problem I can't find

Discussion in 'other software & services' started by Kathyhl, Nov 8, 2003.

Thread Status:
Not open for further replies.
  1. Kathyhl

    Kathyhl Registered Member

    Joined:
    Oct 18, 2003
    Posts:
    186
    Location:
    California
    I've had an ongoing problem with my win98 for the past few years, but because I'm running so many safe programs, i.e. anti-virus, spyguards, registry cleaners, and all the other programs that came with my Norton system works, I've never considered it anything more than just a nuisance that I have to put up with, but since finding this site, I wonder if someone can shed any light on why I'm having this problem? It mainly happens when I am in my e-mail program and someone has sent me an URL to check out. I will click on the URL and this large abnoxious box comes up comes up letting me know I have an error, and either click ignore and it will try and fix it, or click on end and I will lose all unsaved data. I actually have tried clicking on ignore, but not surprisingly, it ignores me and does nothing, only clicking on end will do something, then it closes half my programs, and I always have to wind up re-booting. (It does however always let me go to the URL I've clicked on, which I now consider a big price to pay just to see an URL, so I have been copying and pasting instead). Once in while this will happen when I'm going into my windows explorer or control panel, but usually it's in my e-mail program.

    Thank you for any help you can give me.
     
  2. TonyKlein

    TonyKlein Security Expert

    Joined:
    Feb 9, 2002
    Posts:
    4,350
    Location:
    The Netherlands
    Hi, and welcome to the board.

    The details of that error message would be very useful indeed.

    When you next get the error, please click "details of what this error report contains", and tell us what the AppName and the ModName are you see listed there.
    Then we'll have something to work with.

    And we'd like a closer look at your configuration:
    Go to http://tomcoyote.org/hjt/ , and download 'Hijack This!'.
    Unzip, doubleclick HijackThis.exe, and hit "Scan".

    When the scan is finished, the "Scan" button will change into a "Save Log" button.
    Press that, save the log somewhere, and please show us its contents.

    Most of what it lists will be harmless or even required, so do NOT fix anything yet.
    Someone here will be happy to help you analyze the results.
     
  3. Kathyhl

    Kathyhl Registered Member

    Joined:
    Oct 18, 2003
    Posts:
    186
    Location:
    California
    Here's the list, unfortunately this time I clicked on it, it took me right to you, but it's a box that says explorer. Here's the hijack info.
    Logfile of HijackThis v1.97.3
    Scan saved at 7:04:24 PM, on 11/8/03
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINJECT.EXE
    C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE
    C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
    C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\RNAAPP.EXE
    C:\WINDOWS\SYSTEM\TAPISRV.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\WINDOWS\SYSTEM\STIMON.EXE
    C:\WINDOWS\TPPALDR.EXE
    C:\USBSTORAGE\USBDETECTOR.EXE
    C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON ANTIVIRUS\NAVAPW32.EXE
    C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON ANTIVIRUS\POPROXY.EXE
    C:\PROGRAM FILES\PESTPATROL\PPCONTROL.EXE
    C:\PROGRAM FILES\PESTPATROL\PPMEMCHECK.EXE
    C:\PROGRAM FILES\PESTPATROL\COOKIEPATROL.EXE
    C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZAPLUS.EXE
    C:\WINDOWS\LOADQM.EXE
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
    C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINSM32.EXE
    C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\SYSDOC32.EXE
    C:\Program Files\Norton SystemWorks\Norton CleanSweep\Monwow.exe
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\PROGRAM FILES\INCREDIMAIL\BIN\INCMAIL.EXE
    C:\PROGRAM FILES\INCREDIMAIL\BIN\IMAPP.EXE
    C:\HIJACK THIS\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = C:\Program Files\Copernic Agent\Web\SearchBar.htm
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.comcast.net/~kathyhl/index.htm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = C:\Program Files\Copernic 2001 Pro\Search Bar.htm
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.r4.attbi.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
    O2 - BHO: Atomica BHO - {3392BD0A-A851-4AA4-86E0-4651006F9EA8} - C:\PROGRAM FILES\COMMON FILES\ATOMICA SHARED\AGTBHO.DLL
    O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\PROGRA~1\COPERN~4\COPERN~1.DLL
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
    O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
    O4 - HKLM\..\Run: [USBDetector] C:\USBStorage\USBDetector.exe
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [NAV DefAlert] C:\PROGRA~1\NORTON~2\NORTON~2\DEFALERT.EXE
    O4 - HKLM\..\Run: [NPROTECT] C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~2\NORTON~2\NAVAPW32.EXE /LOADQUIET
    O4 - HKLM\..\Run: [Norton eMail Protect] C:\Program Files\Norton SystemWorks\Norton AntiVirus\POPROXY.EXE
    O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Program Files\PestPatrol\PPControl.exe
    O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
    O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
    O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
    O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zaplus.exe
    O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [CSINJECT.EXE] C:\Program Files\Norton SystemWorks\Norton CleanSweep\CSINJECT.EXE
    O4 - HKLM\..\RunServices: [NPROTECT] C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    O4 - HKLM\..\RunServices: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"
    O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
    O4 - HKCU\..\Run: [Weather] C:\PROGRAM FILES\AWS\WEATHERBUG\WEATHER.EXE 1
    O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
    O4 - Startup: CleanSweep Smart Sweep-Internet Sweep.lnk = C:\Program Files\Norton SystemWorks\Norton CleanSweep\csinsm32.exe
    O4 - Startup: Norton System Doctor.lnk = C:\Program Files\Norton SystemWorks\Norton Utilities\SYSDOC32.EXE
    O8 - Extra context menu item: Summarize Using Copernic Summarizer - C:\Program Files\Copernic Summarizer\Web\SummarizePage.htm
    O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
    O8 - Extra context menu item: Search Using Copernic Agent - C:\Program Files\Copernic Agent\Web\SearchExt.htm
    O8 - Extra context menu item: GuruNet... - file:C:\Program Files\GuruNet\Html\atiemenu.htm
    O9 - Extra 'Tools' menuitem: Summarize Using Copernic Summarizer (HKLM)
    O9 - Extra button: Summarize (HKLM)
    O9 - Extra button: LiveSummarizer (HKLM)
    O9 - Extra button: ICQ (HKLM)
    O9 - Extra 'Tools' menuitem: ICQ (HKLM)
    O9 - Extra 'Tools' menuitem: Launch Copernic Agent (HKLM)
    O9 - Extra button: Copernic Agent (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {D45FD31B-5C6E-11D1-9EC1-00C04FD7081F} (Microsoft Agent Control 2.0) - http://activex.microsoft.com/activex/controls/agent2/msagent.exe
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    O16 - DPF: {E389B374-BB5A-4A73-ACF4-3CE63E4C1DE9} (Brxpdf5 Control) - http://a19.g.akamai.net/7/19/7125/1234/ftp.coupons.com/brxpdf5.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37874.5295601852
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/d052c1d7d32ead/housecall.antivirus.com/housecall/xscan53.cab
    O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
     
