{RESOLVED}AVG, Adaware Etc. causing crash

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

socksthecat

Thread Starter
Joined
Mar 14, 2004
Messages
54
Hi,
I've a problem with all of my virus programs. Every time I try to run AVG, Adaware or Spybot my computer crashes. They all run for a few seconds to a minute and then crash. This is on a five year old Presario running Windows 98.
Thanks

Logfile of HijackThis v1.97.7
Scan saved at 19:23:02, on 30/03/04
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v5.00 SP2 (5.00.3314.2100)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\MESSENGER PLUS! 2\MSGPLUS.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\PROGRAM FILES\COMMON FILES\EPSON\EBAPI\SAGENT2.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5\DIRECTCD\DIRECTCD.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\WINDOWS\SYSTEM\E_S10IC2.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZONEALARM.EXE
C:\PROGRAM FILES\SAGEM\SAGEM [email protected] 800-840\DSLMON.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\TEMP\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.profusion.com/default.asp?agt=0!&cat=1!&cobid=ess&sid={A863AE55-C8FD-494F-A351-DE365FAD6506}&queryterm=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.ic24.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.co.uk/
O3 - Toolbar: @msdxmLC.dll,[email protected],&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRAM FILES\GRISOFT\AVG6\avgcc32.exe /startup
O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\SYSTEM\E_S10IC2.EXE /P23 "EPSON Stylus C62 Series" /O5 "LPT1:" /M "Stylus C62"
O4 - HKLM\..\Run: [EPSON Stylus C62 Serie (Copy 2)] C:\WINDOWS\SYSTEM\E_S10IC2.EXE /P31 "EPSON Stylus C62 Serie (Copy 2)" /O5 "LPT1:" /M "Stylus C62"
O4 - HKLM\..\RunServices: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKLM\..\RunServices: [SAgent2ExePath] C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe" /WinStart
O4 - Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM [email protected] 800-840\dslmon.exe
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://www.ic24.net
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
 
Joined
Mar 9, 2003
Messages
4,699
This entry is trying to start up twice.

O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\SYSTEM\E_S10IC2.EXE /P23 "EPSON Stylus C62 Series" /O5 "LPT1:" /M "Stylus C62"
O4 - HKLM\..\Run: [EPSON Stylus C62 Serie (Copy 2)] C:\WINDOWS\SYSTEM\E_S10IC2.EXE /P31 "EPSON Stylus C62 Serie (Copy 2)" /O5 "LPT1:" /M "Stylus C62"

I would strongly recommend that you do an online virus scan at least one and preferably 2 of the following sites:

http://security.symantec.com/default.asp?
http://housecall.trendmicro.com/
http://www.pandasoftware.com/activescan/
 
Joined
Mar 9, 2003
Messages
4,699
You should move HJT into it's own folder and out of Windows Temp. The reason is that HJT not only creates logs, but when you use it to fix entries it also creates backup files.

Another reason is that periodically everything in \Windows\Temp and the \Windows\Temporary Internet Files folders should be deleted to get rid of some of the Windows clutter.

Is this your ISP?

O14 - IERESET.INF: START_PAGE_URL=http://www.ic24.net
 

socksthecat

Thread Starter
Joined
Mar 14, 2004
Messages
54
Hi, I've run these checksa as advised and have found nothing. Spybot ran and found five problems, all of which I have fixed. I loaded a new Adaware download but it still crashed the computer about halfway through. Windows update also won't download. AVG also still crashes the computer.
Should I do something about the Epson program trying to run twice ?
Thanks for your help.
 
Joined
Mar 9, 2003
Messages
4,699
As you can see both the Epson printer entry and Messenger Plus! 2 are attempting to start twice. I would defiantly get rid of the duplicate entry. Messenger Plus! 2, unless you were very careful when you installed it usually contains the LOP spyware parasite. Use the "here" link to read more about it. Personally, I would get rid of it.

The rest of the items I have tried to include a short explanation from Pacs Portal as to what each does. Since I don't know how you use your PC and how often you use things like your scanner, you will have to decide what you feel you need running all the time.
Remember that each one of these can be started up on an as needed basis via either the Start > Programs menu or a desktop icon.


O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN

Part of the USB driver for your Fuji digital cameras - used when uninstalling the USB drivers, erasing all entries from the registry. Only required BEFORE attempting to uninstall the Fuji software or the uninstall may not work correctly


O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE

Stimon.exe enables a USB still-image device (such as a scanner) to initiate data transfer to a program. For example, if your scanning device has a scan button, it may start a program and begin scanning when you press it. Create a shortcut and start it manually when needed if your scanner otherwise fails to scan. May be required for your USB scanner to work - including all HP scanners and some of their SCSI scanners]/I]


O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"

DirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later


O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\SYSTEM\E_S10IC2.EXE /P23 "EPSON Stylus C62 Series" /O5 "LPT1:" /M "Stylus C62"

Epson Stylus printer monitor - for checking ink levels, etc.

