Hi everyone
I desperately need help with this problem.
Most of my icons have been changed to a clipboard kind of design & Lnk has been added to the end of them and to my programmes.
This happened after I was trying to view a video clip sent to me.
Everytime I try to open anything Lecture windows media pops up saying errors, this also happens when I boot up.
I have run virus checks, System Mechanic5 no virus found & no cure yet.

I have just been recomended to this forum but although I was shown as logged in it wouldn't let me post.
I have managed to via internet explorer.
I'm on ME (French version) so some of my titles names differ slightly.

I have XP home addition waiting to be installed, do I need to sort the Lnk problem first ie will the problem carry over.

Fingers crossed you guys can help me.

Merci
Dave

Welcome to PCHF Dave,

You have obviously now activated your account. When you register, you are automatically logged in but until you reply to your activation email you are not able to post. This is a VBulletin system that we use to confirm users email addresses and is standard within the software.

In answer to your question, you may have spyware/malware on your PC - please can you visit this link and follow the process carefully: PreWork When you have done that, please submit your Hijackthis log in this post for us to look at.

Thanks for the welcome.
Did the check is this what you need.
Logfile of HijackThis v1.99.1
Scan saved at 11:10:51 AM, on 10/12/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\PROGRAM FILES\EXECUTIVE SOFTWARE\DISKEEPERLITE\DKSERVICE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\CMMPU.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\PCTVOICE.EXE
C:\WINDOWS\SYSTEM\HPZTSB05.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\INKLINE GLOBAL\PC BOOSTER\PCBOOSTER.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\TRUST\12521 AMI MOUSE 250S OPTICAL\1.0\LWBWHEEL.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\PROGRAM FILES\RFA\RFAGENT.EXE
C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 4\CREATECD\CREATECD.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\FAST DEFRAG\FAST2.EXE
C:\PROGRAM FILES\3B SOFTWARE\WINDOWS REGISTRY REPAIR PRO\REGISTRYREPAIRPRO.EXE
C:\PROGRAM FILES\AOL 8.0\WAOL.EXE
C:\PROGRAM FILES\AOL 8.0\SHELLMON.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\WINZIP\WINZIP32.EXE
C:\UNZIPPED\HIJACKTHIS[1]\HIJACKTHIS.EXE
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\Program Files\Wire2_20\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\Program Files\Wire2_20\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\PROGRAM FILES\AOL\AOL TOOLBAR 2.0\AOLTB.DLL
F1 - win.ini: run=C:\WINDOWS\SYSTEM\cmmpu.exe
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\PROGRAM FILES\AOL\AOL TOOLBAR 2.0\AOLTB.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1036,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\PROGRAM FILES\AOL\AOL TOOLBAR 2.0\AOLTB.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [PCTVOICE] pctvoice.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb05.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [PC Booster] C:\Program Files\inKline Global\PC Booster\pcbooster.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Trust\12521 AMI MOUSE 250S OPTICAL\1.0\lwbwheel.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [rfagent] "C:\PROGRAM FILES\RFA\rfagent.exe"
O4 - HKLM\..\Run: [WildTangent CDA] "C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe" /startup C:\PROGRA~1\WILDTA~1\APPS\CDA\CDAENG~1.DLL
O4 - HKLM\..\Run: [CreateCD] C:\PROGRA~1\ADAPTEC\EASYCD~1\CREATECD\CREATECD.EXE -r
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [DkService] C:\Program Files\Executive Software\DiskeeperLite\DkService.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [FAST Defrag] C:\PROGRA~1\FASTDE~1\FAST2.EXE -tray
O4 - HKCU\..\Run: [Windows Registry Repair Pro] C:\PROGRAM FILES\3B SOFTWARE\WINDOWS REGISTRY REPAIR PRO\REGISTRYREPAIRPRO.EXE 4
O4 - HKCU\..\Run: [iolo Utility Bar] "C:\PROGRAM FILES\IOLO\SYSTEM MECHANIC 5\SMUtilityBar.exe"
O4 - Startup: ARTEC ScanEZ.lnk = C:\Program Files\ARTEC ScanEZ\SCANEZ.EXE
O4 - Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O4 - Startup: AOL Compagnon.lnk = C:\Program Files\AOL Compagnon\companion.exe
O4 - Startup: AOL 8.0 Icône AOL.lnk = C:\Program Files\AOL 8.0\aoltray.exe
O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\PROGRAM FILES\AOL\AOL TOOLBAR 2.0\AOLTB.DLL
O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .mid: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin2.dll
O12 - Plugin for .mp3: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {981D847D-2C06-4FB7-A09C-4F0A48601B2C} (DiagSetup Class) - http://techcity.aol.fr/download/img/DiagSetup.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-18.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = aoldsl.net

Hi Dave,

Before we spend a lot of time trying to fix your malware issues. I'd like to make a suggestion.

