Spyware that I can't remove

Computing.Net > Forums > Windows 95/98 > Spyware that I can't remove

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

Spyware that I can't remove

Name: PWS41
Date: January 15, 2004 at 19:00:30 Pacific
OS: Windows 98se
CPU/Ram: P2/256 mb

Comment:

OK i ran adaware and Spybot but cant get rid of some spyware so I was reccomended to this site. I ran Hijackthis and here is my log.
Logfile of HijackThis v1.97.7
Scan saved at 9:41:31 PM, on 1/15/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS.000\SYSTEM\KERNEL32.DLL
C:\WINDOWS.000\SYSTEM\MSGSRV32.exe
C:\WINDOWS.000\SYSTEM\MPREXE.exe
C:\WINDOWS.000\SYSTEM\mmtask.tsk
C:\WINDOWS.000\SYSTEM\MSTASK.exe
C:\WINDOWS.000\EXPLORER.exe
C:\WINDOWS.000\TASKMON.exe
C:\WINDOWS.000\SYSTEM\SYSTRAY.exe
C:\PROGRAM FILES\HP CD-WRITER\MMENU\HPCDTRAY.exe
C:\WINDOWS.000\SYSTEM\NICHT.exe
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.exe
C:\WINDOWS.000\SYSTEM\LVCOMS.exe
C:\WINDOWS.000\SYSTEM\HPOOPM07.exe
C:\WINDOWS.000\SYSTEM\IEFEATURES.exe
C:\PROGRAM FILES\LINKSYS\WMP11 CONFIG UTILITY\WMP11CFG.exe
C:\WINDOWS.000\SYSTEM\SPOOL32.exe
C:\WINDOWS.000\SYSTEM\WMIEXE.exe
C:\WINDOWS.000\SYSTEM\DDHELP.exe
C:\PROGRAM FILES\AIM95\AIM.exe
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.exe
C:\WINDOWS.000\TEMP\HIJACKTHIS.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://popnav.com
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows.000\googletoolbar.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS.000\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows.000\googletoolbar.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS.000\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS.000\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [HP CD-Writer] C:\Program Files\HP CD-Writer\Mmenu\hpcdtray.exe
O4 - HKLM\..\Run: [McAfeeWebScanX] C:\BACKUP\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\WebScanX.exe
O4 - HKLM\..\Run: [Nicht] C:\WINDOWS.000\SYSTEM\nicht.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NAVAPW32.exe
O4 - HKLM\..\Run: [LVCOMS] C:\WINDOWS.000\SYSTEM\LVCOMS.exe
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS.000\SYSTEM\hpoopm07.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS.000\SYSTEM\QTTASK.exe" -atboottime
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS.000\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [MSVersion] C:\WINDOWS.000\SYSTEM\INTERNETFEATURES.exe
O4 - HKLM\..\Run: [iefeatures] C:\WINDOWS.000\SYSTEM\IEFEATURES.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [McAfeeWebScanX] C:\BACKUP\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\WebScanX.exe /RUNSERVICES
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - Startup: Wireless PCI Card Configuration Utility.lnk = C:\Program Files\Linksys\WMP11 Config Utility\WMP11Cfg.exe
O4 - Startup: Microsoft Office.lnk = C:\WINDOWS.000\Application Data\Microsoft\Installer\{00000409-78E1-11D2-B60F-006097C998E7}\misc.exe
O4 - Startup: HPAiODevice.lnk = C:\Program Files\Hewlett-Packard\hp psc 700 series\bin\hpodev07.exe
O8 - Extra context menu item: &Google Search - res://C:\WINDOWS.000\GOOGLETOOLBAR.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\WINDOWS.000\GOOGLETOOLBAR.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\WINDOWS.000\GOOGLETOOLBAR.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\WINDOWS.000\GOOGLETOOLBAR.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate Page - res://C:\WINDOWS.000\GOOGLETOOLBAR.DLL/cmtrans.html
O9 - Extra button: AIM (HKLM)
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {34805D32-AD89-469E-8503-A5666AEE4333} (RdxIE Class) - http://207.188.7.102/289b2514694a09eeff17/netzip/RdxIE.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37899.7755208333
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {1552B1CD-8CB7-4776-B6CB-16EA461928E5} (Cpuid Control) - http://www.powerleap.com/downloads/cpuid.cab

ok what do i remove?

