[Resolved] Need help with start-up

[pauljwest]

I have recently started having numerous problems wuith my PC. I got the badtrans virus awhile ago and downloaded newest Virus Scan software. Now i'm having problems with my PlexWriter CD burner(corrupting files while writing to disk and erasing whole disks) and i get the following message while starting windows which i never received before.

Cannot find the file 'xawhlk.exe'(or one of its componets). Make sure the path and filename are corret and that all required libraries are available.

Here is my start-up:
Iomega Startup Options Startup Group C:\Tools_95\IMGSTART.EXE
Adobe Gamma Loader.exe Startup Group "C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe"
Iomega Watch Startup Group C:\Tools_95\IOWATCH.EXE
Zip Disk Icons Startup Group C:\Tools_95\IMGICON.EXE
AGSatellite Startup Group "C:\Program Files\Audiogalaxy Satellite\AGSatellite.exe" noshow
Microsoft Office Startup Group "C:\Program Files\Microsoft Office\Office\OSA9.EXE" -b -l
HP S20 Scanner Fdbk Startup Group "C:\Program Files\HP PhotoSmart\S20 Scanner\Registration\Remind32.exe"
SideWinder Game Device Profiler Startup Group "C:\Program Files\Microsoft Hardware\Game Devices\SideWinder GDP.exe"
Momwallpaper Startup Group "C:\Program Files\MomWallpaper\momwallp.exe"
EPSON Background Monitor Startup Group C:\ESM2\Stms.exe
Taskbar Display Controls Registry (Per-User Run) RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
Windows Version Check Registry (Per-User Run) C:\WINDOWS\SYSTEM\ver_chk.exe
Mirabilis ICQ Registry (Per-User Run) C:\Program Files\ICQ\NDetect.exe
McAfee.InstantUpdate.Monitor Registry (Per-User Run) "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /startmonitor
SystemTray Registry (Machine Run) SysTray.Exe
EnsoniqMixer Registry (Machine Run) starter.exe
POINTER Registry (Machine Run) c:\MSINPUT\point32.exe
Multi-function Keyboard Registry (Machine Run) GWHotKey.exe
mmpti Registry (Machine Run) C:\WINDOWS\SYSTEM\m1mmpti.exe
EReminderdiamond Registry (Machine Run) D:\EXTRAS\REGISTER\EReminder.exe diamond
Welcome Registry (Machine Run) C:\WINDOWS\Welcome.exe /R
ScanRegistry Registry (Machine Run) C:\WINDOWS\scanregw.exe /autorun
TaskMonitor Registry (Machine Run) C:\WINDOWS\taskmon.exe
LoadPowerProfile Registry (Machine Run) Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
Vshwin32EXE Registry (Machine Run) C:\McAfee\VirusScan\VSHWIN32.EXE
DSS Registry (Machine Run) SOFTWARE\Broderbund Software\DSS\AppList\178220
CriticalUpdate Registry (Machine Run) C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
RealTray Registry (Machine Run) C:\Program Files\Real\RealPlayer\realplay.exe SYSTEMBOOTHIDEPLAYER
Adaptec DirectCD Registry (Machine Run) C:\PROGRA~1\ADAPTEC\DIRECTCD\DIRECTCD.EXE
PLXSTART Registry (Machine Run) C:\PROGRA~1\PLEXTO~1\PLXSTART.EXE
PLXTASK Registry (Machine Run) C:\PROGRA~1\PLEXTO~1\PLXTASK.EXE
SaveNow Registry (Machine Run) C:\PROGRA~1\SAVENOW\SaveNow.exe
webHancer Agent Registry (Machine Run) "C:\Program Files\webHancer\Programs\whAgent.exe"
Registry (Machine Run)
Alogserv Registry (Machine Run) C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
McAfee Guardian Registry (Machine Run) "C:\PROGRAM FILES\MCAFEE\MCAFEE SHARED COMPONENTS\GUARDIAN\CMGRDIAN.EXE" /SU
New.net Startup Registry (Machine Run) rundll32 C:\WINDOWS\NEWDOT~2.DLL,NewDotNetStartup
rmmon Registry (Machine Service) C:\WINDOWS\SYSTEM\mprmmon.exe
LoadPowerProfile Registry (Machine Service) Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent Registry (Machine Service) mstask.exe
Vshwin32EXE Registry (Machine Service) C:\McAfee\VirusScan\VSHWIN32.EXE
BCDetect Registry (Machine Service) C:\WINDOWS\SYSTEM\BCDetect.exe defer
telepath Registry (Machine Service) TELEPATH.101\tpexe.exe
HC Reminder Registry (Machine Service) hc.exe
McAfeeVirusScanService Registry (Machine Service) C:\Program Files\McAfee\McAfee VirusScan\AVSYNMGR.EXE


Any help would be greatly appreciated. Thanks all and Merry Christmas.

Paul

 

[Styxx]

First clean out your Startup folder - Start; Programs; Startup. Right click each item in turn there and choose delete. I have only 'swtray' there, the joystick driver, and it has to be there. On most machines you don't want anything in that folder.

Check your available resources by right-clicking My Computer; clicking Properties; Click the Performance tab. Resources available are displayed as percent there at top. Check it when you get done running the System Configuration Utility mentioned below.

