Error message on startup... and very slow

[andiesmeltz]

My computer is running extremely slow. Almost like it is in slow motion. Constantly needs to be shut down and re-started. Has been doing this for awhile now.

Then this morning this just started with an error message on start up. Small box appears on desktop with RED X (RUNDLL in the small title bar) that says cannot locate file C:Windows/BXXS5.dll

Then my internet access takes forever to load, webpages forever, then locks up even worse. I have shut my pc down at least 5 times in the past 2 hours trying to figure out what is wrong.

I have McAfee Virus Scan on my PC and use Spybot for spyware.

I play with PSP7, but most of my graphics are on zip files and I have a few in my documents that I use so it doesnt bog my pc down with graphics.

Can you help me? I am running Windows 98 on a 6 year old Gateway. 12 G harddrive, 96 mb ram. Not sure what other info you need.

I am about ready to buy a new PC. I am fed up with this one!

Thanks, Andrea

 

[~Candy~]

Hi and welcome.

Download Hijack This, save to a folder of its own, NOT TO DESKTOP or TEMP folder.

Scan and post a scan log.

http://www.majorgeeks.com/download3155.html


Also, by the way, 96 megs of ram would be a nightmare However have you lived with it this long

 

[andiesmeltz]

Here is the results of the scan:

Logfile of HijackThis v1.98.2
Scan saved at 7:57:07 PM, on 9/15/04
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\NETVH32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\STARTER.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\TEMP\V.EXE
C:\WINDOWS\TEMP\QWIZ.EXE
C:\PROGRAM FILES\ISTSVC\ISTSVC.EXE
C:\SIERRA\PLANNER\PLNRNOTE.EXE
C:\PROGRAM FILES\GREETINGS WORKSHOP\GWREMIND.EXE
C:\PROGRAM FILES\YAHOO!\MESSENGER\YMSGR_TRAY.EXE
C:\WMCONNECT\WWM.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\WINZIP\WINZIP32.EXE
C:\WINDOWS\TEMP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\aqwai.dll/sp.html#37794
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\aqwai.dll/sp.html#37794
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\aqwai.dll/sp.html#37794
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\aqwai.dll/sp.html#37794
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\aqwai.dll/sp.html#37794
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\aqwai.dll/sp.html#37794
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\aqwai.dll/sp.html#37794
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.ask.com/index.asp?origin=7019
R3 - URLSearchHook: (no name) - {20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - C:\TV MEDIA\TVMBHO.DLL
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://bluelight.my.yahoo.com"); (C:\Program Files\Netscape\Users\andiebarnett\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: Class - {D0E04D53-A8CB-6CF6-83EA-25418CADEF98} - C:\WINDOWS\SYSHS.DLL
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSCSHELLEXTENSION.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_12_0.DLL (file missing)
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [V] C:\WINDOWS\TEMP\V.EXE
O4 - HKLM\..\Run: [Qwiz] C:\WINDOWS\TEMP\QWIZ.EXE
O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\BXXS5.DLL,DllRun
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [TV Media] C:\TV MEDIA\Tvm.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [NETVH32.EXE] C:\WINDOWS\NETVH32.EXE
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [TV Media] C:\TV MEDIA\Tvm.exe
O4 - Startup: Event Planner Reminders Tray Icon.lnk = C:\SIERRA\Planner\PLNRnote.exe
O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
O4 - Startup: Wal-Mart Connect Tray Icon.lnk = C:\wmconnect\wmtray.exe
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\PROGRAM FILES\CANON\EASY-WEBPRINT\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\PROGRAM FILES\CANON\EASY-WEBPRINT\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\PROGRAM FILES\CANON\EASY-WEBPRINT\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\PROGRAM FILES\CANON\EASY-WEBPRINT\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.slotch.com
O15 - Trusted Zone: *.xxxtoolbar.com
O15 - Trusted Zone: *.blazefind.com
O15 - Trusted Zone: *.05p.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.scoobidoo.com
O15 - Trusted Zone: *.searchbarcash.com
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/23c496af3d5ee4c45705/netzip/RdxIE601.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab
O18 - Protocol: icoo - {4A8DADD4-5A25-4D41-8599-CB7458766220} - C:\WINDOWS\MSOPT.DLL (file missing)

 

[~Candy~]

save to a folder of its own, NOT TO DESKTOP or TEMP folder.

I guess I'll repeat this


By the way, you do have quite a collection there, you'll need to wait for one of the log pros, but they will WANT HIJACK THIS in its own folder.

Make one on the desktop, call it something creative, like Hijack This, and move your hijack.exe from the temp folder to that folder.

 

[andiesmeltz]

Yes, it does suck! Ha! I am desperately trying to convince my hubby to let me buy a new computer. I cant even use my PSP8 on this one. I have to use the older 7 version until I have the money to splurge on a new one. Figure one of the kids could have this one just to use for school when I am done with it.

Oh. I forgot to mention in the first post... I have files that I cannot delete from old programs installed on this computer and are no longer installed. I dont want to totally restore cuz this gateway is a major PITA!

Andrea

 

[~Candy~]

I've emailed flrman1 to look in on you. Hopefully he can get to you before he logs off tonight.

Please get that hijack.exe moved to its own folder

 

[andiesmeltz]

I have hijack this installed in Crogramfiles/hijackthis

Whenever they can help... that would be great. I'll be back on tomorrow, but may still be here alittle this eve.

Thanks!

 

[~Candy~]

Ok, you might scan again, and post another log, just so they can see that you've got that task completed

 

[Flrman1]

Hi andiesmeltz

Please rescan with Hijack This and post a fresh log.

The reason you must rescan with Hijack This each time is because with this hijack the entries in Hijack This may change depending on what you have done with the computer since your last post. I will be wasting my time and yours if I tell you what to remove with HJT if the entries change between posts.

Click here to download getservice.zip and unzip it to your desktop. Open the Getservice folder and click on the getservices.bat file. A notepad will open up with a long list of Services. Please save that notepad file and attach it to your next reply to this thread. It will be easier to attach it rather than copy and paste because it will be too long to paste in one post.

After you post the next Hijack This log and the getservice list, it is very important that you not restart your computer or attempt to do anything to remove this until I have posted the removal directions because the files and the entries in HJT will change and we will have to start all over again. It would be best that you do nothing at all with the computer until you get the directions.

 

[iaavagent]

Flr1man,
Quick question does getservices work with W95?,98?. Site says only NT,2000,2003,xp! Is there such an animal as 2003? Bus. only? Thanks

 

[Flrman1]

That was my mistake. It doesn't work with 9x!

I was multi-tasking and didn't pay close attention here.

andiesmeltz

Just disregard the part about the getservices file and post a fresh Hijack This log please.