Please help me! I've tried everything, and I'm still infected with a virus.

Unknown

Hi!

I'm a real newbie to the forum, and I have a problem. I've already run Ad-Aware, SpyBot Search and Destroy, and CWShredder and have eliminated a lot of infected files, but my computer is still acting weird. It freezes shortly after starting up, and then un-freezes after thirty seconds or so. Additionally, the internet connection has been very slow lately, and often disconnects, and whenever I close an explorer window another window pops up.

I think I still have a virus, but it's invisible tothose programs and I can't figure out how to get rid of it. I'd really appreciate any help on this matter. Thank you so much for offering assistance regarding Spyware and viruses in your free time, you helping alot of less computer-saavy people, like myself, out!

Here's my HiJackThis file from this morning:

Logfile of HijackThis v1.97.7
Scan saved at 8:51:08 AM, on 6/11/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.50 SP1 (5.50.4522.1800)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\COMPAQ\INTERNET\ISDBDC.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\AVSYNMGR.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\VSSTAT.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\VSHWIN32.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\AVCONSOL.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\CPQEADM.EXE
C:\COMPAQ\CPQINET\CPQINET.EXE
C:\CPQS\BWTOOLS\SCCENTER.EXE
C:\PROGRAM FILES\MOTIVE\MOTIVEASSISTANT\MOTMON.EXE
C:\WINDOWS\SYSTEM\LVCOMS.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\ISTSVC\ISTSVC.EXE
C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\WCESCOMM.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\EAUSBKBD.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\COMPAQ\ON-SCREEN DISPLAY\OSD.EXE
C:\WINDOWS\SYSTEM\A32SIPRR.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://desktop.presario.net/scripts/redirectors/presario/deskredir.dll?s=consumer&LC=0409&c=1c00
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.usefulware.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search.usefulware.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.usefulware.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe
O4 - HKLM\..\Run: [CPQInet] c:\compaq\CPQInet\CpqInet.exe
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [PTSNOOP] ptsnoop.exe
O4 - HKLM\..\Run: [cpqns] c:\compaq\cpqinet\cpqnpcss.exe
O4 - HKLM\..\Run: [Service Connection] c:\cpqs\bwtools\sccenter.exe
O4 - HKLM\..\Run: [MotiveMonitor] C:\Program Files\Motive\MotiveAssistant\motmon.exe
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [LVComs] c:\windows\SYSTEM\LVComS.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [OneTouch Monitor] C:\PROGRA~1\VISION~2\ONETOU~2.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [a32siprr] C:\WINDOWS\SYSTEM\a32siprr.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [isdbdc] c:\compaq\internet\isdbdc.exe
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Program Files\Network Associates\VirusScan\AVSYNMGR.EXE
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [PPWebCap] C:\PROGRAM FILES\VISIONEER\PAPERPORT\PPWebCap.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\WCESCOMM.EXE"
O4 - HKCU\..\Run: [OLE] C:\WINDOWS\SM.EXE
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Startup: Reality Fusion GameCam SE.lnk = C:\Program Files\Reality Fusion\Reality Fusion GameCam SE\Program\RFTRay.exe
O4 - Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: Device Detector 2.lnk = C:\Program Files\OLYMPUS\DeviceDetector\DevDtct2.exe
O4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: Translate (HKLM)
O9 - Extra 'Tools' menuitem: AV &Translate (HKLM)
O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL (HKLM)
O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Create Mobile Favorite (HKLM)
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://www.usefulware.com/
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37708.4478703704
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab

---

Thanks so much!!

JGK150

Hmm, I'm still new to this identifying process and the forums as well, but I seem to only be able to spot the common ones like realsched.

Hope a moderator can help ya. =)

LawnMM

It may be slow because you have some much crap loading at startup. I see its a compaq...that doesn't help either. What kind of system specs does this machine have?

I suggest running ad aware and spybot once, clean whatever it finds...reboot, scan again with both. That usually gets rid of everything. If you haven't disabled the messenger service that might explain some of the popups.

primesuspect

You have the about:_blank trojan, which adaware and spybot can't get rid of.

