TechSpot

HJT help needed!

By Lorla
Oct 22, 2006
  1. I'm having to split this up because it says the text is too long! Sorry!!!!
     
  2. Lorla

    Lorla TS Rookie Topic Starter Posts: 24

    I apologize greatly for having to post this in this manner. I have some real problems here!

    I cannot access any webpages that need usernames or passwords and am amazed I could get on here and wanted to post it however I could while I did have access!

    AOL (I know.. bad!) seems to work for all things except pages that need usernames and passwords. Firefox cannot pull up any pages, Yahoo messenger does not work at all, and we cannot download any updates to any virus scanners. So none of them work. My son downloaded too many in an attempt to get one to work, so that explains all those files on the HJT.

    Mainly it is online that is affected, but REAL player now pops up at the startup when it never has before (with some warning) and a new game my son has will not recognize the .exe file for no known reason (A Star Wars Battlefront game)

    Again, I apologize, but this is driving me crazy!

    Thank you so much for ANY advice!!

    I'm in trouble.. I can't see some things and others I can.. but I just saw someone else posted their HJT and had to have it moved by moderators because you should post them as attached files?
    I do apologize.. and feel like an *****.
    I would fix it myself but I am not sure how to at this point.

    I'm sooo sorry.
     
  3. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    Your system has several issues that need to be resolved.

    Go HERE and follow the instructions exactly.

    Post fresh HJT and AVG Antispyware logs as attachments into this thread, only after doing the above.


    Regards Howard :wave: :wave:


    This thread is for the use of Lorla only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  4. Lorla

    Lorla TS Rookie Topic Starter Posts: 24

    Thank you for the reply.

    I am truly trying to follow all the directions, but what is very frustrating is that the very first step listed is the one thing I cannot do.. use an online virus scanner.
    I can get to a certain point, and then it says "update failed". I can never get the updates to load!

    So far, the only online scanner I am getting anywhere with, is the Trend one.
    The others all shut down and say it failed.

    Keeping my fingers crossed that the Trend scanner finishes correctly.
     
  5. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    That`s not a problem. If you have problems with any of the instructions, just skip to the next part.

    Regards Howard :)

    This thread is for the use of Lorla only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  6. Lorla

    Lorla TS Rookie Topic Starter Posts: 24

    So far I have been able to use one of the virus scanners. Trend Micro came through just fine. I cleaned all it found, cleared cookies, Ran the AVG spyware and rebooted. I'm still having all the same issues and am about to go on to the next steps, but here is the AVG spyware report.
     
  7. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Ok, not too many problems there. Just carry on with the instructions, then post a fresh HJT log.

    Regards Howard :)

    This thread is for the use of Lorla only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  8. Lorla

    Lorla TS Rookie Topic Starter Posts: 24

    Hi, thanks again for your reply!

    I struggled through all of this <G>, and there was some that just wouldn't work because of not being able to update anything.
    Still, I found several issues and corrected them.
    My machine appears to be running faster and boots up much quicker than before, but the connectivity issues are still there.
    I cannot update any virus scanners at all.
    Also, I had deleted the virus scanners and some of them still show up on the HJT log.. and show up as errors on start up.
    The Real Player issue is "systemboothideplayer" and I googled that term and found that a few people have the same issue, not sure what to do about it yet, but a realplayer employee was telling someone to install a certain version, so I might try that.
    I can still connect to most everything (except for username and password sites) on AOL. Firefox and Yahoo Messenger will not work.
    Strange issues..

    Here is my HJT log. There were some 023 issues of "file missing" that I set to fix, and they keep showing up.
    Thanks so much for trying to help!
     
  9. Rik

    Rik Banned Posts: 3,814

    You should never delete things that have bee installed, you should always use add/remove programs instead!!!!!!
     
  10. Lorla

    Lorla TS Rookie Topic Starter Posts: 24

    Sorry, bad terminology.. I used the add/remove programs for them.
     
  11. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Never attempt fix anything with HJT unless instructed to do so.

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

    Go to add remove programmes in your control panel and uninstall anything to do with(if there).

    GMT
    eAcceleration
    Station

    Close control panel.

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    station.exe
    GMT.exe

    Close task manager.

    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm

    F2 - REG:system.ini: UserInit=C:\WINNT\system32\Userinit.exe

    O4 - HKLM\..\Run: [SoftwareStation] "C:\Program Files\eAcceleration\Station\station.exe" /b Startup

    O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe

    O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll (file missing)

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\Program Files\Common Files\GMT Delete the entire folder.

    C:\Program Files\eAcceleration Delete the entire folder.

    C:\windows\system32\blank.htm

    Reboot into normal mode, turn system restore back on and rehide your protected OS files.

    Post a fresh HJT log and let me know how your system is running.

    Regards Howard :)

    This thread is for the use of Lorla only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  12. Lorla

    Lorla TS Rookie Topic Starter Posts: 24

    You said "Never attempt to fix anything with HJT unless intstructed to do so".

    Was that a general warning?? Because I felt I had been told to do so by following the instructions in the thread I was referred to..

    Anyway, I'm off to do this next bit. Thank you again!
     
  13. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    The fix anything with file missing only applies to R3 and 02-BHO entries. I believe this is stated next to the entries concerned.

    Regards Howard :)

    This thread is for the use of Lorla only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  14. Lorla

    Lorla TS Rookie Topic Starter Posts: 24

    I just double checked.. and actually.. the 023 instructions DO say
    "Fix ALL with (file missing)"
    (which is exactly what I did so I'm confused!)

    But I am doing this while dealing with three children. So forgive me if I'm getting confused!

    Anyway, I completed the last set of instructions and here is a fresh HJT.

    Can't thank you enough!
     
