This is a test - Am I Clean (merged)

Please, read this log! (Scroll down to bottom.)

Lately I have been getting some very bizarre problems. Windows updates don't work, various errors occur, etc.

When I try to look at a list of MS updates to install (after scanning for updates, before I get a chance to actually download them), a Microsoft error, code 0xc0000005, occurs, and IE quits. Following this, the same error will occur when I try to start IE again, preventing me from getting back on the internet. In addition, both Adaware and Spybot will perform illegal operations and quit on startup following the error. Restarting the computer will negate the aforementioned effects.

Also, directly posting a HijackThis log results in exactly the same Microsoft error as during attempts to install MS updates. I am only able to post such logs via attachments.

This looks to me like it might be some sort of attempt to remain hidden by a virus or trojan - I've heard of Gaobot strains that do things like this. Since AntiVir PE, Adaware, Spybot, F-Prot for DOS, and Trend Micro's Housecall online virus scan have all failed to turn up anything at all, I have decided to post my HJT log indirectly. Please, for God's sake, tak a look at it!

 

Re: This is a test.

Hi Pigman,

You are still having trouble posting the log?

Can you try saving it as an attachment and see if that works.

Regards,

snap

 

Re: This is a test.

Thanks. How do I do that?

Second edit: In first edit, I attempted to copy and paste my log to this post. The attempt failed, resulting in the same IE error that I have been experiencing, with error code 0xc0000005. It seems to me that this is targetted - perhaps a trojan or virus of some sort is using a rather novel defense strategy. This is getting quite ugly.

Hmm... I've heard that a Gaobot strain can block antivirus websites, anti-spyware software, HJT, and various other things. Perhaps I managed to get that thing from an infected websight, but it didn't get installed completely?

 

Re: This is a test.

You can save your Hijackthis log as a .txt file and then in the 'reply box' where you enter the text here on the board, look near the bottom and you will see the button called "Manage Attachments".

Click on the "Choose" button then browse to where you've saved the .txt document on your hard drive. Once you have selected the .txt document, then click the "Upload" button, then "Close this window". Your attachment will upload to the board here in your next post.

snap

 

Re: This is a test.

Ahh. Thanks.

 

Re: This is a test.

posting hijackthis log for Pigman


Logfile of HijackThis v1.97.7
Scan saved at 7:29:09 PM, on 5/15/04
Platform: Windows 98 Gold (Win9x 4.10.199
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\MOUSE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\AVPERSONAL\AVGCTRL.EXE
C:\WINDOWS\CWD3DSND.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\COMPSCANNER\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [OEMCleanup] C:\WINDOWS\OPTIONS\OEMRESET.EXE
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EM_EXEC] c:\mouse\system\em_exec.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [AVGCtrl] C:\PROGRA~1\AVPERS~1\AVGCTRL.EXE /min
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - Startup: Crystal 3D Audio Control.lnk = C:\WINDOWS\CWD3DSND.EXE
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38109.673287037
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash4/cabs/swflash.cab

 

Re: This is a test.

Thank you very much.

Now preparing to edit the first post...

 

Re: This is a test.

That's ok Pigman, you can leave your posts as they are. We can edit the title if you like though.

Do you have Spybot S&D's download protection enabled, and also the protection that locks the IE Internet Options.
That would explain the two 06 lines in our hijackthis log. Try disabling the download protection and the Internet Options restrictions in Spybot S&D and see if that makes any difference.

You can fix these. Close ALL browser and any open windows and place a check beside the following items. Then click *Fixed checked:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank

(if you did not set these yourself, then include them to be fixed too)
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

Then reboot your computer and see if you can access and download from Windows update site.

snap

 

Re: This is a test.

>You can fix these. Close ALL browser and any open windows and place a >check beside the following items. Then click *Fixed checked:

>R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = >about:blank
>R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = >about:blank
>R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = >about:blank
>R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = >about:blank

I want my homepage set to about:blank. I like it that way.

>O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
>O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel >present

Don't even ask me why the bloody hell these are here. I do not have these Spybot options on. Something is seriously screwy here.

 

Re: This is a test.

We usually do advise to fix about:blank when we see it due to the hijacker that uses that. But if you have set those yourself, then yes, leave them as they are.

You can fix these two lines then. (we do see them when people have set the "Miscellaneous Protections" under the Immunize feature in Spybot S&D, but they can also be put there by spyware too.)

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

 

Re: This is a test.

I fixed all 6 things, and my homepage is still about:blank. What the hell, I don't need redundant homepages.

By the way I just downloaded Spybot 1.3, and got rid of something called "Alexa related" (classified as spyware). Also, I found some weird things in the list of programs with uninstall features - "Chlen-us" and "ComicChat". I've never heard of them before, and I doubt I downloaded them; I'm worried that one or both contains spyware or malware. ("ComicChat" has me particularly worried.) What are these things? What should I do with them, if I can do anything?

 

Am I clean?

An error occurs when I try to post my log directly, so I have to use an attachment.

Btw, note that the 4 about:blanks are back, despite being fixed before. I like my homepage to be about:blank, but I would prefer not to have 4 homepages.

 

Re: Am I clean?

Hi Pigman,

Your log is clean. It is no use trying to fix the about:blank entries with HijackThis.
You will need to do that in the registry if you think it's worth the risk and trouble.

