Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Do I need help?


  • Please log in to reply
11 replies to this topic

#1 Brenda13

Brenda13

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:12:25 AM

Posted 11 April 2005 - 01:23 PM

I used Hijack this at home & you helped me out, although I haven't had a chence to follow the instructions you gave me. I need to know if I've messed up my pc at work! Following is my log:

Logfile of HijackThis v1.99.1
Scan saved at 2:17:39 PM, on 04/11/2005
Platform: Windows NT 4 SP6 (WinNT 4.00.1381)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\spoolss.exe
D:\WINNT\System32\drmon\smartagt\smartagt.exe
D:\WINNT\system32\RpcSs.exe
C:\Program Files\navapsvc.exe
d:\winnt\system32\pstores.exe
D:\WINNT\system32\MSTask.exe
D:\WINNT\system32\ZONELABS\vsmon.exe
D:\WINNT\System32\nddeagnt.exe
D:\WINNT\Explorer.EXE
D:\WINNT\System32\DACONFIG.EXE
D:\WINNT\loadqm.exe
D:\WINNT\System32\MSWHEEL.EXE
C:\PROGRAM FILES\PrecisionScan\hpsjbmgr.exe
D:\WINNT\System32\qttask.exe
C:\PROGRA~1\DIRECTCD.EXE
C:\PROGRA~1\navapw32.exe
C:\Program Files\ZoneAlarm\zlclient.exe
C:\BBPROG~1\POP-UP~1\PSFree.exe
C:\BBPROG~1\FDF\FAST2.EXE
C:\bbprograms\Spyware Doctor\swdoctor.exe
D:\WINNT\system32\HPRtry07.exe
C:\Program Files\PrecisionScan\hpppt.exe
D:\Program Files\Microsoft Office\Office\1033\msoffice.exe
D:\Program Files\Plus!\Microsoft Internet\IEXPLORE.EXE
D:\Program Files\Outlook Express\MSIMN.EXE
D:\WINNT\System32\ddhelp.exe
C:\Program Files\Aladdin Systems\StuffIt 7.5\StuffIt.exe
D:\WINNT\Profiles\Administrator\Application Data\Aladdin Systems\StuffIt\Temp\Opened\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
F2 - REG:system.ini: UserInit=userinit,nddeagnt.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\NavShExt.dll
O2 - BHO: (no name) - {D714A94F-123A-45CC-8F03-040BCAF82AD6} - blank (file missing)
O2 - BHO: (no name) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [COMSMDEXE] comsmd.exe -off
O4 - HKLM\..\Run: [DACONFIGEXE] DACONFIG.EXE R
O4 - HKLM\..\Run: [TIPS] D:\PROGRA~1\MICROS~2\tips\mouse\tips.exe
O4 - HKLM\..\Run: [POINTER] D:\PROGRA~1\MICROS~2\point32.exe
O4 - HKLM\..\Run: [PCDRealtime] D:\WINNT\realtime.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [hpsjbmgr] C:\PROGRAM FILES\PrecisionScan\hpsjbmgr.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\WINNT\System32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adaptec DirectCD] c:\PROGRA~1\DIRECTCD.EXE
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\navapw32.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [RegistryMechanic] C:\bb programs\Registry Mechanic\regmech.exe /QS
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [PC 1Click Daily Scan] C:\BB Programs\pc1click\pc1click.exe /background
O4 - HKCU\..\Run: [ScrabbleSetup.exe] D:\WINNT\Profiles\ADMINI~1\Desktop\SCRABB~1.EXE /r
O4 - HKCU\..\Run: [BigSmileys] "C:\BB Programs\BigSmileys\bigsmileys.exe" startup
O4 - HKCU\..\Run: [Pixbyte AntiSpam Professional] C:\Program Files\Pixbyte\AntiSpam\AntiSpam.exe
O4 - HKCU\..\Run: [SpyKiller] C:\BB Programs\SpyKiller\spykiller.exe /startup
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\BBPROG~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [FAST Defrag] C:\BBPROG~1\FDF\FAST2.EXE -tray
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\bbprograms\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: Outlook.lnk = D:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
O4 - Startup: Iexplore.exe.lnk = D:\Program Files\Plus!\Microsoft Internet\IEXPLORE.EXE
O4 - Startup: Luall.exe.lnk = D:\Program Files\Symantec\LiveUpdate\LUALL.EXE
O4 - Global Startup: HP 2000C Taskbar Icon.lnk = system32\HPRtry07.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: HP Parallel Port Test.lnk = C:\Program Files\PrecisionScan\hpppt.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINNT\web\related.htm
O13 - WWW. Prefix: http://
O15 - Trusted Zone: http://*.windowsupdate.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - http://www.symantec.com/techsupp/activedata/ActiveData.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 151.201.0.39 151.201.0.38
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 151.201.0.39 151.201.0.38
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 151.201.0.39 151.201.0.38
O23 - Service: 3Com dRMON SmartAgent PC Software (dRMON SmartAgent) - 3Com Corp. - D:\WINNT\System32\drmon\smartagt\smartagt.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - D:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - D:\WINNT\system32\ZONELABS\vsmon.exe