  15. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    You`re quite right about the advice to fix file missing 023 entries. I have now edited the thread and removed that advice. Thanks.

    We`re almost there, just a couple of things to do.

    Go to add remove programmes in your control panel and uninstall anything to do with(if there).

    Acceleration Software\Anti-Virus

    Close control panel.

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    stopsignav.exe

    Close task manager.

    Run HJT with no other programmes open. Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    O4 - HKLM\..\Run: [StopSignSsTsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\sstsmon.dll",VerifyStatus

    O4 - HKLM\..\Run: [webscan] "C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe" -k

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\Program Files\Acceleration Software

    Reboot your computer and post a fresh HJT log.

    Regards Howard :)

    This thread is for the use of Lorla only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  16. Lorla

    Lorla TS Rookie Topic Starter Posts: 24

    Ok.. finished with the last set of instructions.. things are MUCH quicker.

    Disregarding the Realplayer issue that seems unrelated (hopefully), the only thing odd at boot up now is the AVG application cannot run warning.
    It was suggested several times that I download that, but I had originally removed that program and replaced it with Antivir because that one actually worked for me briefly.

    I must say if it's a virus, it's a smart one. Unable to execute .exe files off the cd drive (I've only checked my sons game.. but still..) , and unable to update virus scanners. Wow.

    Howard, you are GREAT!

    Here's the HJT.
     
  17. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Your HJT log is now clean.

    However, you`re running three different antivirus programmes. Trend/AVG/AntiVir PersonalEdition Classic

    You need to uninstall two of your antivirus programmes. This is because running more than one antivirus programme will slow your system down and will probably cause conflicts/problems.

    Let me know the outcome please.

    Regards Howard :)

    This thread is for the use of Lorla only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  18. Lorla

    Lorla TS Rookie Topic Starter Posts: 24

    An interesting outcome. I knew I had tried this before, but with so many other issues, I didn't think of mentioning it yet.

    I went to add/remove programs, and attempted to uninstall both AVG and Trend. BOTH of these had the "remove" button, but when I clicked on it, it would say "installation failed".
    Neither will uninstall.

    And none of the connectivity issues are resolved. :(
    Silly things like my photobucket, LiveJournal and Youtube accounts work with my username and password. (starting to narrow down what works and what doesn't)
    But important ones, such as my cellphone, phone and electric sites where I pay bills.. they won't even load. Nothing at all on Firefox, no Yahoo Messenger.

    But the speed at which this computer is now working is amazing!
     
  19. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

    Go to add remove programmes in your control panel and try to uninstall anything to do with(if there).

    AVG Free
    AntiVir PersonalEdition Classic

    Reboot your computer, turn system restore back on and rehide your protected OS files.

    Post a fresh HJT log and let me know how your system is running.

    Regards Howard :)

    This thread is for the use of Lorla only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  20. Lorla

    Lorla TS Rookie Topic Starter Posts: 24

    I followed the instructions, and AVG still will not uninstall. I click on "Remove" and it says "Installation Failed" and in "details" it states "undefined error".

    Antivir PE uninstalled just fine..
    Leaving Trend and AVG..

    Are we trying to leave only Trend? I don't know that I've even seen that try to pop up, as in warning messages or otherwise.
    Here's the HJT.
    Thanks again!
     
  21. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Yes we`re trying to just leave Trend.

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

    Click start/run and type services.msc into the run box and press the enter key.

    When the window appears, maximise it. Double click on the following services(if there) and select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

    Alert Manager Server
    AVG7 Update Service
    AVG E-mail Scanner

    Close the services window.

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    avgupsvc.exe
    avgamsvr.exe
    avgemc.exe

    Close task manager.

    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\program files\Grisoft\AVG free

    Reboot into normal mode, turn system restore back on and rehide your protected OS files.

    Post a fresh HJT log.

    Regards Howard :)

    This thread is for the use of Lorla only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  22. Lorla

    Lorla TS Rookie Topic Starter Posts: 24

    ok.. After disabling :
    Alert Manager server, AVG7 Update service, AVG email scanner...

    the AVG Antispyware Guard is still listed in the services box (just wanted to be sure about that)

    I completed the rest of the instructions, but when it came to deleting
    C:\program files\Grisoft\AVG free.. it started normally and then stopped and said "Cannot delete avgse.dll - Access denied"

    So I'm still having the warning popup at start up about AVG.

    Here's the HJT log!
     
  23. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    I missed an AVG free entry in your last HJT log. The AVG Antispyware Guard is part of the AVG Antispyware programme and has nothing to do with AVG free antivirus.

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    avgcc.exe

    Close task manager.

    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\PROGRA~1\Grisoft\AVGFRE~1

    Reboot into normal mode, turn system restore back on and rehide your protected OS files.


    Regards Howard :)

    This thread is for the use of Lorla only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  24. Lorla

    Lorla TS Rookie Topic Starter Posts: 24

    This last one did the trick for the AVG warning at start up.

    Everything is running smoothly and quickly. Now it's just that I can't get into secured websites.
    I've realized it's not just any username/password sites.. it's the ones that are secured, such as Paypal, bill paying sites, etc.
    Except on Firefox, which does not work at all, and yahoo messenger which does not work at all.

    Also, my cd drive is odd. For one game, it says that the .exe file cannot be found, but it recognizes that the game is in the drive.
    For others, it asks which program we would like to open the file with.

    Thank you SO much for your help, Howard. Can you suggest anything in regards to the other issues?

    I can't believe how fast this has gotten.. didn't realize it was so slow!
     
  25. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    What I want you to do is uninstall your Mcafee firewall programme. This is because your Trend programme already has it`s own firewall and you don`t need nor want two firewalls.

    Let me know if this improves things and post a fresh HJT log.

    Regards Howard :)

    This thread is for the use of Lorla only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...