Sponsored Link

Ads by Google

Response Number 1

Name: Abnormal
Date: January 15, 2004 at 20:35:23 Pacific

Reply:

Posting in the security and hijack would have
been noticed sooner.
Put a check by these and click "fix checked"
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://popnav.com
O4 - HKLM\..\Run: [MSVersion] C:\WINDOWS.000\SYSTEM\INTERNETFEATURES.exe
O4 - HKLM\..\Run: [iefeatures] C:\WINDOWS.000\SYSTEM\IEFEATURES.exe
O16 - DPF: {34805D32-AD89-469E-8503-A5666AEE4333} (RdxIE Class) - http://207.188.7.102/289b2514694a09eeff17/netzip/RdxIE.cab
After this, Reboot and Delete the following files:
INTERNETFEATURES.exe
IEFEATURES.exe

Response Number 2

Name: DAVEINCAPS
Date: January 15, 2004 at 21:36:34 Pacific

Reply:

You can remove these too:
MMTASK
MPREXE

Response Number 3

Name: Derek
Date: January 16, 2004 at 16:53:30 Pacific

Reply:

DAVEINCAPS
Your links interested me and then confused me (it's not difficult LOL).
Can I take it that these links do NOT mean that you should delete either mmtask.tsk or mprexe.exe which appear to be normal original Windows files?
D

Response Number 4

Name: DAVEINCAPS
Date: January 16, 2004 at 18:00:24 Pacific

Reply:

No, I think I'm the one that's confused. I did a quick google search on some of the items and those came back as problematic. Either the pestpatrol page on them was in error or it is mprexe and mmtask that inadvertently run the unwanted processes.
I should have done a bit more checking before posting. Thanks for catching it.

Response Number 5

Name: Derek
Date: January 16, 2004 at 18:30:17 Pacific

Reply:

Aha, these things happen to us all. I call mine senior moments, what do you call yours?
D

linksys wmp11 driver linksys wmp11 driver multi function keyboard pkzip e01 real player 10.5 plugin for firefox asp session array CCD-TRV128 remove quicktime linksys wmp11 vista partner bho removal	aim spyware BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) bho.jew removal web pages keep popping up that i don't want remove webroot spy sweeper akamai net session interface linksys wmp11 driver remove BHO my harddrive has an alpha-numeric folder that I can't remove I can't remove Firefox
See More

Response Number 6

Name: DAVEINCAPS
Date: January 16, 2004 at 19:31:45 Pacific

Reply:

They're just reminders that I don't know as much as I sometimes think I do. Thankfully they don't happen too often.

Response Number 7

Name: Derek
Date: January 16, 2004 at 19:34:14 Pacific

Reply:

Yeah, me too.
D

Response Number 8

Name: hownanc
Date: January 20, 2004 at 20:41:14 Pacific

Reply:

Same problem, can you help me?

