I have Windows 98 and I ran a Hi-Jack This and I came up with the following result. If someone is professional with dealing with viruses could you tell me what to delete please and what to do? Thank You.
Logfile of HijackThis v1.99.1
Scan saved at 7:32:53 PM, on 7/4/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Unable to get Internet Explorer version!
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\ptsnoop.exe
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\IRMON.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\MSBB.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\PROGRAM FILES\SCREENPRINT32 V3\SCREENPRINT32.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WINOA386.MOD
A:\HIJACKTHIS NEW 2.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.jethomepage.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.sympatico.ca/iesearchpane.html?blink=static
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.jethomepage.com/ie/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netscape.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aol.ca
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w28029.tjgo.com/searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.jethomepage.com/ie/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\PROGRA~1\COMMON~1\MICROS~1\STATIO~1\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by AOL Canada
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxycfg.marketscore.com/gencfg.asp?id1=IVcOExpmNh7&id2=U2a0MADfs3a&lp=1&nsv=5.2.4.5
F1 - win.ini: run=hpfsched
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.WorkoutGenerator.com"); (C:\Program Files\Netscape\Users\User00\prefs.js)
O1 - Hosts: 164.109.48.67 www.vocaltec.com
O1 - Hosts: 63.251.83.40 www.snickerplanet.com
O1 - Hosts: 63.251.83.40 www.snickerplanet.com
O1 - Hosts: 207.188.7.125 www.real.com
O1 - Hosts: 207.42.23.52 www.onbasetech.com
O1 - Hosts: 64.12.151.211 www.netscape.com
O1 - Hosts: 207.245.244.24 www.netcom.ca
O1 - Hosts: 207.44.158.45 www.mofunzone.com
O1 - Hosts: 207.46.249.27 www.microsoft.com
O1 - Hosts: 12.129.204.189 www.madblast.com
O1 - Hosts: 207.68.173.245 www.hotmail.com
O1 - Hosts: 12.129.204.199 www.gotlaughs.com
O1 - Hosts: 207.44.196.117 www.globalchat.com
O1 - Hosts: 207.44.196.117 www.globalchat.com
O1 - Hosts: 199.106.114.30 www.eudora.com
O1 - Hosts: 204.97.87.197 www.chuckecheese.com
O1 - Hosts: 64.236.16.231 www.cartoonnetwork.com
O1 - Hosts: 207.188.7.117 realguide.real.com
O1 - Hosts: 12.129.204.189 madblast.com
O1 - Hosts: 216.177.73.139 auto.search.msn.com
O1 - Hosts: 216.177.73.139 search.netscape.com
O1 - Hosts: 216.177.73.139 ieautosearch
O2 - BHO: CSBrBho Class - {96DA5BEE-4ACC-476C-B3EC-54C6730C4293} - (no file)
O2 - BHO: WaveHelper Class - {EA7F9A52-0A05-11D2-98C5-00104B7229C2} - C:\PROGRAM FILES\WAVETOP\BIN\WAVEIE.DLL
O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\PROGRAM FILES\WEBHANCER\PROGRAMS\WHIEHLPR.DLL
O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:\PROGRA~1\FRESHD~1\FRESHD~1\FDCATCH.DLL
O2 - BHO: Natural Language Navigation - {60E78CAC-E9A7-4302-B9EE-8582EDE22FBF} - C:\WINDOWS\SYSTEM\BHO001.DLL
O3 - Toolbar: Xupiter - {57E69D5A-6539-4d7d-9637-775DE8A385B4} - C:\PROGRAM FILES\XUPITER\XUPITERTOOLBAR.DLL
O3 - Toolbar: Power Search IE - {4E7BD74F-2B8D-469E-D7F7-EC7EA385FA7D} - C:\PROGRA~1\PWRSIE\PWRSIE.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [PTSNOOP] ptsnoop.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IrMon] IrMon.exe
