[MaggieDee]

help!!!!!

i dont know what is the problem, my computer is freezing, and sometimes a blue screen shows up... my msn messenger is freezing tooo.... and i get a black screen sometimes, it started today.... freezing is mostly my problem i guess, and one day it said, resourse is in danger.....can some one help me??? please

[Mariusz]

what does the bliue screen message refer to?

have u installed anything recently?

have you scanned for viruses?

does it freeze/bluescreen only hen u are on the net?

[MaggieDee]

hi, thanks for responding;

i dont recall installing anything new here, i cant read what the blue thing says cause it goes on and disappears fast.. while im on line doing things thats what happens, it just shows up and a black screen will appear, or it will restart my computer...or sometimes, it will be totally black then something white willl be in the middle saying something in black lettering, but again that disappears too... i have been scanning for viruses but nothing... i will add, today , when i opened my email, my virus scan jump up and said, w32.buqbear.B@mm was dectected and it cleaned it but went in the quaratine , so does it mean it is clean??? i have a norton antivirus 2002... and when i re-scanned my computer for viruses, it didnt give me nothing, and its only when i am online this happens to me,

[Mariusz]

can i suggest u download and run spybot and hijack this
from:

http://www.spywareinfo.com/downloads.php#det

just update spybot before u run
when u open up hijack this, go to 'config' then 'misc tools' then 'generate startup log'

then copy/paste the log here

have u updated the anti virus?

[MaggieDee]

StartupList report, 6/5/03, 11:14:46 PM
StartupList version: 1.52
Started from : C:\UNZIPPED\HIJACKTHIS192\HIJACKTHIS.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZONEALARM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\UNZIPPED\HIJACKTHIS192\HIJACKTHIS.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Profiles\Marguerite\Start Menu\Programs\Startup]
Crystal 3D Audio Control.lnk = C:\WINDOWS\CWD3DSND.EXE

User shell folders Startup:
[C:\WINDOWS\Profiles\Marguerite\Start Menu\Programs\Startup]
Crystal 3D Audio Control.lnk = C:\WINDOWS\CWD3DSND.EXE

Shell folders Common Startup:
[C:\WINDOWS\All Users\Start Menu\Programs\StartUp]
ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
SystemTray = SysTray.Exe
Tweak UI = RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
NAV Agent = C:\PROGRA~1\NORTON~1\NAVAPW32.EXE
LoadQM = loadqm.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

SchedulingAgent = mstask.exe
ScriptBlocking = "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
TrueVector = C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

msnmsgr = "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll power.drv

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 5/6/2003, 16:1:54)

[Rename]
NUL=C:\PROGRA~1\NORTON~1\CUSTACT.EXE

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET PATH=C:\WINDOWS;C:\WINDOWS\COMMAND;C:\DMI2SP\BIN
SET WIN32DMIPATH=C:\DMI2SP

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\E2G\IEBHOS.DLL - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6}
(no name) - C:\WINDOWS\SYSTEM\BTIEIN.DLL - {63B78BC1-A711-4D46-AD2F-C581AC420D41}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Maintenance-Defragment programs.job
Maintenance-ScanDisk.job
Maintenance-Disk cleanup.job
Symantec NetDetect.job
Norton AntiVirus - Scan my computer.job

--------------------------------------------------

Enumerating Download Program Files:

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\DIRECTOR\SWDIR.DLL
CODEBASE = http://download.macromedia.com/pub/s...irector/sw.cab

[MSN Photo Upload Tool]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\MSNPUPLD.DLL
CODEBASE = http://communities.msn.com/scr/PhotoUC/MsnPUpld.cab

[Yahoo! Audio Conferencing]
InProcServer32 = C:\PROGRAM FILES\YAHOO!\MESSENGER\YACSCOM.DLL
CODEBASE = http://us.chat1.yimg.com/us.yimg.com...43/yacscom.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/s...sh/swflash.cab

