At start up I get can not find svcpack.exe and can not load or run svcpack.exe specified in win.ini file. I have read some of the posts and have run Adaware, Spybot, and CWShredder. This has cleaned up a lot but I still get the same messages. I also ran Hijack This and here is the log: Logfile of HijackThis v1.98.2 Scan saved at 9:55:51 PM, on 9/22/04 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.exe C:\WINDOWS\SYSTEM\MPREXE.exe C:\WINDOWS\SYSTEM\MSTASK.exe C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe C:\PROGRAM FILES\COMMON FILES\AOL\ACS\ACSD.exe C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\EXPLORER.exe C:\WINDOWS\TASKMON.exe C:\WINDOWS\SYSTEM\SYSTRAY.exe C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.exe C:\WINDOWS\SYSTEM\FCWHR.exe C:\WINDOWS\APPLICATION DATA\TECO.exe C:\PROGRAM FILES\AMERICA ONLINE 9.0\AOLTRAY.exe C:\PROGRAM FILES\AOL COMPANION\COMPANION.exe C:\WINDOWS\SYSTEM\WMIEXE.exe C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Search,(Default) = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online F1 - win.ini: run=C:\WINDOWS\svcpack.exe O2 - BHO: (no name) - {513A4A2D-0264-11D9-82C8-DD1E8F637703} - C:\WINDOWS\SYSTEM\MSDOH.DLL O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [SystemTray] SysTray.exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [VortexTray] C:\WINDOWS\au30setp.exe 3 O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [winmodem] WINMODEM.101\wmexe.exe O4 - HKLM\..\RunServices: [AolAcsDaemon1] "C:\PROGRAM FILES\COMMON FILES\AOL\ACS\ACSD.exe" O4 - HKCU\..\Run: [Ejo] C:\WINDOWS\SYSTEM\fcwhr.exe O4 - HKCU\..\Run: [Sare] C:\WINDOWS\Application Data\teco.exe O4 - Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll O9 - Extra button: (no name) - {869EE607-5376-486d-8DAC-EDC8E239AD5F} - (no file) (HKCU) O9 - Extra button: Microsoft® JavaScript® Console - {BB7D2D60-A1C2-11D8-82C8-444553540000} - (no file) (HKCU) O9 - Extra 'Tools' menuitem: JavaScript Console - {BB7D2D60-A1C2-11D8-82C8-444553540000} - (no file) (HKCU) O9 - Extra button: (no name) - {237AA178-C3BC-4f67-A8BB-D8BC14BA0B89} - (no file) (HKCU) Can someone help me and tell me what to delete? Any help would be greatly appreciated.

The line: F1 - win.ini: run=C:\WINDOWS\svcpack.exe seems to jump out now, doesn't it?? You could remove it using HJT! or else edit your win.ini file Some svcpack.exe instructions HiJackThis! logs can be posted here for an automated analysis Those people that think they know everything are a great annoyance to those of us who do

Yeah, it looks like you've removed that CWS but it left the reference in win.ini that loaded the file. I'm not sure about this registry entry: O4 - HKCU\..\Run: [Ejo] C:\WINDOWS\SYSTEM\fcwhr.exe I couldn't find any references to the file 'fcwhr.exe'. You may want to uncheck it in msconfig--startup to keep it from loading and see if your machine runs OK. But don't have hijackthis remove it as it may be a legitimate file.

Also take out the following (it's Webhancer and a "nasty") O4 - Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe Now, how do I know this? Because I put your log in on this website and it said so!: HIJACK ANALYSE One little tip. When you are absolutely sure your machine is clean, tick all items and add them to Hijack's Ignore List. It will then only report changes, which will save you having to rummage through all those entries again. You will either recognise changes as something legit or can search Google for anything weird (or use above link). Derek.W

jboy Oooops, totally missed the fact that you had already given the link. Derek.W

Eek! that's ok ; ) Checked it out with a couple from here (just not this one) - seems to do the job, and sure beats wading through some of those 200 line XP logs - plus, one hopes that the user may be familiar with some of the processes specific to their system. Tech Support: "I need you to boot the computer." Customer: (THUMP! Pause.) "No, that didn't help."

jboy & icarusninety Yep, roughly speaking if you get shot of the red ones, keep the green ones, it then only leaves the items with a question mark to deal with. For anyone who doesn't recognise the questioned items, putting the file name in Google often gets the info. Nothing is 100% but it sure goes a long way to helping. Derek.W