Thanks for your help!

BC AdBot (Login to Remove)

 


#2 OldTimer

OldTimer

    Malware Expert


  • Members
  • 11,092 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:North Carolina
  • Local time:01:25 AM

Posted 12 April 2005 - 01:55 PM

Hello Brenda13. I don't see alot in the log that would cause any problems. There are a couple of cleanup items we can perform and we'll get to those in a minute.

Are you having a particular issues at this time? Please include any details with your next log post.

Now let's get to the fixes. Please proceed with the following steps in order.

Step #1

Start HijackThis and click the Scan button to perform a scan. Look for the following items and click in the checkbox in front of each item to select it:R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: (no name) - {D714A94F-123A-45CC-8F03-040BCAF82AD6} - blank (file missing)
O2 - BHO: (no name) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - (no file)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINNT\web\related.htm

These next items are fixes I recommend that you make:
SpyKiller is considered a rogue application that produces false positives as a goad to get you to purchase it. I recommend fixing this line and then uninstalling the application
O4 - HKCU\..\Run: [SpyKiller] C:\BB Programs\SpyKiller\spykiller.exe /startup
Now close ALL open windows except HijackThis and click the Fix Checked button to finish the repair.

Step #2

Download CleanUp! and install it. Start CleanUp! and click on the CleanUp! button. Let it run to completion. It may take a few minutes depending on the size of your hard drive so be patient.

Step #3

OK. Reboot your computer normally, start HijackThis and perform a new scan. Post your new log file back here along with details of any problems you encountered performing the above steps using the Add Reply button and I will review it when it comes in.

OT
I do not respond to PM's requesting help. That's what the forums are here for. Please use them so that others may benefit from your questions and the responses you receive.
OldTimer

Posted Image

#3 Brenda13

Brenda13
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:12:25 AM

Posted 13 April 2005 - 04:08 PM

Logfile of HijackThis v1.99.1
Scan saved at 4:56:13 PM, on 04/13/2005
Platform: Windows NT 4 SP6 (WinNT 4.00.1381)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\spoolss.exe
D:\WINNT\System32\drmon\smartagt\smartagt.exe
D:\WINNT\system32\RpcSs.exe
C:\Program Files\navapsvc.exe
d:\winnt\system32\pstores.exe
D:\WINNT\system32\MSTask.exe
D:\WINNT\system32\ZONELABS\vsmon.exe
D:\WINNT\System32\nddeagnt.exe
D:\WINNT\Explorer.EXE
D:\WINNT\System32\DACONFIG.EXE
D:\WINNT\loadqm.exe
D:\WINNT\System32\MSWHEEL.EXE
C:\PROGRAM FILES\PrecisionScan\hpsjbmgr.exe
D:\WINNT\System32\qttask.exe
C:\PROGRA~1\DIRECTCD.EXE
C:\PROGRA~1\navapw32.exe
C:\Program Files\ZoneAlarm\zlclient.exe
C:\BBPROG~1\POP-UP~1\PSFree.exe
C:\BBPROG~1\FDF\FAST2.EXE
C:\bbprograms\Spyware Doctor\swdoctor.exe
D:\WINNT\system32\HPRtry07.exe
C:\Program Files\PrecisionScan\hpppt.exe
D:\Program Files\Microsoft Office\Office\1033\msoffice.exe
D:\WINNT\system32\tapisrv.exe
C:\BB Programs\Hijack This\HijackThis.exe