Logfile of HijackThis v1.97.7
Scan saved at 10:32:44 PM, on 1/20/04
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v5.50 (5.50.4134.0600)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.exe
C:\WINDOWS\SYSTEM\SPOOL32.exe
C:\WINDOWS\SYSTEM\MPREXE.exe
C:\WINDOWS\SYSTEM\MSTASK.exe
C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.exe
C:\WINDOWS\TASKMON.exe
C:\WINDOWS\SYSTEM\SYSTRAY.exe
C:\WINDOWS\STARTER.exe
C:\WINDOWS\GWHOTKEY.exe
C:\WINDOWS\LOADQM.exe
C:\WINDOWS\ptsnoop.exe
C:\WINDOWS\ESSSPK.exe
C:\PROGRAM FILES\BROADJUMP\CLIENT FOUNDATION\CFD.exe
C:\PROGRAM FILES\SUPPORT.COM\BIN\TGCMD.exe
C:\WINDOWS\SYSTEM\QTTASK.exe
C:\WINDOWS\SYSTEM\IEFEATURES.exe
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\MICROSOFT MONEY\SYSTEM\REMINDER.exe
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.exe
C:\PROGRAM FILES\GREETINGS WORKSHOP\GWREMIND.exe
C:\WINDOWS\SYSTEM\DDHELP.exe
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.exe
C:\PROGRAM FILES\THE HELPSPOT!\FAWGRD32.exe
C:\COREL\SUITE8\PROGRAMS\DAD8.exe
C:\PROGRAM FILES\BELLSOUTH\CONNECTION MANAGER\CMANAGER.exe
C:\PROGRAM FILES\THE HELPSPOT!\FA_GD32.exe
C:\PROGRAM FILES\THE HELPSPOT!\RTFIXM32.exe
C:\PROGRAM FILES\BROADJUMP\CORRECTCONNECT ENGINE\CCD.exe
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.exe
C:\PROGRAM FILES\PKZIP\PKZIPW.exe
C:\WINDOWS\DESKTOP\PKTMP000.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.al.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.al.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.seekseek.com/quicksearch.asp?session=FE2A9220-04FC-4CA7-A5C0-31BF25FF3E32&version_id=18
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online
O2 - BHO: (no name) - {004A5840-FF59-11d2-B50D-0090271D3FD4} - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\PROGRAM FILES\WS_FTP PRO\WSBHO2K0.DLL
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [Multi-function Keyboard] GWHotKey.exe
O4 - HKLM\..\Run: [Winkxi] C:\WINDOWS\SYSTEM\Winkxi.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [PTSNOOP] ptsnoop.exe
O4 - HKLM\..\Run: [EssSpkPhone] essspk.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server /nosystray
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.exe" -atboottime
O4 - HKLM\..\Run: [MSVersion] C:\WINDOWS\SYSTEM\INTERNETFEATURES.exe
O4 - HKLM\..\Run: [iefeatures] C:\WINDOWS\SYSTEM\IEFEATURES.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [winmodem] WINMODEM.101\wmexe.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [Reminder] C:\Program Files\Microsoft Money\System\reminder.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.exe" /background
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.exe
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.exe
O4 - Startup: Windows Guardian.lnk = C:\Program Files\the HelpSpot!\Fawgrd32.exe
O4 - Startup: Corel Desktop Application Director 8.LNK = C:\Corel\Suite8\Programs\DAD8.exe
O4 - Startup: Connection Manager.lnk = C:\Program Files\BellSouth\Connection Manager\CManager.exe
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html
O9 - Extra button: Real.com (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.aol.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe

Sponsored Link

Ads by Google

missing file C:MSVc\BIN\d...

win98se and AOL

Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.

Go to Windows 95/98 Forum Home

Sponsored links

Ads by Google

Results for: Spyware that I can't remove

Some program have font that I can't read.

Summary

www.computing.net/answers/windows-95/some-program-have-font-that-i-cant-read/44062.html

Trojan I can't Remove

Summary

www.computing.net/answers/windows-95/trojan-i-cant-remove/151475.html

can't removed es1688 from sound device manager

Summary

www.computing.net/answers/windows-95/cant-removed-es1688-from-sound-device-manager/9203.html

From the Geek Dictionary
environment - the surroundings of any living organism,including but not limited to vegeta...

Ask a Question!

Weekly Poll
Do you think Comcast should have bought NBC?

Poll Finishes In 7 Days.
Discuss in The Lounge
Poll History

Recent Posts
operation not permitted

MSWMM File

CD - Device/Serial id?

Problems in downloading documents

My route directory does not see the USB drive

All Awaiting Reply

Tom's News
Nintendo DS Flash Cards are Legal Says Judge

Go Retro: Dragon's Lair Confirmed for iPhone

Sony's PSPgo May Get External UMD Reader

Report: Teen Internet Addicts Likely to Self-Harm

Violent Games Still Marketed to Kids, Says FTC

More Tom's Guide News

Data Recovery

Manufacturer List | About Us | Advertising Info | Contact Us
The information on Computing.Net is the opinions of its users. Such opinions may not be accurate and they are to be used at your own risk. Computing.Net cannot verify the validity of the statements made on this site. Computing.Net and Computing.Net LLC hereby disclaim all responsibility and liability for the content of Computing.Net and its accuracy.
PLEASE READ THE FULL DISCLAIMER AND LEGAL TERMS BY CLICKING HERE