[Preloader Object]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\IEPRELD.OCX
CODEBASE = http://activex.microsoft.com/activex...86/iepreld.cab

[OPUCatalog Class]
InProcServer32 = C:\WINDOWS\SYSTEM\OPUC.DLL
CODEBASE = http://office.microsoft.com/productu...ntent/opuc.cab

[Microsoft Office Tools on the Web Control]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\OUTC.DLL
CODEBASE = http://officeupdate.microsoft.com/Te...loads/outc.cab

[AcceptLang Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\SETACCEPTLANG.DLL
CODEBASE = http://runonce.msn.com/setacceptlang.cab

[Yahoo! Audio UI1]
InProcServer32 = C:\PROGRAM FILES\YAHOO!\MESSENGER\YACSUI.DLL
CODEBASE = http://chat.yahoo.com/cab/yacsui.cab

[Symantec RuFSI Registry Information Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\RUFSI.DLL
CODEBASE = http://security2.norton.com/SSC/Shar.../bin/cabsa.cab

[Symantec AntiVirus scanner]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\AVSNIFF.DLL
CODEBASE = http://security.symantec.com/SSC/Sha...in/AvSniff.cab

[sys Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\PCPITSTOP.DLL
CODEBASE = http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

[CV3 Class]
InProcServer32 = C:\WINDOWS\SYSTEM\WUV3IS.DLL
CODEBASE = http://windowsupdate.microsoft.com/R...n/actsetup.cab

[YInstStarter Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\YINSTHELPER.DLL
CODEBASE = http://download.yahoo.com/dl/installs/yinst.cab

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.co...641.6417361111

[HeartbeatCtl Class]
InProcServer32 = C:\WINDOWS\DOWNLO~1\HRTBEAT.OCX
CODEBASE = http://fdl.msn.com/zone/datafiles/heartbeat.cab

[WONWebLauncher Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\WONWEBLAUNCHERCONTROL.OCX
CODEBASE = http://www.virtualvegas.com/cab/WONW...herControl.cab

[{E9041F85-3C18-4A7E-A29D-E24F84B79BF1}]
CODEBASE = http://e2give.com/downloads/UGO20.exe

[MSN Chat Control 4.5]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\MSNCHAT45.OCX
CODEBASE = http://fdl.msn.com/public/chat/msnchat45.cab

[{26E8361F-BCE7-4F75-A347-98C88B418322}]
InProcServer32 = C:\WINDOWS\DOWNLO~1\BTIEIN.DLL
CODEBASE = http://dst.trafficsyndicate.com/Dnl/T_50017/btiein.cab

[HouseCall Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\XSCAN53.OCX
CODEBASE = http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL

--------------------------------------------------
End of report, 7,767 bytes
Report generated in 0.160 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

[Mariusz]

so far it look ok to me, mind u im not an expert, but i dont see any obvious culprits

lets see if spybot sees anything

[Rollin' Rog]

Be sure to update Spybot before you run it; after doing so post a copy of the Scanlog from HijackThis, rather than the StartupList.

These two BHOs may need to be removed:

(no name) - C:\E2G\IEBHOS.DLL - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6}

(no name) - C:\WINDOWS\SYSTEM\BTIEIN.DLL - {63B78BC1-A711-4D46-AD2F-C581AC420D41}

And this as well:

[{26E8361F-BCE7-4F75-A347-98C88B418322}]
InProcServer32 = C:\WINDOWS\DOWNLO~1\BTIEIN.DLL
CODEBASE = http://dst.trafficsyndicate.com/Dnl/T_50017/btiein.cab

I'm not sure what the first is, but the second is associated with some well known spyware.

http://www.doxdesk.com/parasite/HuntBar.html

Do you know what program is associated with the c:\e2g folder?

[TonyKlein]

The first is sure to be E2Give, and it gets stealth installed on a rather large scale.

Have a look at this ActiveX control:

[{E9041F85-3C18-4A7E-A29D-E24F84B79BF1}]
CODEBASE = http://e2give.com/downloads/UGO20.exe


If you didn't install it wittingly, feel free to have HT remove it.