F2 - REG:system.ini: UserInit=userinit,nddeagnt.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [COMSMDEXE] comsmd.exe -off
O4 - HKLM\..\Run: [DACONFIGEXE] DACONFIG.EXE R
O4 - HKLM\..\Run: [TIPS] D:\PROGRA~1\MICROS~2\tips\mouse\tips.exe
O4 - HKLM\..\Run: [POINTER] D:\PROGRA~1\MICROS~2\point32.exe
O4 - HKLM\..\Run: [PCDRealtime] D:\WINNT\realtime.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [hpsjbmgr] C:\PROGRAM FILES\PrecisionScan\hpsjbmgr.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\WINNT\System32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adaptec DirectCD] c:\PROGRA~1\DIRECTCD.EXE
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\navapw32.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [RegistryMechanic] C:\bb programs\Registry Mechanic\regmech.exe /QS
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [PC 1Click Daily Scan] C:\BB Programs\pc1click\pc1click.exe /background
O4 - HKCU\..\Run: [ScrabbleSetup.exe] D:\WINNT\Profiles\ADMINI~1\Desktop\SCRABB~1.EXE /r
O4 - HKCU\..\Run: [BigSmileys] "C:\BB Programs\BigSmileys\bigsmileys.exe" startup
O4 - HKCU\..\Run: [Pixbyte AntiSpam Professional] C:\Program Files\Pixbyte\AntiSpam\AntiSpam.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\BBPROG~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [FAST Defrag] C:\BBPROG~1\FDF\FAST2.EXE -tray
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\bbprograms\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: Outlook.lnk = D:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
O4 - Startup: Iexplore.exe.lnk = D:\Program Files\Plus!\Microsoft Internet\IEXPLORE.EXE
O4 - Startup: Luall.exe.lnk = D:\Program Files\Symantec\LiveUpdate\LUALL.EXE
O4 - Global Startup: HP 2000C Taskbar Icon.lnk = system32\HPRtry07.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: HP Parallel Port Test.lnk = C:\Program Files\PrecisionScan\hpppt.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O13 - WWW. Prefix: http://
O15 - Trusted Zone: http://*.windowsupdate.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - http://www.symantec.com/techsupp/activedata/ActiveData.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 151.201.0.39 151.201.0.38
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 151.201.0.39 151.201.0.38
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 151.201.0.39 151.201.0.38
O23 - Service: 3Com dRMON SmartAgent PC Software (dRMON SmartAgent) - 3Com Corp. - D:\WINNT\System32\drmon\smartagt\smartagt.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - D:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - D:\WINNT\system32\ZONELABS\vsmon.exe

I had no problems with the fixes you recommended. There are only 2 problems that I've been having.
1. Yesterday, when I booted up, I got the "blue screen of death". That happens every so often, but I can always seem to reboot and it seems everything is o.k. Any ideas what the problem is?
2. I seem to be running out of memory so I downloaded FAST defrag, but I can't tell if it's working or doing any good. How can I tell, or is there a better method?

Thanks for your help!

Brenda13

#4 OldTimer

OldTimer

    Malware Expert


  • Members
  • 11,092 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:North Carolina
  • Local time:01:25 AM

Posted 13 April 2005 - 06:23 PM

Hi Brenda13. Your log looks clean. Congratulations! We have a couple of things to take care of yet but before we do let's look at the items you are having problems with.

When you get the 'Blue Screen' there should be information displayed that points to what the device or software application caused the problem. If that happens again, if you could copy that information down and post it back here I will take a look at it and see if we can determine a specific cause and propose a fix for that.