O4 - HKLM\..\Run: [webHancer Agent] "C:\Program Files\webHancer\Programs\whAgent.exe"
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [WINSTART001.EXE] C:\WINDOWS\System\WINSTART001.EXE -b
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [msbb] C:\PROGRAM FILES\MSBB.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [ScreenPrint32] C:\PROGRAM FILES\SCREENPRINT32 V3\SCREENPRINT32.exe -startup
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKCU\..\Run: [NB Window Patterns] C:\PROGRAM FILES\NETWORK ASSOCIATES\NUTS & BOLTS\windbkgd.exe
O4 - HKCU\..\Run: [OSSProxy] C:\WINDOWS\SYSTEM\ossproxy.exe
O4 - HKCU\..\Run: [NSCheck] C:\WINDOWS\SYSTEM\nscheck.exe /check
O4 - HKCU\..\RunServices: [NB Window Patterns] C:\PROGRAM FILES\NETWORK ASSOCIATES\NUTS & BOLTS\windbkgd.exe
O4 - HKCU\..\RunServices: [OSSProxy] C:\WINDOWS\SYSTEM\ossproxy.exe
O4 - HKCU\..\RunServices: [NSCheck] C:\WINDOWS\SYSTEM\nscheck.exe /check
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: AOL Instant Messenger (TM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE (file missing)
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O10 - Broken Internet access because of LSP provider 'csloa.dll' missing
O14 - IERESET.INF: START_PAGE_URL=http://www.aol.ca
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...pple.com/borris/us/win/QuickTimeInstaller.exe
O16 - DPF: {9DBAFCCF-592F-FFFF-FFFF-00608CEC297C} - http://download.weatherbug.com/minibug/tricklers/AWS/minibuginstaller.cab
O16 - DPF: {8522F9B3-38C5-4AA4-AE40-7401F1BBC851} - http://www.musicmass.com/MP3_Plugin.exe
O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_03) -
O16 - DPF: {018B7EC3-EECA-11D3-8E71-0000E82C6C0D} - http://www.lyricsdomain.com/download.mp3.exe
O18 - Protocol: ayb - (no CLSID) - (no file)
Logfile of HijackThis v1.99.1
Scan saved at 7:32:53 PM, on 7/4/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Unable to get Internet Explorer version!
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\ptsnoop.exe
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\IRMON.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\MSBB.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\PROGRAM FILES\SCREENPRINT32 V3\SCREENPRINT32.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WINOA386.MOD
A:\HIJACKTHIS NEW 2.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.jethomepage.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.sympatico.ca/iesearchpane.html?blink=static
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.jethomepage.com/ie/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netscape.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aol.ca
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w28029.tjgo.com/searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.jethomepage.com/ie/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\PROGRA~1\COMMON~1\MICROS~1\STATIO~1\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by AOL Canada
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxycfg.marketscore.com/gencfg.asp?id1=IVcOExpmNh7&id2=U2a0MADfs3a&lp=1&nsv=5.2.4.5
F1 - win.ini: run=hpfsched
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.WorkoutGenerator.com"); (C:\Program Files\Netscape\Users\User00\prefs.js)
O1 - Hosts: 164.109.48.67 www.vocaltec.com
O1 - Hosts: 63.251.83.40 www.snickerplanet.com
O1 - Hosts: 63.251.83.40 www.snickerplanet.com