As an ex ME user, I can tell you that you don't want to upgrade to XP, you want to reformat and start clean. I cannot tell you how many days I wasted trying to get XP to run well over my ME. It was a nightmare that I would like to spare you. :computer_

My suggestion is that you save all of your files, if you run Office and use Outlook, you will want to do a search for .pst and .rwz files, you will also want to save your Favorites file. (either burn to a cd, or save to an offline storage site such as Xdrive.)

Then print out the instructions for Installing XP from my signature. It is a brilliant tutorial written by our resident magician, Merlin, and I can tell you from first hand knowledge, it really keeps XP running smoothly.

Then, follow the instructions exactly, and reinstall your software.

The hours it could take to try to solve the malware problem isn't worth the time and energy. Especially since you want to upgrade to XP anyway.

Look forward to your reply,

TTFN

T

Hi T
I have seen your reply & recomendations thanks. I've printed out the tutorial.
I was hoping for a fix but what you suggest might save me more frustration.
I have never attempted anything like this before & am a little concerned in case it all goes pear shaped & I can not get any advice online etc. Then again the way the system is performing at the moment has become a real pain.
Am I right in thinking that by following the tutorial it deletes ME or do I have to get rid of that first.
Also my XP home version is the French version, so if its the same as ME its not in English, so I'll have to be careful not to enter something wrong, I have never seen my computer refered to on the tutorial for example, but I think its called Poste de travail. Also mentioned on the tutorial is E drive, never seen that either on my system.
Also can you clarify, in the second paragraph (in green) it says download the below programes, what programes exactly ?

If I save any documents / files with this Lnk attached will they re appear when put back into the XP version.

thanks again
Dave

a few more questions coming to mind (Told you I'd never done this kind of thing before!!)
Will this mean I totally start from scratch again, what about things like my Paypal account or Ebay profile, will things like that be effected.

Hi Dave,

First, just by the quality of your questions I can tell that you are going to be just fine. You will read with comprehension :read2:

Now to your questions,

You do not have to do anything to ME, when you follow the instructions, you will be reformatting your hard drive and that wipes everything out. (Reason you want to save your files first.)

Second, I can't help you with the French part, my heritage on both sides "Barbour and La Verdiere", but not my language, lol.

Third, you will need to identify the size of your hard drive in order to determine the number you will be using for each of the partitions you will be creating. From the total gig of your hard drive, we'll say 40 for example's sake, take 95% of that, in this instance that would be 38 and take the following amounts from that, C drive 40%, next partition 3%, next partition 13.5%, and allocate the remainder for your final partition.

You will end up with a very different, albeit much more efficient, set up of your computer. Instead of having everything on C, you will have your System and OS files on C, you will have a separate drive for your "Page File", (I'll post the explanation if you want, but you don't really need to understand for it to work,)this will be your D drive, You will have a separate drive (partition) for your temporary and personal files, this will be your E drive, and you will have a separate drive for your Program Files, your F drive.

Fourth, I need to find out about the .lnk extensions, they should revert but I need to verify.

Fifth, information such as your PayPal and eBay accounts are stored on the companies server, you may just have to allow a cookie to be installed and then you will be able to log in to these sites. You will however have to reinstall all of your hardware and drivers for things like printers, special mice, scanners etc. as well as all of your software programs.

EDIT: Ooops, sorry I missed one, sixth, there are three programs farther down in the tutorial whch are linked, it is almost at the end, CCleaner you can download from my signature, the other two are DiskKeeper Lite and O&O Defrag. You can download them from the links I just posted.

I'll post back in a sec, as soon as I find out about your misidentified files.

TTFN

T