Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

Register Log in
  • Congratulations SkipVought on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Hijack This - Could someone check my log please?

Status
Not open for further replies.
carbison

carbison

Technical User
Jan 11, 2001
7
0
0
CA
My computer has been doing weird things lately could some one review this and see if you can ID any problems? Thanks

Logfile of HijackThis v1.97.3
Scan saved at 7:08:29 AM, on 10/26/03
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\EASY KEYBOARD\EASYKEY.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZONEALARM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\MY DOCUMENTS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - c:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Easykey] C:\Program Files\Easy Keyboard\EasyKey.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [NPROTECT] c:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O4 - HKLM\..\RunServices: [ccEvtMgr] "c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [NPROTECT] c:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O9 - Extra button: MoneySide (HKLM)
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
StartupList report, 10/26/03, 7:13:37 AM
StartupList version: 1.52
Started from : C:\MY DOCUMENTS\HIJACKTHIS.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\EASY KEYBOARD\EASYKEY.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZONEALARM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\MY DOCUMENTS\HIJACKTHIS.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Common Startup:
[C:\WINDOWS\All Users\Start Menu\Programs\StartUp]
ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

SystemTray = SysTray.Exe
Easykey = C:\Program Files\Easy Keyboard\EasyKey.exe
ccApp = "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
ccRegVfy = "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
NPROTECT = c:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

ccEvtMgr = "c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
ScriptBlocking = "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
SchedulingAgent = mstask.exe
NPROTECT = c:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
TrueVector = C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll power.drv

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 21/10/2003, 16:19:28)

[Rename]
NUL=c:\windows\ttfcache.

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

c:\windows\net start
c:\windows\cwcdata\cwrdos.exe
SET TEMP=C:\WINDOWS\TEMP

--------------------------------------------------


Enumerating Browser Helper Objects:

NAV Helper - c:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}
(no name) - (no file) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC}
(no name) - c:\Program Files\Microsoft Money\System\mnyside.dll - {243B17DE-77C7-46BF-B94B-0B5F309A0E64}
(no name) - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Symantec NetDetect.job
Norton SystemWorks One Button Checkup.job
Norton AntiVirus - Scan my computer.job

--------------------------------------------------

Enumerating Download Program Files:

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE =
[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\DIRECTOR\SWDIR.DLL
CODEBASE =
[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE =
[ActiveScan Installer Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\ASINST.DLL
CODEBASE =
[HouseCall Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\XSCAN53.OCX
CODEBASE =
--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL

--------------------------------------------------
End of report, 5,285 bytes
Report generated in 0.046 seconds
 
Sort by date Sort by votes
Your log is clean...What 'wierd' things is your machine doing?
 
Upvote 0 Downvote
Hi carbison,

I don't see anything of interest except for the existance of those web-controls that are anti-virus scanners. I'de worry about them co-existing with Norton Anti-Virus...

More info about your problem would be helpful..

Thanks,
Kevin
 
Upvote 0 Downvote
The weird things are:
1) If I turn the system off for several hours. I get random errors on start up. These include: WPE, GPF, various files can't be loaded into memory but it is always a different error. After letting the system warm up it boots fine. I have reseated all the cards, cleaned etc. It must have something to do with the heat expanding contacts but I thought it might be something else. My only work around is to leave the thing on all the time.
2)I can't get the taskbar to change from checked to unchecked in the "Always on top" box.
3)And NAV always gives a error saying it can't load properly when I switch users. (Forcing me to reboot.) Symantec says they have heard of the problem but can't reproduce it.
4) This all started when one of my kids allowed GATOR to be downloaded.

I think I'm going to removed these using Hijack This:
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
What do you think?

Carbison
 
Upvote 0 Downvote
Hi carbison,

Your problems have all the making of hardware issues - wether they be memory, hard disk or video card related. Since your computer is probably a litle older - finding the culprit may take some diligence. if I were to go after something as a start - I'de say it would be the hard disk - they are generally the most common failure...

In this case I might get another hard drive (it might be hard to find something small enough these days) and cleanly install Windows 98. After installation, take a look at your system to see if your issues still exist..

As far as your plans to remove controls with HijackThis - I would suggest you only remove

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
and

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
The first entry is not suspect as far as I can tell.

Hope this helps,
Kevin
 
Upvote 0 Downvote
As far as the taskbar problem is concerned....
Go Start>Run Regedit go to
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StuckRects

Delete the entire "StuckRects" key and reboot. When Windows restarts the taskbar should be set back to a default working state..

You may want to check if this key is also here...
HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\StuckRects

Delete the entire "StuckRects" key and reboot.
I noticed you say User profiles, so you may have to do this under each specific user

TT4U

Notification:
These are just "my" thoughts....and should be carefully measured against other opinions....I try very hard to impart correct info at all times.
 
Upvote 0 Downvote
Hi ! iv'e heard there is trouble with printer driver you have for your lexmark printer (LEXBCES).
This trouble is problems at boot ,slow shutdowns ,resource bahaviour and so on).
Try unistalling your printer/drivers and make sure LEXBCES.EXE
is not loaded afterwords .

This program is a component of the Lexmark MarkVision software. If your Lexmark printer comes with an internal network card, you will need to install MarkVision to configure that network card. This results in LEXBCES running as a background process on Windows 9x and as a service in Windows NT4. Recommendation : If you are not experiencing any problems, leave alone. In our case, however, we have found the MarkVision software extremely buggy, to cause Windows startup problems, to cause serious performance hogs, and a number of other problems. As a result, while we often recommend Lexmark printers, particularly for the high end lasers, we now never ever buy Lexmark printers with in-built network cards - we use external Intel Netport Express print servers instead.
(source reger24.de )
 
Upvote 0 Downvote
Status
Not open for further replies.

Similar threads

pmonett
  • Locked
  • Question
What is this now ? 1
Replies
8
Views
338
pmonett
pmonett
DSaba10
  • Locked
  • Question
Creating a log of SFTP Uploads
Replies
0
Views
39
DSaba10
DSaba10
bsquared18
  • Locked
  • Question
Trying to Reduce Used Space on My Windows 10 C Drive 1
Replies
19
Views
96
bsquared18
bsquared18
12345DrDave
  • Locked
  • Question
Windows Update cannot check for updates following using Portable Update Windows 7
Replies
2
Views
63
12345DrDave
12345DrDave
Randy_F
  • Locked
  • Question
How do I transfer my hard drive from my current Lenovo PC to my new Dell Optiplex 3050
Replies
12
Views
115
Randy_F
Randy_F

Part and Inventory Search

Sponsor

Back
Top