O4 - HKLM\..\Run: [EPSON Stylus C62 Serie (Copy 2)] C:\WINDOWS\SYSTEM\E_S10IC2.EXE /P31 "EPSON Stylus C62 Serie (Copy 2)" /O5 "LPT1:" /M "Stylus C62"

O4 - HKLM\..\RunServices: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"

Third party MSN Messenger extension that hides banner ads and adds archiving and other useful features. Appears not to work unless checked, but may be activated after startup. Not recommended as it includes Lop.com - see here


O4 - HKLM\..\RunServices: [SAgent2ExePath] C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

Seiko Epson printer status agent. Disable if printer is not used often


O4 - HKCU\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe" /WinStart

O4 - Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM [email protected] 800-840\dslmon.exe
this one may or may not be necessary. It is more of a diagnostic tool.


In this case, my suggestion would be to use HJT to fix Messenger Plus! and the duplicate Epson entry. Then use the built in Windows utility MSconfig on the others one at a time.
Start > Run then type msconfig in the box. Then click in the startups tab. Find one or two items and uncheck them. Then click on Apply then OK It will prompt you to reboot so the changes can be made to your startups in the registry. REBOOT.

Test/use your PC and see if you really need that entry to be running all the time.
Work your way down the list one or two at a time. IF you do feel you need something, it's easy to reverse, just re-check it in MSconfig and reboot.

As an additional final clean up, once you have determined what you do and don't need, go back into MSconfig and put a check on the items you don't need, reboot, and then run HJT and check them off to fix/delete them. This will remove the entries out of your registry so it's a little cleaner.

Since this may take a few days, you may want to print this out as a reminder and reference.
 

socksthecat

Thread Starter
Joined
Mar 14, 2004
Messages
54
Hello Nitehawk,
Thanks for all that. As I only get a short time each day to play with my computer, this may take a while. Do you think this will sort out the 'crashes' that I'm getting, and why Windows Update won't work ?
Thanks again, I'll post a new HJT log when I've done it all.
Cheers.
 

socksthecat

Thread Starter
Joined
Mar 14, 2004
Messages
54
Hi,
I've done what you suggested, but as soon as I tried to use Adaware my computer crashed. Any ideas ?
Thanks

Logfile of HijackThis v1.97.7
Scan saved at 18:39:19, on 01/04/04
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v5.00 SP2 (5.00.3314.2100)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\PROGRAM FILES\COMMON FILES\EPSON\EBAPI\SAGENT2.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5\DIRECTCD\DIRECTCD.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZONEALARM.EXE
C:\PROGRAM FILES\SAGEM\SAGEM [email protected] 800-840\DSLMON.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\TEMP\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.profusion.com/default.asp?agt=0!&cat=1!&cobid=ess&sid={A863AE55-C8FD-494F-A351-DE365FAD6506}&queryterm=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.ic24.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.co.uk/
O3 - Toolbar: @msdxmLC.dll,[email protected],&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRAM FILES\GRISOFT\AVG6\avgcc32.exe /startup
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKLM\..\RunServices: [SAgent2ExePath] C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O4 - Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM [email protected] 800-840\dslmon.exe
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://www.ic24.net
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
 

socksthecat

Thread Starter
Joined
Mar 14, 2004
Messages
54
Hi,
I don't know what you are refering to. My ISP is Tiscali.co.uk, which I started using about 4 weeks ago. I've previously used Fast 24, IC24, Powergen among others.
Thanks
 
Joined
Mar 9, 2003
Messages
4,699
Oops, it missed the cut n paste.

O14 - IERESET.INF: START_PAGE_URL=http://www.ic24.net

IF you no longer use it, you can also get rid of this also.

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.ic24.net
 
Joined
Dec 3, 2003
Messages
8
I used AVG Virus scan before and had trouble with it. I since have gotten Avast! virus scan and have not had any issues.

As far as crashes when attempting to run Adaware or Spybot, etc., my suggestion is to boot into safe mode, where a lot of the start-up junk is by-passed, to run the programs that give you trouble.

BTW, I used Spybot and it'll freeze-up on me, too. I got rid of it and just use AdAware.

Best of luck to you.
 

socksthecat

Thread Starter
Joined
Mar 14, 2004
Messages
54
Brilliant ! I did what you both suggested and all of the problems with my anti-virus progs have gone... Thanks.

But, I am still being told by Windows Update, that my update has failed, due to probems which could include the security level being too high (I've checked that) or something about activating Active X, but I don't know what that is. Is there anything else I can try ?
Thanks again.
 

socksthecat

Thread Starter
Joined
Mar 14, 2004
Messages
54
Thanks everyone for your help. I managed to solve the problem with a lot of help from Microsoft on-line support.
This thread can now be closed
Thanks
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online

Top