As for the running out of memory, are you talking about RAM memory or disk space? What is the specific message that you are receiving? A shortage in either one can adversley afftect Windows operations. For a shortage of RAM we can disable some of the programs starting when Windows loads and see if that helps or add more RAM to the machine. For a shortage of disk space the only thing you can do is either remove (uninstall) some programs or get a larger hard drive. It's hard to say which to do at this time.

Now let's finish up. Now that you are clean we have a couple of last steps to perform and then you're all set.

First, let's reset your hidden/system files and folders. System files are hidden for a reason and we don't want to have them openly available and susceptible to accidental deletion.* Open My Computer.
* Select the View menu and click Folder Options.
* Select the View tab.
* Under the Hidden files heading SELECT Do not show hidden or system files.
* Click OK.
Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs: SpywareBlaster, SpywareGuard and IESpy-Ad. They will add 1000's of sites to your resticted zone and block some hijacks from happening.

You should also have a good firewall and anti-virus application like the ones you are currently using. It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your system up to date and clean visit Windows Update monthly, run AdAware SE and Spybot Search & Destroy weekly, and be aware of what emails you open and websites you visit.

To learn more about how to protect yourself while on the internet read this article by Tony Klien: So how did I get infected in the first place?

Have a safe and happy computing day!

OT
I do not respond to PM's requesting help. That's what the forums are here for. Please use them so that others may benefit from your questions and the responses you receive.
OldTimer

Posted Image

#5 Brenda13

Brenda13
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:12:25 AM

Posted 04 May 2005 - 03:25 PM

Thanks, Old Timer. I've taken care of all your suggestions with varying results:

I've installed Spybot and it works fine.

Ad-Aware gives me an error message every time I try to start it (I've uninstalled & re-installed several times): An application error has occurred and an application error log is being generated. AdAware.exe Exception:(0xc0000025), Address:0x77f89591. I checked the Knowledge Base at Lavasoft.com, but there was no help on this error.

I've installed SpyBlaster... no problem there.

I've downloaded SpywareGuard & installed it, but when I try to run it, I get the following error: System Error &H80004005 (-2147467259). Unspecified error.

The IESpy-Ad downloaded. But what do I have to do to update it, etc?

Also, when I shut down or log off at the end of the day, I get a box that says: OleMain ThreadWndName cannot respond to end task. I then have to click on "End Task" to continue shutting down.

Any ideas to help me out?

Thanks!

#6 OldTimer

OldTimer

    Malware Expert


  • Members
  • 11,092 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:North Carolina
  • Local time:01:25 AM

Posted 04 May 2005 - 06:25 PM

Hi Brenda13. You are probably using an outdated version of the vb runtime. Check the faq here: http://www.javacoolsoftware.com/downloadfaq.html and download the latest version and try it again.

Cheers.

OT
I do not respond to PM's requesting help. That's what the forums are here for. Please use them so that others may benefit from your questions and the responses you receive.
OldTimer

Posted Image

#7 Brenda13

Brenda13
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:12:25 AM

Posted 05 May 2005 - 09:05 AM

Thanks again for your quick reply!

I did as suggested & downloaded vbrun60sp5.exe, but the same thing happened! SpywareGuard gave the same error as did Ad-Aware.

Now what?

Brenda13

#8 OldTimer

OldTimer

    Malware Expert


  • Members
  • 11,092 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:North Carolina
  • Local time:01:25 AM

Posted 05 May 2005 - 05:58 PM

Hi Brenda13. Try installing the files below:MissingFileSetup.exe
Cheers.

OT
I do not respond to PM's requesting help. That's what the forums are here for. Please use them so that others may benefit from your questions and the responses you receive.
OldTimer

Posted Image

#9 Brenda13

Brenda13
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:12:25 AM

Posted 06 May 2005 - 09:39 AM

Tried that... no help. I did read that SpywareGuard does not work with Windows NT, though. I'll quit trying on that one!

SpywareBlaster seems to run perfectly.

Ad-Aware gives me an error message every time I try to start it (I've uninstalled & re-installed several times): "An application error has occurred and an application error log is being generated. AdAware.exe Exception:(0xc0000025), Address:0x77f89591". I checked the Knowledge Base at Lavasoft.com, but there was no help on this error.