Regards,

Pieter

 

Am I clean?

Anything I should fix on this log?

Logfile of HijackThis v1.97.7
Scan saved at 9:28:01 PM, on 5/16/04
Platform: Windows 98 Gold (Win9x 4.10.199
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\MOUSE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE
C:\WINDOWS\CWD3DSND.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\COMPSCANNER\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [OEMCleanup] C:\WINDOWS\OPTIONS\OEMRESET.EXE
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EM_EXEC] c:\mouse\system\em_exec.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [AVGCtrl] C:\PROGRAM FILES\AVPERSONAL\AVGCTRL.EXE /min
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TeaTimer.exe
O4 - Startup: Crystal 3D Audio Control.lnk = C:\WINDOWS\CWD3DSND.EXE
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38109.673287037
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash4/cabs/swflash.cab

 

Hi Pigman,

I have merged your 3 threads together. Please stay in one thread (this one now) until all problems are solved. It becomes too confusing for anyone trying to help you if they cannot see what previous instructions were given, and we don't have the available free time to go hunting them all down.

Thank you,

snap

 

Oops, never mind.

Well, being able to post that log proves it - my problem, be it a problem with IE or a virus/trojan, is definetly linked to IE in some way.

Also, some other weird stuff following the errors:

a) My computer stated that the reason Spybot and Adaware failed after the errors was that a .dll file, "PSAPI.DLL", was missing. What does this file do, and how would a computer be fooled into not noticing it?

b) Just before the error window popped up, my HD would start clicking away like mad. Also, when I had Avast installed, the little Avast logo would start spinning. Since I had Avast set to scan things when they were opened, I'm getting a little suspicious... Maybe I'm dealing with a virus of some sort?

c) By sheer chance, a link on a certain website I visited today, instead of going to where I expected, sent me to a page with text that said, "You are being used in a DDoS attack against this sight." Being sent there was followed by - what else? - exactly the same error as happened when I tried to get an MS update (the same error code, 0xc0000005), though this time IE would start properly again after quitting. This got me wondering about exactly what's going on here...

d) I attempted to post the last three things several times on this forum, but was unable to post without causing the same error, though again, IE worked perfectly fine afterwards, with no need for restart. After restarting, I was still unable to post. As far as I know, I might still be unable to post on this forum using IE.

Again, though, note that these problems do not plague me any more - switching to a different browser worked wonders.

 

Hi Pigman,

http://www.scripting.com/frontier5/downloads/FrontierPsapiInstaller.zip
It is meant for Windows NT so replace where it states System32 with System

Hope it helps,

Pieter

 

Ummm...

What exactly does this thing do?

 

Please, for God's sake, HELP ME!!!

What the bloody hell am I supposed to do with this thing? What do you mean, "replace where it states System32 with System"? Is this in the code? Do I have to decompile it or something? WHAT THE HELL DO I DO?!!

 

Hi Pigman,

You had said in your previous post that PSAPI.DLL file was missing. Pieter has given you the link to reinstall that file. The file there is for an NT system which would put it into the System32 folder. Since you have a win98, you would need to put it into the System folder.

Does that help?

snap

 

No good!

Okay. I move the installer to C:\Windows\System, doubleclick it, and install psapi.dll. Guess what?! Psapi.dll DOES NOT APPEAR IN MY SYSTEM FOLDER!!! As a matter of fact, it doesn't even appear somehwere else! As far as I can tell, this installer is not installing anything!!!

 

Re: No good!

Well, applications should dynamically load psapi.dll if they want to support Windows 9x, rather than statically linking to it. Is Adaware and Spybot only for Windows NT class machines? I thought they worked on both.

What could be happening here is some form of EXE replacer is running instead (or binded) to your original EXE files and it requires PSAPI.DLL, that is unless those programs actually require PSAPI.DLL now. I am pretty sure you cannot load psapi.dll on Windows 9x due to it's NT dependancies.

 

If you search for the file, is it anywhere in your windows?
Do you still have the windows92 install cd-rom? or are the original install files for windows still on your system? think some path in windows.....(profiles?)...\....cab lot of cab files there anyway.
In that case you could try to start > run > sfc > unpack / put back one file > type in the name and point to the cd-rom or the directory and it could be found and set back.
Might make a difference or not, but you'll be sure anyway it's there complete.

The other thing: your firewall, did you give that options to access internet?
Which one are you using?

You might like in Internet Explorer add the www.microsoft.com site to the trusted zone and see if that makes a difference for your updates.
You do realise when you update or install anything you really must close all anti-virus like your AVG and Avast till the update is ready? also the resident protection from those.

Seeing those protection/restriction entries in your HJT log in O6 , googled a lot for those keys and it's said everywhere it's related to imunizing the system in spybot S&D. This can give problems on certain systems, not sure for which reasons, but i chose not to use it on my system too.

Maybe all replies here can give some light.
If the experts here told you not to use the CWShredder for your problem then better don't as i understand if it's used unnecessary it can do more damage then good (correct me if i'm wrong).
Sasser does not affect win98 systems, so there should be no relation to your blank problems either. (if it is a problem, as i understood you wanted that page on blank; good to try if you can change it at will though)

Looking forward to your next results.