Win98 Startup Problemo's

[Corrosive]

Hi everyone!

I currently have my Aunt's PC in my room (running Win98) which I promised I would sort out for her. Everything that she wanted done has been, with one exception...

When Windows starts, an IE window pop's up containing the bog standard "This page cannot be displayed" error, presumably because I'm not connected to the WWW.

I have been through the msconfig utility and cleared all startup programs (bar Explorer and SysTray, of course) and yet it still comes up. I clear the Startup menu and folders; no fix. The only place I havn't been is the Registry, because it is kind-of scary

Any suggestions?

 

[LANMaster]

Check your taskbar for programs in your Start Up folder

Check Win.ini for entries under Load= and Run=

Check registry for Gator.Com entries.

You might find the culprit in one of those places.

Backup a copy of the Win.ini and the registry before you make any changes. Goes without saying, but there, I covered my rump!!!!

 

[TonyKlein]

Go back to Msconfig > Startup, and RE-check Scan Registry. You need it.

Subsequently do this:

Go to http://www.spywareinfo.com/downloads.php#startup , and download 'Startuplist'.

Unzip, doubleclick it, and it will generate a text file that will list all running processes, all applications that are loaded automatically when you start Windows, and more.

Go to Edit > select all, copy it and please post the contents here.

 

[Corrosive]

Thanks you guys!

I've already scanned the HDD for spyware using Ad-Aware, and the pooty was infested! I have removed them all though (manually; it would never automatically do it for some reason).

Nevertheless, I have downloaded that startup list proggy and will check it out in a moment.

Thanks again.

 

[TonyKlein]

No prob.

Do post the Startuplist log, however. Ad-Aware is not a credible first line of defense against spyware any more, as it hasn't been updated for 4 months.

It would be best not to use it until v. 6.0 is launched.

We recommend <A HREF="http://security.kolla.de/">Spybot - Search & Destroy</A>

 

[bassetman]

Yesterday I found I had Xupiter ware. Spybot was not able to remove it. (PC started beeping and stopped when it tired).

I had to use info from this site to get rid of it.

http://home1.gte.net/johnfull/n230.htm

John

 

[Corrosive]

As requested, the startup list...

---

StartupList report, 1/11/03, 4:44:49 PM
StartupList version: 1.50
Started from : C:\PROGRAM FILES\STARTUPLIST.EXE
Detected: Windows 98 Gold (Win9x 4.10.1998)
Detected: Internet Explorer v5.00 (5.00.2314.1000)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\STARTUPLIST.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

SystemTray = SysTray.Exe
Tweak UI = RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {89820200-ECBD-11cf-8B85-00AA005B4383}

[MmoptPreferredAudioDevices] *
StubPath = rundll32.exe shell32.dll,Control_RunDLL mmsys.cpl,@0,SUSB\VID_0471&PID_0310&MI_01\1USB&VID_0471&PID_0310&015300005A618001

[PerUser_LinkBar_URLs] *
StubPath = c:\windows\COMMAND\sulfnbk.exe /L

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {44BBA840-CC51-11CF-AAFA-00AA00B6015C}

[>IEPerUser] *
StubPath = RUNDLL32.EXE IEDKCS32.DLL,BrandIE4 SIGNUP

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:IE50 /user /install

[{44BBA851-CC51-11CF-AAFA-00AA00B6015C}]
StubPath = rundll32.exeadvpack.dll

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=
run=

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\SYSTEM\SCIENCE.SCR
drivers=mmsystem.dll power.drv

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 6/1/2003, 21:42:56)

[rename]
c:\windows\SYSTEM\secur32.dll=c:\windows\SYSTEM\secur32.001

--------------------------------------------------

C:\CONFIG.SYS listing:

DEVICE=C:\WINDOWS\HIMEM.SYS
DEVICE=C:\WINDOWS\EMM386.EXE NOEMS
BUFFERSHIGH=23,0
FILESHIGH=30
DOS=HIGH,UMB
FCBSHIGH=4,0
COUNTRY=044,850,C:\WINDOWS\COMMAND\COUNTRY.SYS
LASTDRIVEHIGH =Z
DEVICEHIGH = C:\WINDOWS\OAKCDROM.SYS /D:MSCD001 /V

--------------------------------------------------

C:\WINDOWS\DOSSTART.BAT listing:

@ECHO OFF
REM
REM
LH C:\WINDOWS\COMMAND\MSCDEX.EXE /D:MSCD001 /V

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: *Registry key not found*
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: *Registry key not found*

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - (no file) - {004A5840-FF59-11d2-B50D-0090271D3FD4}

--------------------------------------------------

Enumerating Download Program Files:

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\SWFLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[Yahoo! Audio Conferencing]
InProcServer32 = C:\PROGRAM FILES\YAHOO!\MESSENGER\YACSCOM.DLL
CODEBASE = http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v43/yacscom.cab

[{018B7EC3-EECA-11D3-8E71-0000E82C6C0D}]
CODEBASE = http://194.164.192.109/fukk.exe

[YInstStarter Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\YINSTHELPER.DLL
CODEBASE = http://download.yahoo.com/dl/installs/yinst.cab

[YahooYMailTo Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\YMMAPI.DLL
CODEBASE = http://us.dl1.yimg.com/download.yahoo.com/dl/installs/essentials/ymmapi_0410.dll

[YBIOCtrl Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\YCOMP4,0,2,5.DLL
CODEBASE = http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/my/yiebio4025.cab

[MSN Chat Control 4.2]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\MSNCHAT42.OCX
CODEBASE = http://fdl.msn.com/public/chat/msnchat42.cab

--------------------------------------------------
End of report, 5,640 bytes
Report generated in 1.435 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

---

Oh, and Tony, how do you re-enable the scanreg? It's not in the startup list.

Thanks in advance