1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Illegal Oper, Warnings, Freezes, ETC

Discussion in 'Security and Privacy' started by opheim1, 2004/08/28.

Thread Status:
Not open for further replies.
Page 1 of 2
  1. 2004/08/28
    opheim1

    opheim1 Inactive Thread Starter

    Joined:
    2002/09/05
    Messages:
    92
    Likes Received:
    0
    Hi,
    I seem to have a group of problems and am wondering if they are not related.
    They are:
    Frequent freezes. I use Ctrl-Alt. & Delete a lot, and sometimes that doesn't work either. So I manually have to shut down and re-boot which includs the slow ScanDisk function.
    Safe Mode- Goes there automatically some times.
    Illegal Operations- Many and they crop up at any time even when I go to my e-mail.
    Warnings-System Memory running low. Norton may not function properly. As far as I can tell there is adequate memory.
    For these and other quirks, I frequently have to manually shut down in order to get working order.
    Any suggestions would be appreciated. Thanks!
    Larry
     
    opheim1,
    #1
  2. 2004/08/29
    opheim1

    opheim1 Inactive Thread Starter

    Joined:
    2002/09/05
    Messages:
    92
    Likes Received:
    0
    Multiple Problems

    Do you think that running a Recovery CD would be of any benefit?
    Thanks!
    Larry
     
    opheim1,
    #2


  3. to hide this advert.

  4. 2004/08/29
    Miz

    Miz Inactive Alumni

    Joined:
    2002/05/02
    Messages:
    2,345
    Likes Received:
    35
    If you haven't scanned for and removed spyware recently (or at all), that's the first thing I'd try.

    Spybot and/or Ad-Aware are the two most widely used spyware removal programs. They're free.
     
    Miz,
    #3
  5. 2004/08/30
    goldienite Lifetime Subscription

    goldienite Senior Member

    Joined:
    2004/06/27
    Messages:
    131
    Likes Received:
    0
    I would also do a online scan for viruses goto RAV

    Good luck :cool:
     
    goldienite,
    #4
  6. 2004/08/30
    opheim1

    opheim1 Inactive Thread Starter

    Joined:
    2002/09/05
    Messages:
    92
    Likes Received:
    0
    Thanks for the input. I do have Norton which is up-to-date and doing it's thing and does a complete scan weekly. I also have used Spybot on a regular basis. I have it installed.
    Thanks, but I may need another suggestion or two.
    Larry
     
    opheim1,
    #5
  7. 2004/08/30
    goldienite Lifetime Subscription

    goldienite Senior Member

    Joined:
    2004/06/27
    Messages:
    131
    Likes Received:
    0
    Hi
    What have you got to lose? Run RAV online, I stop using Norton 2 years ago because it let 5 virus on to my PC:cool:
     
    goldienite,
    #6
  8. 2004/08/30
    opheim1

    opheim1 Inactive Thread Starter

    Joined:
    2002/09/05
    Messages:
    92
    Likes Received:
    0
    Goldenite,
    I did the online of RAV.
    Found:
    Viruses-0
    Suspicious-1
    Disinfected-0
    Mail Files-142
    What do you make of the findings?
    I appreciate your concern and help.
    Larry
     
    opheim1,
    #7
  9. 2004/08/30
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please, post your "HijackThis" log here, and we may see more about your problems. Dumping IE would be another good sidekick.
     
    broni,
    #8
  10. 2004/08/31
    goldienite Lifetime Subscription

    goldienite Senior Member

    Joined:
    2004/06/27
    Messages:
    131
    Likes Received:
    0
    Hi
    Well it found something when I run RAV it's all 0's, your best bet is to run Hijackthis and post it here.

    :cool:
     
    goldienite,
    #9
  11. 2004/08/31
    opheim1

    opheim1 Inactive Thread Starter

    Joined:
    2002/09/05
    Messages:
    92
    Likes Received:
    0
    Thanks again for your help!
    Now I need to know how to download Hijack This.
    Thanks!
    Larry
     
    opheim1,
    #10
  12. 2004/08/31
    goldienite Lifetime Subscription

    goldienite Senior Member

    Joined:
    2004/06/27
    Messages:
    131
    Likes Received:
    0
    Hi Larry

    Use the windowsbbs Q/link in my signature to get HijackThis, Place it in its own folder. Run, save log, cut and paste here.