[MaggieDee]

Logfile of HijackThis v1.92.0
Scan saved at 5:07:49 PM, on 6/6/03
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://www.websearch.com/ie.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://www.websearch.com/ie.aspx
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Crystal 3D Audio Control.lnk = C:\WINDOWS\CWD3DSND.EXE
O4 - User Startup: Crystal 3D Audio Control.lnk = C:\WINDOWS\CWD3DSND.EXE
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O8 - Extra context menu item: Download using FlashGet - C:\PROGRAM FILES\FLASHGET\jc_link.htm
O8 - Extra context menu item: Download All by FlashGet - C:\PROGRAM FILES\FLASHGET\jc_all.htm
O9 - Extra button: ICQ (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: FlashGet (HKLM)
O9 - Extra 'Tools' menuitem: &FlashGet (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra 'Tools' menuitem: IMI (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://communities.msn.com/scr/PhotoUC/MsnPUpld.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com...43/yacscom.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {16E349E0-702C-11CF-A3A9-00A0C9034920} (Preloader Object) - http://activex.microsoft.com/activex...86/iepreld.cab
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productu...ntent/opuc.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://officeupdate.microsoft.com/Te...loads/outc.cab
O16 - DPF: {E6A3C1E2-F792-483E-9133-596215172BE9} (AcceptLang Class) - http://runonce.msn.com/setacceptlang.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security2.norton.com/SSC/Shar.../bin/cabsa.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/Sha...in/AvSniff.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (sys Class) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...641.6417361111
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: Yahoo! Cribbage (HeartbeatCtl Class) - http://download.games.yahoo.com/game...ts/y/it0_x.cab
O16 - DPF: {A031D222-B496-11D2-9CC8-00105A10AAF6} (WONWebLauncher Class) - http://www.virtualvegas.com/cab/WONW...herControl.cab
O16 - DPF: Yahoo! Pool 2 (WONWebLauncher Class) - http://download.games.yahoo.com/game...s/y/potb_x.cab
O16 - DPF: {E9041F85-3C18-4A7E-A29D-E24F84B79BF1} - http://e2give.com/downloads/UGO20.exe
O16 - DPF: Yahoo! Literati - http://download.games.yahoo.com/game...ts/y/tt0_x.cab
O16 - DPF: Yahoo! Word Racer - http://download.games.yahoo.com/game...ts/y/wt0_x.cab
O16 - DPF: Yahoo! Dice - http://download.games.yahoo.com/game...s/y/dct2_x.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = nbnet.nb.ca

[Rollin' Rog]

Put a check in the following items and have HijackThis fix/remove them:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://www.websearch.com/ie.aspx

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://www.websearch.com/ie.aspx


O16 - DPF: {E9041F85-3C18-4A7E-A29D-E24F84B79BF1} - http://e2give.com/downloads/UGO20.exe

>>> Spybot targets FlashGet for its tracking cookies which are considered "spywares", but it's up to you whether you want to keep the program. If not, look for an uninstall, and if these items remain after uninstalling you can use HijackThis to remove them.

O8 - Extra context menu item: Download using FlashGet - C:\PROGRAM FILES\FLASHGET\jc_link.htm
O8 - Extra context menu item: Download All by FlashGet - C:\PROGRAM FILES\FLASHGET\jc_all.htm

O9 - Extra button: FlashGet (HKLM)
O9 - Extra 'Tools' menuitem: &FlashGet (HKLM)
============================================

How are you doing now with regard to the original errors?

[MaggieDee]

i wanna thank you all who helped me solved my problem.. It seems now my computer is running smoothly after following all the instructions i was given..... again, thank you. my computer havent frozen up yet (knock on wood) and i havent seen the blue screen or any messages of any errors.. i hope it lasts, thank you again

[Rollin' Rog]

Good to hear Maggie, I'll put a 'resolved' on this for now, but if you have any further problems just post back and we'll look further.