Computer crashing, IE popups, HJT log included

Comments

• lemonlime Canada Member

  October 2005 edited October 2005

  I don't see too much out of the ordinary in your log, with the exception of 'WeatherBug'. You should try to 'uninstall' that application, from the Windows Add/Remove programs area in the Control Panel. There is sketchy information avaliable online, but I believe it is an adware based application.
  
  You can also remove the following from HJT (It may actually be removed automatically when you uninstall the program:
  
  O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
  
  I doubt that this will correct your blue screen issues, I'm afriad. You may want to try to get the latest drivers for your graphics card, and other components. It is possible, however that this may be a hardware issue of some kind.
  
  Let us know how that goes..

  0
• LaRock TX, USA

  October 2005 edited October 2005

  OK, I deleted Weatherbug. You were right; the "O4-HKCU..." Weatherbug item was removed automatically when I uninstalled the program.
  
  When you say it's a hardware problem, what could I do to check on that? I haven't seen the probem again since I've uninstalled Weatherbug, but I'm not sure the problem is gone for good.
  
  I received a "Low virtual memory" message last night while I was running Ewido and a browser window was up. Not sure if that applies here at all but I thought I'd mention it as well.
  
  Thanks for your help!

  0
• lemonlime Canada Member

  October 2005 edited October 2005

  LaRock wrote:

  OK, I deleted Weatherbug. You were right; the "O4-HKCU..." Weatherbug item was removed automatically when I uninstalled the program.
  
  When you say it's a hardware problem, what could I do to check on that? I haven't seen the probem again since I've uninstalled Weatherbug, but I'm not sure the problem is gone for good.
  
  I received a "Low virtual memory" message last night while I was running Ewido and a browser window was up. Not sure if that applies here at all but I thought I'd mention it as well.
  
  Thanks for your help!

  
  A low virtual memory message usually indicates that an application has gotten stuck in a loop, or is operating incorrectly, and quickly chews up all physical and virtual memory. The next time that happens, hit CTRL+ALT+DEL, go to the task manager, and click the 'Processes' tab. Once there, look for an item that is using a large amount of memory, and that is likely the problem.
  
  As for hardware checks, I'd open your PC up, and remove any dust bunnies from hell
  
  Also, you could look into a full Memtest86+ scan.. which will help to determine if you have any physical memory issues.
  
  There is also the possibility that that weatherbug application was indeed the problem, let us know if it occurs again.
  
  Thanks,.
  Mike

  0
• LaRock TX, USA

  October 2005 edited October 2005

  Thanks for the help! I'll try those hardware tips ans see if that helps.
  
  Strangely, as I was just about to visit here I was at the previous site I was visiting and got a message stating that my antivirus software had quarrantined a bloodhound exploit virus. So when I went to google to find out more about this type of virus, I got 2 more IE popus about antivirus protection. Again, this is with me using Firefox and with Pop-up Stopper activated.
  
  I'm not sure what is going on...

  0
• Trogan London, UK

  October 2005 edited October 2005

  I used to get the 'Detected Bloodhound Virus' etc etc from Norton when it detected something.
  
  
  Enable everything at startup and post a new HJT log.

  0
• LaRock TX, USA

  October 2005 edited October 2005

  Alright, everything is enabled at startup...here's my new HJT log. Thanks!
  
