Member Panel

sabicas

OS: WIN 98 SE
SYMPTOMS:
1) START ? RUN ? REGEDIT (or MSCONFIG) ? the 2 cannot open.
But if I browse to where the 2 items actually are, I CAN OPEN the Registry:& MsConfig
RUN ? C:\WINDOWS\REGEDIT.EXE or C:\WINDOWS\SYSTEM\MSCONFIG.EXE
2) CONTROL PANEL ICONS - cannot open
But if I take any CONTROL PANEL ICON and put a SHORTCUT of it on the
DESKTOP, then rightclick it and click ?OPEN WITH CONTROL PANEL?, it can open.
3) SYSTEM TRAY items, like VOLUME CONTROL, PRINTER ICON
cannot open.

I installed several new PROGRAMS and also had several MALWARE infections recently, but I think I could remove them all. But maybe they changed some settings in the registry or elswhere which even after their removal remain. Or maybe a badly written Program changed these settings?
For Protection & Identification of MALWARE, I use the following programs:
Zonealarm Firewall, McAfee VirusScan, Spybot, Adaware, HijackThis, CWShredder.

I tried already many things by myself and I think this problem is not easy to resolve, that?why some help in solving this is all the more appreciated.

joe5 · 07:47 AM

Hya Sabicas , welcome to PCHF.

Sounds indeed like (the reminents) of a malware problem. Lets have a look if there is some left. If you follow the instructions in the Prework link below , and attach the two resulting log files to a post then we'll have a look at it for you.

Also run stinger before Ewido and hjt please. See below for a link.

sabicas

Here my HJT-LOG and my STING-LOG.
I could not run the EWIDO because that is for XP & WIN 2000 only
MY OS is WIN 98 SE

ladygreenwitch

:smiley: Hi Sabicas,

Welcome to PCHF. Thank you so much for following the directions, however, for future reference, when ever you are looking for help with a new problem, please start your own thread by clicking on the Start New Thread button at the beginning of every forum. I have obviously moved your post to your own thread for this issue.

Can you please give us an idea of what you have been experiencing?

Look forward to your reply,

TTFN

LGW

ladygreenwitch · 06:07 AM

Hi Sabicas,

did you enter this into your trusted IP range?

O15 - Trusted IP range: 213.159.117.202

IP is from:

netname: HISTHOST-BIZ-NET
descr: HISTHOST
country: RU

role: Linkey Network Administrator
address: Malaja Morskaja 11, apt 216
address: Saint-Petersburg
address: Russia 191186

role: Joy Hosting NOC
address: Moscowskaya 38
address: Sankt-Peterburg
address: Russian

If not, then you may want to fix them in HijackThis as well as the entries below. Your Stiner log shows that you had one virus, which it was able to fix.

I have noticed that your computer is not as protected as it should be, for example I see no firewall, or Anti-Virus programs installed on your computer. Please read the PCHF Protecting Your PC article in my signature to learn more about why these are important, and what you can do to keep your computer healthy.

Please boot in safemode (hit f8 when booting up) and fix these with HijackThis, then delete the files/folders in bold.

R3 - URLSearchHook: {2499216C-4BA5-11D5-BD9C-000103C116D5} - - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [autoclk] autoclk.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O15 - Trusted IP range: (HKLM)
O19 - User stylesheet: (file missing) (HKLM)

And do a manuall search for this one and also delete it:

autoclk.exe

Looking forward to your reply,

TTFN

LGW

joe5 · 06:09 AM

Threads merged. :smiley:

And ive added some things.

sabicas

I deleted the Entry in the TRUSTED IP-RANGE. Of course I did not enter that myself, I have never added any web page to that range.
?Can you please give us an idea of what you have been experiencing??
All the initially mentioned symptoms, and none have improved since then.
You wrote: ?I see no firewall, or Anti-Virus programs installed on your computer.?
That?s not correct, I wrote already in my very first POSTING that I have & use all the following programs for protection:
Zonealarm Firewall, McAfee VirusScan, Spybot, Adaware, HijackThis, CWShredder.
I cannot find the file AUTOCLK.EXE, so it must have been deleted already. But maybe that?s a FALSE-POSITIVE, because I read that this file belongs to ADSL MODEM programs, and I have an ADSL MODEM.
I fixed all the problems indicated in the HJT-log, but all initial problems remain.