First, get rid of the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about_:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about_:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about_:blank
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [a32siprr] C:\WINDOWS\SYSTEM\a32siprr.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [OLE] C:\WINDOWS\SM.EXE
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE


Then, follow Vanagon45's trials here since he has detailed about:_blank Windows 98 removal solutions. It's pretty complicated, but he wrote an excellent thread describing it.

Let us know how it goes, and welcome to Short-Media.

Dexter

FYI, one of those items Prime suiggested you delete may be a mailing program that resides on your computer, and sends out spam from your account using forged headers:

O4 - HKCU\..\Run: [OLE] C:\WINDOWS\SM.EXE

http://www.pestpatrol.com/PestInfo/s/secret_messenger.asp

It also matches up to a virus file:

http://www.sophos.com/virusinfo/analyses/trojpsymep.html

Either one of those would certainly account for some slow internet and strange behaviour symptoms such as those you described.

Prime forgot to mention, but boot up in SAFE MODE before you remove the items he listed. In normal mode, you may not be able to kill some of those processes, because they are active, but in safe mode they will not be active, so you can safely remove them. If you do not know how to get into safe mode, reboot your computer, and start tapping the F8 key, until you get a boot options menu. Choose the option that says SAFE MODE without any options.

Also, I would take these three files:

C:\Program Files\ISTsvc\istsvc.exe
C:\WINDOWS\SYSTEM\a32siprr.exe
C:\WINDOWS\SM.EXE

and move them to a new directory: C:\Quarantine. Then rename the .exe extension to .XXX. This effectively stops them from being re-run on your system, but saves them safely in case they turn out to be needed for something after all.

Dexter...

krycek_chick

JGK150
You're way ahead of me! I have no idea how to go about identifying processes, but I hope I'll get some experience, and learn!!

LawnMM
It's true, *ALOT* of stuff was loading at startup, so I removed a bunch of programs. Being a Compaq hasn't brought too many problems, but it's in no way as speedy as my graphics computer. Basically, the system specs are a 30 Gig Hard Drive, 64Megs Ram, and a 733Mhz processor.

primesuspect
Thank you so much for your advice!!!!! The update on my situation follows below.

Dexter
I've been trying to find out what SM.exe is, but to no avail; thank you so much for bringing it up. You know, I was having some real problems with my computer not wanting to shut down, and I narrowed my problem down to SM.exe by process of elimination when I "End Task"ed it and it came up that the program wasn't responding. I've tried to find out if it's a program that's supposed to be on the PC, and I was aftraid to get rid of it, but I knew it was causing my problem with the shut down. So far, after deleting it, it hasn't returned, and the PC shuts down perfectly. I didn't boot up in safe mode when I deleted the files, but so far, I think they were successfullt deleted. They don't show up in my new HijackThis File, so I'm crossing my fingers that they're permanently gone. At any rate, *Thank you* for telling me how to boot up in safe mode, I wasn't sure how to do it.

---Alright, so I deleted all the files primesuspect suggested, and I followed Vanagon45's guide to getting rid of the about_:_blank virus. I found a mysterious dll file in a folder from a program I downloaded, and I couldn't delete it, so I just deleted the whole folder and didn't run into any problems. I restarted, and I ran CWShredder, and came out clean, and then I ran SpyBot Search and Destroy (no new updates) and came out clean. I then got an update for Adaware, and I ran that. I found a total of 19 recognized objects including several Malware's, Cookies and a Trojan, and I deleted them, too.

After restarting, I've noticed nothing but good news! So far, the PC shuts down perfectly, and doesn't freeze when it's starting up; there are no more Pop Ups when I close an Explorer window, the internet connection is more stable, and the PC feels less sluggish. Also, as of late, the computer would try to connect to the internet promptly after starting up, and now it no longer does.

Thank you so much for all your help!!!! Please let me know if there's anything else that look suspicious to you in my new HijackThis file, or everything looks good. Is there any chance that my passwords were snatched by any of the spyware I had on my computer, and should I change them all? Also, out of curiosity, when you do a complete system reboot and return everything to original form, does that effectively get rid of all viruses and trojans that may have previously been on the computer?


