1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

dialup problem 2

Discussion in 'Legacy Windows' started by DeeTee, 2004/01/09.

Thread Status:
Not open for further replies.
  1. 2004/01/09
    DeeTee

    DeeTee Inactive Thread Starter

    Joined:
    2004/01/06
    Messages:
    13
    Likes Received:
    0
    OK, sorry about that...
    Yes, since the last couple of days both my pcs have started loading the dialer on start up, this one does not disply the Norton Antivirus auto protect icon in the systray until I click cancel or connect.
    Also, when I hit shutdown to exit the system the dialer reapears before the closing screen, but it usually shuts down ok.

    I have ran Adaware 6 181. and it has the newest update ref file.

    Here is the logs;

    Logfile of HijackThis v1.97.7
    Scan saved at 19:13:21, on 09/01/04
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v5.50 SP1 (5.50.4522.1800)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\RUNDLL32.EXE
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
    C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
    C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\PROGRAM FILES\CREATIVE\SBLIVE\AUDIOHQ\AHQTBU.EXE
    C:\WINDOWS\SYSTEM\CTHELPER.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\FREESERVE\FREESERVECONNECTIONKIT\ATDIALLER1.EXE
    C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON ANTIVIRUS\NAVAPW32.EXE
    C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZAPRO.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\DOWNLOADS\HIJACK THIS\HIJACK THIS\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.freeserve.com/iesearch/default.htm
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=http://www-cache.freeserve.com:8080;ftp=http://www-cache.freeserve.com:8080
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [AudioHQU] C:\PROGRAM FILES\CREATIVE\SBLIVE\AUDIOHQ\AHQTBU.EXE
    O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
    O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe "
    O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [MicroDialler] C:\Freeserve\FreeserveConnectionKit\atdialler1.exe
    O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NORTON~1\NAVAPW32.EXE
    O4 - HKLM\..\Run: [NPROTECT] C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    O4 - HKLM\..\RunServices: [LicCtrl] rundll32.exe C:\WINDOWS\MMFS.DLL,Service
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
    O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
    O4 - HKLM\..\RunServices: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks "
    O4 - HKLM\..\RunServices: [NPROTECT] C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37985.6662384259
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

    StartupList report, 09/01/04, 19:14:33
    StartupList version: 1.52
    Started from : C:\DOWNLOADS\HIJACK THIS\HIJACK THIS\HIJACKTHIS.EXE
    Detected: Windows 98 SE (Win9x 4.10.2222A)
    Detected: Internet Explorer v5.50 SP1 (5.50.4522.1800)
    * Using default options
    ==================================================

    Running processes:

    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\RUNDLL32.EXE
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
    C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
    C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\PROGRAM FILES\CREATIVE\SBLIVE\AUDIOHQ\AHQTBU.EXE
    C:\WINDOWS\SYSTEM\CTHELPER.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\FREESERVE\FREESERVECONNECTIONKIT\ATDIALLER1.EXE
    C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON ANTIVIRUS\NAVAPW32.EXE
    C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZAPRO.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\DOWNLOADS\HIJACK THIS\HIJACK THIS\HIJACKTHIS.EXE

    --------------------------------------------------

    Listing of startup folders:

    Shell folders Common Startup:
    [C:\WINDOWS\All Users\Start Menu\Programs\StartUp]
    ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe

    --------------------------------------------------

    Autorun entries from Registry:
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run

    ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
    SystemTray = SysTray.Exe
    AudioHQU = C:\PROGRAM FILES\CREATIVE\SBLIVE\AUDIOHQ\AHQTBU.EXE
    WINDVDPatch = CTHELPER.EXE
    Jet Detection = "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe "
    TaskMonitor = C:\WINDOWS\taskmon.exe
    LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    MicroDialler = C:\Freeserve\FreeserveConnectionKit\atdialler1.exe
    NAV Agent = C:\PROGRA~1\NORTON~1\NORTON~1\NAVAPW32.EXE
    NPROTECT = C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE

    --------------------------------------------------

    Autorun entries from Registry:
    HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

    LicCtrl = rundll32.exe C:\WINDOWS\MMFS.DLL,Service
    LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    SchedulingAgent = mstask.exe
    TrueVector = C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
    ScriptBlocking = "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
    SymTray - Norton SystemWorks = C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks "
    NPROTECT = C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE

    --------------------------------------------------

    Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

    Shell=Explorer.exe
    SCRNSAVE.EXE=
    drivers=mmsystem.dll

    --------------------------------------------------

    C:\WINDOWS\WININIT.BAK listing:
    (Created 9/1/2004, 12:22:48)

    [Rename]
    NUL=c:\windows\cookies\anyuser@atdmt[2].txt
    NUL=c:\windows\cookies\anyuser@adserv[1].txt
    NUL=c:\windows\cookies\anyuser@fortunecity[1].txt
    NUL=c:\windows\cookies\anyuser@clickbank[2].txt
    NUL=c:\windows\cookies\anyuser@adserver.promokant[1].txt