  4. TonyKlein

    TonyKlein Security Expert

    Joined:
    Feb 9, 2002
    Posts:
    4,350
    Location:
    The Netherlands
    That's a pretty clean log.

    Try this:

    Go to Start > Settings , click Control Panel , and then double-click Add/Remove Programs .

    On the Install/Uninstall tab, click Microsoft Internet Explorer, click Add/Remove , click Repair the current installation of Internet Explorer , and then click OK .

    Now test IE for a while. If there's no improvement, do the following:

    Go to Start/run, and type SFC.
    Choose 'Extract One File From Installation Disk'.
    Type oleaut32.dll, not worrying about its location. Then, click Start.

    Next to 'Restore From', type in or browse for the file’s location, which is probably in the Win98 folder of your installation CD-ROM (typically D:\Win9:cool:, or in your Windows\Options\Cabs folder, as the case may be.

    Then, next to 'Save File In', enter C:\Windows\System, and click OK. System File Checker looks for the file, saves it as you requested, and then tells you that 'the file has been successfully extracted'.

    Reboot, test your browser, and tell us whether that has helped. It often will.

    NOTE: before doing that, make a copy of your present version of Oleaut32.dll and save it outside your Windows\System directory for safekeeping.
     
  5. Kathyhl

    Kathyhl Registered Member

    Joined:
    Oct 18, 2003
    Posts:
    186
    Location:
    California
    Thank you so much Tony, I will most definitely do what you have requested, and as soon as I am able, I will let you know the results. What a godsend if it works, I am so tired of having to re-boot just because I accidently click on an URL in my e-mail.

    Thanks again :)
     
  6. Kathyhl

    Kathyhl Registered Member

    Joined:
    Oct 18, 2003
    Posts:
    186
    Location:
    California
    well Tony, I have actually been able to click on an URL 3 times now with no error message, and this was just after asking it to repair the current installation of Internet Explorer, so I haven't had to do the second part yet, but I have printed it out and kept it in case it's needed. do you know what causes something like that to happen? Or is this just one of those pc things that no one knows why it changes?

    This website is one of the best things that has ever happened to me. such great help, such good people, and so many new programs I have now downloaded. I just bought the Ace Utilities, and I think it's been the best purchase I've made in awhile.

    Thanks again
     
  7. TonyKlein

    TonyKlein Security Expert

    Joined:
    Feb 9, 2002
    Posts:
    4,350
    Location:
    The Netherlands
    Glad to hear that appears to have worked:

    As to why it happened, hard to tell; you install and remove software, applications and Windows itself may crash occasionally, and things will go bump in the night... ;)
     
Loading...
Thread Status:
Not open for further replies.