Logfile of HijackThis v1.97.7
Scan saved at 5:21:55 PM, on 6/12/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.50 SP1 (5.50.4522.1800)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\COMPAQ\INTERNET\ISDBDC.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\AVSYNMGR.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\VSSTAT.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\VSHWIN32.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\AVCONSOL.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\CPQEADM.EXE
C:\COMPAQ\CPQINET\CPQINET.EXE
C:\WINDOWS\ptsnoop.exe
C:\CPQS\BWTOOLS\SCCENTER.EXE
C:\PROGRAM FILES\MOTIVE\MOTIVEASSISTANT\MOTMON.EXE
C:\WINDOWS\SYSTEM\LVCOMS.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\VISIONEER ONETOUCH\ONETOUCHMON.EXE
C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\WCESCOMM.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\PROGRAM FILES\OLYMPUS\DEVICEDETECTOR\DEVDTCT2.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\BTTNSERV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\EAUSBKBD.EXE
C:\PROGRAM FILES\COMPAQ\ON-SCREEN DISPLAY\OSD.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://desktop.presario.net/scripts/redirectors/presario/deskredir.dll?s=consumer&LC=0409&c=1c00
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.usefulware.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search.usefulware.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.usefulware.com
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe
O4 - HKLM\..\Run: [CPQInet] c:\compaq\CPQInet\CpqInet.exe
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [PTSNOOP] ptsnoop.exe
O4 - HKLM\..\Run: [cpqns] c:\compaq\cpqinet\cpqnpcss.exe
O4 - HKLM\..\Run: [Service Connection] c:\cpqs\bwtools\sccenter.exe
O4 - HKLM\..\Run: [MotiveMonitor] C:\Program Files\Motive\MotiveAssistant\motmon.exe
O4 - HKLM\..\Run: [LVComs] c:\windows\SYSTEM\LVComS.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [OneTouch Monitor] C:\PROGRA~1\VISION~2\ONETOU~2.EXE
O4 - HKLM\..\Run: [SKMAINTD] C:\WINDOWS\SYSTEM\SKMAINTD.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [isdbdc] c:\compaq\internet\isdbdc.exe
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Program Files\Network Associates\VirusScan\AVSYNMGR.EXE
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\WCESCOMM.EXE"
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Startup: Device Detector 2.lnk = C:\Program Files\OLYMPUS\DeviceDetector\DevDtct2.exe
O4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: Translate (HKLM)
O9 - Extra 'Tools' menuitem: AV &Translate (HKLM)
O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL (HKLM)
O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Create Mobile Favorite (HKLM)
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://www.usefulware.com/
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38149.2927893519
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab

primesuspect

Well, there's a lot of things that I personally would get rid of, especially as they relate to all the "helpful" compaq stuff that comes with your computer. You may use some of the features, but if you're asking what I personally would delete, it would be the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://desktop.presario.net/scripts...&LC=0409&c=1c00
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.usefulware.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search.usefulware.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.usefulware.com
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe
O4 - HKLM\..\Run: [CPQInet] c:\compaq\CPQInet\CpqInet.exe
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [PTSNOOP] ptsnoop.exe
O4 - HKLM\..\Run: [cpqns] c:\compaq\cpqinet\cpqnpcss.exe
O4 - HKLM\..\Run: [Service Connection] c:\cpqs\bwtools\sccenter.exe
O4 - HKLM\..\Run: [MotiveMonitor] C:\Program Files\Motive\MotiveAssistant\motmon.exe
O4 - HKLM\..\Run: [OneTouch Monitor] C:\PROGRA~1\VISION~2\ONETOU~2.EXE
O4 - HKLM\..\Run: [SKMAINTD] C:\WINDOWS\SYSTEM\SKMAINTD.exe
O4 - HKLM\..\RunServices: [isdbdc] c:\compaq\internet\isdbdc.exe
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Startup: Device Detector 2.lnk = C:\Program Files\OLYMPUS\DeviceDetector\DevDtct2.exe
O4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.usefulware.com/

Glad we could help

krycek_chick

There are a couple of files there that I need for my DM1 Recorder, and Scanner, but other than that, I have no idea what a few of those things are! What does 'ptsnoop.exe' control? I recognize the Compaq Easy Access buttons...

