveXImgCtl.CAB
O16 - DPF: {34805D32-AD89-469E-8503-A5666AEE4333} (RdxIE Class) - http://207.188.7.150/08f52425f84bcf5a4222/netzip/RdxIE.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20020323/qtinstall.info.apple.com/qt505/us/win/QuickTimeInstaller.exe
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: Yahoo! Bingo - http://download.games.yahoo.com/games/clients/y/xt0_x.cab
O16 - DPF: {427273CC-764E-11D3-823D-006097F90453} (Pixami Image Editor Control) - http://www.imagestation.com/common/classes/BPImageEditor.cab?ver=1,1,0,30
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 192.168.1.1

dawsongirl

04-28-2005, 10:14 PM

This was the first time I've used Spybot, so I'm sure there's a easier way to do this.

dawsongirl

04-28-2005, 10:20 PM

Spybot Cont.

dawsongirl

04-28-2005, 10:23 PM

And as far as space is concerned:

dawsongirl

04-28-2005, 10:24 PM

omg...even with the popup blockers shut off, it still disconnects me when I close a popup window. pissed:

This is ridiculous.

Brent88

04-28-2005, 10:27 PM

Sounds like it's time to start from scratch... you've got MASSIVE problems.

dawsongirl

04-28-2005, 10:29 PM

Sounds like it's time to start from scratch... you've got MASSIVE problems.
:crying:

I am Roboto

04-28-2005, 11:13 PM

:crying:

That SpyBot report doesn't look that bad - most of the problems are pretty benign. Alexa is included with IE. WildTangent is a web services game driver and isn't malware. ebay toolbar you obviously want.

It probably is best to start from scratch - and do yourself a favor & dump ME.

ME was notorious for network-related errors & instability.

BTW - As to "all of this looking like a foreign language" - don't worry about it - you've got to learn sometime. :)

robyrob

04-28-2005, 11:17 PM

[QUOTE=dawsongirl]Hijack This:

Logfile of HijackThis v1.99.1
Scan saved at 8:56:50 PM, on 4/28/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) [quote]

items that you should fix by checking the box in HJT:

R3 - URLSearchHook: URLSearchHook Class {37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - C:\PROGRAM FILES\NZSEARCH\SEARCHENH1.DLL
O16 - DPF: {34805D32-AD89-469E-8503-A5666AEE4333} (RdxIE Class) - http://207.188.7.150/08f52425f84bcf...etzip/RdxIE.cab

*if you dont use it anymore, you should uninstall internet connection software, it looks like you have SEVERAL running - PeoplePC software, NetZero, SBC Yahoo!*

it looks like you have a nasty hijacker in there - the Roings hijacker.

if Adaware and Spybot can't remove Roings, you can remove it manually by following the instructions on this page: http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453079089

I am Roboto

04-28-2005, 11:24 PM

Hijack This:

Logfile of HijackThis v1.99.1
Scan saved at 8:56:50 PM, on 4/28/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

items that you should fix by checking the box in HJT:

R3 - URLSearchHook: URLSearchHook Class {37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - C:\PROGRAM FILES\NZSEARCH\SEARCHENH1.DLL
O16 - DPF: {34805D32-AD89-469E-8503-A5666AEE4333} (RdxIE Class) - http://207.188.7.150/08f52425f84bcf...etzip/RdxIE.cab

*if you dont use it anymore, you should uninstall internet connection software, it looks like you have SEVERAL running - PeoplePC software, NetZero, SBC Yahoo!*

it looks like you have a nasty hijacker in there - the Roings hijacker.

if Adaware and Spybot can't remove Roings, you can remove it manually by following the instructions on this page: http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453079089

Dang I missed that one. Ad-Aware does remove that one. Make sure to kill any running processes of unstall.exe before running it though.

dawsongirl

04-29-2005, 12:16 AM