    :cool:
     
    goldienite,
    #11
  13. 2004/08/31
    opheim1

    opheim1 Inactive Thread Starter

    Joined:
    2002/09/05
    Messages:
    92
    Likes Received:
    0
    Hi, Here is the Hijack this log:

    Logfile of HijackThis v1.98.2
    Scan saved at 10:37:03 AM, on 8/31/04
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
    C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\ptsnoop.exe
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\WINDOWS\SYSTEM\STIMON.EXE
    C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
    C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\EVNTSVC.EXE
    C:\PROGRAM FILES\CITI VIRTUAL ACCOUNT NUMBERS\CITIVAN.EXE
    C:\PROGRAM FILES\COMMON FILES\KODAK\KODAK_DR\KODAKCCS.EXE
    C:\PROGRAM FILES\KODAK\KODAK EASYSHARE SOFTWARE\BIN\EASYSHARE.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\45Y3CDQJ\HIJACKTHIS[1].EXE

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.excite.com/
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
    O2 - BHO: CitiUS Shared Browser Helper Object - {387EDF53-1CF2-4523-BC2F-13462651BE8C} - C:\WINDOWS\SYSTEM\BHOCITUS.DLL
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [PTSNOOP] ptsnoop.exe
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
    O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
    O4 - HKLM\..\Run: [CitiVAN] C:\PROGRA~1\CITIVI~1\CitiVAN.exe /dontopenmycards
    O4 - HKLM\..\Run: [KodakCCS] C:\Program Files\Common Files\KODAK\KODAK_DR\KodakCCS.exe --pdr: "C:\Program Files\Common Files\KODAK\KODAK_DR\dcmnter.pdr "
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe "
    O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe "
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - Startup: Kodak EasyShare software.lnk = C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
    O8 - Extra context menu item: Citibank Toolbar - about:<script>new ActiveXObject( "OBar.BarLauncher ").ShowBar(window.external.menuArguments, "{2db95750-6d83-11d4-bb5b-00e02956ca77} ")</script>
    O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
    O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
    O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
    O9 - Extra button: Citi - {4C730913-3961-439b-83D5-F4E445520422} - C:\PROGRA~1\CITIVI~1\CitiVAN.exe
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
    O9 - Extra button: Citibank Toolbar - {2db95750-6d83-11d4-bb5b-00e02956ca77} - C:\PROGRA~1\OBONGO\IEBAR\1OBAR~1.DLL (file missing) (HKCU)
    O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
    O12 - Plugin for .hpb: C:\PROGRA~1\INTERN~1\PLUGINS\nphpipb.dll
    O12 - Plugin for .bpt: C:\PROGRA~1\INTERN~1\Plugins\NPBelv32.dll
    O12 - Plugin for .bcf: C:\PROGRA~1\INTERN~1\Plugins\NPBelv32.dll
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O16 - DPF: {CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_04) -
    O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
    O16 - DPF: {427273CC-764E-11D3-823D-006097F90453} (Pixami Image Editor Control) - http://www.imagestation.com/common/classes/BPImageEditor.cab?ver=1,1,0,30
    O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.charter.com/sdccommon/download/tgctlcm.cab
    O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://photo.walmart.com/photo/upload/XUpload.ocx
    O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
    O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
    O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.cab
    O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://download.weatherbug.com/minibug/tricklers/AWS/MiniBugTransporter.cab?
    O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab
    O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
     
    opheim1,
    #12
  14. 2004/08/31
    markp62

    markp62 Geek Member Alumni

    Joined:
    2002/05/01
    Messages:
    4,012
    Likes Received:
    16
    I moved this to Security where we are handling HJT logs.
    There are some items that needs to be 'fixed' by HJT.
    O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
    O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.charter.com/sdccommo...oad/tgctlcm.cab
    Maybe eliminating some things from startup? Some of these can be started manually. Use Msconfig to disable these. Some of these may be conflicting with each other.
    O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
    O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
    O4 - HKLM\..\Run: [CitiVAN] C:\PROGRA~1\CITIVI~1\CitiVAN.exe /dontopenmycards
    O4 - HKLM\..\Run: [KodakCCS] C:\Program Files\Common Files\KODAK\KODAK_DR\KodakCCS.exe --pdr: "C:\Program Files\Common Files\KODAK\KODAK_DR\dcmnter.pdr "
    O4 - Startup: Kodak EasyShare software.lnk = C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
     
    markp62,
    #13
  15. 2004/09/01
    opheim1

    opheim1 Inactive Thread Starter

    Joined:
    2002/09/05
    Messages:
    92
    Likes Received:
    0
    Hi Mark'
    Thanks for your help.
    One the first item 03 Toolbar etc. How do I remove it?
    On the second item 016 DPF etc with the link, the message was "No Page Found ". What do I do here?
    On the Start Up items, There was only about three that I could disable, as the others were unchecked. Some in fact were not on the list including many Kodak related.
    Thanks Again.
    Larry
     
    opheim1,
    #14
  16. 2004/09/01
    goldienite Lifetime Subscription

    goldienite Senior Member

    Joined:
    2004/06/27
    Messages:
    131
    Likes Received:
    0
    Hi Larry