O1 - Hosts: 207.188.7.125 www.real.com
O1 - Hosts: 207.42.23.52 www.onbasetech.com
O1 - Hosts: 64.12.151.211 www.netscape.com
O1 - Hosts: 207.245.244.24 www.netcom.ca
O1 - Hosts: 207.44.158.45 www.mofunzone.com
O1 - Hosts: 207.46.249.27 www.microsoft.com
O1 - Hosts: 12.129.204.189 www.madblast.com
O1 - Hosts: 207.68.173.245 www.hotmail.com
O1 - Hosts: 12.129.204.199 www.gotlaughs.com
O1 - Hosts: 207.44.196.117 www.globalchat.com
O1 - Hosts: 207.44.196.117 www.globalchat.com
O1 - Hosts: 199.106.114.30 www.eudora.com
O1 - Hosts: 204.97.87.197 www.chuckecheese.com
O1 - Hosts: 64.236.16.231 www.cartoonnetwork.com
O1 - Hosts: 207.188.7.117 realguide.real.com
O1 - Hosts: 12.129.204.189 madblast.com
O1 - Hosts: 216.177.73.139 auto.search.msn.com
O1 - Hosts: 216.177.73.139 search.netscape.com
O1 - Hosts: 216.177.73.139 ieautosearch
O2 - BHO: CSBrBho Class - {96DA5BEE-4ACC-476C-B3EC-54C6730C4293} - (no file)
O2 - BHO: WaveHelper Class - {EA7F9A52-0A05-11D2-98C5-00104B7229C2} - C:\PROGRAM FILES\WAVETOP\BIN\WAVEIE.DLL
O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\PROGRAM FILES\WEBHANCER\PROGRAMS\WHIEHLPR.DLL
O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:\PROGRA~1\FRESHD~1\FRESHD~1\FDCATCH.DLL
O2 - BHO: Natural Language Navigation - {60E78CAC-E9A7-4302-B9EE-8582EDE22FBF} - C:\WINDOWS\SYSTEM\BHO001.DLL
O3 - Toolbar: Xupiter - {57E69D5A-6539-4d7d-9637-775DE8A385B4} - C:\PROGRAM FILES\XUPITER\XUPITERTOOLBAR.DLL
O3 - Toolbar: Power Search IE - {4E7BD74F-2B8D-469E-D7F7-EC7EA385FA7D} - C:\PROGRA~1\PWRSIE\PWRSIE.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [PTSNOOP] ptsnoop.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IrMon] IrMon.exe
O4 - HKLM\..\Run: [webHancer Agent] "C:\Program Files\webHancer\Programs\whAgent.exe"
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [WINSTART001.EXE] C:\WINDOWS\System\WINSTART001.EXE -b
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [msbb] C:\PROGRAM FILES\MSBB.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [ScreenPrint32] C:\PROGRAM FILES\SCREENPRINT32 V3\SCREENPRINT32.exe -startup
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKCU\..\Run: [NB Window Patterns] C:\PROGRAM FILES\NETWORK ASSOCIATES\NUTS & BOLTS\windbkgd.exe
O4 - HKCU\..\Run: [OSSProxy] C:\WINDOWS\SYSTEM\ossproxy.exe
O4 - HKCU\..\Run: [NSCheck] C:\WINDOWS\SYSTEM\nscheck.exe /check
O4 - HKCU\..\RunServices: [NB Window Patterns] C:\PROGRAM FILES\NETWORK ASSOCIATES\NUTS & BOLTS\windbkgd.exe
O4 - HKCU\..\RunServices: [OSSProxy] C:\WINDOWS\SYSTEM\ossproxy.exe
O4 - HKCU\..\RunServices: [NSCheck] C:\WINDOWS\SYSTEM\nscheck.exe /check
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: AOL Instant Messenger (TM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE (file missing)
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O10 - Broken Internet access because of LSP provider 'csloa.dll' missing
O14 - IERESET.INF: START_PAGE_URL=http://www.aol.ca
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...pple.com/borris/us/win/QuickTimeInstaller.exe
O16 - DPF: {9DBAFCCF-592F-FFFF-FFFF-00608CEC297C} - http://download.weatherbug.com/minibug/tricklers/AWS/minibuginstaller.cab
O16 - DPF: {8522F9B3-38C5-4AA4-AE40-7401F1BBC851} - http://www.musicmass.com/MP3_Plugin.exe
O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_03) -
O16 - DPF: {018B7EC3-EECA-11D3-8E71-0000E82C6C0D} - http://www.lyricsdomain.com/download.mp3.exe
O18 - Protocol: ayb - (no CLSID) - (no file)