  Logfile of HijackThis v1.99.1
  Scan saved at 1:40:11 PM, on 10/8/2005
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\NavNT\defwatch.exe
  C:\Program Files\ewido\security suite\ewidoctrl.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
  C:\Program Files\NavNT\rtvscan.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\NavNT\vptray.exe
  C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
  C:\Program Files\Panicware\Pop-Up Stopper\dpps2.exe
  C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\PROGRA~1\COMMON~1\ADAPTE~1\CreateCD\CREATE~1.EXE
  C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Weather Watcher\ww.exe
  C:\WINDOWS\system32\MsgSys.EXE
  C:\Program Files\Logitech\MouseWare\system\em_exec.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\Program Files\Real\RealPlayer\RealPlay.exe
  C:\Program Files\Real\RealPlayer\RealPlay.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\WINDOWS\system32\wscntfy.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
  C:\WINDOWS\system32\HPZipm12.exe
  C:\Documents and Settings\Scot\Desktop\spyware\HijackThis.exe
  C:\Program Files\HP\hpcoretech\comp\hpdarc.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp_adbe/defaults/sb/*http://www.yahoo.com/search/ie.html
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp_adbe/defaults/sp/*http://www.yahoo.com
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.he-man.org/
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by Cox High Speed Internet
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
  O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
  O4 - HKLM\..\Run: [McAfee Guardian] "C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe" /SU
  O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\Program Files\Panicware\Pop-Up Stopper\dpps2.exe"
  O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
  O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
  O4 - HKLM\..\Run: [CreateCD50] C:\PROGRA~1\COMMON~1\ADAPTE~1\CreateCD\CREATE~1.EXE -r
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [WeatherWatcher] C:\Program Files\Weather Watcher\ww.exe
  O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {01111C00-3E00-11D2-8470-0060089874ED} (Support.com ActionRunner Class) - http://support.cox.net/custsup/supportaction/sdccommon/download/tgctlar.cab
  O16 - DPF: {01111E00-3E00-11D2-8470-0060089874ED} (Support.com SmartIssue) - http://support.cox.net/custsup/supportaction/sdccommon/download/tgctlsi.cab
  O16 - DPF: {0335A685-ED24-4F7B-A08E-3BD15D84E668} - http://dl.filekicker.com/send/file/128985-NZIL/PhPSetup.cab
  O16 - DPF: {09C6CAC0-936E-40A0-BC26-707480103DC3} - http://www.uproar.com/applets/activex/shizmoo/flipside_web18.cab
  O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab28177.cab
  O16 - DPF: {17D72920-7A15-11D4-921E-0080C8DA7A5E} (AimSp32 Class) - http://www.makeoversolutions.com/save/makeover.cab
  O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://www.streamaudio.com/download/ccpm_0237.cab
  O16 - DPF: {4AD05F0E-C8E7-11D8-838A-005004B8588A} - http://www.snipnsend.com/SnipS08c.cab
  O16 - DPF: {4B9F2C37-C0CF-42BC-BB2D-DCFA8B25CABF} (PopCapLoaderCtrl Class) - http://zone.msn.com/bingame/rock/default/popcaploader1.cab
  O16 - DPF: {58172624-85DD-4482-9E64-02ADCA637E96} - http://www.kungfuchess.com/activex/web665.cab
  O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab
  O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://us.games2.yimg.com/download.games.yahoo.com/games/play/client/exentctl_0_0_0_1.ocx
  O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://zone.msn.com/binGame/ZAxRcMgr.cab
  O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
  O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
  O16 - DPF: {AEF76437-F960-4EBC-97EA-7BBB4230CF38} (OcarptMain Class) - https://oca.microsoft.com/en/secure/ocarpt.CAB
  O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
  O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab
  O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab28177.cab
  O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab28177.cab
  O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://utu.popcap.com/games/popcaploader_v5.cab
  O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
  O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
  O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
  O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
  O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
  O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
  O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
  O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
  

  ---

  
  Thanks again for all of you helping me!

  0
• Trogan London, UK

  October 2005 edited October 2005

  Your log is clean.
  
  You need to get a firewall or activate XP's SP2 firewall.
  ==
  
  Are you having any particular problem?

  0
• LaRock TX, USA

  October 2005 edited October 2005

  This is strange...I have McAfee Firewall, and it always has run at startup. I opened it and it wasn't running. So I tried to start it and I keep getting an error saying that there was a timeout and it won't run now. Should I uninstall it and then reinstall it?
  
  My problem is that I get Internet Explorer popups when I'm using Firefox and when I have a popup blocker running. Usually they are related to the site I'm on (i.e., auto loan popups when I search for cars). Plus I keep experiencing crashes when I only have one or two things running at once.
  
  Please advise me on my firewall problem. That is worrying me more than anything else right now. If I need to reinstall McAfee I will or I can try the XP SP2 Firewall if that is a better choice.
  
  Thanks for mentioning the firewall...I just assumed it was running all this time.
  
  EDIT: OK, I got it to finally start back up for me. I made sure that it will run on startup now. But since I assumed it was running all this time and it wasn't, I am going to ask a very dense question: If I have the McAfee Firewall window open and I click on the red "X," will it still run in the background or is it actually closed? I assumed it still ran, but I also assumed it was on all this time too...

  0
• Trogan London, UK

  October 2005 edited October 2005

  First off, do not worry about the pop-ups in firefox. The last few firefox releases don't seem to be "pop up" free. The pop-ups you are getting are fine as long as their from related sites like you said.
  
  About your question if you close McAfee Firewall by clicking the red X, it still should work in the backround. I've never used McAfee but having said that, it would be kind of silly to have the window open just for it to work
  
  If for any reason McAfee Firewall stops working then unistalling > reinstalling should work
  
  I only have XP SP2 as my firewall
  
  I hope that helps and if you have any other questions then do ask If you have a hardware or windows problem than start a new thread in the apprioate forum where someone can help you

  0
• LaRock TX, USA

  October 2005 edited October 2005

  Thanks again for everyone's help! I really love this forum and the people here are very friendly and generous with their time and efforts.

  0
• Trogan London, UK

  October 2005 edited October 2005

  No problem
  
  Stick around LaRock, there are loads of cool people on this forum .
  
  
  If you want, you can join the Short-Media Folding@Home Project.

  0