The IESpy-Ad downloaded. But what do I have to do to update it, etc?

Also, when I shut down or log off at the end of the day, I get a box that says: OleMain ThreadWndName cannot respond to end task. I then have to click on "End Task" to continue shutting down.

Maybe this will help on the AdAware problem. Following is the install log from the AdAware error message:

*** Installation Started 04/27/2005 13:33 ***
Title: Ad-Aware SE Personal
Source: D:\WINNT\Profiles\Administrator\Temporary Internet Files\Content.IE5\YOD4F3WJ\aawsepersonal[1].exe
Display Text: Uninstall complete.
Made Dir: C:\Program Files\Ad-Aware SE Personal
File Copy: C:\Program Files\Ad-Aware SE Personal\UNWISE.EXE
RegDB Key: Software\Microsoft\Windows\CurrentVersion\Uninstall\Ad-Aware SE Personal
RegDB Val: Ad-Aware SE Personal
RegDB Name: DisplayName
RegDB Root: 2
RegDB Key: Software\Microsoft\Windows\CurrentVersion\Uninstall\Ad-Aware SE Personal
RegDB Val: C:\PROGRA~1\AD-AWA~1\UNWISE.EXE C:\PROGRA~1\AD-AWA~1\INSTALL.LOG
RegDB Name: UninstallString
RegDB Root: 2
File Copy: C:\Program Files\Ad-Aware SE Personal\license.txt
File Copy: C:\Program Files\Ad-Aware SE Personal\Ad-Aware.exe
File Copy: C:\Program Files\Ad-Aware SE Personal\alert.wav
File Copy: C:\Program Files\Ad-Aware SE Personal\defs.ref
File Copy: C:\Program Files\Ad-Aware SE Personal\manual.chm
Made Dir: C:\Program Files\Ad-Aware SE Personal\Lang
File Copy: C:\Program Files\Ad-Aware SE Personal\Lang\default.awl
Made Dir: C:\Program Files\Ad-Aware SE Personal\Skins
File Copy: C:\Program Files\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask
Made Dir: C:\Program Files\Ad-Aware SE Personal\Plugins
Version: Following file not copied.
File Copy: D:\WINNT\System32\Psapi.Dll
File Copy: C:\Program Files\Ad-Aware SE Personal\unregaaw.exe
Shell Link: D:\WINNT\Profiles\All Users\Desktop\Ad-Aware SE Personal.lnk
Made Dir: D:\WINNT\Profiles\All Users\Start Menu\Programs\Lavasoft Ad-Aware SE Personal
Shell Link: D:\WINNT\Profiles\All Users\Start Menu\Programs\Lavasoft Ad-Aware SE Personal\Ad-Aware SE Personal.lnk
Shell Link: D:\WINNT\Profiles\All Users\Start Menu\Programs\Lavasoft Ad-Aware SE Personal\Ad-Aware SE Manual.lnk
Shell Link: D:\WINNT\Profiles\All Users\Start Menu\Programs\Lavasoft Ad-Aware SE Personal\Uninstall Ad-Aware SE Personal.lnk
File Tree: D:\WINNT\Profiles\Administrator\Application Data\Lavasoft\Ad-Aware
RegDB TREE: SOFTWARE\Lavasoft\Ad-Aware SE
RegDB Root: 1
RegDB TREE: SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ad-Aware
RegDB Root: 2
RegDB TREE: SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ad-Watch
RegDB Root: 2
RegDB TREE: SOFTWARE\Classes\Drive\shell\Scan with Ad-Aware
RegDB Root: 1
RegDB TREE: SOFTWARE\Classes\Directory\shell\Scan with Ad-Aware
RegDB Root: 1
RegDB TREE: SYSTEM\CurrentControlSet\Services\Eventlog\Application\Adwatch
RegDB Root: 1
File Tree: D:\WINNT\Profiles\Administrator\Application Data\Lavasoft\Ad-Aware
File Tree: C:\PROGRA~1\AD-AWA~1
Execute Program: C:\PROGRA~1\AD-AWA~1\unregaaw.exe
RegDB Key: Software\Microsoft\Windows\CurrentVersion\Uninstall\Ad-Aware SE Personal
RegDB Val: http://www.lavasoft.de
RegDB Name: HelpLink
RegDB Root: 2
RegDB Key: Software\Microsoft\Windows\CurrentVersion\Uninstall\Ad-Aware SE Personal
RegDB Val: Lavasoft
RegDB Name: Publisher
RegDB Root: 2
RegDB Key: Software\Microsoft\Windows\CurrentVersion\Uninstall\Ad-Aware SE Personal
RegDB Val: C:\PROGRA~1\AD-AWA~1\Ad-Aware.exe,-0
RegDB Name: DisplayIcon
RegDB Root: 2
RegDB Key: Software\Microsoft\Windows\CurrentVersion\Uninstall\Ad-Aware SE Personal
RegDB Val: http://www.lavasoft.de
RegDB Name: URLInfoAbout
RegDB Root: 2
User Rights: Admin

