Tom's Guide | Tom's Hardware | Tom's Games
![]() |
![]() |
![]() |
hey guys..i have problem in surfing..each time when i log,,for example checking my mail at yahoo. i can't go through, after entering my password and log-on, i can log on and after a couple of second about;blank page always display at my browser...
i run Adaware by lavasoft, it detects and clean,,but when i go back browse again..the issue comes up again..
i have a hackthis log, and startuplist generated by hijackthis..
Here it is:
Logfile of HijackThis v1.98.1
Scan saved at 9:18:32 PM, on 8/7/04
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.exe
C:\WINDOWS\SYSTEM\MPREXE.exe
C:\WINDOWS\SYSTEM\MSTASK.exe
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\NORTON ANTIVIRUS\RTVSCN95.exe
C:\PROGRAM FILES\NORTON ANTIVIRUS\DEFWATCH.exe
C:\WINDOWS\SYSTEM\R_SERVER.exe
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.exe
C:\WINDOWS\EXPLORER.exe
C:\WINDOWS\TASKMON.exe
C:\WINDOWS\SYSTEM\SYSTRAY.exe
C:\PROGRAM FILES\NORTON ANTIVIRUS\VPTRAY.exe
C:\WINDOWS\LOADQM.exe
C:\WINDOWS\RUNDLL32.exe
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.exe
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZAPRO.exe
C:\WINDOWS\SYSTEM\DDHELP.exe
C:\PROGRAM FILES\YAHOO!\MESSENGER\YMSGR_TRAY.exe
C:\WINDOWS\SYSTEM\SPOOL32.exe
C:\PROGRAM FILES\HISTORYKILL\HISTKILL.exe
C:\PROGRAM FILES\HISTORYKILL\HKPOPUPKILLER.exe
C:\HIJACKTHIS.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\TEMP\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\WINDOWS\TEMP\sp.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\TEMP\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\WINDOWS\TEMP\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\WINDOWS\TEMP\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\WINDOWS\TEMP\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {035DD821-DA6A-11D8-BCEF-0050E5946726} - C:\WINDOWS\SYSTEM\JKDI.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [vptray] C:\Program Files\Norton AntiVirus\vptray.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [rtvscn95] C:\Program Files\Norton AntiVirus\rtvscn95.exe
O4 - HKLM\..\RunServices: [defwatch] C:\Program Files\Norton AntiVirus\defwatch.exe
O4 - HKLM\..\RunServices: [r_server] C:\WINDOWS\SYSTEM\R_SERVER.exe /service
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.exe -service
O4 - HKLM\..\RunServices: [WinVNC] "C:\PROGRAM FILES\REALVNC\WINVNC\WINVNC.exe" -service
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.exe C:\WINDOWS\SYSTEM\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [HistoryKill] C:\Program Files\HistoryKill\histkill.exe /startup
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.exe
O16 - DPF: Win32 Classes - file://C:\WINDOWS\Java\classes\win32ie4.cab
O16 - DPF: {BE44DD6F-057A-4476-A0D5-EC926957D277} - http://204.177.92.198/quickdl/livevideo/msdlupd.cab
O18 - Filter: text/html - {035DD820-DA6A-11D8-BCEF-00508AD8C2BD} - C:\WINDOWS\SYSTEM\JKDI.DLL
O18 - Filter: text/plain - {035DD820-DA6A-11D8-BCEF-00508AD8C2BD} - C:\WINDOWS\SYSTEM\JKDI.DLL
Thx in Advance..

For starters, remove all references to 'sp.html' (anything running from the TEMP folder is automatically suspicious)
Similar problem reported at the LavaSoft forum - they recommend running HiJackThis! from Safe Mode, with no extraneous applications running.
I'm just looking for clues at the scene of the crime

You may want to also check this fix from a previous post:
http://www.computing.net/windows95/wwwboard/forum/158464.html

(The below is in reference to something someone said at the page linked to just above -- I'd have posted there, but the page was too old, so I couldn't)
Umm... just a quick head's up... from everything I've read, "CoolWWWSearch SmartKiller" is not in fact a newer, better CWShredder, but is in fact a newer, worse CoolWebSearch.
I wouldn't recommend downloading anything named "CoolWWWSearch SmartKiller", as that appears to be the name of another spyware.
Do like I did and do a Google search on that name before you download anything. Actually, do a google search on anything you download ever before downloading it.

Ugly new CoolWWWSearch variant
"CoolWWWSearch.SmartKiller (v1 and v2) is a new, real ugly variant of CoolWWWSearch. When running, it will close every browser window you use to visit a large list of anti-spyware-sites, and even will close Spybot-S&D and some other anti-spyware applications as well.
So if your copy of Spybot-S&D (or the anti-spyware application of your choice) closes a few seconds after starting, or your browser closes whenever you try to visit an anti-spyware site, check our CWS.SmartKiller removal utility on this page."
I'm just looking for clues at the scene of the crime

![]() |
slow computer when printi...
|
Freezing on an IBM Netvis...
|

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.
| Ads by Google |