Clicking Start; Run; typing 'msconfig', without the quoatation marks, in the Run box and clicking OK; Then clicking the Startup tab; Uncheck anything you don't need running in the background. For reference on what's not needed running in the background in the System Configuration Utility, view this website first and print out the list:

http://www2.whidbey.net/djdenham/Running_items.htm

 

[beach51]

Hi Paul,you have some real nasty spyware on your computer.Plus you have way to many programs starting up.Lets work on the spyware First.Go to Start>Run>type in Msconfig>click ok>click on startup tab>remove the check marks next to Savenow,web hancer,and newnet.Click apply then ok,reboot the computer.Now go to Control panel ,add and remove programs,remove newnet,webhancer,and save now,>click remove button.Do each one you find one at a time and reboot between each one.

Now download a program called Ad-aware5.6.this will scan your computer for other spyware componnets.

http://www.lavasoftusa.net

Let us know how that works and then will remove the rest of the startup programs you dont need

 

[TonyKlein]

This 'xawhlk.exe' error worries me a little. It could possibly be a virus or trojan.

Start by having your computer scanned on line at <A HREF="http://housecall.antivirus.com/">Trend Micro HouseCall </A>

Beach51 has already given you some good advice.
But there's far too much unnecessary and harmful stuff starting up there.

I'll look it over myself as well, and I'll get back to you.

Good luck,

 

[SavvyLady]

I can't find anything on xawhlk...I don't even see it

You must have received BadsTran in your e-mail.. doesn't McAfee cover e-mail?

 

[TonyKlein]

You have some serious spyware there, plus some stuff routinely responsible for causing errors, and slowing your machine down.
Let's remove all unnecessary and harmful stuff from startup.

Hi,

You have some serious spyware there, plus some stuff routinely responsible for causing errors, and slowing your machine down.
Let's remove all unnecessary and harmful stuff from startup.

Go to Start/run, and type msconfig.
On the Startup tab, uncheck EVERYTHING, EXCEPT for the following items

SideWinder Game Device (optional)
Momwallpaper (optional)
EPSON Background Monitor (optional)
Taskbar Display Controls (optional)
Mirabilis ICQ (optional)
McAfee.InstantUpdate.
SystemTray
EnsoniqMixer
POINTER (optional)
Multi-function Keyboard
ScanRegistry
LoadPowerProfile
Vshwin32EXE
Adaptec DirectCD
PLXSTART
PLXTASK
rmmon
LoadPowerProfile
SchedulingAgent
Vshwin32EXE
BCDetect Registry
telepath
McAfeeVirusScanService

Click OK, close Msconfig, and reboot (important!)

The items marked 'optional' aren't neccessary for Windows to run either, and you may experiment later by unchecking them as well.

Now go to Software add/remove and remove New(dot)net application and Webhancer Agent.

Reboot AGAIN.

Download and install <A HREF="http://www.lavasoftusa.net/index.html">Ad-Aware</A> . This is a program which scans your system for spyware.

After having downloaded AAW, also download the latest Signature file (Reflist.sig) : http://www.lavasoftusa.net/aaw/binary/reflist.zip
Unpack it to the Lavasoft Ad-Aware folder in Program Files, and have it overwrite the one that's there.

Then have your drives and registry scanned for spyware, check all found files and reg keys, click continue, and have them removed.
Reboot one last time.

Your computer will thank you for this, and you'll be amazed about how much more smoothly your system will run.


Good luck,

 

[beach51]

Tony,that was bothering me also.it looks like a something a virus or trojan would leave.Going to see if i can find anything about it

Paul,Dss registry is also spyware,remove it also from msconfig.Am sure Tony will have a list of the programs you need and dont need at startup,follow his advice on that also.

 

[TonyKlein]

Hi Beach51,

I could't find anything on this file either, which only adds to my doubts about whether it's legit.

I think House Call would be a good first step.

Greetz,

 

[pauljwest]

Guys,
Thanks for all your help with this. I think my system looks much cleaner. After running Housecall i detected:

Virus - Worm Badtrans.b
Scan result - Non cleanable
File - c:\windows\system\kdll.dll

I tried cleaning it a couple times, no joy..... so i just deleted it. I previously ran the latest greatest MaAfee's VirusScan and it did not detect it.....maybe i should ask for my money back.

Anyway...i am still getting the xawhlk.exe message and i wish i knew where it was being called from, but i can live with it.

Just want to thank all u great people(Tony, Beach, Savvy) for ur help. If your ever in New York or Tokyo look me up.......first , second, third drinks on me.....Best of luck to you all.

Paul

 

[Rollin' Rog]

Paul, try doing a registry search for the file xawhlk.exe

Start>Run>regedit

Enter xawhlk in the Edit>Find field.

Before deleting it, report back on where you find it.

Also run win.ini (it will load in Notepad) and see if it is apart of the "load =" entry


Run system.ini and see if it is a part of the "Shell=" statement, which should be just shell=Explorer.exe

 

[pauljwest]

Excellent......found it in the system.ini file. Statement read:

shell=explorer.exe xawhlk.exe

Works fine now......best wishes and happy holidays

Paul

 

[Rollin' Rog]

Great, you're good to go I must say you got some excellent help from the above on a heck of startup list. Happy Holidays to you too!