Just to be sure, though, none of these files are necessary for the computer to run properly, right? Just making sure before I delete anything too hastily! ^_^

edcentric

When I get down to your point in the process I set up a holding pen file. Like Dexter suggested. Move files into it and change the extensions to xxx. Then later is something doesnt work you can go get the file and restore it instead of having to reinstall something.

shwaip

http://www.windowsstartup.com/wso/index.php
windows startup online is a good resource for lookup of exactly what the processes are, and whether or not they are necessary.

primesuspect

The PTsnoop stuff is for your PCTel modem. If you're on a dialup, or use a dialup in hotels (if this is a laptop) , I'd keep it.

Straight_Man

krycek_chick wrote:

There are a couple of files there that I need for my DM1 Recorder, and Scanner, but other than that, I have no idea what a few of those things are! What does 'ptsnoop.exe' control? I recognize the Compaq Easy Access buttons...

Just to be sure, though, none of these files are necessary for the computer to run properly, right? Just making sure before I delete anything too hastily! ^_^

These two are the only two of Prime's list I would consider keeping:

O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [PTSNOOP] ptsnoop.exe

Top one actually does two things, the PCTel drivers choose mode (CCITT versus US or North American specs) based on country selection, and the top one is that EXE that pokes that info into driver configs, but you need that prgram ONLY to make country changes if things are wrong or you travel from continent to continent with the computer and need to change to European CCITT and then to Bell (US) and later change back. Will not hurt majorly your windows itself to kill them, but they will not hurt your box if left either (can keep these two, easier to keep in this case).

krycek_chick

Hi again! Thank you everyone for your advice and tips!! The 'holding pen' file is a really great idea (thanks Dexter and edcentric!!), and thanks primesuspect and John_D, as a matter of fact, I am running dial-up, so I'm real glad I didn't delete PTSnoop or pctptt!! ^_^

Wow! The windows start up page is a really great tool; thank you so much for posting the link shwiap!!

The computer is running really great, and i've eliminated a bunch of stuff that isn't necessary. I can't thank you guys enough for helping me out! ^_^

Dexter

If you want to find a way to thank us, consider joining our good cause: Folding at Home. Check the links in my signature to find out how you can put your computer to work trying to find cures for many diseases. Join Team 93 and make a difference! We would love to have you on the Team

Dexter...

primesuspect

And stick around the site. We always welcome new members with open arms, and you'll find that this is a friendly and fun community to be involved with.

krycek_chick

Hi Dexter! You know, I was wondering what Folding@Home was, but didn't know how to ask! ^_^ Anyways, yeah, I can imagine the amount of computation that needs to be done, and I don't mind helping at all. I've tried looking for the program download, but can't seem to locate it, is there a specific download for Windows 98?

primesuspect

I am so happy to answer this question

Click here to download the program. Enter your name in the name box, and 93 in the team number box, and you will be folding for us!

Now you're part of a family... Now you HAVE to stick around

Straight_Man

krycek_chick wrote:

Hi again! Thank you everyone for your advice and tips!! The 'holding pen' file is a really great idea (thanks Dexter and edcentric!!), and thanks primesuspect and John_D, as a matter of fact, I am running dial-up, so I'm real glad I didn't delete PTSnoop or pctptt!! ^_^

Wow! The windows start up page is a really great tool; thank you so much for posting the link shwiap!!

The computer is running really great, and i've eliminated a bunch of stuff that isn't necessary. I can't thank you guys enough for helping me out! ^_^

Happy we all could help, and welcome to Team 93! I am doing some oddball testing stuff for Stanford's Folding@home effort-- most of which I can't talk about except to say that the goal of what beta testers are doing as part of Folding is to remove as many possible bugs in stuff before the public gets things going awry because something got not tested. That really is a very good cause!!! If you have any Folding problems that do not get answers here (NOT very likely), you can PM or email me and I will help you one on one if you want. I will do that for any Team 93 folder.

John Danielson