    You need to run Hijackthis inside its folder again, this time put a tick into the box beside the ones you need to remove and click fix log. tick these
    O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
    O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
    O4 - HKLM\..\Run: [CitiVAN] C:\PROGRA~1\CITIVI~1\CitiVAN.exe /dontopenmycards
    O4 - HKLM\..\Run: [KodakCCS] C:\Program Files\Common Files\KODAK\KODAK_DR\KodakCCS.exe --pdr: "C:\Program Files\Common Files\KODAK\KODAK_DR\dcmnter.pdr "
    O4 - Startup: Kodak EasyShare software.lnk = C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe

    :cool:
     
    Last edited: 2004/09/01
    goldienite,
    #15
  17. 2004/09/01
    opheim1

    opheim1 Inactive Thread Starter

    Joined:
    2002/09/05
    Messages:
    92
    Likes Received:
    0
    Hi Mark and Goldienite,
    I was able to get back to Hijackthis and use the check boxes for the two items listed other than the Start Up items which I had done manually before.
    Many of those Kodak items were not on the Start Up list; just one.
    Thanks much and I will report back on any progress or lack thereof.
    Larry
     
    opheim1,
    #16
  18. 2004/09/01
    opheim1

    opheim1 Inactive Thread Starter

    Joined:
    2002/09/05
    Messages:
    92
    Likes Received:
    0
    Hi,
    After the above reply, I left the computer for about three hours, when I turned the monitor on, the background was solid blue like a DOS function. The message said " System memory is running very low. Norton AntiVirus may not be able to function properly. Press any key to continue. When I did that, I got back to the Desktop. At that point I decided to check for memory in My Computer. When I clicked on Properties I received the following message
    "Access to the specified device path or tile is denied. When I then clicked OK, it froze up . Control-Alt-Delete did nothing, so I had to manually shut down. Then I tried My Computer again and this time I was able to check on the System Resources which said 90% free, and Your System is configured for optimal performance.
    I'm wondering if Power Management has anything to do with matters, or if it is set up right. I have Home/Office Desk, System Standby after 45 min, Turn off monitor-after 45 min., and turn off hard disk after 4 hours. I didn'y always have the setting at Home/Office, but deleted the previous setting and can't get it back whatever it was.
    This is my major problem right now, and would really like to get it straightened out. Your help is appreciated.
    Thanks.
    Larry
     
    opheim1,
    #17
  19. 2004/09/01
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    This is true for all items, except O4s. You can't fix them using HT.

    To prevent O4 items from starting automatically, you go Start>Run, type: MSCONFIG, go "Startup" tab, and you'll find all of them there. Uncheck those, you were adised to.
     
    broni,
    #18
  20. 2004/09/01
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    You have also above entry, as a startup. Windows 98 is a faulty feature, and may cause all kind of errors, hang-ups, etc.
    My advice is to disable it.
    In "msconfig/startup" you'll find TWO identical entries [LoadPowerProfile]. Uncheck them both.

    O4 - HKLM\..\Run: [PTSNOOP] ptsnoop.exe
    These descriptions I've come across - all valid as far as I can see :-
    (1) Program installed with some modems that monitors the COM ports for the modem driver. Not required from what I've read - may need a registry edit to get rid of it
    (2) Backdoor trojan virus that copies itself as PTSNOOP.EXE -see HERE for more info
    (3) Apparently the people who put it out claim it's a driver for a Voice modems
    Note: If using AOL and you disable this you may lose your connection or lock up
    (4) Can also be an older Logitech scanner program. Remove from the Win.ini tab under Load='path'PTSNOOP and the System.ini tab under drivers='path'ptrtkr.drb. Can cause parallel port conflicts big time dragging system resources way down when a conflict exists
    (5) Allows audio monitoring of modem phone dialling tones and can be useful if you have connection problems
    (6) Karen Kenworthy's Snooper - "logs the start and stop time of all programs run under Windows "

    O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
    Country selection for a PCtel HSP56 based modem. Often found in OEM (Dell,Compaq, HP, etc) systems for their modems included on the motherboard or as a separate card. Once you've set the modem up to the chosen country it's not required

    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    MS Scheduling Agent displayed as a box with a stopwatch in the System Tray that is only needed if you have regular scheduled disk defragmenting, ScanDisk, etc.

    Make all those changes, and fixes, and post your new HT log.
     
    broni,
    #19
  21. 2004/09/01
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Hi broni,

    Could you please explain that for me. HJT removes the startup entry from the registry, thereby disabling the startup. :confused:
     
    noahdfear,
    #20
Page 1 of 2
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...