    --------------------------------------------------

    C:\AUTOEXEC.BAT listing:

    mode con codepage prepare=((850) C:\WINDOWS\COMMAND\ega.cpi)
    mode con codepage select=850
    keyb uk,,C:\WINDOWS\COMMAND\keyboard.sys

    --------------------------------------------------


    Enumerating Browser Helper Objects:

    (no name) - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
    NAV Helper - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}

    --------------------------------------------------

    Enumerating Task Scheduler jobs:

    Tune-up Application Start.job
    Symantec NetDetect.job
    Norton AntiVirus - Scan my computer.job

    --------------------------------------------------

    Enumerating Download Program Files:

    [Update Class]
    InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
    CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37985.6662384259

    [Shockwave Flash Object]
    InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
    CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

    --------------------------------------------------

    Enumerating ShellServiceObjectDelayLoad items:

    WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL

    --------------------------------------------------
    End of report, 5,300 bytes
    Report generated in 0.334 seconds

    Command line options:
    /verbose - to add additional info on each section
    /complete - to include empty sections and unsuspicious data
    /full - to include several rarely-important sections
    /force9x - to include Win9x-only startups even if running on WinNT
    /forcent - to include WinNT-only startups even if running on Win9x
    /forceall - to include all Win9x and WinNT startups, regardless of platform
    /history - to list version history only


    If you can assist with this I would be most grateful(and impressed)
    Thanks.
    Chris
     
    DeeTee,
    #1
  2. 2004/01/09
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    I'll take a look at your HijackThis log.
    Meanwhile go Start>Settings>Control Panel
    Double click on "Internet Options ", go "Connections" tab, make sure, there is a dot next to "Never dial a connection "
     
    broni,
    #2


  3. to hide this advert.

  4. 2004/01/09
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    Needed at the startup, only when you have some scheduled tasks.

    C:\WINDOWS\SYSTEM\CTHELPER.EXE
    No needed at the startup

    O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe "
    No needed at the startup

    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    There are two identical entries. These are for Power Management, which is not recommended in Windows 98. It's better to turn PM off, and uncheck above two entries in msconfig\startup.

    I don't see any "bad guys" in your log.
     
    broni,
    #3
  5. 2004/01/09
    aleekat

    aleekat Inactive

    Joined:
    2002/01/07
    Messages:
    902
    Likes Received:
    0
    Definitely run Spybot and Adaware to clean further. Look in your add/remove programs for "windows critical updates" or something like that. It likes to "phone home ".
     
    aleekat,
    #4
  6. 2004/01/09
    DeeTee

    DeeTee Inactive Thread Starter

    Joined:
    2004/01/06
    Messages:
    13
    Likes Received:
    0
    I dont know where to start with these, I tried to turn off the task scheduler and it caused start up problems all of its own and forced windows to restart with a "recent back up of the registry "
    the dial up was still there... I think it's since I did Norton Anti Virus live update,

    I know that you are trying to help here guys, but some of this stuff is over the top of my head...really....

    There are a few entries in the msconfig that look similar???
    "C:\WINDOWS\SYSTEM\MSTASK.EXE "
    There are at least two of these, should they be ticked or not???
     
    DeeTee,
    #5
  7. 2004/01/09
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Don't disable "mstask.exe ", if you have any task scheduled.
    If you don't, then in "msconfig\startup" you should have only one entry:
    in left column it says "SchedulingAgent ", next to it, it says "mstask.exe "
     
    broni,
    #6
  8. 2004/01/09
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    You want to uncheck the ones in startup that match those broni listed.

    I would also like to recommend you run CWShreddder.
     
    noahdfear,
    #7
  9. 2004/01/09
    aleekat

    aleekat Inactive

    Joined:
    2002/01/07
    Messages:
    902
    Likes Received:
    0
    Since your using Freeserve as an ISP, take a look here at their recommendation. Just scroll down until getting to "atdialler "..
     
    aleekat,
    #8
  10. 2004/01/11
    DeeTee

    DeeTee Inactive Thread Starter

    Joined:
    2004/01/06
    Messages:
    13
    Likes Received:
    0
    Well,
    It all went sour and I had a major crash, the machine just wouldnt start and I ended up typing "fdisk "...
    There must have been a bug somewhere so....
    Anyway, its running now and the dialup has gonski....
     
    DeeTee,
    #9
  11. 2004/01/11
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    DeeTee
    Thanks for posting back, and it's good to see, you are up, and running.
     
    broni,
    #10
  12. 2004/01/13
    Ryder

    Ryder Inactive

    Joined:
    2003/09/01
    Messages:
    124
    Likes Received:
    0
    I just solved a similar problem on a PC out here, altho their probelms were more extreme, in that "My Computer" would not open, could only be accesses through Explorer. I tried scandisk (dos and Windows, as I've discovered they seem to fix different things), as well as Norton and Spybot. Everything came back negative. I tried re-installing windows, same problem.
    What did fix it in the end was "scanreg /fix " - the PC had problems shutting down, and so over time, the registry just got overly corrupted - altho it did coincide with a recent upgrade to Norton 2004 which may have been the culprit.
    Just thought I'd mention it
     
    Ryder,
    #11
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...