Edited by Brenda13, 06 May 2005 - 09:42 AM.


#10 OldTimer

OldTimer

    Malware Expert


  • Members
  • 11,092 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:North Carolina
  • Local time:01:25 AM

Posted 06 May 2005 - 04:07 PM

hi Brenda13. the only thing I see a problem with inthe AdAware refers to the psapi.dll file not installing and that could be tied in with the error message that you are receiving. Psapi.dll is used to help with process status. It is used on older operating systems so that leads me to believe that the 2 problems are tied together.

You can try installing a fresh version and see what happens. It can be downloaded here: http://www.winutils.com/psapi.dll or do a search for it in Google.

Cheers.

OT

And regarding IE-SPYAD installation here are the directions from the website:

Download one of the following files from the Download section below:

* IE-SPYAD.EXE is a self-extracting .ZIP file, which you can double-click on to extract the files inside (default dir is C:\IE-SPYAD).
* IE-SPYAD.ZIP requires that you have an "zip/unzip" program like WinZip, 7-Zip, or PowerArchiver to extract the files.

The simplest way to install IE-SPYAD is to use the installation batch file utility (INSTALL.BAT), which you can find in the main IE-SPYAD directory after you extract IE-SPYAD's files from the .ZIP or .EXE file you downloaded. Simply double-click on INSTALL.BAT to run the installation utility and follow the prompts. The installation utility can also be used to uninstall IE-SPYAD.

Users can also install and uninstall IE-SPYAD manually by merging the appropriate .REG files (ie-ads.reg to install; ie-ads-uninst.reg to uninstall). Complete instructions for manual installation/uninstallation are included in the ReadMe.txt shipped with IE-SPYAD.

For more information on installing and using the IE-SPYAD Restricted sites list as well as the INSTALL.BAT installation utility, consult the ReadMe.txt included in the package. To view ReadMe.txt online, click HERE.

Edited by OldTimer, 06 May 2005 - 04:09 PM.

I do not respond to PM's requesting help. That's what the forums are here for. Please use them so that others may benefit from your questions and the responses you receive.
OldTimer

Posted Image

#11 Brenda13

Brenda13
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:12:25 AM

Posted 10 May 2005 - 12:45 PM

Thanks again, OT.

I've got IE-SpyAd on now.

Still can't run Ad-Aware, though. I've tried everything you suggested and still no luck. Any more ideas?

Also, what does the OLEMain ThreadWndName error mean? Am I missing a file?

Brenda 13

#12 OldTimer

OldTimer

    Malware Expert


  • Members
  • 11,092 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:North Carolina
  • Local time:01:25 AM

Posted 10 May 2005 - 03:57 PM

Hi Brenda13. I think that because you are running Windows NT that you will need to do without AdAware. If the system will not allow the psapi file to install then you are simply out of luck :thumbsup:

Cheers.

OT
I do not respond to PM's requesting help. That's what the forums are here for. Please use them so that others may benefit from your questions and the responses you receive.
OldTimer

Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users